joyce8/EMBER2024-capa huggingface dataset:
Function at 0x689ea1
Capabilities:
Encode data using xor

Disassembly:
call 0x688d8a
jmp 0x689c41
call 0x688dda
jmp 0x689ad9
call 0x688e23
push ebx
insb byte es:[edi], dx
jo 0x688e23
jmp 0x689a68
call 0x688e8d
jmp 0x689a46
call 0x688efa
jmp 0x689b7f
push 0
jmp 0x688dd5
call 0x689a29
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
stosb byte es:[edi], al
and dword [edi - 0x26], ebp
test eax, eax
je 0x6899f9
jne 0x688e18
in eax, dx
jb 0x689a1c
xchg dword [edx - 0x3b], esi
jmp 0x7df785bf
pop ecx
sub ecx, 0x688e8d
jmp 0x689aaf
push eax
call fcn.005f7089
call fcn.005f73ac
jmp 0x688e88
mov word [ecx + 0x689eab], 0xc39d
jmp 0x689b47
mov dword [ecx + 0x689ea2], eax
mov dword [ecx + 0x689ea7], 0x82444ff
jmp 0x689a8f
pop eax
sub eax, 0xf3bd4df1
call dword [eax - 0xc4cc6bd]
jmp 0x689a2f
movzx ebx, byte [eax]
add ebx, 0xf842501
cmp ebx, 0xf8425cd
je 0x689bb4
jmp 0x689c24
popal
inc dword [esp + 8]
popfd
ret
pop eax
sub eax, 0x909b4e55
jmp 0x689c06
push 0
jmp 0x688ef5
push edx
shl byte [edi + 0x576d9952], 0xc9
call 0x689bce
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
lea eax, [ecx + 0x63]
salc
test eax, eax
je 0x689b9f
jne 0x689e37
lcall 0xd2ff, 0x13e08111
call fcn.00689bf9
add byte [eax], al
add byte [eax], al
mov esi, dword [0x2c924554]
lea esp, [esp - 4]
ret
call dword [eax - 0x6f6ec779]
jmp 0x689bd4
mov dword [esp + 0x24], eax
jmp 0x689b78
pop eax
sub eax, 0xda793608
jmp 0x689a17
call 0x689e4f
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x689ea6
push ebx
jb 0x689ebb
imul esp, dword [ebx + 0x65], 0x646e6148
insb byte es:[edi], dx
add byte gs:[eax - 0x18], dl
xor al, 0xd2
idiv bh
call fcn.005f73ac
push eax
jmp 0x689be5
push 0x2c5c28a5
pushfd
add dword [esp + 4], 0x767c04d9
pushal
jmp 0x688d85
call 0xbe97b533
jmp 0x689f23
call 0x689f35
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
mov dh, 0x6f
out dx, eax
jg 0x689f55
jmp 0x3b2745e
nop
lcall 0x5048, 0xebc93b2b
call fcn.005f7089
jmp 0x689f87
call fcn.005f73ac
jmp 0x689fbf
push eax
jmp 0x68a2c9
call fcn.0068a2dd
add byte [eax], al
add byte [eax], al
mov esi, dword [0x19600671]
lea esp, [esp - 4]
ret

Function at 0x68b02b
Capabilities:
Encode data using xor

Disassembly:
call 0x6899ea
jmp 0x68afe6
pop eax
sub eax, 0xb97a3640
jmp 0x68b019
push 0x36643a0c
pushfd
add dword [esp + 4], 0x3e005c8e
pushal
jmp 0x6899e5
call 0x68b02b
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
aaa
xchg ebp, eax
movsb byte es:[edi], byte ss:[esi]
ret

Function at 0x6a11b2
Capabilities:
Encode data using xor

Disassembly:
call 0x6a0750
jmp 0x6a103c
push 0x68855b4f
pushfd
add dword [esp + 4], 0x462d074f
pushal
jmp 0x6a074b
pop eax
sub eax, 0xb389ca6e
jmp 0x6a11a0
call 0x6a11b2
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
dec edx
cmp al, 0x7e
mov bl, 0x85
ror byte [edi], 0x84
cmp edi, edi
invalid
Function at 0x6a7af3
Capabilities:
Encode data using xor

Disassembly:
call 0x6a5f54
jmp 0x6a77b7
call 0x6a5f74
jmp 0x6a7841
call 0x6a5f95
jmp 0x6a7863
call 0x6a6039
jmp 0x6a79cf
call 0x6a6064
jmp 0x6a7a0e
call 0x6a66b1
inc ebp
jno 0x6a671f
popal
insb byte es:[edi], dx
push edx
arpl word gs:[eax + eax - 0x17], si
popfd
adc dword [eax], eax
add byte [ecx - 0x2c], bl
dec edx
sub eax, 0xda8c28dc
lea esp, [esp + 8]
jmp 0x6a6606
or byte [edi - 0x66], ch
js 0x6a6754
movsd dword es:[edi], dword [esi]
xor eax, 0x4347af5c
invalid
mov dword [esp + 0x24], eax
popal
inc dword [esp + 8]
popfd
ret
push ds
jmp 0x6a672e
pop eax
sub eax, 0xcd154cd3
jmp 0x6a7809
push 0
jmp 0x6a5f6f
push 0xede08fb
pushfd
add dword [esp + 4], 0x305a2f46
pushal
jmp 0x6a5f4f
call 0x6a7819
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
stosd dword es:[edi], eax
or bp, cx
test eax, eax
je 0x6a77c0
jne 0x6a66a2
rcl byte [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
mov ebp, 0xb6d343b9
inc ebp
lodsd eax, dword [esi]
pop ss
xchg edx, eax
add byte [edi - 0x6e], ah
jnp 0x6a785e
dec eax
jae 0x6a784f
paddb mm3, qword [eax - 0x7f]
call 0xc5ca6dfd
pop eax
sub eax, 0xc55ff5b5
call dword [eax - 0x3aabf093]
jmp 0x6a781f
iretd
jmp 0x6a5f90
pop ecx
sub ecx, 0x6a5f95
jmp 0x6a789e
mov dword [ecx + 0x6a77df], eax
mov dword [ecx + 0x6a77e4], 0x82444ff
mov word [ecx + 0x6a77e8], 0xc39d
jmp 0x6a78db
mov dword [esp + 0x24], eax
popal
inc dword [esp + 8]
popfd
ret
movzx ebx, byte [eax]
add ebx, 0x21b30862
cmp ebx, 0x21b3092e
je 0x6a7948
jmp 0x6a78ce
stosd dword es:[edi], eax
mov bh, 0x1c
call 0x6a7961
inc edi
je 0x6a79a7
jns 0x6a79c9
je 0x6a79bd
insd dword es:[edi], dx
dec ebp
je 0x6a79cf
imul esp, dword [ebx + 0x73], 0x22e85000
div esp
invalid
xchg dword [esi + esi*4], ebp
pop edx
xor al, 0xc6
call 0x6a79a5
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add cl, ch
pop eax
add dword [eax], eax
add byte [edx - 0x1d], al
jae 0x6a79c4
in eax, 0x54
lcall 0x424, 0x44819c07
rol byte [0xe9606b96], 0x3c
out 0xff, al
dec ebx
push ebp
lds ebp, [edi + ebx*2 - 0x34a4370c]
scasb al, byte es:[edi]
pop ebp
in al, dx
jl 0x6a798f
cmp al, 0xe6
invalid
lodsb al, byte [esi]
pop edi
hlt
retf
pop eax
sub eax, 0xefa24f8c
call dword [eax - 0x10699781]
jmp 0x6a7b08
call 0x6a79fb
inc esp
jb 0x6a7a49
imul ebp, dword [esi + 0x64], 0x6f50776f
jae 0x6a79fb
push eax
call fcn.005f7089
call fcn.005f73ac
jmp 0x6a605f
pop ecx
sub ecx, 0x6a6064
mov dword [ecx + 0x6a7900], eax
mov dword [ecx + 0x6a79b3], 0x82444ff
mov word [ecx + 0x6a79b7], 0xc39d
movzx ebx, byte [eax]
add ebx, 0x6a0870ee
jmp 0x6a7a82
push esp
cmp byte [ebp + edi - 0x5cb84b53], 0x6f
push 0
jmp 0x6a6034
cmp ebx, 0x6a0871ba
je 0x6a7ae6
jmp 0x6a7ad2
mov dword [esp + 0x24], eax
popal
inc dword [esp + 8]
popfd
ret
add byte [eax], al
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add cl, ch
jmp 0x6a7c16
in eax, 0x6a
clc
lahf
push 0xffffffffffffff88
mov eax, 0xff14c7bb
nop
mov ah, 0x49
xchg esp, eax
mov es, word [ebp + 0x42840fc0]
invalid
test eax, eax
je 0x6a7a52
jne 0x6a79e7
ret
Function at 0x401bc0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x4da080]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], esi
push edi
mov edi, ecx
test esi, esi
je 0x401d59
cmp dword [edi + 4], 0xffffffff
je 0x401bf9
call fcn.00401b30
mov al, byte [esi]
sub al, 0x30
push esi
cmp al, 9
ja 0x401c21
xorps xmm0, xmm0
mov eax, 2
movlpd qword [esp + 0x2c], xmm0
mov word [esp + 0x24], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x24], eax
jmp 0x401c59
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x401d59
xorps xmm0, xmm0
lea eax, [esp + 0x24]
movaps xmmword [esp + 0x20], xmm0
movsx ecx, word [esi + 0xa]
push ecx
mov ecx, dword [esi + 0xc]
push dword [ecx]
push eax
call fcn.00474c60
mov ax, word [esi + 8]
add esp, 0xc
mov word [esp + 0x20], ax
push 0x3afc
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 1
push 2
mov word [esp + 0x2e], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, 0xffffffff
jne 0x401c99
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00472d8e
mov esp, ebp
pop ebp
ret 0xc
push 4
lea eax, [esp + 0x3c]
mov dword [edi + 4], esi
push eax
push 0x1002
push 0xffff
push esi
mov dword [esp + 0x4c], 0x40000
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x401cfc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi + 4], 0xffffffff
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00472d8e
mov esp, ebp
pop ebp
ret 0xc
push 0x31
push 0x401
push dword [esp + 0x1c]
push esi
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov eax, dword [esp + 0x14]
mov dword [edi + 8], eax
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401d20
sub ecx, esi
push ecx
push edx
lea ecx, [edi + 0xc]
call fcn.00402970
mov dword [edi + 0x24], 0x3afc
xor eax, eax
mov dword [edi + 0x40028], 1
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00472d8e
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 0x3c]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.00472d8e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401d70
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4da080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x401f42
cmp dword [esi + 0x40028], 0
je 0x401f42
lea ecx, [ebp - 8]
xor edi, edi
push ecx
push 0x4004667f
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp dword [ebp - 8], edi
jbe 0x401f37
mov ecx, dword [sym.imp.WS2_32.dll_recv]
lea eax, [esi + 0x28]
mov dword [ebp - 0x14], ecx
push 0
push 0x40000
push eax
push dword [esi + 4]
call ecx
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401f1b
test ebx, ebx
je 0x401f0a
add edi, ebx
mov dword [ebp - 0x10], edi
test ebx, ebx
jle 0x401f0a
mov edx, dword [esi + 0x4003c]
mov ecx, edx
sub ecx, dword [esi + 0x40038]
mov edi, dword [esi + 0x40030]
jns 0x401e0a
add ecx, edi
mov eax, edi
sub eax, ecx
cmp ebx, eax
jl 0x401e7c
lea eax, [edi + edi]
push eax
mov dword [esi + 0x40030], eax
call fcn.00472de4
add esp, 4
mov dword [ebp - 0xc], eax
push edi
push dword [esi + 0x40034]
push eax
call fcn.00474c60
mov eax, dword [esi + 0x4003c]
add esp, 0xc
cmp eax, dword [esi + 0x40038]
jge 0x401e60
push eax
push dword [esi + 0x40034]
mov eax, dword [ebp - 0xc]
add eax, edi
push eax
call fcn.00474c60
add esp, 0xc
add dword [esi + 0x4003c], edi
push dword [esi + 0x40034]
call fcn.00472d9c
mov eax, dword [ebp - 0xc]
add esp, 4
mov dword [esi + 0x40034], eax
jmp 0x401df2
lea eax, [edx + ebx]
cmp eax, edi
jl 0x401eeb
sub edi, edx
sub ebx, edi
test edi, edi
jne 0x401eaa
push 0x37
push str.E:HSACSX7_Launcher_SourceAPISocket.h
push 0x4b4960
push str.ERROR____s_n_s:__d_n_n
call fcn.00401670
mov edx, dword [esi + 0x4003c]
add esp, 0x10
push edi
lea eax, [esi + 0x28]
push eax
mov eax, dword [esi + 0x40034]
add eax, edx
push eax
call fcn.00474c60
add esp, 0xc
test ebx, ebx
je 0x401ee1
lea eax, [esi + 0x28]
push ebx
add eax, edi
push eax
push dword [esi + 0x40034]
call fcn.00474c60
add esp, 0xc
mov dword [esi + 0x4003c], ebx
jmp 0x401f07
xor ebx, ebx
mov dword [esi + 0x4003c], ebx
jmp 0x401f07
push ebx
lea eax, [esi + 0x28]
push eax
mov eax, dword [esi + 0x40034]
add eax, edx
push eax
call fcn.00474c60
add esp, 0xc
add dword [esi + 0x4003c], ebx
mov edi, dword [ebp - 0x10]
lea eax, [esi + 0x28]
mov ecx, dword [ebp - 0x14]
cmp edi, dword [ebp - 8]
jb 0x401dc5
jmp 0x401f37
push 0xc6
push str.E:HSACSX7_Launcher_SourceAPISocket.cpp
push str.socket_receive_error_
push str.ERROR____s_n_s:__d_n_n
call fcn.00401670
add esp, 0x10
mov ecx, esi
call fcn.00401f60
test eax, eax
jne 0x401f37
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00472d8e
mov esp, ebp
pop ebp
ret
Function at 0x402540
Capabilities:
Encode data using xor
Hash data with crc32
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49a8ed
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4da080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x24], eax
cmp dword [eax + 0x40058], 0
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], ebx
je 0x4026fe
cmp dword [eax + 4], 0xffffffff
je 0x4026fe
cmp dword [eax + 0x40028], 0
je 0x4026fe
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
xor edi, edi
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], vtable.DataPack.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
cmp dword [0x4ddcac], edi
je 0x40265a
mov eax, dword [0x4ddca8]
push ebx
inc eax
push esi
push 0x4de13c
mov dword [0x4ddca8], eax
mov dword [0x4de138], eax
call fcn.00474c60
lea esi, [ebx + 4]
add esp, 0xc
or ecx, 0xffffffff
xor edx, edx
test esi, esi
je 0x40261b
nop
movzx eax, byte [edx + 0x4de138]
inc edx
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4b4a38]
cmp edx, esi
jb 0x402600
push 0x4de138
mov dword [ebx + 0x4de13c], ecx
add ebx, 8
push 0x4de138
push ebx
mov dword [ebp - 0x20], ebx
call fcn.0041c820
push ebx
mov dword [ebp - 0x18], ebx
call fcn.00472de4
push ebx
mov esi, eax
mov dword [ebp - 0x28], eax
push 0x4de138
push esi
mov dword [ebp - 0x2c], esi
call fcn.00474c60
mov eax, dword [ebp - 0x24]
add esp, 0x10
add ebx, 6
cmp ebx, 0xc8
jg 0x4026f3
mov esi, dword [sym.imp.WS2_32.dll_htons]
lea edi, [eax + 0x28]
push 0xaa55
call esi
mov word [edi], ax
mov eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x28]
mov word [edi + 2], ax
add edi, 4
push edi
call fcn.00474c60
add esp, 0xc
push 0x55aa
call esi
mov ecx, dword [ebp - 0x20]
xor esi, esi
mov word [ecx + edi], ax
mov edi, dword [ebp - 0x24]
test ebx, ebx
jle 0x4026ed
nop word [eax + eax]
push 0
push ebx
lea eax, [edi + 0x28]
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x4026d1
test eax, eax
je 0x4026cb
add esi, eax
cmp esi, ebx
jl 0x4026b0
jmp 0x4026ed
push 0x151
push str.E:HSACSX7_Launcher_SourceAPISocket.cpp
push str.socket_send_error_
push str.ERROR____s_n_s:__d_n_n
call fcn.00401670
add esp, 0x10
add dword [edi + 0x40040], ebx
push dword [ebp - 0x2c]
call fcn.00472d9c
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472d8e
mov esp, ebp
pop ebp
ret 8
Function at 0x4056c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x4056f2
jl 0x4056e5
test ecx, ecx
jne 0x4056f2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4057b2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00407050
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x40575e
jg 0x40571d
test esi, esi
je 0x40575e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x405735
mov eax, dword [esp + 0x10]
jl 0x40572f
cmp eax, esi
jae 0x405735
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.00474c60
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x40577f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40579b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x405704
jl 0x40579b
test ecx, ecx
jne 0x405704
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x4057eb
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x4057eb
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.00474c60
mov eax, dword [ebx + 0x2c]
add esp, 0xc
add dword [esp + 0xc], esi
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x40585b
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x405811
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x405844
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0047a9ef
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x40586f
cmp edi, eax
ja 0x405820
test ecx, ecx
je 0x40585b
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0047a9ef
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407760
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49afb0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4da080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00472da1
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00471482
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409af0
Capabilities:
Create thread
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b2d5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4da080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x4ddcf0]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipImageGetFrameDimensionsCount]
test eax, eax
je 0x409b3b
mov dword [esi + 8], eax
mov esi, dword [ebp - 0x14]
xor ecx, ecx
mov eax, esi
mov edx, 0x10
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00472de4
mov edi, dword [0x4ddcf0]
add esp, 4
mov dword [0x4ddcc8], eax
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.gdiplus.dll_GdipImageGetFrameDimensionsList]
test eax, eax
je 0x409b76
mov dword [edi + 8], eax
mov esi, dword [0x4ddcf0]
lea eax, [ebp - 0x14]
push eax
push dword [0x4ddcc8]
mov dword [ebp - 0x14], 0
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipImageGetFrameCount]
test eax, eax
je 0x409b9d
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x14]
mov esi, dword [0x4ddcf0]
mov dword [0x4ddcbc], eax
lea eax, [ebp - 0x1c]
push eax
push 0x5100
push dword [esi + 4]
mov dword [ebp - 0x1c], 0
call dword [sym.imp.gdiplus.dll_GdipGetPropertyItemSize]
test eax, eax
je 0x409bcb
mov dword [esi + 8], eax
mov esi, dword [ebp - 0x1c]
push esi
call fcn.0047ce1a
mov edi, dword [0x4ddcf0]
add esp, 4
mov dword [0x4ddcdc], eax
push eax
push esi
push 0x5100
push dword [edi + 4]
call dword [sym.imp.gdiplus.dll_GdipGetPropertyItem]
test eax, eax
je 0x409bf9
mov dword [edi + 8], eax
cmp dword [0x4ddcbc], 1
jbe 0x409c65
push str.NOTICED:_GDIHelper::InitializeImage____Image_file_has_more_than_1_frame__its_playable__2_._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 4
mov dword [0x4ddcb8], 1
call fcn.00472da1
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [eax], 0x4096e0
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x409ef0
push 0
push 0
call fcn.0047cd4d
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x409c85
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.00409560
cmp dword [ebp - 0x14], 0
jne 0x409c80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472d8e
mov esp, ebp
pop ebp
ret
call fcn.0047cdde
push 6
mov dword [ebp - 0x14], 0
call fcn.00471880
int3
Function at 0x40ebf0
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b6bd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x38
push esi
push edi
mov eax, dword [0x4da080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2c], 0
push 8
push str.Path.ini
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00402970
lea eax, [edi + 0xc]
mov dword [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x40ec71
mov eax, dword [eax]
push ecx
push eax
push 0
lea ecx, [ebp - 0x2c]
call fcn.00412cf0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x44], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x34], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x30], 0x10
cmovae eax, dword [ebp - 0x44]
push eax
push 0xa
push str.Count
push str.Version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x30]
mov dword [edi + 4], eax
cmp edx, 0x10
jb 0x40ecf8
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ecee
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ed99
push edx
push ecx
call fcn.00472dd6
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
cmp edx, 0x10
jb 0x40ed41
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40ed37
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ed99
push edx
push ecx
call fcn.00472dd6
add esp, 8
mov eax, dword [edi + 4]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
test eax, eax
js 0x40ed5f
cmp eax, 0xa
jle 0x40ed66
mov dword [edi + 4], 0
mov eax, dword [edi + 0x28]
mov esi, dword [edi + 0x24]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x40ed85
push 0
push esi
mov ecx, edi
call fcn.0040f8e0
add esi, 0x18
cmp esi, dword [ebp - 0x14]
jne 0x40ed73
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0047a550
int3
Function at 0x41c820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
movzx eax, cl
imul eax, eax, 0x9d
push edi
mov edi, 0x86d
mov dword [ebp - 4], eax
xor eax, eax
test ecx, ecx
jle 0x41c87e
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
sub ebx, ecx
nop dword [eax]
lea esi, [eax + ecx]
mov ecx, eax
and ecx, 7
inc eax
mov dl, byte [ecx + 0x4ddea8]
mov ecx, edi
xor dl, byte [ebx + esi]
sar ecx, 8
xor dl, cl
imul edi, edi, 0x87b
xor dl, byte [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov byte [esi], dl
cmp eax, dword [ebp + 8]
jl 0x41c850
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc