joyce8/EMBER2024-capa huggingface dataset:
Function at 0x907df9b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ac387
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090a6f20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.09009812
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x907e020
push 0
push 0x753
push 0xb71b
push dword [esi + 4]
call fcn.09009812
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.090168fd
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x907e037
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x907e093
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x907e086
mov ecx, dword [ebp - 0x13e4]
mov eax, 0x504c4142
push 0
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
call fcn.09009812
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x753
push edi
push dword [eax]
call fcn.09009812
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005d4d
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [esi]
mov edx, dword [esi + 4]
shr eax, 0x10
imul eax, eax, 0xff
movzx ecx, dx
add ecx, 0x40
shr ecx, 7
add eax, 0x4000
shr eax, 0xf
cmp ecx, 0xff
mov byte [edi - 2], al
movzx eax, cl
mov ecx, 0xff
cmova eax, ecx
shr edx, 0x10
add edx, 0x40
mov byte [edi - 1], al
shr edx, 7
cmp edx, ecx
movzx eax, dl
cmova eax, ecx
add esi, 8
mov byte [edi], al
add edi, 3
sub dword [ebp - 0x13d4], 1
jne 0x907e12c
sub dword [ebp - 0x13d8], 1
jne 0x907e122
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005e1d
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x753
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xb71b
jb 0x907e06f
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.09016a6b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x907e5ad
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ac387
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090a6f20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0x94
push eax
call fcn.09009812
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x907e632
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.09009812
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.090168fd
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x907e649
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x907e6a5
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x907e698
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x50524742
push 0x271
push eax
push eax
call fcn.09009812
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.09009812
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.09005d4d
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x907e741
sub dword [ebp - 0x13d8], 1
jne 0x907e737
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.09005e1d
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x907e681
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.09016a6b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x909f010
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90ace1d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb20
mov eax, dword [0x90e6610]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb2c], eax
call fcn.09009812
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.09009812
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09008247
add esp, 0x3c
lea ecx, [ebp - 0xb20]
push eax
call fcn.09009812
mov byte [ebp - 4], 1
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x909f0c0
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.09009812
movzx ecx, word [ebp - 0x11c]
movzx edi, word [ebp - 0x914]
mov dword [ebp - 0xb28], ecx
cmp ecx, edi
jbe 0x909f23a
mov edx, ecx
sub edx, edi
xor esi, esi
mov dword [ebp - 0xb1c], edx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x909f131
xor eax, eax
jmp 0x909f15e
cmp eax, ecx
jb 0x909f13c
mov eax, 0x8000
jmp 0x909f15e
sub eax, edi
mov ecx, edx
shl eax, 0xf
xor edx, edx
shr ecx, 1
add eax, ecx
mov ecx, dword [ebp - 0xb28]
div dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb1c]
movzx eax, ax
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x909f121
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0
call fcn.09017177
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.0901b295
mov esi, dword [ebp - 0xb2c]
lea eax, [esi + 8]
push eax
push 0x278
mov dword [ebp - 0xb2c], eax
call fcn.09009812
add esp, 8
mov dword [ebp - 0xb28], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x909f1ca
push esi
mov ecx, eax
call fcn.09009812
mov edx, eax
jmp 0x909f1cc
xor edx, edx
mov ecx, dword [ebx + 0xc]
xorps xmm0, xmm0
movsd xmm1, qword [ebx + 0x10]
mulsd xmm1, qword [0x90bee38]
mov eax, dword [ecx]
mov dword [edx + 0x68], eax
mov eax, dword [ecx + 4]
comisd xmm0, xmm1
mov dword [edx + 0x6c], eax
jbe 0x909f1fa
subsd xmm1, qword [0x90b4780]
jmp 0x909f202
addsd xmm1, qword [0x90b4780]
cvttsd2si eax, xmm1
lea edi, [edx + 0x72]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x70], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001f80
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x6250726f
call fcn.09009812
int3
Function at 0x4014e0
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x7fc348
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x401609
cmp dword fs:[0xc0], eax
je 0x40150b
mov dword [0x7fc344], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x7fc22c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x7fc230], eax
movzx edx, word [esi + 0xac]
mov dword [0x7fc234], edx
mov eax, dword [esi + 0xb0]
mov dword [0x7fc238], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x40156b
push 0x7f
push eax
push 0x7fc23c
call fcn.004026f0
mov edx, dword [0x7fc234]
add esp, 0xc
jmp 0x401573
xor eax, eax
mov word [0x7fc23c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x7fc33c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x7fc33e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x7fc340], ax
mov ecx, eax
mov byte [0x7fc342], 0
cmp byte [0x7ffe0268], 0
je 0x4015ba
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x7fc342], bl
cmp ebx, 1
pop ebx
jne 0x4015d4
and ecx, 0xffef
mov word [0x7fc340], cx
test edx, edx
jne 0x401609
call fcn.004014e0
cmp dword [0x7fc22c], 6
ja 0x401609
jb 0x4015f1
cmp dword [0x7fc230], 4
jae 0x401609
call fcn.004014e0
cmp dword [0x7fc22c], 0xa
jae 0x401609
mov dword [0x7fc234], 1
ret
Function at 0x402750
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x402778
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x402786
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x40279f
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x4027ad
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x4027c6
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x4027d4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x4027ed
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x4027fb
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x402842
add dword [esp], 5
retf

Function at 0x4028d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x7fd1ac]
sub esp, 0x11c
test eax, eax
jne 0x4029ce
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.004025d0
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x402920
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + str.tbVS]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x402930
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41a104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x402965
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00403380
pop edi
pop esi
pop ebx
test eax, eax
je 0x4029c9
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4029c9
mov dword [0x7fd1ac], eax
add esp, 0x11c
ret
mov eax, dword [0x7fd1ac]
add esp, 0x11c
ret
Function at 0x402a40
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x402a8b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x402a7b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x402a61
jmp 0x402a80
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x402adb
mov edi, edx
lea ecx, [edi + 2]
jmp 0x402aa0
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x402aa0
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x402abc
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.004026f0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x402afd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x402b70
mov esi, dword [ebx]
cmp esi, ebx
je 0x402b70
test esi, esi
je 0x402b70
cmp word [esi + 0x24], 2
jbe 0x402b6a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x402b6a
cmp dword [esi + 0x18], 0
je 0x402b6a
test ebp, ebp
je 0x402b25
cmp ebp, eax
jne 0x402b6a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.004026f0
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x402b4a
cmp eax, dword [esi + 0x18]
jne 0x402b6a
cmp dword [esp + 0x10], 0
je 0x402b7d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00402570
add esp, 8
test eax, eax
je 0x402b7d
mov esi, dword [esi]
cmp esi, ebx
jne 0x402b03
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x402d10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x7fc208]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x402ebd
cmp dword [0x7fc20c], 0
jne 0x402ea9
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.004025d0
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x402d60
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41a0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x402d70
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41a0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x402da5
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.004025d0
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402e04
sub edx, esi
sar edx, 1
je 0x402ebd
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x402e20
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x402ebd
xor eax, eax
push ebx
test edx, edx
je 0x402e58
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x402e58
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x402e41
xor eax, eax
test edx, edx
je 0x402e72
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x402e72
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x402e60
xor eax, eax
test edx, edx
je 0x402e8f
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x402e8f
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x402e80
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x7fc208]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x403380
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x4033db
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4033a0
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x4033bc
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.004026f0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4033fd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x40346f
mov esi, dword [ebx]
cmp esi, ebx
je 0x40346f
test esi, esi
je 0x40346f
cmp word [esi + 0x24], 2
jbe 0x403469
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x403469
cmp dword [esi + 0x18], 0
je 0x403469
test ebp, ebp
je 0x403425
cmp ebp, eax
jne 0x403469
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.004026f0
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x40344a
cmp edx, dword [esi + 0x18]
jne 0x403469
cmp dword [esp + 0x14], eax
je 0x40347c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00402570
add esp, 8
test eax, eax
je 0x40347c
mov esi, dword [esi]
cmp esi, ebx
jne 0x403403
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x419c32
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x10001890
Capabilities:
Terminate process

Disassembly:
sub esp, 0x108
mov eax, dword [0x10087700]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0x10062324
push 0x10062334
mov esi, ecx
call fcn.10001850
cmp eax, 1
jne 0x100018c6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10062344
push 0x1006235c
mov ecx, esi
call fcn.10001850
cmp eax, 1
jne 0x100018e7
push 0x3e9
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1006236c
push 0x10062388
mov ecx, esi
call fcn.10001850
cmp eax, 1
jne 0x10001908
push 0x3ea
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10062398
push 0x100623a0
mov ecx, esi
call fcn.10001850
cmp eax, 1
jne 0x10001929
push 0x3eb
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x100623ac
push 0x100623b4
mov ecx, esi
call fcn.10001850
cmp eax, 1
jne 0x1000194a
push 0x3ec
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 4]
push eax
call fcn.10003db0
push 0x100623c0
mov dword [esi + 0xc], eax
call fcn.10003db0
push str.DataPlayerPlayer.bmd
mov dword [esi + 0x10], eax
call fcn.10003db0
push str.DataLang.mpr
mov dword [esi + 0x14], eax
call fcn.10003db0
push str.DataLocalServerInfo.bmd
mov dword [esi + 0x18], eax
call fcn.10003db0
push str.LiveGuard.dll
mov dword [esi + 0x1c], eax
call fcn.10003db0
add esp, 0x18
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x108]
mov dword [esi + 4], eax
pop esi
xor ecx, esp
call fcn.1004344b
add esp, 0x108
ret

Function at 0x10003db0
Capabilities:
Read file on windows

Disassembly:
push ebx
push 0x100627e0
push dword [esp + 0xc]
call fcn.10049454
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x10003dca
pop ebx
ret
push esi
push edi
push 2
push 0
push ebx
call fcn.10049a68
push ebx
call fcn.1004a0c7
push 0
push 0
push ebx
mov esi, eax
call fcn.10049a68
push esi
call fcn.10043701
push ebx
push esi
mov edi, eax
push 1
push edi
call fcn.10049644
push esi
push edi
call fcn.10003c60
push ebx
mov esi, eax
call fcn.1004936d
push edi
call fcn.1004370a
add esp, 0x40
mov eax, esi
pop edi
pop esi
pop ebx
ret