joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10120630
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, 0x98
call fcn.100a7a90
mov eax, dword [0x101e3070]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa8]
push edi
mov edi, dword [esp + 0xa0]
mov dword [esp + 4], edi
mov eax, dword [ecx]
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x6c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x74], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x78], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x80], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x84], eax
mov dword [esp + 0x58], 0x61707865
mov dword [esp + 0x5c], 0x3320646e
mov eax, dword [ecx]
mov dword [esp + 0x88], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x8c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x90], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x60], 0x79622d32
mov dword [esp + 0x64], 0x6b206574
test eax, eax
je 0x1012082d
push ebx
mov ebx, dword [esp + 0xa8]
push ebp
push esi
nop
mov esi, 0x40
cmp eax, esi
cmovb esi, eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], esi
push eax
call fcn.10120850
add esp, 8
xor eax, eax
test esi, esi
je 0x101207fc
cmp esi, 0x20
jb 0x101207d4
lea edx, [edi - 1]
lea ecx, [esp + esi + 0x23]
add edx, esi
cmp edi, ecx
ja 0x1012074c
lea ecx, [esp + 0x24]
cmp edx, ecx
jae 0x101207d4
lea ecx, [ebx - 1]
add ecx, esi
cmp edi, ecx
ja 0x10120759
cmp edx, ebx
jae 0x101207d4
mov ebp, esi
lea edx, [edi + 0x10]
lea esi, [esp + 0x24]
mov ecx, ebx
sub ecx, esi
and ebp, 0xffffffe0
mov dword [esp + 0x14], ecx
mov ecx, edi
sub ecx, esi
mov dword [esp + 0x18], ecx
mov ecx, ebx
mov ebx, dword [esp + 0x14]
sub ecx, edi
mov esi, dword [esp + 0x18]
mov edi, ecx
mov dword [esp + 0x1c], ecx
nop word [eax + eax]
movups xmm0, xmmword [esp + eax + 0x24]
lea ecx, [ebx + eax]
movups xmm1, xmmword [esp + ecx + 0x24]
lea ecx, [esi + eax]
lea edx, [edx + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x34]
add eax, 0x20
movups xmmword [esp + ecx + 0x24], xmm1
movups xmm1, xmmword [edi + edx - 0x20]
pxor xmm1, xmm0
movups xmmword [edx - 0x20], xmm1
cmp eax, ebp
jb 0x10120790
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0xb0]
cmp eax, esi
jae 0x101207fc
lea ecx, [esp + 0x24]
mov ebp, edi
sub ebx, ecx
sub ebp, ecx
lea edx, [esp + 0x24]
add edx, eax
inc eax
mov cl, byte [ebx + edx]
xor cl, byte [edx]
mov byte [edx + ebp], cl
cmp eax, esi
jb 0x101207e2
mov ebx, dword [esp + 0xb0]
mov eax, dword [esp + 0xb4]
add edi, esi
inc dword [esp + 0x94]
sub eax, esi
add ebx, esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], eax
test eax, eax
jne 0x10120700
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
pop edi
xor ecx, esp
call fcn.100a66bf
add esp, 0x98
ret
Function at 0x10123930
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x10123944
mov dword [esp + 0x18], fcn.10122110
jmp fcn.100baa60
mov dword [esp + 0x18], fcn.101213b0
jmp fcn.100ba7b0
Function at 0x101346b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.100a7a90
mov eax, dword [0x101e3070]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x10134716
cmp edi, dword [esi]
je 0x1013470d
test ebp, ebp
je 0x10134790
test ebx, ebx
js 0x10134790
mov eax, 1
mov dword [esi], edi
jmp 0x1013471c
mov edi, dword [esi]
test edi, edi
je 0x10134790
test ebp, ebp
je 0x101348aa
push edi
call fcn.100b4890
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x10134750
push 0x28
push str.cryptohmachmac.c
push str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.100ac610
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x101347ab
push dword [esp + 0x10]
push edi
push dword [esi + 4]
call fcn.100dd720
add esp, 0xc
test eax, eax
je 0x10134790
push ebx
push ebp
push dword [esi + 4]
call fcn.100dd8d0
add esp, 0xc
test eax, eax
je 0x10134790
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.100dd6a0
add esp, 0xc
test eax, eax
jne 0x101347c7
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100a66bf
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x10134790
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call fcn.101544a0
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x101347ea
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call fcn.10154a20
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x101347f0
push edx
push edi
push dword [esi + 8]
call fcn.100dd720
add esp, 0xc
test eax, eax
je 0x10134790
push edi
call fcn.100b4890
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.100dd8d0
add esp, 0x10
test eax, eax
je 0x10134790
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x10134840
push dword [esp + 0x10]
push edi
push dword [esi + 0xc]
call fcn.100dd720
add esp, 0xc
test eax, eax
je 0x10134790
push edi
call fcn.100b4890
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.100dd8d0
add esp, 0x10
test eax, eax
je 0x10134790
push dword [esi + 8]
push dword [esi + 4]
call fcn.100dd8e0
add esp, 8
test eax, eax
je 0x10134790
mov eax, 1
jmp 0x10134792
test eax, eax
je 0x1013488a
jmp 0x101347ee
Function at 0x1013d22b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1016fc1e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1016fa9d

Function at 0x1017410d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10173dcd
Function at 0x687c3240
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x1c
and edx, 1
mov edi, dword [ebp + 8]
je 0x687c3270
mov edx, dword [eax + 0x38]
test edx, edx
jne 0x687c32c0
test esi, esi
je 0x687c3266
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x38], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [eax + 0x40]
test eax, eax
jne 0x687c3300
test esi, esi
je 0x687c3266
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
mov dword [ebx + 0x3c], eax
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
mov dword [ebx + 0x40], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebx + 0x34]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
sub esp, 0xc
jmp 0x687c325c
mov edx, dword [ebx + 0x3c]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
sub esp, 0xc
test esi, esi
je 0x687c3266
jmp 0x687c327f

Function at 0x687c3350
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x1c
and edx, 1
mov edi, dword [ebp + 8]
je 0x687c3380
mov edx, dword [eax + 0x20]
test edx, edx
jne 0x687c33d0
test esi, esi
je 0x687c3376
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [eax + 0x28]
test eax, eax
jne 0x687c3410
test esi, esi
je 0x687c3376
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
mov dword [ebx + 0x24], eax
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
mov dword [ebx + 0x28], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebx + 0x1c]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
sub esp, 0xc
jmp 0x687c336c
mov edx, dword [ebx + 0x24]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
sub esp, 0xc
test esi, esi
je 0x687c3376
jmp 0x687c338f
Function at 0x687c34c0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, edx
mov esi, dword fs:[0x18]
sub esp, 0x10
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x687c4080
Capabilities:
Get process heap flags
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x20
mov eax, dword [eax + 0x54]
mov edx, dword [eax + 4]
cmp edx, 0xffffffff
je 0x687c40bc
mov dword [esp], edx
mov dword [esp + 4], 0
call sub.kernel32.dll_TerminateThread
mov eax, dword [ebx + 0x54]
sub esp, 8
mov eax, dword [eax + 4]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebx + 0x54]
sub esp, 4
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx + 0x48]
test edx, edx
je 0x687c4218
test byte [0x687da03c], 8
jne 0x687c41e0
mov eax, dword [eax + 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
mov dword [esp], eax
call edx
mov eax, dword [ebx + 0x54]
sub esp, 4
mov edx, dword [eax + 0x70]
test edx, edx
je 0x687c4100
mov dword [esp], edx
call sub.kernel32.dll_FreeLibrary
mov eax, dword [ebx + 0x54]
sub esp, 4
mov edx, dword [eax + 0x74]
test edx, edx
je 0x687c4115
mov dword [esp], edx
call sub.kernel32.dll_FreeLibrary
mov eax, dword [ebx + 0x54]
sub esp, 4
mov eax, dword [eax + 0x10]
mov esi, dword fs:[0x18]
mov dword [esp], eax
call fcn.687d8120
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x5c]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov eax, dword [ebx + 0x54]
sub esp, 0xc
mov eax, dword [eax + 0x1c]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov eax, dword [ebx + 0x54]
sub esp, 0xc
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebx + 0x54]
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov eax, dword [ebx + 0x3c]
sub esp, 0xc
mov dword [eax + 0x18], 0
lea eax, [ebx + 0x3c]
mov dword [esp], eax
call sub.kernel32.dll_DeleteCriticalSection
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0xc], str.Calling_SP_ShutdownEx_n
mov dword [esp + 8], str.DP_DestroyDirectPlay2
mov dword [esp + 4], 0x687da03c
mov dword [esp], 3
call fcn.687c3970
mov eax, dword [ebx + 0x54]
mov edx, dword [eax + 0x30]
mov edx, dword [edx + 0x48]
jmp 0x687c40d7
mov edx, dword [ecx + 0x40]
test edx, edx
je 0x687c40eb
test byte [0x687da03c], 8
jne 0x687c4240
call edx
mov eax, dword [ebx + 0x54]
jmp 0x687c40eb
mov dword [esp + 0xc], str.Calling_obsolete_SP_Shutdown_n
mov dword [esp + 8], str.DP_DestroyDirectPlay2
mov dword [esp + 4], 0x687da03c
mov dword [esp], 3
call fcn.687c3970
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 0x40]
jmp 0x687c422c
Function at 0x687c47d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
lea edi, [ebp - 0x30]
push ebx
mov ebx, ecx
sub esp, 0x4c
mov edx, dword [0x687e2400]
mov dword [esi], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], edx
mov edx, dword [0x687e2404]
mov dword [ecx], 0
mov eax, dword [esi]
mov dword [ebp - 0x2c], edx
mov edx, dword [0x687e2408]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], edi
mov dword [ebp - 0x28], edx
mov edx, dword [0x687e240c]
mov dword [ebp - 0x20], 0x10
mov dword [ebp - 0x24], edx
call fcn.687d61d0
cmp eax, 0x8877001e
je 0x687c4898
test byte [0x687da03c], 2
jne 0x687c4860
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call fcn.687d14e0
mov dword [esp + 0xc], str.cant_get_buffer_size:__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.DP_BuildSPCompoundAddr
mov dword [esp + 4], 0x687da03c
mov dword [esp], 1
call fcn.687c3970
jmp 0x687c484c
mov edx, dword [ebx]
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
mov dword [esi], eax
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], edi
call fcn.687d61d0
mov edx, eax
mov eax, 1
test edx, edx
jns 0x687c484e
test byte [0x687da03c], 2
je 0x687c484c
mov dword [esp], edx
call fcn.687d14e0
mov dword [esp + 0xc], str.cant_create_address:__s_n
mov dword [esp + 0x10], eax
jmp 0x687c4874
Function at 0x687c5c10
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
mov eax, dword fs:[0x18]
sub esp, 0x3c
mov dword [ebp - 0x1c], edx
mov dword [esp + 8], 0x44
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x687c5c8a
lea eax, [eax + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x1c]
mov dword [eax], 0
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], eax
mov eax, dword [esi]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
call fcn.687c3520
mov eax, dword [ebp + 8]
mov dword [ebx + 0x1c], edi
mov dword [ebx], eax
test byte [0x687da03c], 8
jne 0x687c5c98
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi]
mov dword [esp + 0xc], str.Created_group_id_0x_08x_n
mov dword [esp + 8], str.DP_CreateGroup
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x687da03c
mov dword [esp], 3
call fcn.687c3970
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x687c5f20
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x4c
test byte [0x687da03c], 8
jne 0x687c5ff0
mov eax, dword [ebx + 0x54]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x687c60a0
test edi, edi
jne 0x687c60b0
mov edx, dword [eax + 0x14]
test edx, edx
je 0x687c6090
mov edx, dword [ebp + 0xc]
mov eax, esi
call fcn.687c5e30
mov dword [esp + 4], 8
mov dword [esp + 8], eax
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x687c60ba
mov eax, dword [ebx + 0x54]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax + 0x1c]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov eax, dword [ebx + 0x54]
mov ecx, dword [ebp + 0xc]
mov edx, esi
sub esp, 0xc
mov dword [eax + 0x1c], edi
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x1c]
call fcn.687c5cd0
mov eax, dword [ebp + 8]
test eax, eax
jne 0x687c6038
test byte [0x687da03c], 1
jne 0x687c6060
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], str.__p_____p_0x_08x__u__u__n
mov dword [esp + 8], str.DP_SetSessionDesc
mov dword [esp + 4], 0x687da03c
mov dword [esp], 3
call fcn.687c3970
jmp 0x687c5f3c
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x1c]
add eax, 8
mov dword [esp], eax
call sub.ole32.dll_CoCreateGuid
xor eax, eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.Need_to_send_a_DPMSG_SETSESSIONDESC_msg_to_everyone_n
mov dword [esp + 8], str.DP_SetSessionDesc
mov dword [esp + 4], 0x687da03c
mov dword [esp], 0
call fcn.687c3970
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x8877000a
jmp 0x687c5fe6
mov eax, 0x88770140
jmp 0x687c5fe6
mov eax, 0x80070057
jmp 0x687c5fe6
mov eax, 0x8007000e
jmp 0x687c5fe6
Function at 0x687cd1e0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
sub esp, 0xc
leave
ret
Function at 0x687ceec0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test byte [0x687da04c], 8
jne 0x687cef50
mov dword [edi], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x687cf01f
mov dword [eax], fcn.687cec60
mov dword [eax + 4], 1
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x18], eax
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.687cec60
mov esi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x687cf018
mov eax, esi
shr eax, 0x10
je 0x687cf000
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], 0x687defc4
mov dword [esp + 4], eax
call fcn.687cdeb0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x687df046
mov dword [esp + 8], str.dplaysp_create
mov dword [esp + 4], 0x687da04c
mov dword [esp], 3
call fcn.687cdf10
jmp 0x687ceed8
movzx eax, si
mov dword [esp], 0x687defb4
mov dword [esp + 4], eax
call fcn.687cdeb0
jmp 0x687cefc5
mov eax, 0x687defad
jmp 0x687cefc5
mov esi, 0x8007000e
jmp 0x687cef42

Function at 0x687cf030
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
test byte [0x687da04c], 8
jne 0x687cf070
mov dword [esp + 8], 0x10
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
leave
ret
mov dword [esp + 0xc], str.Creating_SPPlayer_data_struct_n
mov dword [esp + 8], str.DPSP_CreateSPPlayerData
mov dword [esp + 4], 0x687da04c
mov dword [esp], 3
call fcn.687cdf10
jmp 0x687cf03f
Function at 0x687d2110
Capabilities:
Create thread
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov esi, dword [ebp + 8]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
test eax, eax
je 0x687d2260
mov ebx, eax
test esi, esi
je 0x687d218e
lea eax, [eax + 0xc]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], esi
mov dword [esp], 0xffffffff
call sub.kernel32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
je 0x687d21f0
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x687d1f20
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_CreateThread
sub esp, 0x18
test eax, eax
je 0x687d2228
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
test byte [0x687da07c], 2
jne 0x687d2270
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
test byte [0x687da07c], 2
je 0x687d21f9
mov dword [esp + 0xc], str.Unable_to_create_msg_thread_n
mov dword [esp + 8], str.CreateLobbyMessageReceptionThread
mov dword [esp + 4], 0x687da07c
mov dword [esp], 1
call fcn.687d1cf0
jmp 0x687d21f9
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0xc], str.Unable_to_duplicate_event_handle_n
mov dword [esp + 8], str.CreateLobbyMessageReceptionThread
mov dword [esp + 4], 0x687da07c
mov dword [esp], 1
call fcn.687d1cf0
jmp 0x687d21f9