joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x2718
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
mov dword [ebp - 0x10], 0x720d
add esp, 4
mov dword [ebp - 0x18], edi
mov bl, 0xfa
lea edx, [edi + 8]
mov dword [ebp - 0x14], edx
nop dword [eax + eax]
movzx ecx, bl
lea eax, [ecx + ecx*4]
cmp byte [eax*8 + 0x7eafbe], 0
jne 0x434345
add bl, 0xff
jne 0x434330
movzx eax, bl
mov dword [edi], 0xffff4a06
lea esi, [eax + eax*4]
shl esi, 3
push esi
push 0x7eafc0
push edx
lea eax, [esi + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
call sub.VCRUNTIME140.dll_memcpy
mov dx, word [ebp - 0x10]
mov ecx, 8
add esp, 0xc
cmp dword [ebp - 0xc], ecx
jbe 0x434391
mov eax, ecx
nop dword [eax]
movsx ax, byte [eax + edi]
inc ecx
add dx, ax
movzx eax, cx
cmp eax, dword [ebp - 0xc]
jb 0x434380
mov word [edi + 4], dx
mov byte [edi + 6], bl
mov byte [edi + 7], 0
test esi, esi
je 0x4343df
mov eax, dword [ebp - 8]
xor ebx, ebx
mov esi, dword [0xa89048]
shr eax, 2
mov dword [ebp - 8], eax
test eax, eax
je 0x4343df
mov edi, eax
mov ecx, esi
mov edx, esi
shr ecx, 2
mov eax, esi
add ecx, dword [0xa89008]
shr edx, 3
shr eax, 1
add ecx, edx
add eax, ecx
add esi, eax
mov eax, dword [ebp - 0x14]
xor dword [eax + ebx*4], esi
inc ebx
cmp ebx, edi
jb 0x4343b7
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0xc]
mov edx, edi
push ecx
push ebx
mov ecx, 0xb0b700
call fcn.0042ce90
add esp, 8
mov byte [ebp - 1], al
test al, al
je 0x43440b
push ecx
push ebx
mov edx, edi
mov ecx, 0xb0b780
call fcn.0042ce90
add esp, 8
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
push 1
push 0x80000
mov dword [ebp - 0x10], edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
add esp, 8
mov dword [ebp - 8], 0xff02
cmp byte [0x7e802e], 2
mov ebx, eax
mov dword [ebp - 0xc], ebx
sete al
mov byte [ebp - 1], al
test al, al
je 0x434b69
or byte [0x7eadc0], 2
mov esi, 0x7eadb0
jmp 0x434b75
and byte [0x7eadc0], 0xfd
mov esi, 0x7e8028
push edi
push 0x80
push 0x7e8238
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
movzx eax, word [ebp - 8]
push 0x80
mov word [ebx], ax
add ebx, 2
push 0x7eabb0
push ebx
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [0xa92810]
mov word [ebx + 0x80], ax
movzx eax, word [0xa9280c]
push 0x104
mov word [ebx + 0x82], ax
add ebx, 0x84
push esi
push ebx
call sub.VCRUNTIME140.dll_memcpy
push 0x1c
add ebx, 0x104
push 0x7ea9b0
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x30
add ebx, 0x1c
cmp byte [ebp - 1], 0
je 0x434bf4
xor byte [0x7eadc0], 2
movzx ecx, byte [0x7e802a]
mov edx, 2
cmp byte [0x7e802a], dl
cmovb ecx, edx
test cl, cl
je 0x434c2c
mov esi, 0x7ea7b0
movzx edi, cl
push 0x40
push esi
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add ebx, 0x40
add esi, 0x40
sub edi, 1
jne 0x434c15
push 0xfa
push 0x7ea6b0
push ebx
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [0x7e8104]
add ebx, 0xfa
lea esi, [eax + eax*8]
shl esi, 2
push esi
push 0x7d0720
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x18
add ebx, esi
cmp byte [0x7e8120], 1
jne 0x434cb4
cmp byte [ebp - 1], 0
mov ecx, 0x56c130
mov eax, 0x56a2e0
push 0x9f8
cmovne eax, ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add ebx, 0x9f8
mov ecx, 0x7c97f8
cmp byte [ebp - 1], 0
mov eax, 0x7c9a90
push 0x126
cmovne eax, ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x18
add ebx, 0x126
jmp 0x434d0d
cmp byte [ebp - 1], 0
je 0x434ccb
mov eax, 0x56c130
mov esi, 0x7c9a48
mov edi, 0x617890
jmp 0x434cda
mov eax, 0x56a2e0
mov esi, 0x7c9c00
mov edi, 0x738cd0
push 0x740
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
push 0x42
add ebx, 0x740
push esi
push ebx
call sub.VCRUNTIME140.dll_memcpy
push 0x69300
add ebx, 0x42
push edi
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
add ebx, 0x69300
cmp byte [0x7e8029], 3
jne 0x434d5c
mov ecx, 0xe0
mov esi, 0xb278d0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0xa89048]
xor edi, edi
nop dword [eax]
mov ecx, esi
mov edx, esi
shr ecx, 2
mov eax, esi
add ecx, dword [0xa89008]
shr edx, 3
shr eax, 1
add ecx, edx
add eax, ecx
add esi, eax
xor dword [ebx + edi*4], esi
inc edi
cmp edi, 0xe0
jb 0x434d30
add ebx, 0x380
movups xmm0, xmmword [0x56b700]
mov esi, dword [ebp - 0xc]
mov edx, esi
push ecx
mov ecx, dword [ebp - 0x10]
movups xmmword [ebx], xmm0
mov eax, dword [0x56b710]
mov dword [ebx + 0x10], eax
mov ax, word [0x56b714]
mov word [ebx + 0x14], ax
sub ebx, esi
add ebx, 0x16
push ebx
call fcn.0042ce90
push esi
mov bl, al
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0xc
test bl, bl
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 1
push 0x400
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
movzx ecx, byte [ebp + 8]
mov esi, eax
add esp, 4
shl ecx, 7
add ecx, 0xb0b580
mov dword [ebp - 4], esi
mov edx, esi
mov dword [ebp - 8], esi
push 0x400
call fcn.0042cde0
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x434e03
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x1c], 6
mov edx, 0x4e9900
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
push edi
cmp eax, 5
ja case.default.0x434e1d
jmp dword [eax*4 + 0x434f60]
mov ecx, 0x7ea7ac
mov dword [ebp + 8], ecx
jmp 0x434e63
mov ecx, 0x7eab90
mov dword [ebp + 8], ecx
jmp 0x434e63
mov ecx, 0x7eab40
mov dword [ebp + 8], ecx
jmp 0x434e63
mov ecx, 0x9f0610
mov dword [ebp + 8], ecx
jmp 0x434e63
mov ecx, 0x7eab9a
mov dword [ebp + 8], ecx
jmp 0x434e63
mov ecx, 0x7eab4f
mov dword [ebp + 8], ecx
jmp 0x434e63
mov ecx, dword [ebp + 8]
mov edi, dword [edx]
mov eax, edi
mov edx, dword [ebp - 8]
sub eax, esi
add eax, edx
cmp eax, dword [ebp - 0x10]
ja 0x434ece
push edi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
add dword [ebp - 8], edi
add esp, 0xc
test edi, edi
je 0x434f2e
mov esi, dword [0xa89048]
shr edi, 2
mov dword [ebp - 0xc], 0
test edi, edi
je 0x434f2b
mov ecx, esi
mov edx, esi
shr ecx, 2
mov eax, esi
add ecx, dword [0xa89008]
shr edx, 3
shr eax, 1
add ecx, edx
add eax, ecx
mov ecx, dword [ebp + 8]
add esi, eax
mov eax, dword [ebp - 0xc]
xor dword [ecx + eax*4], esi
inc eax
mov dword [ebp - 0xc], eax
cmp eax, edi
jb 0x434ea1
jmp 0x434f2b
mov esi, dword [ebp - 0x10]
sub esi, edx
add esi, dword [ebp - 4]
test esi, esi
jle 0x434f2b
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
add dword [ebp - 8], esi
add esp, 0xc
test esi, esi
je 0x434f2b
mov edi, dword [0xa89048]
shr esi, 2
mov dword [ebp - 0xc], 0
test esi, esi
je 0x434f2b
mov ecx, edi
mov edx, edi
shr ecx, 2
mov eax, edi
add ecx, dword [0xa89008]
shr edx, 3
shr eax, 1
add ecx, edx
add eax, ecx
mov ecx, dword [ebp + 8]
add edi, eax
mov eax, dword [ebp - 0xc]
xor dword [ecx + eax*4], edi
inc eax
mov dword [ebp - 0xc], eax
cmp eax, esi
jb 0x434f00
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
inc eax
add edx, 4
mov dword [ebp - 0x14], eax
sub dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], edx
jne 0x434e18
call fcn.00438520
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43f6e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [0x7eaeb4]
movaps xmm5, xmm0
movss xmm4, dword [0x7ea9ac]
movaps xmm3, xmm2
mulss xmm4, xmm3
movaps xmm2, xmm1
movss dword [edx], xmm5
addss xmm2, xmm3
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
movaps xmm0, xmm4
mov dword [edx + 0x10], 0
addss xmm0, xmm5
movss dword [edx + 4], xmm2
movss dword [edx + 0x20], xmm1
mov dword [edx + 0x24], 0
movss dword [edx + 0x1c], xmm0
movaps xmm0, xmm1
mov dword [edx + 0x28], 0
subss xmm0, xmm3
mov dword [edx + 0x2c], 0
movss dword [edx + 0x38], xmm5
mov dword [edx + 0x44], ecx
mov ecx, 5
movss dword [edx + 0x3c], xmm1
mov dword [edx + 0x40], 0
mov dword [edx + 0x48], 0
movss dword [edx + 0x54], xmm5
subss xmm5, xmm4
movss dword [edx + 0x58], xmm0
mov dword [edx + 0x5c], 0
mov dword [edx + 0x60], 0
mov dword [edx + 0x64], 0
movss dword [edx + 0x70], xmm5
movss dword [edx + 0x74], xmm1
mov dword [edx + 0x78], 0
mov dword [edx + 0x7c], 0
mov dword [edx + 0x80], 0
movups xmm0, xmmword [edx + 0x70]
mov eax, dword [edx + 0x88]
movups xmmword [edx + 0x8c], xmm0
movq xmm0, qword [edx + 0x80]
movq qword [edx + 0x9c], xmm0
mov dword [edx + 0xa4], eax
movups xmm0, xmmword [edx + 0x38]
mov eax, dword [edx + 0x50]
movups xmmword [edx + 0xa8], xmm0
movq xmm0, qword [edx + 0x48]
movq qword [edx + 0xb8], xmm0
mov dword [edx + 0xc0], eax
movups xmm0, xmmword [edx]
mov eax, dword [edx + 0x18]
movups xmmword [edx + 0xc4], xmm0
movq xmm0, qword [edx + 0x10]
movq qword [edx + 0xd4], xmm0
mov dword [edx + 0xdc], eax
add edx, 0xe0
mov dword [0x7eaeb4], edx
jmp fcn.0043bca0
Function at 0x440b40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor edx, edx
movzx esi, di
mov eax, 0x10000
div esi
xor ebx, ebx
movss dword [ebp - 4], xmm2
movzx eax, ax
movaps xmm7, xmm3
mov dword [ebp - 0x18], eax
movaps xmm5, xmm1
movss xmm3, dword [0x7ea9ac]
mov eax, ecx
shr eax, 0x10
movaps xmm4, xmm3
movzx eax, al
movaps xmm6, xmm0
mov dword [ebp - 8], eax
mov edx, 0x80
mov eax, ecx
mulss xmm4, xmm2
and eax, 0xff00ffff
mulss xmm3, xmm7
mov dword [ebp - 0xc], eax
mov eax, ecx
shr eax, 8
movzx eax, al
mov dword [ebp - 0x10], eax
movzx eax, cl
mov dword [ebp - 0x14], eax
lea eax, [edi + 1]
mov edi, dword [0x7eaeb4]
movzx eax, ax
mov dword [ebp + 0x10], eax
nop dword [eax + eax]
movzx ecx, bx
add ebx, dword [ebp - 0x18]
mov dword [edi + 8], 0
mov dword [edi + 0x14], 0x3f000000
mov ax, word [ecx*2 + 0x90ab20]
movss xmm2, dword [ecx*4 + 0x98ab20]
movss xmm1, dword [ecx*4 + 0x94ab20]
movaps xmm0, xmm2
sar ax, 7
add ax, dx
mulss xmm0, xmm4
movzx esi, ax
mov eax, 0x100
sub eax, esi
mulss xmm2, xmm3
mov ecx, esi
movzx edx, ax
imul esi, dword [ebp - 8]
addss xmm0, xmm6
mov eax, dword [ebp - 0x10]
shl edx, 7
addss xmm2, xmm6
imul eax, ecx
movss dword [edi], xmm0
add esi, edx
shl esi, 8
movaps xmm0, xmm1
or esi, dword [ebp - 0xc]
mulss xmm0, dword [ebp - 4]
add eax, edx
and esi, 0xffff00ff
or esi, eax
mulss xmm1, xmm7
mov eax, dword [ebp - 0x14]
and esi, 0xffffff00
imul eax, ecx
addss xmm0, xmm5
addss xmm1, xmm5
movss dword [edi + 4], xmm0
add eax, edx
movss xmm0, dword [ebp + 8]
mov edx, 0x80
movss dword [edi + 0x18], xmm0
movss xmm0, dword [ebp + 0xc]
shr eax, 8
or esi, eax
mov dword [edi + 0xc], esi
mov dword [edi + 0x28], esi
mov dword [edi + 0x10], 0
movss dword [edi + 0x1c], xmm2
movss dword [edi + 0x20], xmm1
mov dword [edi + 0x24], 0
mov dword [edi + 0x30], 0x3f000000
movss dword [edi + 0x34], xmm0
mov dword [edi + 0x2c], 0
add edi, 0x38
sub dword [ebp + 0x10], 1
jne 0x440bc0
lea ecx, [edx - 0x7b]
mov dword [0x7eaeb4], edi
call fcn.0043bca0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4437a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [0x7eaeb4]
mov eax, dword [ecx + 0xc]
mov dword [edx], eax
mov eax, dword [ecx + 0x10]
mov dword [edx + 4], eax
mov eax, dword [ecx + 0x14]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0x18]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x1c]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x3c]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x40]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 0x44]
mov dword [edx + 0x24], eax
mov eax, dword [ecx + 0x48]
mov dword [edx + 0x28], eax
mov eax, dword [ecx + 0x4c]
mov dword [edx + 0x2c], eax
mov eax, dword [ecx + 0x6c]
mov dword [edx + 0x38], eax
mov eax, dword [ecx + 0x70]
mov dword [edx + 0x3c], eax
mov eax, dword [ecx + 0x74]
mov dword [edx + 0x40], eax
mov eax, dword [ecx + 0x78]
mov dword [edx + 0x44], eax
mov eax, dword [ecx + 0x7c]
mov dword [edx + 0x48], eax
mov eax, dword [ecx + 0x9c]
mov dword [edx + 0x54], eax
mov eax, dword [ecx + 0xa0]
mov dword [edx + 0x58], eax
mov eax, dword [ecx + 0xa4]
mov dword [edx + 0x5c], eax
mov eax, dword [ecx + 0xa8]
mov dword [edx + 0x60], eax
mov eax, dword [ecx + 0xac]
mov ecx, 5
mov dword [edx + 0x64], eax
add edx, 0x70
mov dword [0x7eaeb4], edx
jmp fcn.0043bca0

Function at 0x444130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [0x7eaeb4]
mov eax, dword [ecx + 0xc]
mov dword [edx], eax
mov eax, dword [ecx + 0x10]
mov dword [edx + 4], eax
mov eax, dword [ecx + 0x14]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0x20]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x24]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x18]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x1c]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x3c]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x40]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 0x44]
mov dword [edx + 0x24], eax
mov eax, dword [ecx + 0x50]
mov dword [edx + 0x30], eax
mov eax, dword [ecx + 0x54]
mov dword [edx + 0x34], eax
mov eax, dword [ecx + 0x48]
mov dword [edx + 0x28], eax
mov eax, dword [ecx + 0x4c]
mov dword [edx + 0x2c], eax
mov eax, dword [ecx + 0x6c]
mov dword [edx + 0x38], eax
mov eax, dword [ecx + 0x70]
mov dword [edx + 0x3c], eax
mov eax, dword [ecx + 0x74]
mov dword [edx + 0x40], eax
mov eax, dword [ecx + 0x80]
mov dword [edx + 0x4c], eax
mov eax, dword [ecx + 0x84]
mov dword [edx + 0x50], eax
mov eax, dword [ecx + 0x78]
mov dword [edx + 0x44], eax
mov eax, dword [ecx + 0x7c]
mov ecx, 4
mov dword [edx + 0x48], eax
add edx, 0x54
mov dword [0x7eaeb4], edx
jmp fcn.0043bca0
Function at 0x4441d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [0x7eaeb4]
mov eax, dword [ecx + 0xc]
mov dword [edx], eax
mov eax, dword [ecx + 0x10]
mov dword [edx + 4], eax
mov eax, dword [ecx + 0x14]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0x20]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x24]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x18]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x1c]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x3c]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x40]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 0x44]
mov dword [edx + 0x24], eax
mov eax, dword [ecx + 0x50]
mov dword [edx + 0x30], eax
mov eax, dword [ecx + 0x54]
mov dword [edx + 0x34], eax
mov eax, dword [ecx + 0x48]
mov dword [edx + 0x28], eax
mov eax, dword [ecx + 0x4c]
mov dword [edx + 0x2c], eax
mov eax, dword [ecx + 0x6c]
mov dword [edx + 0x38], eax
mov eax, dword [ecx + 0x70]
mov dword [edx + 0x3c], eax
mov eax, dword [ecx + 0x74]
mov dword [edx + 0x40], eax
mov eax, dword [ecx + 0x80]
mov dword [edx + 0x4c], eax
mov eax, dword [ecx + 0x84]
mov dword [edx + 0x50], eax
mov eax, dword [ecx + 0x78]
mov dword [edx + 0x44], eax
mov eax, dword [ecx + 0x7c]
mov dword [edx + 0x48], eax
mov eax, dword [ecx + 0x9c]
mov dword [edx + 0x54], eax
mov eax, dword [ecx + 0xa0]
mov dword [edx + 0x58], eax
mov eax, dword [ecx + 0xa4]
mov dword [edx + 0x5c], eax
mov eax, dword [ecx + 0xb0]
mov dword [edx + 0x68], eax
mov eax, dword [ecx + 0xb4]
mov dword [edx + 0x6c], eax
mov eax, dword [ecx + 0xa8]
mov dword [edx + 0x60], eax
mov eax, dword [ecx + 0xac]
mov ecx, 5
mov dword [edx + 0x64], eax
add edx, 0x70
mov dword [0x7eaeb4], edx
jmp fcn.0043bca0

Function at 0x4499e0
Capabilities:
Initialize winhttp library

Disassembly:
xor al, al
mov ecx, 0x90a491
mov byte [ecx], al
lea ecx, [ecx + 0xc]
inc al
cmp al, 0x40
jb 0x4499e7
mov eax, dword [0x8f7d38]
test eax, eax
jne 0x449a1b
push 0x10000000
push eax
push eax
push eax
push str.Cue_Club_2
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [0x8f7d38], eax
test eax, eax
je 0x449a9f
push 0
push 0x7e0000
push 0x492ba0
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
cmp eax, 0xffffffff
je 0x449a71
push 0
push 0x50
push 0xb22f80
push dword [0x8f7d38]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [0x8eda8c], eax
test eax, eax
je 0x449a5f
mov eax, dword [0x8f7d38]
mov byte [0x7d05f3], 1
jmp 0x449a84
push 0
push 0
push 0
push dword [0x8f7d38]
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
push dword [0x8f7d38]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor eax, eax
mov dword [0x8f7d38], eax
push 0x7530
push 0x7530
push 0x7530
push 0x7530
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
ret
Function at 0x449f60
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
cmp byte [0x90a893], 0
push esi
push edi
je 0x44a1a5
movss xmm0, dword [0x7e80d0]
mulss xmm0, dword [0x4fc8e0]
mov dword [ebp - 8], 0
mov si, word [ebp - 8]
cvttss2si eax, xmm0
movss xmm0, dword [0x7e80d4]
mulss xmm0, dword [0x4fc8e0]
mov dword [ebp - 0x10], eax
mov al, byte [0x7e80cd]
test al, al
je 0x449fe3
mov ecx, 0x56a2f4
movzx edx, al
nop dword [eax + eax]
mov ax, word [ecx - 4]
lea ecx, [ecx + 0x74]
add ax, word [ecx - 0x74]
xor si, ax
sub edx, 1
jne 0x449fd0
movzx eax, byte [0x7e8036]
shl eax, 6
movsx edi, byte [0x7e8054]
mov word [ebp - 6], si
movzx edx, byte [0x7eaaca]
mov cl, byte [eax + 0x7ea7d2]
mov al, byte [eax + 0x7ea7d1]
mov byte [ebp - 2], al
movzx eax, byte [0x9eabeb]
mov dword [ebp - 0x14], eax
movsx eax, byte [0x7e8051]
mov dword [ebp - 0xc], eax
mov byte [ebp - 1], cl
movzx eax, byte [ebp - 1]
movzx ecx, si
movzx esi, byte [ebp - 2]
xor esi, eax
mov dword [ebp - 0x18], edx
movsx eax, word [0x7e80f0]
xor esi, eax
mov dword [ebp - 0x1c], edi
movsx eax, word [0x7e80f4]
xor esi, eax
movsx eax, word [0x7e80f8]
xor esi, eax
movzx eax, word [0x9eaeac]
xor esi, dword [ebp - 0xc]
xor esi, edi
mov edi, dword [0x9eaf18]
xor esi, ecx
mov ecx, dword [0x56a2f0]
xor esi, eax
movzx eax, word [0x7e80fc]
xor esi, dword [ebp - 0x14]
xor esi, eax
movzx eax, word [0x7e80fe]
xor esi, eax
movzx eax, word [0x7e8100]
xor esi, eax
xor esi, edx
mov edx, dword [0x56a2f4]
cvttss2si eax, xmm0
xor esi, edx
xor esi, ecx
xor esi, edi
xor esi, eax
movzx eax, word [ebp - 6]
xor esi, dword [ebp - 0x10]
push esi
push eax
push dword [ebp - 0x18]
movzx eax, byte [ebp - 1]
push eax
movzx eax, byte [ebp - 2]
push eax
movzx eax, word [0x7e8100]
push edx
push ecx
push dword [ebp - 0x1c]
push dword [ebp - 0xc]
push eax
movzx eax, word [0x7e80fe]
push eax
movzx eax, word [0x7e80fc]
push eax
movsx eax, word [0x7e80f8]
push eax
movsx eax, word [0x7e80f4]
push eax
movsx eax, word [0x7e80f0]
push eax
cvttss2si eax, xmm0
push eax
push dword [ebp - 0x10]
movzx eax, word [0x9eaeac]
push dword [ebp - 0x14]
push eax
push edi
push 0xb214a0
push 0x140
push 0xa033f0
call fcn.0042cda0
movzx eax, byte [0x90a892]
add esp, 0x5c
imul eax, eax, 0x284
push 0xa033f0
push 0x140
add eax, 0x9eaf24
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov dl, byte [0x90a892]
add esp, 0xc
mov cx, word [0x9eaeac]
movzx eax, dl
inc dl
imul eax, eax, 0x284
and dl, 0x1f
mov byte [0x90a892], dl
mov word [eax + 0x9eaf20], 1
mov word [eax + 0x9eaf22], cx
inc cx
cmp byte [0x7ea98b], 0
mov word [0x9eaeac], cx
je 0x44a18d
mov ecx, str.Net_ServerSendGameData
call fcn.004bfb10
push 0
xor dl, dl
mov ecx, 0xa033f0
call fcn.004497a0
add esp, 4
mov byte [0x7eaaca], 0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x44ab20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movss xmm0, dword [0x4fca68]
subss xmm0, dword [0x90a898]
movss xmm1, dword [0x9eae90]
movss xmm2, dword [0x9eae94]
subss xmm2, dword [0x90a978]
subss xmm1, xmm0
mulss xmm2, xmm2
mulss xmm1, dword [0x7ea9ac]
mulss xmm1, xmm1
addss xmm1, xmm2
comiss xmm1, dword [0xb256ac]
ja 0x44abe5
cmp byte [0x7c9ce2], 2
jne 0x44ab85
cmp word [0x90aa04], 0
jne 0x44ab85
cmp byte [0x7c9ce1], 0
je 0x44abe5
cmp byte [0x7e8237], 0
mov byte [0x7d05f7], 3
je 0x44abec
cmp byte [0x7ea922], 0
mov byte [0x7e8237], 0
mov byte [0x7d05f7], 1
mov byte [0x7d0602], 1
mov byte [0xa88a02], 1
mov byte [0x7c9c63], 1
jne 0x44abcb
mov ecx, 0x2ba
jmp fcn.00417e70
mov ecx, 0x2a2
call fcn.00417e70
cmp byte [0x9eaf02], 1
jne 0x44abec
xor cl, cl
jmp fcn.004a1f60
mov byte [0x7d05f7], 1
ret

Function at 0x450910
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x4ff074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 7
mov esi, 0x5048e0
mov ebx, 1
mov dword [ebp - 0x28c], edi
nop dword [eax + eax]
push ebx
push str.gamesprogress_tour
push str._sgame_d
lea eax, [ebp - 0x288]
push 0x80
push eax
call fcn.0042cda0
lea eax, [ebp - 0x288]
push eax
push 0xa92828
push str._s_s.dat
lea eax, [ebp - 0x188]
push 0x80
push eax
call fcn.0042cda0
add esp, 0x28
lea eax, [ebp - 0x188]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4509a9
xor al, al
jmp 0x4509b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
test al, al
je 0x450a58
lea eax, [ebp - 0x288]
push eax
push 0xa92828
push str._s_s.dat
lea eax, [ebp - 0x188]
push 0x80
push eax
call fcn.0042cda0
add esp, 0x14
lea eax, [ebp - 0x188]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x450a28
push 0
lea eax, [ebp - 0x290]
push eax
push 0x82
lea eax, [ebp - 0x88]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xff01
cmp word [ebp - 0x88], ax
jne 0x450a3c
xor eax, eax
mov word [ebp - 0x4a], ax
lea eax, [ebp - 0x86]
push eax
push str.___s
push 0x50
push esi
call fcn.0042cda0
mov edi, dword [ebp - 0x28c]
jmp 0x450a6a
push 0xb0a8c8
push str.___s
push 0x50
push esi
call fcn.0042cda0
mov esi, dword [esi + 0xcc]
add esp, 0x10
inc ebx
sub edi, 1
mov dword [ebp - 0x28c], edi
jne 0x450940
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
Function at 0x457500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp cl, byte [0x7e8036]
jne 0x41289b
movzx eax, cl
shl eax, 6
cmp byte [eax + 0x7ea7db], 0
jne 0x41289b
mov dl, 1
jmp 0x41289d
xor dl, dl
movzx eax, cl
shl eax, 6
mov byte [eax + 0x7ea7db], 0xff
test dl, dl
jne fcn.00423fe0
ret
cmp byte [0x7e8118], 4
push ebx
jne 0x457589
cmp byte [0x7d0cb7], 0
jne 0x457589
cmp byte [0x7e8039], 0
jne 0x457589
cmp byte [0x7ea719], 1
jne 0x457589
cmp byte [0x7e8029], 7
je 0x457589
cmp dword [0x7e8110], 0
je 0x457540
cmp byte [0x7d05ff], 0
je 0x457589
mov al, byte [0x7c9ce1]
test al, al
jne 0x457562
mov cl, byte [0x7e80d8]
cmp cl, 1
je 0x457559
cmp cl, 0xe
jne 0x457589
cmp byte [0x7e8107], 0
jne 0x457589
cmp byte [0x7e802e], 0
mov byte [0x7d0cb7], 1
jne 0x45758b
test al, al
jne 0x45758f
mov ax, word [0xa91e1c]
mov byte [0x7e80d8], 0xa
mov word [0x7d0614], ax
pop ebx
ret
test al, al
je 0x4575a5
xor dl, dl
mov ecx, 0x19
xor bl, bl
call fcn.004bd4f0
mov cl, bl
pop ebx
jmp 0x412880
mov bl, byte [0x7e8036]
xor dl, dl
mov ecx, 0x19
call fcn.004bd4f0
mov cl, bl
pop ebx
jmp 0x412880

Function at 0x4580a0
Capabilities:
Hide graphical window

Disassembly:
push ecx
cmp byte [0x7d05a3], 1
jne 0x4580f3
mov eax, dword [0xa91e30]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
je 0x4580be
call fcn.0043bf30
push 5
push dword [0xa91984]
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, byte [0xa90f78]
push 0
mov byte [0x7d05a3], 0
mov byte [0x7d118f], al
mov byte [0x7d1096], 0
mov byte [0x7d061f], 0
call dword [sym.imp.USER32.dll_ShowCursor]
pop ecx
ret