joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cd00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
lea ebx, [ecx - 1]
test ebx, ebx
jl 0x40cdb1
test bl, 1
je 0x40cd23
xor ecx, ecx
jmp 0x40cd58
mov bp, word [edx]
mov esi, ebp
shl si, 8
shr bp, 5
and ebp, 0xff
and ebp, 0xffff
xor si, word [ebp*2 + 0x4d5cc0]
movzx ebp, byte [eax]
xor ebp, esi
mov word [edx], bp
cmp ecx, 1
je 0x40cdb1
mov ecx, 1
test esp, esp
mov bp, word [edx]
mov esi, ebp
shl si, 8
shr bp, 5
and ebp, 0xff
and ebp, 0xffff
xor si, word [ebp*2 + 0x4d5cc0]
movzx ebp, byte [eax + ecx]
xor ebp, esi
mov word [edx], bp
mov esi, ebp
shl si, 8
shr bp, 5
and ebp, 0xff
and ebp, 0xffff
xor si, word [ebp*2 + 0x4d5cc0]
movzx ebp, byte [eax + ecx + 1]
xor ebp, esi
mov word [edx], bp
add ecx, 2
cmp ebx, ecx
jae 0x40cd58
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40e0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
add esp, 0xfffffe00
mov edi, dword [esp + 0x208]
lea eax, [esp]
push eax
push edi
mov dword [esp + 8], 0x61772023
mov dword [esp + 0xc], 0x62686374
mov dword [esp + 0x10], 0x6f636165
mov dword [esp + 0x14], 0xa0d6e
call fcn.00407070
mov ecx, dword [0x473008]
mov dword [edi + 8], ecx
sub esp, 0xfffffe00
pop edi
ret 4

Function at 0x40e180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xfffffe00
push 1
push 0x200
lea eax, [esp + 8]
push eax
mov word [esp + 0xc], 0x23
call fcn.0040e110
push 3
push 0x469790
push 0x200
lea ecx, [esp + 0xc]
push ecx
call fcn.0041f450
lea eax, [esp]
push eax
push dword [esp + 0x208]
call fcn.00407070
push 1
push 0x200
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x746e6553
mov dword [esp + 0x10], 0x206f7420
mov dword [esp + 0x14], 0x76726553
mov word [esp + 0x18], 0x7265
mov byte [esp + 0x1a], 0
call fcn.0040e110
push 0x200
lea eax, [esp + 4]
push eax
push 0x62
push 4
push 6
push 5
push 0
call fcn.0043cdc0
sub esp, 0xfffffe00
ret 4
Function at 0x40ec90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
add esp, 0xfffff828
mov edi, dword [esp + 0x7e4]
mov bl, byte [esp + 0x7e8]
push ebx
call fcn.0043eae0
test al, al
je 0x40ed7c
mov al, byte [edi + 5]
test al, al
jne 0x40ed80
mov al, byte [edi + 4]
test al, al
jne 0x40ed80
push 0x3e9
lea eax, [esp + 0x3f0]
push eax
push ebx
call fcn.0043e900
mov cl, byte [esp + 0x3ec]
test cl, cl
je 0x40ed80
push edi
push 0x3e9
lea eax, [esp + 0x3f4]
push eax
call fcn.00459930
mov byte [edi + 4], 1
mov cl, byte [edi + 5]
test cl, cl
je 0x40ed1c
push 0x67
push 3
push 0x17
push str.Start_Serial_Interface
call fcn.0043ce00
jmp 0x40ed80
push 0x3e9
lea eax, [esp + 0x3f0]
push eax
push 0x3e9
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x206e6163
mov dword [esp + 0x14], 0x20746f6e
mov dword [esp + 0x18], 0x72617473
mov word [esp + 0x1c], 0x2074
mov byte [esp + 0x1e], 0
call fcn.0041f450
push 0x3e9
lea eax, [esp + 4]
push eax
call fcn.0043d8a0
push 0
push ebx
call fcn.0043ea90
mov byte [0x5b0f4b], 1
jmp 0x40ed80
mov byte [edi + 4], 0
sub esp, 0xfffff828
pop edi
pop ebx
ret 8
Function at 0x410820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
add esp, 0xffffff38
mov edi, dword [esp + 0xd0]
mov eax, dword [0x493d8c]
mul dword [0x46b0cc]
shr edx, 3
add edi, edx
test edi, edi
jge 0x410846
xor edi, edi
jmp 0x410850
cmp edi, 0x64
jle 0x410850
mov edi, 0x64
push edi
push 0x3f
lea eax, [edi + edi*4]
lea ecx, [eax*2]
mov dword [0x493d8c], ecx
call fcn.00440130
call fcn.00440330
push 0x64
lea eax, [esp + 4]
push eax
push 1
push edi
mov dword [esp + 0x74], 0x67697242
mov dword [esp + 0x78], 0x656e7468
mov dword [esp + 0x7c], 0x4d207373
mov dword [esp + 0x80], 0x207061
call fcn.0041f600
push 0x64
lea ecx, [esp + 4]
push ecx
push 0x64
lea eax, [esp + 0x70]
push eax
call fcn.0041f450
push 2
push 0x46b0d0
push 0x64
lea ecx, [esp + 0x70]
push ecx
call fcn.0041f450
push 0x62
push 4
push 0x64
lea eax, [esp + 0x70]
push eax
call fcn.0043ce00
sub esp, 0xffffff38
pop edi
ret 4

Function at 0x4108e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xffffff38
mov eax, dword [0x493de4]
cmp eax, 0x384
jae 0x4108f9
mov ecx, 0x3c
jmp 0x41091a
cmp eax, 0xe10
jae 0x410907
mov ecx, 0x12c
jmp 0x41091a
cmp eax, 0x2a30
jae 0x410915
mov ecx, 0x384
jmp 0x41091a
mov ecx, 0x708
xor edx, edx
div ecx
mov dl, byte [esp + 0xcc]
test dl, dl
je 0x410931
cmp eax, 1
jbe 0x410932
dec eax
jmp 0x410932
inc eax
imul ecx, eax
mov dword [0x493de4], ecx
mov eax, dword [0x493ddc]
cmp eax, ecx
jae 0x410949
mov dword [0x493de4], eax
mov eax, dword [0x493de4]
mul dword [0x46b0b0]
shr edx, 5
push edx
push 0x35
call fcn.00440130
push 0x64
lea ecx, [esp + 4]
push ecx
push 1
mov dword [esp + 0x70], 0x6c6c7546
mov dword [esp + 0x74], 0x67697262
mov dword [esp + 0x78], 0x54207468
mov dword [esp + 0x7c], 0x20656d69
mov byte [esp + 0x80], 0
mov eax, dword [0x493de4]
mul dword [0x46b0b0]
shr edx, 5
push edx
call fcn.0041f600
push 0x64
lea ecx, [esp + 4]
push ecx
push 0x64
lea eax, [esp + 0x70]
push eax
call fcn.0041f450
push 4
push 0x46b0b4
push 0x64
lea ecx, [esp + 0x70]
push ecx
call fcn.0041f450
push 0x62
push 4
push 0x64
lea eax, [esp + 0x70]
push eax
call fcn.0043ce00
sub esp, 0xffffff38
ret 4
Function at 0x414d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
add esp, 0xfffff824
push 0x3e8
lea eax, [esp + 0x3f8]
push eax
push 1
mov byte [0x473021], 0
call fcn.0043e900
push 1
call fcn.0043eae0
test al, al
je 0x414f0a
mov al, byte [esp + 0x3f4]
test al, al
je 0x414f0a
push 0x62
push 0
push 0x1f
push str.Reading_Log__ESC_to_abort__...
call fcn.0043ce00
push dword [0x4d5ed4]
call fcn.0043d950
call fcn.0045d610
lea ecx, [esp + 0x3ec]
push ecx
lea edx, [esp + 0x3ec]
push edx
lea ecx, [esp + 0x3f8]
push ecx
push 1
push 0x46abb4
push eax
mov edx, dword [0x493ddc]
mov ecx, eax
sub ecx, edx
push ecx
push 0x3e8
lea edx, [esp + 0x414]
push edx
push 0x493e44
mov dword [0x473008], eax
mov dword [esp + 0x418], ecx
mov dword [esp + 0x414], 0
call fcn.00411280
mov eax, dword [esp + 0x3ec]
test eax, eax
jle 0x414ea1
push 0x3e8
lea ecx, [esp + 4]
push ecx
push 1
push eax
call fcn.0041f600
push 9
push str._lines_
push 0x3e8
lea eax, [esp + 0xc]
push eax
call fcn.0041f450
push 0x3e8
lea ecx, [esp + 0x3f8]
push ecx
push 0x3e8
lea eax, [esp + 0xc]
push eax
call fcn.0041f450
push 0xc
push str._imported
push 0x3e8
lea ecx, [esp + 0xc]
push ecx
call fcn.0041f450
push 0x62
push 4
push 0x3e8
lea eax, [esp + 0xc]
push eax
call fcn.0043ce00
push dword [0x4d5ed4]
call fcn.0043d950
jmp 0x414f25
push 0x3e8
lea ecx, [esp + 0x3f8]
push ecx
push 0x3e8
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], 0x66676f6c
mov dword [esp + 0x14], 0x20656c69
mov word [esp + 0x18], 0x27
call fcn.0041f450
push 0xc
push 0x46ab84
push 0x3e8
lea eax, [esp + 0xc]
push eax
call fcn.0041f450
push 0x72
push 6
push 0x3e8
lea ecx, [esp + 0xc]
push ecx
call fcn.0043ce00
push dword [0x4d5ed4]
call fcn.0043d950
jmp 0x414f25
push 0x62
push 5
push 0x14
push str.No_Log_File_Enabled
call fcn.0043ce00
push dword [0x4d5ed4]
call fcn.0043d950
call fcn.00413c30
call fcn.0045d610
mov ecx, dword [0x493de0]
mov edi, eax
sub edi, ecx
call fcn.0045d610
push edi
mov edx, dword [0x493ddc]
sub eax, edx
push eax
push 0x493e44
call fcn.004023a0
mov byte [0x473017], 1
sub esp, 0xfffff824
pop edi
ret
Function at 0x419cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xffffff9c
call fcn.0043feb0
lea ecx, [esp + 0x5c]
push ecx
mov edx, dword [0x5b0f2c]
sub eax, edx
mov dword [esp + 4], eax
fild dword [esp + 4]
sub esp, 4
fstp dword [esp]
mov eax, dword [0x5b0f28]
mov dword [esp + 8], eax
fild dword [esp + 8]
sub esp, 4
fstp dword [esp]
call fcn.004307c0
push 0x29
lea ecx, [esp + 0x34]
push ecx
push 0x29
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x6c]
push ecx
call fcn.00432090
push 1
push 0x46a704
push 0x29
lea eax, [esp + 0x10]
push eax
call fcn.00468b00
sub esp, 0xfffffff0
test eax, eax
je 0x419dc7
mov al, byte [esp + 0x68]
test al, al
je 0x419d69
lea ecx, [esp + 0x5c]
push ecx
mov edx, dword [esp + 0x60]
mov dword [0x47309c], edx
mov ecx, dword [esp + 0x64]
mov dword [0x4730a0], ecx
call fcn.00416f90
jmp 0x419d86
push 0
push 0x7fffffff
push 1
lea ecx, [esp + 0x68]
push ecx
call fcn.00429850
push 0x4730d0
call fcn.0043d4d0
push 0x29
lea eax, [esp + 8]
push eax
push 0x29
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x40], 0x6b636f4c
mov dword [esp + 0x44], 0x74206465
mov word [esp + 0x48], 0x206f
mov byte [esp + 0x4a], 0
call fcn.0041f450
push 0x62
push 4
push 0x29
lea eax, [esp + 0x3c]
push eax
call fcn.0043ce00
jmp 0x419dd7
push 0x72
push 4
push 0xb
push str.Not_Locked
call fcn.0043ce00
sub esp, 0xffffff9c
ret 4
Function at 0x41f160
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov cl, byte [eax]
cmp cl, 0x47
jne 0x41f197
cmp byte [eax + 1], 0x50
jne 0x41f197
cmp byte [eax + 2], 0x53
jne 0x41f197
mov dl, byte [eax + 3]
cmp dl, 0x43
je 0x41f226
cmp dl, 0x45
je 0x41f226
cmp cl, 0x47
jne 0x41f1a8
cmp byte [eax + 1], 0x50
jne 0x41f1a8
cmp byte [eax + 2], 0x53
je 0x41f1d6
cmp cl, 0x53
jne 0x41f1b9
cmp byte [eax + 1], 0x50
jne 0x41f1b9
cmp byte [eax + 2], 0x43
je 0x41f1d6
cmp cl, 0x53
jne 0x41f26e
cmp byte [eax + 1], 0x59
jne 0x41f26e
cmp byte [eax + 2], 0x4d
jne 0x41f26e
mov cl, byte [eax + 3]
test cl, cl
je 0x41f21e
xor edx, edx
jmp 0x41f1fa
cmp byte [edx*2 + str.OBOCODOEOFOGOHOIOJOKOLOMONOOOPA0A1A2A3A4A5A6A7A8A9NRNSNTNUNVNWNXAAABACADAEAFAGAHAIAJAKALAMANAOAPAQARASATAUAVAWAXAYAZDSDTDUDVDWDXSASBSCSDSESFSGSHSISJSKSLSMSNSOSPSQSRSSSTSUSVSWSXSYSZQ1Q2Q3Q4], cl
jne 0x41f1f9
mov bl, byte [eax + 4]
cmp byte [edx*2 + 0x46b125], bl
je 0x41f274
inc edx
cmp edx, 0x5e
jae 0x41f26e
cmp byte [edx*2 + str.BBBCBDBEBFBGBHBIBJBKBLBMBNBOBPP0P1P2P3P4P5P6P7P8P9MRMSMTMUMVMWMXPAPBPCPDPEPFPGPHPIPJPKPLPMPNPOPPPQPRPSPTPUPVPWPXPYPZHSHTHUHVHWHXLALBLCLDLELFLGLHLILJLKLLLMLNLOLPLQLRLSLTLULVLWLXLYLZJ1J2J3J4], cl
jne 0x41f1e4
mov bl, byte [eax + 4]
cmp byte [edx*2 + 0x46b1e5], bl
jne 0x41f1e4
add edx, 0x21
mov byte [edi], dl
mov byte [esi], 0x2f
jmp 0x41f26e
mov byte [edi], 0x2f
mov byte [esi], 0x2f
jmp 0x41f26e
mov cl, byte [eax + 4]
cmp cl, 0x30
jb 0x41f26e
cmp cl, 0x39
ja 0x41f26e
mov al, byte [eax + 5]
cmp al, 0x30
jb 0x41f26e
cmp al, 0x39
ja 0x41f26e
and ecx, 0xff
lea ecx, [ecx + ecx*4]
and eax, 0xff
lea eax, [eax + ecx*2 - 0x210]
test eax, eax
je 0x41f26e
cmp eax, 0x5e
ja 0x41f26e
add eax, 0x20
mov byte [edi], al
cmp dl, 0x43
je 0x41f26b
mov byte [esi], 0x5c
jmp 0x41f26e
mov byte [esi], 0x2f
pop edi
pop esi
pop ebx
ret 0x10
add edx, 0x21
mov byte [edi], dl
mov byte [esi], 0x5c
mov al, byte [eax + 5]
cmp al, 0x30
jb 0x41f287
cmp al, 0x39
jbe 0x41f28f
cmp al, 0x41
jb 0x41f26e
cmp al, 0x5a
ja 0x41f26e
mov byte [esi], al
jmp 0x41f26e

Function at 0x420a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
add esp, 0xfffffff8
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
lea esi, [edi - 1]
test esi, esi
jge 0x420a9f
xor dl, dl
mov byte [esp + 4], 0
jmp 0x420b14
test esi, 1
je 0x420ab2
xor dl, dl
mov byte [esp + 4], 0
xor ebp, ebp
jmp 0x420ad0
xor ecx, ecx
mov cl, byte [eax]
mov dl, byte [ecx + 0x4e4121]
mov cl, byte [ecx + 0x4e4021]
mov byte [esp + 4], cl
cmp edi, 1
je 0x420b14
mov ebp, 1
xor dl, byte [eax + ebp]
and edx, 0xff
mov cl, byte [eax + ebp + 1]
xor cl, byte [edx + 0x4e4121]
xor cl, byte [esp + 4]
and ecx, 0xff
mov dword [esp], ecx
mov cl, byte [ecx + 0x4e4121]
mov bl, cl
xor bl, byte [edx + 0x4e4021]
mov dl, bl
mov ecx, dword [esp]
mov bl, byte [ecx + 0x4e4021]
mov byte [esp + 4], bl
add ebp, 2
cmp esi, ebp
jae 0x420ad0
mov byte [eax + edi], dl
mov cl, byte [esp + 4]
mov byte [eax + edi + 1], cl
sub esp, 0xfffffff8
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x42ce10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
add esp, 0xffffffb8
mov dword [esp + 8], 0
mov edi, dword [esp + 0x5c]
fld dword [esp + 0x60]
fsub dword [0x46c560]
fstp dword [esp + 0x10]
fld dword [esp + 0x64]
fsub dword [0x46c560]
fstp dword [esp + 0xc]
fld dword [esp + 0x68]
fcomp dword [esp + 0x10]
fnstsw ax
and ah, 1
je 0x42d040
mov eax, dword [edi + 0xc]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
fild qword [esp + 4]
fsub dword [esp + 0x68]
fcomp dword [esp + 0x10]
fnstsw ax
and ah, 0x41
jne 0x42d040
fld dword [esp + 0x68]
fcomp dword [esp + 0xc]
fnstsw ax
and ah, 1
je 0x42d040
mov eax, dword [edi + 4]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
fild qword [esp + 4]
fsub dword [esp + 0x68]
fcomp dword [esp + 0xc]
fnstsw ax
and ah, 0x41
jne 0x42d040
push dword [esp + 0x68]
call fcn.00402540
push dword [esp + 0x10]
lea esi, [eax + 1]
call fcn.00402540
mov ebp, eax
push dword [esp + 0xc]
mov dword [esp + 4], ebp
fild dword [esp + 4]
fsubr dword [esp + 0x14]
fstp dword [esp + 0x14]
call fcn.00402540
mov dword [esp], eax
fild dword [esp]
fsubr dword [esp + 0xc]
fstp dword [esp + 0xc]
mov ecx, esi
neg ecx
mov dword [esp + 0x38], ecx
cmp ecx, esi
jg 0x42d040
sub esi, ecx
inc esi
mov dword [esp + 0x40], esi
lea ebx, [eax + eax*2]
mov eax, dword [esp + 0x38]
lea edx, [ecx + eax*2]
lea eax, [edx*2]
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x40]
mov dword [esp + 0x3c], edx
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], eax
jmp 0x42cf38
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], edx
fild dword [esp + 0x30]
fstp dword [esp + 0x20]
mov eax, dword [esp + 0x28]
lea esi, [eax + ebx*2]
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
jmp 0x42cf56
mov edx, eax
mov dword [esp], ecx
fild dword [esp]
fsub dword [esp + 0x10]
fstp dword [esp + 0x24]
fld dword [esp + 0xc]
fsubr dword [esp + 0x20]
fstp dword [esp + 0x1c]
fld dword [esp + 0x24]
fmul st(0)
fld dword [esp + 0x1c]
fmul st(0)
faddp st(1)
fstp dword [esp + 0x44]
cmp dword [esp + 0x44], 1
sbb eax, eax
or eax, dword [esp + 0x44]
jle 0x42cf99
fld dword [esp + 0x44]
fsqrt
fstp dword [esp + 0x44]
fld dword [esp + 0x44]
fsubr dword [esp + 0x68]
fstp dword [esp + 0x44]
cmp dword [esp + 0x44], 1
sbb eax, eax
or eax, dword [esp + 0x44]
jle 0x42d019
fld1
fcomp dword [esp + 0x44]
fnstsw ax
and ah, 1
je 0x42cfc8
mov eax, 0x3f800000
mov dword [esp + 0x44], eax
fld dword [esp + 0x44]
fmul dword [0x46c268]
sub esp, 4
fstp dword [esp]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.00402540
mov edx, dword [esp + 4]
mov ecx, dword [esp]
push eax
push dword [esp + 0x78]
push dword [esp + 0x78]
push dword [esp + 0x78]
lea eax, [ecx + ebp]
imul eax, dword [edi + 8]
add eax, dword [edi]
add eax, esi
push eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
call fcn.004397e0
mov edx, dword [esp + 4]
mov ecx, dword [esp]
inc ecx
lea eax, [edx - 1]
cmp edx, 1
jne 0x42cf54
mov edx, dword [esp + 0x30]
inc edx
add dword [esp + 0x28], 6
mov eax, dword [esp + 0x3c]
dec eax
cmp dword [esp + 0x3c], 1
jne 0x42cf30
sub esp, 0xffffffb8
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x439870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
add esp, 0xffffffbc
mov dword [esp + 8], 0
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
fld dword [esp + 0x5c]
fsubr dword [esp + 0x64]
fstp dword [esp + 0x10]
fld dword [esp + 0x60]
fsubr dword [esp + 0x68]
fstp dword [esp + 0xc]
fld dword [esp + 0x10]
fmul st(0)
fld dword [esp + 0xc]
fmul st(0)
faddp st(1)
fstp dword [esp + 0x2c]
test dword [esp + 0x2c], 0x7fffffff
je 0x439a7c
fld dword [esp + 0x2c]
fsqrt
fstp dword [esp + 0x2c]
fld dword [esp + 0xc]
fmul dword [esp + 0x78]
fdiv dword [esp + 0x2c]
fstp dword [esp + 0x18]
fld dword [esp + 0x10]
fmul dword [esp + 0x78]
fdiv dword [esp + 0x2c]
fchs
fstp dword [esp + 0x14]
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
fild qword [esp + 4]
fstp dword [esp + 0x40]
fld dword [esp + 0x2c]
fcomp dword [0x46c4a0]
fnstsw ax
and ah, 1
je 0x43992a
fld dword [esp + 0x40]
fmul dword [0x46c46c]
fstp dword [esp + 0x40]
fld dword [esp + 0x40]
fdivr dword [esp + 0x2c]
sub esp, 4
fstp dword [esp]
call fcn.00402540
shr eax, 1
lea ecx, [eax*2 + 1]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
fild qword [esp + 4]
fdivr dword [0x46c56c]
fstp dword [esp + 0x2c]
lea edx, [eax + 1]
xor ecx, ecx
jmp 0x43996a
mov edx, eax
push 0
push dword [esp + 0x84]
push ebx
push ebp
push esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0
fild qword [esp + 0x18]
fmul dword [esp + 0x40]
fstp dword [esp + 0x30]
lea eax, [ecx + 1]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
fild qword [esp + 0x18]
fmul dword [esp + 0x40]
fst dword [esp + 0x38]
fmul dword [esp + 0x20]
fadd dword [esp + 0x74]
fstp dword [esp + 0x3c]
push dword [esp + 0x3c]
fld dword [esp + 0x3c]
fmul dword [esp + 0x28]
fadd dword [esp + 0x74]
fstp dword [esp + 0x3c]
push dword [esp + 0x3c]
fld dword [esp + 0x38]
fmul dword [esp + 0x28]
fadd dword [esp + 0x7c]
fstp dword [esp + 0x3c]
push dword [esp + 0x3c]
fld dword [esp + 0x3c]
fmul dword [esp + 0x30]
fadd dword [esp + 0x7c]
fstp dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
call fcn.0042d050
mov edx, dword [esp + 4]
mov ecx, dword [esp]
test dword [esp + 0x78], 0x7fffffff
je 0x439a6d
push 0
push dword [esp + 0x84]
push ebx
push ebp
push esi
fld dword [esp + 0x28]
fadd dword [esp + 0x3c]
sub esp, 4
fstp dword [esp]
fld dword [esp + 0x30]
fadd dword [esp + 0x3c]
sub esp, 4
fstp dword [esp]
fld dword [esp + 0x30]
fadd dword [esp + 0x3c]
sub esp, 4
fstp dword [esp]
fld dword [esp + 0x38]
fadd dword [esp + 0x3c]
sub esp, 4
fstp dword [esp]
push edi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
call fcn.0042d050
mov edx, dword [esp + 4]
mov ecx, dword [esp]
add ecx, 2
lea eax, [edx - 1]
cmp edx, 1
jne 0x439968
sub esp, 0xffffffbc
pop edi
pop esi
pop ebx
pop ebp
ret 0x2c
Function at 0x43c120
Capabilities:
Get file size

Disassembly:
push dword [esp + 0xc]
push dword [esp + 8]
call sub.KERNEL32.DLL_GetFileSize
mov ecx, dword [esp + 8]
mov dword [ecx], eax
ret 0xc

Function at 0x43c250
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push esi
push edi
add esp, 0xffffffe8
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.0041f830
test al, al
je 0x43c318
call fcn.0043c8e0
push dword [esp + 0x24]
call sub.WSOCK32.DLL_gethostbyname
test eax, eax
je 0x43c311
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x43c30a
cmp word [eax + 0xa], 4
jge 0x43c29d
mov edi, 0xffffffff
jmp 0x43c31d
push 6
push 1
push 2
mov esi, dword [ecx]
call sub.WSOCK32.DLL_socket
mov edi, eax
lea ecx, [esp + 0x10]
push ecx
push 0x8004667e
push edi
mov dword [esp + 0x1c], 1
call sub.WSOCK32.DLL_ioctlsocket
test eax, eax
je 0x43c2cf
mov edi, 0xffffffff
jmp 0x43c31d
push 0x10
push 0
lea eax, [esp + 8]
push eax
call fcn.0046896f
mov word [esp + 0xc], 2
push dword [esp + 0x20]
call sub.WSOCK32.DLL_htons
mov word [esp + 0xe], ax
push 0x10
lea ecx, [esp + 0x10]
push ecx
push edi
mov edx, dword [esi]
mov dword [esp + 0x1c], edx
call sub.WSOCK32.DLL_connect
sub esp, 0xfffffff4
jmp 0x43c31d
mov edi, 0xffffffff
jmp 0x43c31d
mov edi, 0xffffffff
jmp 0x43c31d
mov edi, 0xffffffff
mov eax, edi
sub esp, 0xffffffe8
pop edi
pop esi
ret 0x10

Function at 0x43c330
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push edi
push eax
call fcn.0043c8e0
push 0
push 2
push 2
call sub.WSOCK32.DLL_socket
mov edi, eax
cmp edi, 0xffffffff
je 0x43c36b
lea ecx, [esp]
push ecx
push 0x8004667e
push edi
mov dword [esp + 0xc], 1
call sub.WSOCK32.DLL_ioctlsocket
test eax, eax
je 0x43c370
mov edi, 0xffffffff
jmp 0x43c370
mov edi, 0xffffffff
mov eax, edi
pop ecx
pop edi
ret

Function at 0x43c3e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push edi
add esp, 0xffffffdc
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
mov dword [esp + 0x38], 0x10
call sub.WSOCK32.DLL_recvfrom
mov edi, eax
mov edx, dword [esp + 0x10]
mov dword [esp], edx
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x18]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], ecx
push dword [esp + 2]
call sub.WSOCK32.DLL_ntohs
and eax, 0xffff
mov edx, dword [esp + 0x3c]
mov dword [edx], eax
push dword [esp + 4]
call sub.WSOCK32.DLL_ntohl
mov ecx, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, edi
sub esp, 0xffffffdc
pop edi
ret 0x18
Function at 0x43c460
Capabilities:
Send data
Send data on socket

Disassembly:
add esp, 0xffffffe0
push 0x10
push 0
lea eax, [esp + 0x18]
push eax
call fcn.0046896f
mov word [esp + 0x1c], 2
push dword [esp + 0x40]
call sub.WSOCK32.DLL_htons
mov word [esp + 0x1e], ax
push dword [esp + 0x44]
call sub.WSOCK32.DLL_htonl
mov dword [esp + 0x20], eax
push 0x10
lea ecx, [esp + 0x10]
push ecx
push 0
push dword [esp + 0x48]
push dword [esp + 0x44]
push dword [esp + 0x44]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x24], edx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x30], ecx
call sub.WSOCK32.DLL_sendto
sub esp, 0xffffffd4
ret 0x18

Function at 0x43c8e0
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
mov al, byte [0x5b0ed9]
test al, al
jne 0x43c906
lea ecx, [esp]
push ecx
push 0x202
call sub.WSOCK32.DLL_WSAStartup
test eax, eax
sete byte [0x5b0ed9]
sub esp, 0xfffffe70
ret
Function at 0x43ce60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push edi
add esp, 0xfffffc14
call fcn.00440f40
push 0x101
push 0x493884
call fcn.00420b60
push 0x101
push 0x493884
call fcn.0043c040
mov edi, eax
push edi
call fcn.0043c670
test al, al
je 0x43cf0c
push 1
push 1
lea eax, [esp + 8]
push eax
push edi
mov byte [esp + 0x14], 0
call fcn.0043c0b0
mov bl, byte [esp]
cmp eax, 1
jne 0x43cf01
nop
cmp bl, 0xd
je 0x43ceea
push 1
lea eax, [esp + 4]
push eax
push 0x3e8
lea ecx, [esp + 0x10]
push ecx
call fcn.0041f450
cmp bl, 0xa
jne 0x43ceea
push 0
push 0x3e8
lea eax, [esp + 0xc]
push eax
call fcn.00442070
mov byte [esp + 4], 0
push 1
push 1
lea eax, [esp + 8]
push eax
push edi
call fcn.0043c0b0
mov bl, byte [esp]
cmp eax, 1
je 0x43ceb4
push edi
call fcn.0043c0a0
jmp 0x43cfa2
push 0x101
push 0x493884
push 0x3e8
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x6e61430a
mov dword [esp + 0x18], 0x746f6e20
mov dword [esp + 0x1c], 0x61657220
mov word [esp + 0x20], 0x2064
mov byte [esp + 0x22], 0
call fcn.0041f450
push 2
push 0x46ef84
push 0x3e8
lea ecx, [esp + 0x10]
push ecx
call fcn.0041f450
push 0x3e8
lea eax, [esp + 8]
push eax
push 0x65
push 0xa
push 6
push 0
push 0
call fcn.0043cdc0
mov cl, byte [esp + 0x3f8]
test cl, cl
je 0x43cf9b
push 0x3e8
lea eax, [esp + 8]
push eax
mov byte [0x5b0f4b], 1
call fcn.0043c780
jmp 0x43cfa2
mov byte [0x5b0f4b], 1
call fcn.0043d580
push 0x3e8
lea eax, [esp + 8]
push eax
push 0x47
call fcn.0043e900
mov cl, byte [esp + 4]
test cl, cl
jne 0x43d010
push 0xe
push str.tiles_0.25_25
push 1
push 0x47
call fcn.0043eb30
push 0x13
push str.tiles_topo_0.25_25
push 1
push 0x47
call fcn.0043eb30
push 0x17
push str.tiles_cyclemap_0.25_25
push 1
push 0x47
call fcn.0043eb30
push 0x13
push str.tiles_sat_0.45_100
push 1
push 0x47
call fcn.0043eb30
push 0x14
push str.tiles_quest_0.25_25
push 1
push 0x47
call fcn.0043eb30
push 0x3e8
lea eax, [esp + 8]
push eax
push 0x6e
call fcn.0043e900
mov cl, byte [esp + 4]
test cl, cl
jne 0x43d079
push 0x10
push str._APRST:PATHp
push 1
push 0x6e
call fcn.0043eb30
push 0x10
push str._PING_:PATHp
push 1
push 0x6e
call fcn.0043eb30
push 0xb
push str._APRSP:l
push 1
push 0x6e
call fcn.0043eb30
push 0x11
push str._VER:VERSION__v
push 1
push 0x6e
call fcn.0043eb30
push 0x20
push str._HELP:_APRST__APRSP__PING___VER
push 1
push 0x6e
call fcn.0043eb30
push 0x3e8
lea eax, [esp + 8]
push eax
push 0x5c
call fcn.0043e900
push 0x4730a4
push 0x3e8
lea ecx, [esp + 0xc]
push ecx
call fcn.00427c20
call fcn.0042c2c0
call fcn.00436e50
sub esp, 0xfffffc14
pop edi
pop ebx
ret 4