joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035beb
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006438c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10035c3b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
push 1
push 0x4a31
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.10035d92
add esp, 0x10
jmp 0x10035d81
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10035c6c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x10035d81
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], 0x1002
mov dword [ebp - 0x3c], 0x1000a7f8
cmp dword [ebp - 0x20], 0x111c
jle 0x10035d00
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
and dword [ebp - 0x18], 0
jmp 0x10035c9e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x331d
jge 0x10035cf8
and dword [ebp - 0x1c], 0
jmp 0x10035cb4
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x458e
jge 0x10035cf6
mov eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.1000dafa
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.1001b097
push eax
call fcn.1004e316
pop ecx
lea ecx, [ebp - 0x68]
call fcn.1001b08d
jmp 0x10035cad
jmp 0x10035c97
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xda5
jge 0x10035d1c
push dword [ebp - 0x3c]
call fcn.1004e316
pop ecx
jmp 0x10035d38
or dword [ebp - 4], 0xffffffff
jmp 0x10035d42
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x10035d64
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jge 0x10035d81
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.1001b386
mov dword [eax], 0x15fb57a6
jmp 0x10035d59
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038197
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006440a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100381da
push 1
push 0x481e
push 0x12d0
call fcn.100382fd
add esp, 0xc
jmp 0x100382ec
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x100381fd
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x100382ec
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0x3094
mov dword [ebp - 0x34], 0x1000aa28
cmp dword [ebp - 0x20], 0x342e
jle 0x10038295
and dword [ebp - 0x1c], 0
jmp 0x1003822d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x506e
jge 0x10038288
and dword [ebp - 0x14], 0
jmp 0x10038243
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x31f7
jge 0x10038286
and dword [ebp - 0x18], 0
jmp 0x10038259
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2925
jge 0x10038284
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov ecx, 0x1060d6f8
call fcn.1001b0b7
jmp 0x10038252
jmp 0x1003823c
jmp 0x10038226
push 0
push 0x1b30
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100382ac
push 0
push 0xd4e
call dword [sym.imp.USER32.dll_EndPaint]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2f88
jge 0x100382c6
mov edx, dword [ebp - 0x34]
mov ecx, 0x1060d6f8
call fcn.1001d5c2
jmp 0x100382e2
or dword [ebp - 4], 0xffffffff
jmp 0x100382ec
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039c13
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10039c4e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x2cb9
push 0x52f5
push 1
call fcn.10039cdf
add esp, 0x14
jmp 0x10039cdb
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10039cbd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10039c9e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10039cbb
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.1001b386
mov dword [eax], 0xdf99ff60
jmp 0x10039c93
jmp 0x10039cdb
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10039cdb
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x10045103
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10045174
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x6532
call fcn.100451e2
add esp, 0x2c
jmp 0x100451dd
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100451b4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x100451b2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x100451dd
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov esi, dword [eax]
push 1
mov ecx, dword [ebp - 0x4c]
call fcn.1001b386
mov dword [eax], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004603d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100460a2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1004607f
push 0x1074
push 0x1b26
push 0x2a1
push 0x3dc
push 0
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x100460a0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100460a0
push 0x25e3
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x100460dc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
push 0x33fc
push 0x422f
push 1
push 0x36a0
push dword [ebp - 0x14]
push 0x527a
push dword [ebp - 0x18]
push 0x5cb4
push 0x7581
call fcn.10029612
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x10046bb4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064702
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0x555f
mov dword [ebp - 0x30], 0x1000bffc
cmp dword [ebp - 0x28], 0x56fb
jle 0x10046cdc
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
and dword [ebp - 0x14], 0
jmp 0x10046c24
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xdb8
jge 0x10046cc0
and dword [ebp - 0x18], 0
jmp 0x10046c3e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2b3f
jge 0x10046cbb
and dword [ebp - 0x1c], 0
jmp 0x10046c54
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1064
jge 0x10046cb6
and dword [ebp - 0x20], 0
jmp 0x10046c6a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x29bd
jge 0x10046cb4
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x20]
xor eax, ecx
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.1000dafa
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.1001b097
push eax
call fcn.1004e316
pop ecx
lea ecx, [ebp - 0x68]
call fcn.1001b08d
jmp 0x10046c63
jmp 0x10046c4d
jmp 0x10046c37
jmp 0x10046c1d
push 0x1074
push 0x1b26
push 0x2a1
push 0x3dc
push 0
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x552b
jge 0x10046cf8
push dword [ebp - 0x30]
call fcn.1004e316
pop ecx
jmp 0x10046d14
or dword [ebp - 4], 0xffffffff
jmp 0x10046d1e
mov eax, dword [ebp - 0x24]
mov dword [eax], 8
jmp 0x10046d34
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0xfffffffe
jle 0x10046d7d
mov dword [ebp - 0x40], 0xc6c8951b
push 1
push 0x471d
push 0x552c
push 0x94f
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 1
push 0x25f9
lea eax, [ebp - 0x40]
push eax
push 0x4b21
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.1004138d
add esp, 0x34
jmp 0x10046d29
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004b2ee
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064865
call fcn.10063290
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0x4c2b
cmp dword [ebp - 0x14], 0x4f95
push edi
mov dword [ebp - 0x10], esp
jle 0x1004b346
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x1060d6f8
xor eax, esi
cdq
push edx
push eax
call fcn.1001b0b7
inc ebx
cmp ebx, 0x704a
jl 0x1004b316
inc edi
cmp edi, 0x1b04
jl 0x1004b314
inc esi
cmp esi, 0x34e6
jl 0x1004b312
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x4973
jge 0x1004b362
mov edx, 0x1000c540
mov ecx, 0x1060d6f8
call fcn.1001d5c2
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
xor edx, edx
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005f755
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006a750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100518e8
mov dword [ebp - 0x14], eax
cmp dword [0x1060e75c], esi
jne 0x1005f848
push 0x800
push esi
push 0x1000750c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1005f7d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1005f928
push esi
push esi
push 0x1000750c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1005f928
push 0x10007524
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005f928
push eax
call ebx
push 0x10007530
push edi
mov dword [0x1060e75c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007540
push edi
mov dword [0x1060e760], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007554
push edi
mov dword [0x1060e764], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060e76c], eax
test eax, eax
je 0x1005f845
push 0x10007570
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060e768], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1005f86d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1005f860
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1005f882
push 4
pop eax
jmp 0x1005f92a
cmp dword [ebp - 0x14], esi
je 0x1005f882
push dword [0x1060e75c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1005f867
mov eax, dword [0x1060e768]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1005f8e0
cmp dword [0x1060e76c], edi
je 0x1005f8e0
push eax
call ebx
push dword [0x1060e76c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1005f8e0
test eax, eax
je 0x1005f8e0
call ecx
test eax, eax
je 0x1005f8d5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1005f8d5
test byte [ebp - 8], 1
jne 0x1005f8e0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1005f910
mov eax, dword [0x1060e760]
cmp eax, edi
je 0x1005f90d
push eax
call ebx
test eax, eax
je 0x1005f90d
call eax
mov esi, eax
test esi, esi
je 0x1005f90d
mov eax, dword [0x1060e764]
cmp eax, edi
je 0x1005f90d
push eax
call ebx
test eax, eax
je 0x1005f90d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1060e75c]
call ebx
test eax, eax
je 0x1005f928
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1005f92a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004edfb
mov esp, ebp
pop ebp
ret
Function at 0xdcb67c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0xdf31fc]
test eax, eax
je 0xdcb6bb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xdcb6bb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xdcb6bb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0xdcb6bb
cmp dword [ecx + 0x74], 0xe
jbe 0xdcb6bb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x402e82
Capabilities:
Encode data using add xor sub operations

Disassembly:
jmp 0x5b0ed0
push 0xffffffffffffffff
push 0x6bf8b0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
call fcn.00406910
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [esp + 0x58]
mov dword [esp + 0x14], eax
push 4
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004064f1
push 0x1000
push 0x100
lea ecx, [esp + 0x30]
or ebx, 0xffffffff
call fcn.00405d8f
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x54], 0
call fcn.0040bb09
cmp dword [esp + 0x14], 0
mov byte [esp + 0x50], 1
mov edi, ebp
jbe 0x5b0f8c
movzx esi, byte [edi]
movzx ecx, bl
xor ecx, esi
mov eax, dword [ecx*4 + 0x7812d8]
lea edx, [esp + 0x1c]
push edx
shr ebx, 8
push esi
lea ecx, [esp + 0x30]
xor ebx, eax
call fcn.0040a73b
push esi
lea ecx, [esp + 0x2c]
call fcn.0040bece
add edi, 1
sub dword [esp + 0x14], 1
jne 0x5b0f51
mov esi, dword [esp + 0x58]
lea ecx, [esp + 0x1c]
call fcn.0040e9a8
push 4
lea eax, [esp + 0x1c]
not ebx
push eax
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.004064f1
push ebp
call fcn.00651684
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x50], 0
call fcn.0040d97c
lea ecx, [esp + 0x28]
mov dword [esp + 0x50], 0xffffffff
call fcn.00407658
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4
Function at 0x403c5b
Capabilities:
Set socket configuration

Disassembly:
jmp 0x49d860
push 0xffffffffffffffff
push 0x6a2c61
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x774458]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x74]
mov esi, dword [esp + 0x78]
lea eax, [esp + 0x1c]
xor edi, edi
push eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], edi
call fcn.00406f00
add esp, 4
cmp esi, edi
mov dword [esp + 0x6c], 1
je 0x49d8c5
push esi
call sub.WSOCK32.dll_inet_addr
mov edi, eax
mov ebx, dword [esp + 0x7c]
push ebx
mov word [esp + 0x54], 2
call sub.WSOCK32.dll_htons
mov edx, dword [esp + 0x40]
push 0x10
lea ecx, [esp + 0x54]
push ecx
push edx
mov word [esp + 0x5e], ax
mov dword [esp + 0x60], edi
call sub.WSOCK32.dll_connect
test eax, eax
je 0x49d94b
lea eax, [esp + 0x34]
push eax
call fcn.004033af
add esp, 4
mov dword [0x754830], 0xfffffff6
push 0
mov ecx, ebp
call fcn.0040a46b
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x6c], 0
call fcn.004091b5
mov eax, ebp
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00651675
add esp, 0x5c
ret
test esi, esi
je 0x49d959
push esi
call sub.WSOCK32.dll_inet_addr
mov esi, eax
jmp 0x49d95b
xor esi, esi
add ebx, 1
push ebx
mov word [esp + 0x54], 2
call sub.WSOCK32.dll_htons
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x20]
push edx
mov word [esp + 0x5a], ax
mov dword [esp + 0x5c], esi
call fcn.004098f4
add esp, 8
test eax, eax
je 0x49d90b
mov ecx, 0xd
lea esi, [esp + 0x1c]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
jmp 0x49d914
Function at 0x404728
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x47e500
push 0xffffffffffffffff
push 0x6a12e8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], vtable.ClassPSystem.0
call fcn.004098fe
mov eax, dword [esp + 0x38]
push eax
mov ecx, esi
call fcn.0040848b
fldz
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov dword [esi], vtable.ClassFireBolt.0
xor edi, edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov eax, 1
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x44], ecx
fst dword [esi + 0x48]
fld dword [0x6ddfb4]
push str.FIREBOLT
fstp dword [esi + 0x4c]
lea ecx, [esi + 0x78]
mov dword [esp + 0x34], edi
fst dword [esi + 0x54]
fst dword [esi + 0x50]
fst dword [esi + 0x5c]
fstp dword [esi + 0x58]
mov dword [esi + 0x64], edx
mov dword [esi + 0x68], eax
call fcn.0040a123
lea ebx, [esi + 0x7c]
mov ecx, esi
mov dword [ebx], vtable.sParticleColTab.0
call fcn.00405380
push edi
push edi
mov ecx, esi
call fcn.0040ca7c
mov edi, dword [esp + 0x3c]
mov dword [esi + 8], 3
movzx edx, word [edi]
movzx ecx, word [edi + 2]
movzx eax, word [edi + 4]
mov ebp, edx
or ebp, ecx
or ebp, eax
test bp, bp
jne 0x47e60b
lea ecx, [esp + 0x1a]
push ecx
lea edx, [esp + 0x24]
mov word [esp + 0x1e], 0xff
mov word [esp + 0x20], 0x6c
mov word [esp + 0x22], bp
mov word [esp + 0x24], 0xf6
mov word [esp + 0x26], 0xf3
mov word [esp + 0x28], 0xb4
push edx
jmp 0x47e656
mov word [esp + 0x22], cx
mov word [esp + 0x24], ax
mov word [esp + 0x20], dx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x22]
lea ecx, [eax + eax]
mov word [esp + 0x20], cx
mov ecx, dword [esp + 0x24]
lea eax, [edx + edx]
lea edx, [ecx + ecx]
lea ecx, [esp + 0x20]
mov word [esp + 0x22], ax
mov word [esp + 0x24], dx
call fcn.0040db43
lea ecx, [esp + 0x20]
call fcn.0040db43
lea eax, [esp + 0x20]
push eax
push edi
mov ecx, ebx
call fcn.0040a87b
mov eax, esi
mov dword [esi + 0x1c], 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x14
Function at 0x405240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x499850
push 0xffffffffffffffff
push 0x6a29eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
test eax, eax
jle 0x49992f
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x3c]
add esi, 0xc
mov dword [esp + 0x34], eax
push 0x44
call fcn.00651953
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x24], 0
je 0x4998e4
mov ecx, dword [esp + 0x2c]
mov edi, dword [esi + 0x60]
add edi, dword [esp + 0x38]
push 0
push 0xffffffffffffffff
push ecx
lea edx, [esi + 0x20]
push edx
mov edx, dword [esi + 0x64]
push 0
push 0
push 0
push esi
sub esp, 8
mov ebp, esp
add edx, ebx
mov ecx, eax
mov dword [esp + 0x40], esp
mov dword [ebp], edi
mov dword [ebp + 4], edx
call fcn.00406f05
jmp 0x4998e6
xor eax, eax
test eax, eax
mov dword [esp + 0x24], 0xffffffff
mov dword [esi + 0x7c], eax
je 0x49991e
cmp byte [esi + 0x70], 0
lea eax, [esi + 0x70]
je 0x49991e
mov ecx, dword [0x7b72f8]
push eax
call fcn.00621ca0
mov ecx, dword [esi + 0x7c]
push eax
mov dword [esi + 0x78], eax
call fcn.00403d9b
mov eax, dword [esi + 0x7c]
mov ecx, dword [eax]
mov dword [esi - 4], ecx
add esi, 0x9c
sub dword [esp + 0x34], 1
jne 0x499892
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x40622b
Capabilities:
Get number of processors

Disassembly:
jmp 0x4a2260
push 0xffffffffffffffff
push 0x6a2f78
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x774458]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x7c]
mov esi, ecx
mov ecx, dword [esp + 0x80]
push ecx
push eax
lea eax, [esp + 0x30]
push str._s___.CARISMA_0__s__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0xc]
call fcn.004024af
lea edx, [esp + 8]
push edx
push str.ACCIONES
add esi, 0x30
push esi
mov dword [esp + 0x80], 0
call fcn.0040d026
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x74], 0xffffffff
call fcn.0040934a
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00651675
add esp, 0x70
ret 8