joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404ff0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x43100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x110]
mov esi, ecx
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x128], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405040
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.00413e60
sub esp, 0x18
mov ecx, esp
push 0x432294
call fcn.00413b00
lea ecx, [ebp - 0x140]
call fcn.00402ac0
push eax
lea edx, [ebp - 0x128]
mov ecx, esi
call fcn.00413fb0
mov edx, dword [ebp - 0x114]
add esp, 0x1c
cmp edx, 0x10
jb 0x4050bd
mov ecx, dword [ebp - 0x128]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4050b3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40511f
push edx
push ecx
call fcn.0041541e
add esp, 8
mov edx, dword [ebp - 0x12c]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
cmp edx, 0x10
jb 0x40510e
mov ecx, dword [ebp - 0x140]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405104
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40511f
push edx
push ecx
call fcn.0041541e
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00414dac
mov esp, ebp
pop ebp
ret
call fcn.0041886c
int3

Function at 0x405130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x43100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x110]
mov esi, ecx
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x128], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405180
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.00413e60
sub esp, 0x18
mov ecx, esp
push 0x432294
call fcn.00413b00
lea ecx, [ebp - 0x140]
call fcn.00402ac0
push eax
lea edx, [ebp - 0x128]
mov ecx, esi
call fcn.00413fb0
mov edx, dword [ebp - 0x114]
add esp, 0x1c
cmp edx, 0x10
jb 0x4051fd
mov ecx, dword [ebp - 0x128]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4051f3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40525f
push edx
push ecx
call fcn.0041541e
add esp, 8
mov edx, dword [ebp - 0x12c]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
cmp edx, 0x10
jb 0x40524e
mov ecx, dword [ebp - 0x140]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405244
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40525f
push edx
push ecx
call fcn.0041541e
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00414dac
mov esp, ebp
pop ebp
ret
call fcn.0041886c
int3
Function at 0x405270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x43100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x110]
mov esi, ecx
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x128], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4052c0
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.00413e60
sub esp, 0x18
mov ecx, esp
push 0x432294
call fcn.00413b00
lea ecx, [ebp - 0x140]
call fcn.00402ac0
push eax
lea edx, [ebp - 0x128]
mov ecx, esi
call fcn.00413fb0
mov edx, dword [ebp - 0x114]
add esp, 0x1c
cmp edx, 0x10
jb 0x40533d
mov ecx, dword [ebp - 0x128]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405333
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40539f
push edx
push ecx
call fcn.0041541e
add esp, 8
mov edx, dword [ebp - 0x12c]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
cmp edx, 0x10
jb 0x40538e
mov ecx, dword [ebp - 0x140]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405384
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40539f
push edx
push ecx
call fcn.0041541e
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00414dac
mov esp, ebp
pop ebp
ret
call fcn.0041886c
int3
Function at 0x406fe0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
cmp dword [0x4321a0], 0x10
mov eax, 0x43218c
cmovae eax, dword [0x43218c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40700c
ret
push 0
call fcn.0041762f
int3
Function at 0x408030
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x1c]
mov eax, edx
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 1
jb 0x408067
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x18], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
mov word [eax + ecx], 0
jmp 0x40807a
sub esp, 8
mov byte [ebp - 0x28], 0
push dword [ebp - 0x28]
push ecx
lea ecx, [ebp + 8]
call fcn.00414480
mov edx, dword [ebp + 0x34]
mov eax, edx
mov ecx, dword [ebp + 0x30]
sub eax, ecx
cmp eax, 1
jb 0x4080a1
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov word [eax + ecx], 0
jmp 0x4080b4
sub esp, 8
mov byte [ebp - 0x28], 0
push dword [ebp - 0x28]
push ecx
lea ecx, [ebp + 0x20]
call fcn.00414480
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push esi
cmovae eax, dword [ebp + 8]
xorps xmm0, xmm0
cmp dword [ebp + 0x34], 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, 0x610
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
movlpd qword [ebp - 0x12], xmm0
mov dword [ebp - 0xa], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov edx, dword [ebp + 0x1c]
mov esi, eax
cmp edx, 0x10
jb 0x408133
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408129
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408186
push edx
push ecx
call fcn.0041541e
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x408175
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40816b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408186
push edx
push ecx
call fcn.0041541e
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00414dac
mov esp, ebp
pop ebp
ret
call fcn.0041886c
int3
Function at 0x413940
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x413860
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4138b0
push 0
push 0
call esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0x7530
call esi
jmp 0x413930
push ebp
mov ebp, esp
and esp, 0xfffffff8
call fcn.00408b60
call fcn.00406fe0
mov ecx, 1
call fcn.00408750
mov ecx, 1
call fcn.00408190
sub esp, 0x18
mov ecx, esp
call fcn.004053b0
call fcn.00409180
add esp, 0x18
call fcn.00411150
jmp 0x413900
Function at 0x401567
Capabilities:
Check for sandbox username or hostname
Execute command
Get hostname

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push ebx
push ecx
mov eax, 0x144c
call fcn.004027b0
sub esp, eax
call fcn.004018a0
lea edx, [ebp - 0x438]
mov eax, 0
mov ecx, 0x100
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x43c], 0x400
lea eax, [ebp - 0x43c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x438]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call eax
sub esp, 8
lea edx, [ebp - 0x143c]
mov eax, 0
mov ecx, 0x400
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0
mov dword [esp], 0x404009
call fcn.004027e0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x401663
jmp 0x401644
mov eax, dword [ebp - 0x2c]
lea ecx, [eax + 8]
mov eax, 0x1000
sub eax, dword [ebp - 0x1c]
lea ebx, [ebp - 0x143c]
mov edx, dword [ebp - 0x1c]
add edx, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x40400b
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00401530
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jle 0x401644
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
add eax, edx
cmp eax, 0xfff
ja 0x401644
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call fcn.00402980
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4015f5
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call fcn.00402a90
mov eax, dword [str.KITTY000]
add eax, 5
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
lea edx, [eax + 7]
test eax, eax
cmovs eax, edx
sar eax, 3
movzx eax, byte [ebp + eax - 0x438]
movsx ebx, al
mov eax, dword [ebp - 0x34]
cdq
shr edx, 0x1d
add eax, edx
and eax, 7
sub eax, edx
mov ecx, eax
sar ebx, cl
mov eax, ebx
and eax, 1
test eax, eax
je 0x4016ba
mov dword [ebp - 0x20], 0x403020
mov dword [ebp - 0x24], 0x44
jmp 0x4016c8
mov dword [ebp - 0x20], 0x403080
mov dword [ebp - 0x24], 0xbd
mov dword [esp + 4], 0x40400f
mov dword [esp], str.malware.exe
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x38], eax
jmp 0x401703
mov eax, dword [ebp - 0x20]
lea edx, [eax + 1]
mov dword [ebp - 0x20], edx
movzx eax, byte [eax]
movsx eax, al
xor al, 0xff
mov edx, eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x24]
lea edx, [eax - 1]
mov dword [ebp - 0x24], edx
test eax, eax
jne 0x4016e1
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp], str.malware.exe
call sub.msvcrt.dll_system
mov eax, 0
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x401bf0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00401c50

Function at 0x401c50
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4053a0]
test esi, esi
jle 0x401d43
mov edi, dword [0x4053a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401c84
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401d3c
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x401c70
mov dword [esp], eax
mov esi, eax
call fcn.00402540
test eax, eax
mov edi, eax
je 0x401d80
mov esi, dword [0x4053a4]
lea ebx, [ebx + ebx*4]
shl ebx, 2
add esi, ebx
mov dword [esi + 0x10], eax
mov dword [esi], 0
call fcn.00402650
add eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4053a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401d60
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401d35
sub eax, 4
and eax, 0xfffffffb
je 0x401d35
add ebx, dword [0x4053a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401d4a
add dword [0x4053a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x401c8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401bf0
mov eax, dword [0x4053a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401bf0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401bf0
Function at 0x4021c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4053b0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402215
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40220e
test esi, esi
je 0x40220e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4021f0
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4027e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x40296c
cmp byte [ebx], 0
je 0x402930
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x402950
test al, 0x10
je 0x402930
lea edi, [esp + 0x2c]
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], edi
mov esi, edi
call sub.msvcrt.dll__fullpath
mov edx, dword [esi]
add esi, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x402844
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [esi + 2]
mov ecx, eax
cmove esi, edx
add cl, al
sbb esi, 3
sub esi, edi
lea eax, [esi + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x40295f
lea edx, [esi + 1]
lea ebp, [eax + 0x22c]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp], ebp
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
cmp byte [ebx + 0x22c], 0
je 0x4028d4
movzx eax, byte [ebx + esi + 0x22b]
cmp al, 0x2f
je 0x4028d4
cmp al, 0x5c
je 0x4028d4
mov edx, dword [esp + 0x1c]
mov edi, 0x5c
mov word [ebp + esi], di
mov esi, edx
mov eax, 0x2a
xor edx, edx
xor ecx, ecx
mov word [ebp + esi], ax
mov word [ebx + 0x11c], dx
lea edx, [ebx + 0x120]
mov word [ebx + 0x11e], cx
xor eax, eax
mov ecx, 0x41
mov edi, edx
mov dword [ebx + 0x224], 0xffffffff
mov dword [ebx + 0x228], 0
mov dword [ebx + 0x118], 0
rep stosd dword es:[edi], eax
add esp, 0x13c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [eax], 0x14
add esp, 0x13c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [eax], 2
jmp 0x40291f
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x40291f
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
jmp 0x40291f
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x7720359d
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x480e4442
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x403bb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov edx, ecx
push edi
xor eax, eax
mov ecx, 0x40
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, ebx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403bd0
sub eax, esi
cmp eax, 0xff
jae 0x403bf0
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403be5
sub eax, esi
jmp 0x403bf5
mov eax, 0xff
mov ecx, eax
shr ecx, 2
mov esi, ebx
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403c10
sub eax, esi
cmp eax, 0xff
jae 0x403c30
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403c25
sub eax, esi
jmp 0x403c35
mov eax, 0xff
mov byte [eax + edx], 0
xor eax, eax
jmp 0x403c40
mov cl, byte [eax + edx + 0x100]
mov bl, byte [eax + edx]
xor bl, cl
mov cl, byte [eax + edx + 0x101]
mov byte [eax + edx], bl
mov bl, byte [eax + edx + 1]
xor bl, cl
mov cl, byte [eax + edx + 0x102]
mov byte [eax + edx + 1], bl
mov bl, byte [eax + edx + 2]
xor bl, cl
mov cl, byte [eax + edx + 0x103]
mov byte [eax + edx + 2], bl
xor byte [eax + edx + 3], cl
add eax, 4
cmp eax, 0x100
jl 0x403c40
pop edi
pop esi
pop ebx
ret 4

Function at 0x403cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov eax, dword [0x5fe940]
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x40
mov esi, edx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x114], eax
lea eax, [esp + 0x11]
lea ecx, [edx + 0x101]
mov esi, 0x40
lea esp, [esp]
mov dl, byte [ecx - 1]
mov bl, byte [eax - 1]
xor bl, dl
mov dl, byte [ecx]
mov byte [eax - 1], bl
mov bl, byte [eax]
xor bl, dl
mov dl, byte [ecx + 1]
mov byte [eax], bl
mov bl, byte [eax + 1]
xor bl, dl
mov dl, byte [ecx + 2]
mov byte [eax + 1], bl
xor byte [eax + 2], dl
add ecx, 4
add eax, 4
dec esi
jne 0x403cf0
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403d24
sub eax, edx
inc eax
cmp eax, 0xff
jae 0x403d4e
lea eax, [esp + 0x10]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403d40
sub eax, edx
lea ecx, [eax + 1]
jmp 0x403d53
mov ecx, 0xff
mov edi, dword [ebp + 8]
mov eax, ecx
shr ecx, 2
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x114]
call fcn.005900c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov eax, dword [0x5fe940]
push ebx
push esi
mov edx, ecx
push edi
mov ecx, 0x40
mov esi, edx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x114], eax
lea eax, [esp + 0x11]
lea ecx, [edx + 0x101]
mov esi, 0x40
lea esp, [esp]
mov dl, byte [ecx - 1]
mov bl, byte [eax - 1]
xor bl, dl
mov dl, byte [ecx]
mov byte [eax - 1], bl
mov bl, byte [eax]
xor bl, dl
mov dl, byte [ecx + 1]
mov byte [eax], bl
mov bl, byte [eax + 1]
xor bl, dl
mov dl, byte [ecx + 2]
mov byte [eax + 1], bl
xor byte [eax + 2], dl
add ecx, 4
add eax, 4
dec esi
jne 0x403dd0
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403e04
mov ecx, dword [esp + 0x114]
sub eax, edx
call fcn.005900c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c920
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x5a65bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov eax, dword [0x5fe940]
mov dword [esp + 0x108], eax
mov al, byte [0x60d188]
test al, al
push esi
mov esi, ecx
je 0x40c9be
lea ecx, [esp + 8]
call fcn.00437d80
mov dword [esp + 0x118], 0
push str.game_info.ini
lea ecx, [esp + 0xc]
call fcn.00438040
lea eax, [esp + 4]
push eax
push 0x5b5d44
push str.Setting
lea ecx, [esp + 0x14]
call fcn.004381c0
cmp eax, 1
jne 0x40c9a3
mov eax, dword [esp + 4]
test eax, eax
setne cl
mov byte [esi + 0x124], cl
jmp 0x40c9aa
mov byte [esi + 0x124], 1
mov dword [esp + 0x118], 0xffffffff
lea ecx, [esp + 8]
call fcn.00437d90
push 0xdc
mov dword [esi + 0x230], 0x40c840
call sub.d3d8.dll_Direct3DCreate8
test eax, eax
mov dword [esi + 0x224], eax
pop esi
jne 0x40ca00
mov ecx, dword [0x60d19c]
push eax
push str.Error
push 2
call fcn.004fef50
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x80004005
jmp 0x40ca3a
mov ecx, 0x817088
call fcn.00424830
mov eax, dword [0x81709c]
test eax, eax
jne 0x40ca38
mov ecx, dword [0x60d19c]
push 0
push str.Error
push 3
call fcn.004fef50
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov ecx, dword [esp + 0x10c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x108]
call fcn.005900c7
add esp, 0x118
ret
Function at 0x40d4b0
Capabilities:
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
lea eax, [esp]
push eax
mov eax, dword [ecx]
push edx
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40d50f
mov edx, dword [esp + 0x10]
mov eax, edx
push esi
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d4e0
mov ecx, dword [esp + 0x10]
sub eax, esi
push eax
push edx
mov edx, dword [esp + 0xc]
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret 0xc

Function at 0x40d610
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5a65db
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
push esi
push 0
push eax
push 0
push 0
push 0
push SysReAllocString
push 0
push SysReAllocString
push 0xcf0000
push 0x5ffe40
push 0x5ffdd8
push 0
mov dword [0x5ffea4], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
mov dword [0x60d160], esi
jne 0x40d677
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
push 8
call fcn.0058f5cc
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0
test eax, eax
je 0x40d69f
push str.gTxt.dat
mov ecx, eax
call fcn.004ff100
jmp 0x40d6a1
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, 0x7d1868
mov dword [0x60d19c], eax
call fcn.00448380
mov eax, dword [esp + 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [esp + 4]
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret

Function at 0x40db90
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5fe940]
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x40dbdc
mov ax, word [esp]
cmp al, 2
jne 0x40dbd6
cmp ah, al
jne 0x40dbd6
xor eax, eax
mov ecx, dword [esp + 0x190]
call fcn.005900c7
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
mov eax, 0x80004005
call fcn.005900c7
add esp, 0x194
ret