joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460cb0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x460d88
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x498ccc], 0
jne 0x460d6c
lea eax, [ebp - 4]
mov edx, 0x460da0
call fcn.00404960
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d78
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x460d6c
mov eax, ebx
call fcn.00402790
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x460d65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x460d4f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x460db0
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x460d4f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x498ccc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460d6c
mov eax, dword [ebp - 0xc]
call fcn.004027b0
ret
mov ebx, dword [0x498ccc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460d8f
lea eax, [ebp - 4]
call fcn.004048c8
ret

Function at 0x467bec
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x498cf0], 0
jne 0x467c0f
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x467b60
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x498cf0], eax
ret
Function at 0x40d5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10d8
call fcn.00475550
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10d8]
mov ecx, 0x436
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x513690]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov dword [eax], vtable.cAESFile.0
mov byte [ebp - 0x1014], 0x58
mov byte [ebp - 0x1013], 0x21
mov byte [ebp - 0x1012], 0x5e
mov byte [ebp - 0x1011], 0x61
mov byte [ebp - 0x1010], 0x73
mov byte [ebp - 0x100f], 0x69
mov byte [ebp - 0x100e], 0x72
mov byte [ebp - 0x100d], 0x66
mov byte [ebp - 0x100c], 0x31
mov byte [ebp - 0x100b], 0x5e
mov byte [ebp - 0x100a], 0x23
mov byte [ebp - 0x1009], 0x58
mov byte [ebp - 0x1008], 0x38
mov byte [ebp - 0x1007], 0x30
mov byte [ebp - 0x1006], 0x6f
mov byte [ebp - 0x1005], 0x69
mov byte [ebp - 0x1004], 0x5b
mov byte [ebp - 0x1003], 0x73
mov byte [ebp - 0x1002], 0x64
mov byte [ebp - 0x1001], 0x66
mov byte [ebp - 0x1000], 0x67
mov byte [ebp - 0xfff], 0x38
mov byte [ebp - 0xffe], 0x39
mov byte [ebp - 0xffd], 0x70
mov byte [ebp - 0xffc], 0x6f
mov byte [ebp - 0xffb], 0x61
mov byte [ebp - 0xffa], 0x38
mov byte [ebp - 0xff9], 0x61
mov byte [ebp - 0xff8], 0x62
mov byte [ebp - 0xff7], 0x21
mov byte [ebp - 0xff6], 0x40
mov byte [ebp - 0xff5], 0x25
mov byte [ebp - 0xff4], 0x51
mov byte [ebp - 0xff3], 0x54
mov byte [ebp - 0xff2], 0x51
mov byte [ebp - 0xff1], 0x67
mov byte [ebp - 0xff0], 0x73
mov byte [ebp - 0xfef], 0x64
mov byte [ebp - 0xfee], 0x67
mov byte [ebp - 0xfed], 0x51
mov byte [ebp - 0xfec], 0x45
mov byte [ebp - 0xfeb], 0x54
mov byte [ebp - 0xfea], 0x59
mov byte [ebp - 0xfe9], 0x51
mov byte [ebp - 0xfe8], 0x66
mov byte [ebp - 0xfe7], 0x61
mov byte [ebp - 0xfe6], 0x31
mov byte [ebp - 0xfe5], 0x32
mov byte [ebp - 0xfe4], 0x34
mov byte [ebp - 0xfe3], 0x30
mov byte [ebp - 0xfe2], 0x2a
mov byte [ebp - 0xfe1], 0x2f
mov byte [ebp - 0xfe0], 0
push 0xfcb
push 0
lea eax, [ebp - 0xfdf]
push eax
call fcn.00472c50
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4f117c]
mov dword [edx + 0xc], eax
push 0x1000
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x1010
push ecx
call fcn.00472600
add esp, 0xc
mov eax, dword [ebp - 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x40d7d0]
call fcn.00474e50
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474ee0
add esp, 0x10d8
cmp ebp, esp
call fcn.00474eb0
mov esp, ebp
pop ebp
ret
Function at 0x40e920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10e4
call fcn.00475550
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10e4]
mov ecx, 0x439
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x513690]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x1014], 0x58
mov byte [ebp - 0x1013], 0x21
mov byte [ebp - 0x1012], 0x5e
mov byte [ebp - 0x1011], 0x61
mov byte [ebp - 0x1010], 0x73
mov byte [ebp - 0x100f], 0x69
mov byte [ebp - 0x100e], 0x72
mov byte [ebp - 0x100d], 0x66
mov byte [ebp - 0x100c], 0x31
mov byte [ebp - 0x100b], 0x5e
mov byte [ebp - 0x100a], 0x23
mov byte [ebp - 0x1009], 0x58
mov byte [ebp - 0x1008], 0x38
mov byte [ebp - 0x1007], 0x30
mov byte [ebp - 0x1006], 0x6f
mov byte [ebp - 0x1005], 0x69
mov byte [ebp - 0x1004], 0x5b
mov byte [ebp - 0x1003], 0x73
mov byte [ebp - 0x1002], 0x64
mov byte [ebp - 0x1001], 0x66
mov byte [ebp - 0x1000], 0x67
mov byte [ebp - 0xfff], 0x38
mov byte [ebp - 0xffe], 0x39
mov byte [ebp - 0xffd], 0x70
mov byte [ebp - 0xffc], 0x6f
mov byte [ebp - 0xffb], 0x61
mov byte [ebp - 0xffa], 0x38
mov byte [ebp - 0xff9], 0x61
mov byte [ebp - 0xff8], 0x62
mov byte [ebp - 0xff7], 0x21
mov byte [ebp - 0xff6], 0x40
mov byte [ebp - 0xff5], 0x25
mov byte [ebp - 0xff4], 0x51
mov byte [ebp - 0xff3], 0x54
mov byte [ebp - 0xff2], 0x51
mov byte [ebp - 0xff1], 0x67
mov byte [ebp - 0xff0], 0x73
mov byte [ebp - 0xfef], 0x64
mov byte [ebp - 0xfee], 0x67
mov byte [ebp - 0xfed], 0x51
mov byte [ebp - 0xfec], 0x45
mov byte [ebp - 0xfeb], 0x54
mov byte [ebp - 0xfea], 0x59
mov byte [ebp - 0xfe9], 0x51
mov byte [ebp - 0xfe8], 0x66
mov byte [ebp - 0xfe7], 0x61
mov byte [ebp - 0xfe6], 0x31
mov byte [ebp - 0xfe5], 0x32
mov byte [ebp - 0xfe4], 0x34
mov byte [ebp - 0xfe3], 0x30
mov byte [ebp - 0xfe2], 0x2a
mov byte [ebp - 0xfe1], 0x2f
mov byte [ebp - 0xfe0], 0
push 0xfcb
push 0
lea eax, [ebp - 0xfdf]
push eax
call fcn.00472c50
add esp, 0xc
mov dword [ebp - 0x1020], 0
jmp 0x40eaf5
mov eax, dword [ebp - 0x1020]
add eax, 1
mov dword [ebp - 0x1020], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1020]
cmp ecx, dword [eax + 4]
jge 0x40eb4c
mov eax, dword [ebp - 0x1020]
mov ecx, dword [eax*4 + 0x4f1180]
cmp ecx, dword [ebp + 8]
jne 0x40eb4a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1020]
mov edx, dword [ecx*4 + 0x4f1180]
mov dword [eax + 8], edx
push 0x1000
lea eax, [ebp - 0x1014]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x10
push ecx
call fcn.00472600
add esp, 0xc
mov eax, 1
jmp 0x40eb4e
jmp 0x40eae6
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x40eb80]
call fcn.00474e50
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474ee0
add esp, 0x10e4
cmp ebp, esp
call fcn.00474eb0
mov esp, ebp
pop ebp
ret 4
Function at 0x416d50
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b8
push ebx
push esi
push edi
lea edi, [ebp - 0x3b8]
mov ecx, 0xee
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x513690]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5181d0], 0
je 0x416dd1
mov esi, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.ASSERT___file:_s_line:_d___s__do_you_debug_
push 0x5181d8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
cmp esi, esp
call fcn.00474eb0
mov esi, esp
push 0x40004
push 0
push 0x5181d8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00474eb0
cmp eax, 6
jne 0x416dcc
int3
jmp 0x416f80
cmp dword [ebp + 0x10], 0
je 0x416df9
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_line:_d__msg:_s_
lea eax, [ebp - 0x108]
push eax
call fcn.00476c40
add esp, 0x14
jmp 0x416e15
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_line:_d_
lea edx, [ebp - 0x108]
push edx
call fcn.00476c40
add esp, 0x10
mov byte [ebp - 0x228], 0
push 0xff
push 0
lea eax, [ebp - 0x227]
push eax
call fcn.00472c50
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp esi, esp
call fcn.00474eb0
movzx eax, word [ebp - 0x11a]
push eax
movzx ecx, word [ebp - 0x11e]
push ecx
movzx edx, word [ebp - 0x120]
push edx
push str.._Log_Assert__4d_02d_02d.txt
lea eax, [ebp - 0x228]
push eax
call fcn.00476c40
add esp, 0x14
cmp dword [0x5182d8], 0
jne 0x416f80
mov esi, esp
push 0
lea eax, [ebp - 0x2e8]
push eax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp esi, esp
call fcn.00474eb0
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0xffffffff
jne 0x416f1a
mov esi, esp
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00474eb0
push 0x4f17cc
lea eax, [ebp - 0x228]
push eax
call fcn.004769a0
add esp, 8
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0
je 0x416f18
call fcn.00402c9d
push eax
lea eax, [ebp - 0x108]
push eax
push str._stime:_s_n
mov ecx, dword [ebp - 0x2f4]
push ecx
call fcn.00473730
add esp, 0x10
mov eax, dword [ebp - 0x2f4]
push eax
call fcn.00476630
add esp, 4
jmp 0x416f80
mov esi, esp
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp esi, esp
call fcn.00474eb0
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x24c]
shl eax, 0x10
or eax, dword [ebp - 0x240]
mov dword [ebp - 0x234], eax
mov esi, esp
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00474eb0
cmp dword [ebp - 0x234], 0xf4240
ja 0x416f76
jmp 0x416f80
mov dword [0x5182d8], 1
push edx
mov ecx, ebp
push eax
lea edx, [0x416fb0]
call fcn.00474e50
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474ee0
add esp, 0x3b8
cmp ebp, esp
call fcn.00474eb0
mov esp, ebp
pop ebp
ret
Function at 0x4170d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
push ebx
push esi
push edi
lea edi, [ebp - 0x4c4]
mov ecx, 0x131
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x513690]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x208], 0
push 0x1ff
push 0
lea eax, [ebp - 0x207]
push eax
call fcn.00472c50
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x41713d
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_line:_d__msg:_s_
lea eax, [ebp - 0x208]
push eax
call fcn.00476c40
add esp, 0x14
jmp 0x417159
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_line:_d_
lea edx, [ebp - 0x208]
push edx
call fcn.00476c40
add esp, 0x10
mov byte [ebp - 0x328], 0
push 0xff
push 0
lea eax, [ebp - 0x327]
push eax
call fcn.00472c50
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp esi, esp
call fcn.00474eb0
movzx eax, word [ebp - 0x21a]
push eax
movzx ecx, word [ebp - 0x21e]
push ecx
movzx edx, word [ebp - 0x220]
push edx
push str.._Log_Debug__4d_02d_02d.txt
lea eax, [ebp - 0x328]
push eax
call fcn.00476c40
add esp, 0x14
cmp dword [0x5181d4], 0
jne 0x41731a
mov esi, esp
push 0
lea eax, [ebp - 0x3e8]
push eax
lea ecx, [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp esi, esp
call fcn.00474eb0
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0xffffffff
jne 0x417261
mov esi, esp
mov eax, dword [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00474eb0
push 0x4f17cc
lea eax, [ebp - 0x328]
push eax
call fcn.004769a0
add esp, 8
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
je 0x41725c
call fcn.00402c9d
push eax
lea eax, [ebp - 0x208]
push eax
push str._stime:_s_n
mov ecx, dword [ebp - 0x3f4]
push ecx
call fcn.00473730
add esp, 0x10
mov eax, dword [ebp - 0x3f4]
push eax
call fcn.00476630
add esp, 4
jmp 0x41731a
mov esi, esp
lea eax, [ebp - 0x34c]
push eax
mov ecx, dword [ebp - 0x358]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp esi, esp
call fcn.00474eb0
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x34c]
shl eax, 0x10
or eax, dword [ebp - 0x340]
mov dword [ebp - 0x334], eax
mov esi, esp
mov eax, dword [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00474eb0
cmp dword [ebp - 0x334], 0xf4240
ja 0x417310
push 0x4f17cc
lea eax, [ebp - 0x328]
push eax
call fcn.004769a0
add esp, 8
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0
je 0x41730e
call fcn.00402c9d
push eax
lea eax, [ebp - 0x208]
push eax
push str._stime:_s_n
mov ecx, dword [ebp - 0x400]
push ecx
call fcn.00473730
add esp, 0x10
mov eax, dword [ebp - 0x400]
push eax
call fcn.00476630
add esp, 4
jmp 0x41731a
mov dword [0x5181d4], 1
push edx
mov ecx, ebp
push eax
lea edx, [0x41734c]
call fcn.00474e50
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474ee0
add esp, 0x4c4
cmp ebp, esp
call fcn.00474eb0
mov esp, ebp
pop ebp
ret
Function at 0x41b8b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x200]
mov ecx, 0x80
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x513690]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
push 0x4f1f80
push str.serverset.txt
call fcn.004769a0
add esp, 8
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x41b924
mov esi, esp
push 0
push 0
push str.serverset.txt
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00474eb0
push 0
call fcn.00478a50
jmp 0x41ba27
lea eax, [ebp - 0x12c]
push eax
push 0x4f1f70
mov ecx, dword [ebp - 0x120]
push ecx
call fcn.00478ad0
add esp, 0xc
mov eax, dword [ebp - 0x120]
push eax
call fcn.00476630
add esp, 4
mov eax, dword [ebp - 0x12c]
push eax
push str.serverset__d_serverlist.msl
lea ecx, [ebp - 0x114]
push ecx
call fcn.00476c40
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov ecx, 0x51f220
call fcn.00402a9a
mov eax, dword [ebp - 0x12c]
push eax
push str.serverset__d_serverlist_Public.msl
lea ecx, [ebp - 0x114]
push ecx
call fcn.00476c40
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov ecx, 0x51f220
call fcn.00402482
mov ecx, dword [ebp - 0xc]
call fcn.00402ac7
test eax, eax
jne 0x41b9bc
mov dword [0x531d24], 1
mov eax, dword [0x531d24]
cmp eax, dword [ebp - 0x12c]
jne 0x41b9d5
mov dword [ebp - 0x200], 1
jmp 0x41b9df
mov dword [ebp - 0x200], 0
cmp dword [ebp - 0x200], 0
jne 0x41ba00
push 0
mov eax, dword [0x5131f4]
add eax, 0x1b
push eax
push str.f:_source_cc_servermodule_bootmanager.cpp
call fcn.00402d06
add esp, 0xc
movzx eax, word [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.00402d24
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004017b2
push edx
mov ecx, ebp
push eax
lea edx, [0x41ba58]
call fcn.00474e50
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474ee0
add esp, 0x200
cmp ebp, esp
call fcn.00474eb0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4233b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x4f4]
mov ecx, 0x13d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x513690]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0xc], 0x400
jg 0x4233f2
mov dword [ebp - 0x4f4], 1
jmp 0x4233fc
mov dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0
jne 0x42341d
push 0
mov eax, dword [0x513260]
add eax, 3
push eax
push str.f:_source_cc_servermodule_serverlistmanager.cpp
call fcn.00402d06
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x414]
push edx
call fcn.00472600
add esp, 0xc
mov dword [ebp - 0x420], 0
jmp 0x42345e
mov eax, dword [ebp - 0x420]
add eax, 1
mov dword [ebp - 0x420], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
add edx, 1
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x420]
cmp eax, dword [ebp + 0xc]
jge 0x4234b0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 4]
cmp edx, dword [ecx + 0xc]
jne 0x423481
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
movsx ecx, byte [eax + ecx]
mov edx, dword [ebp - 0x420]
movsx eax, byte [ebp + edx - 0x414]
add eax, ecx
mov ecx, dword [ebp - 0x420]
mov byte [ebp + ecx - 0x414], al
jmp 0x423440
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.00474880
add esp, 0x10
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 1
jne 0x4234e6
mov dword [ebp - 0x4f4], 1
jmp 0x4234f0
mov dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0
jne 0x423511
push 0
mov eax, dword [0x513260]
add eax, 0xe
push eax
push str.f:_source_cc_servermodule_serverlistmanager.cpp
call fcn.00402d06
add esp, 0xc
cmp dword [ebp - 0x42c], 1
jne 0x423526
mov dword [ebp - 0x4f4], 1
jmp 0x423530
mov dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
push edx
mov ecx, ebp
push eax
lea edx, [0x423568]
call fcn.00474e50
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00474ee0
add esp, 0x4f4
cmp ebp, esp
call fcn.00474eb0
mov esp, ebp
pop ebp
ret 8
Function at 0x401b9f
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
lea eax, [ebx + 0xfc]
mov ecx, dword [eax]
test ecx, ecx
push esi
push edi
jne 0x401bfb
mov ecx, dword [ebx + 0xf4]
test ecx, ecx
mov dword [eax], 1
je 0x401bcb
mov eax, dword [ecx]
call dword [eax + 0x6c]
mov eax, ebx
xor esi, esi
call fcn.00410b20
test eax, eax
jbe 0x401bfb
mov edi, ebx
call fcn.00401ddb
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x401bef
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x6c]
mov eax, ebx
inc esi
call fcn.00410b20
cmp esi, eax
jb 0x401bd8
mov eax, ebx
xor esi, esi
call fcn.00410b20
test eax, eax
jbe 0x401c38
mov edi, ebx
call fcn.00401ddb
mov edi, dword [eax]
test edi, edi
je 0x401c2c
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x401c25
mov eax, dword [ecx]
call dword [eax + 8]
and dword [edi + 0x20], 0
push edi
call fcn.00434443
pop ecx
mov eax, ebx
inc esi
call fcn.00410b20
cmp esi, eax
jb 0x401c08
mov esi, ebx
call fcn.00401df2
lea esi, [ebx + 0x60]
call fcn.0042cb20
lea eax, [ebx + 0x7c]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
mov eax, dword [eax + 4]
lea edi, [esp + 0x18]
lea esi, [esp + 0x10]
mov dword [esp + 0x1c], eax
call fcn.0040efac
test al, al
jne 0x401cbb
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x401c84
call fcn.00434d0f
mov esi, dword [esp + 0x14]
cmp esi, dword [edi + 4]
jne 0x401c92
call fcn.00434d0f
push dword [esi + 0xc]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
je 0x401cac
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea esi, [esp + 0x10]
call fcn.0040ab73
mov eax, dword [esp + 0xc]
jmp 0x401c5f
lea esi, [ebx + 0x60]
call fcn.0042cb20
lea esi, [ebx + 0x2c]
call fcn.0042cf20
mov edi, dword [esp + 0xc]
call fcn.00401e3a
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4032d5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4032ec
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x403321
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x40331d
cmp edi, eax
jae 0x403321
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40330f
cmp edi, eax
jb 0x403325
xor eax, eax
jmp 0x40332f
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x4047f1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push 0x3c
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.00434800
add esp, 0xc
lea esi, [ebp - 4]
call fcn.00426770
mov eax, dword [ebp - 4]
and dword [ebp - 0x3c], 0
and dword [ebp - 0x38], 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x34], str.runas
mov dword [ebp - 0x28], 0x453370
mov dword [ebp - 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00402f9a
pop esi
leave
ret 4

Function at 0x404e4d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404eb0
cmp dword [ebp + 0xc], 1
je 0x404e89
cmp dword [ebp + 0xc], 2
je 0x404e89
push 0xd
pop eax
jmp 0x404eb0
test edi, edi
mov eax, dword [ebp - 4]
je 0x404eaa
test eax, eax
je 0x404ea6
test al, 1
jne 0x404e84
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x404eaa
jmp 0x404e84
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8

Function at 0x404f7d
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, eax
and dword [esi + 0x90], 0
and dword [esi + 0x94], 0
push 0x40
push 0
push esi
mov dword [esi + 0x80], 0x67452301
mov dword [esi + 0x84], 0xefcdab89
mov dword [esi + 0x88], 0x98badcfe
mov dword [esi + 0x8c], 0x10325476
call fcn.00434800
push 0x40
add esi, 0x40
push 0
push esi
call fcn.00434800
add esp, 0x18
mov byte [esi], 0x80
pop esi
ret
Function at 0x405fc0
Capabilities:
Terminate process

Disassembly:
push 0x14
mov eax, 0x44d1dc
call fcn.00439907
xor edi, edi
cmp dword [esi + 0x44c], edi
je 0x40607c
mov dword [esi + 0x9f0], 1
mov eax, dword [0x45fb34]
mov ecx, 0x45fb34
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.004060c8
cmp eax, edi
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
je 0x406072
push edi
push eax
push ecx
lea eax, [ebx - 0x10]
mov dword [ebp - 0x1c], esp
mov edi, esp
call fcn.00402e21
add eax, 0x10
mov dword [edi], eax
push dword [esi + 0x9fc]
lea eax, [ebp - 0xd]
push dword [esi + 0x9f8]
push dword [esi + 0x9f4]
push dword [esi + 0x9f0]
push eax
call fcn.004111bb
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0xa30]
call fcn.0040a5ce
push 0x10
push 0
push dword [eax]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebx - 0x10]
call fcn.00402f9a
jmp 0x4060c2
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
mov ecx, 0x453370
mov dword [esi + 0x9f0], 2
call fcn.00403216
mov ecx, esi
call fcn.004082e9
cmp eax, edi
jne 0x4060c2
push 0x10
push edi
push 0x453548
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.004399a6
ret
Function at 0x408e53
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x45e0a0]
xor eax, ebp
mov dword [ebp + 0x94], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x408e94
cmp dword [ebp - 0x70], 2
jne 0x408e94
cmp dword [ebp - 0x7c], 6
jb 0x408e94
xor eax, eax
inc eax
jmp 0x408e96
xor eax, eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.004347e5
add ebp, 0x98
leave
ret