joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc3ed99
Capabilities:
Access peb ldr_data
Authenticate hmac
Check http status code
Execute anti-debugging instructions
Get number of processors

Disassembly:
add esp, 4
jo 0xc3a881
cmc
add edx, 0xc
test bp, 0xf7f7
cmc
bt sp, bp
add edx, 0xc
pushfd
cmp bl, 0xc7
clc
cmp dword [ebp - 0xfc], edx
call fcn.00c38060
mov eax, dword fs:[0x30]
rcl cl, 2
mov eax, dword [eax + 0xc]
rol dx, 4
rol dh, cl
mov dword [ebp - 0xf4], eax
pushfd
movzx ax, dl
btr ax, cx
test ebx, 0x7b7a6cef
mov dword [ebp - 0xf8], 0
shld dx, si, 2
aaa
mov dword [ebp - 0xf0], 0
cdq
shrd ax, sp, 4
bts cx, bp
mov eax, dword [ebp - 0xf4]
cmp si, bp
btc cx, ax
sbb dh, ah
mov ecx, dword [eax + 0xc]
btc dx, 0xa
movzx dx, bl
sub dx, 0x45d
mov dword [ebp - 0xfc], ecx
lea esp, [esp + 8]
rcl edx, cl
mov dl, ch
push 0xa5ac1085
mov edx, dword [ebp - 0xf4]
jmp 0xc36114

Function at 0xc3ee3d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], ch
mov dword [esp + 0x10], esi
lea esp, [esp + 0x48]
jne 0xc324b4
clc
bt ax, 0xd
mov eax, dword [ebp - 0x100]
bswap cx
mov ecx, dword [eax + 0x30]
pushal
push dword [esp]
test cx, bx
call fcn.00c3fb23
lea esp, [esp + 0xc]
je 0xc3bef8
lea eax, [0x3c84bcd1]
pushal
lahf
adc cl, cl
mov eax, dword [ebp - 0x100]
stc
mov ecx, dword [eax + 0x30]
mov byte [esp + 0x14], 0x92
stc
xor edx, edx
shld dx, sp, cl
sbb dl, 0xda
movsx dx, cl
mov dx, word [ecx + 2]
mov word [esp], dx
pushfd
pushal
cmp ecx, 0x212c8e17
cmp edx, 0x54
push ebp
jmp 0xc338cc

Function at 0xc3f0a7
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions
Get number of processors

Disassembly:
push dword [esp]
lea esp, [esp + 0x2c]
jl 0xc34f08
je 0xc3e4ba
bsf eax, esi
call fcn.00c3ed99

Function at 0xc3f0c2
Capabilities:
Access peb ldr_data
Check http status code
Execute anti-debugging instructions
Get number of processors

Disassembly:
pushal
lea esp, [esp + 0x2c]
je 0xc3e4ba
setne ch
stc
mov eax, dword fs:[0x30]
add cx, di
mov eax, dword [eax + 0xc]
stc
movsx edx, bl
movzx cx, al
sal dl, cl
mov dword [ebp - 0xf4], eax
sbb dh, ah
mov dword [ebp - 0xf8], 0
btc ax, 2
mov dl, cl
dec dh
mov dword [ebp - 0xf0], 0
shl ah, cl
mov eax, dword [ebp - 0xf4]
sar dx, cl
test si, 0x9cf8
mov ecx, dword [eax + 0xc]
rcl dx, 6
call fcn.00c3c073

Function at 0xc3f192
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
add edx, 0xc
pushfd
clc
pushfd
clc
cmp dword [ebp - 0xfc], edx
push edx
push 0xb9d8c187
jmp 0xc400fa
mov dword [ebp - 0xf8], 0
aaa
mov dword [ebp - 0xf0], 0
btc ax, 0xe
mov eax, dword [ebp - 0xf4]
or dl, bl
test ax, si
sub cx, di
bt dx, 0xd
mov ecx, dword [eax + 0xc]
not dh
sal dl, cl
pop edx
bts dx, 0xc
mov dword [ebp - 0xfc], ecx
shr dx, 0xd
cmp esp, esi
mov edx, dword [ebp - 0xf4]
push esi
jmp 0xc3621f
mov byte [esp + 0x10], dl
lea esp, [esp + 0x14]
je 0xc3a5c7
and edx, 0x49ec7967
mov eax, dword [ebp - 0xfc]
rol cl, 3
and dl, bh
mov dword [ebp - 0x100], eax
rcl dl, 5
xchg dh, cl
mov ecx, dword [ebp - 0x100]
bswap dx
mov dx, 0xc1af
cmc
mov edx, dword [ecx + 0x34]
test dl, 0xa9
cmp bl, bl
clc
and edx, 4
stc
jmp 0xc3266a
Function at 0xc3f1e4
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
jne 0xc324b4
pushfd
movsx cx, cl
movsx ax, cl
setno ch
mov eax, dword [ebp - 0x100]
call fcn.00c3bdc5

Function at 0xc3f27c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0xc], ch
mov byte [esp + 8], 0x6e
lea esp, [esp + 0x24]
jne 0xc3eab4
mov dword [esp + 4], ebx
lea esp, [esp + 8]
je 0xc355f2
stc
pushal
cmp ah, ch
push edx
cmp bl, 0x4c
jmp 0xc355df
stc
push dword [esp]
cmp bl, 0x6c
jmp 0xc3ad9d

Function at 0xc3f420
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
mov dword [ecx], eax
pushfd
push dword [esp]
push ebx
lea esp, [esp + 0xc]
jmp 0xc37350
mov dword [esp + 0x3c], 0xc3b556
call fcn.00c38ab3
inc ah
mov ax, 0x6e7a
stc
js 0xc35c68
mov eax, dword [ebp - 0x5c]
test dx, 0x9516
bt esi, ecx
clc
jmp 0xc3f410
bts eax, edx
lea eax, [esi - 0x2f622724]
mov eax, dword [ebp - 0x5c]
pushfd
and eax, 0xffff
lea esp, [esp + 4]
jns 0xc394b5
bt ebp, 0x1c
stc
pushfd
cmp eax, 0x1000
pushal
lea esp, [esp + 0x24]
js 0xc3b678
pushal
lea esp, [esp + 0x20]
jne 0xc33089
or cx, sp
aaa
bsf ax, sp
mov ecx, dword [ebp - 4]
bsf dx, bx
aad 0x85
add eax, ebp
cmp ah, 0x48
and ecx, 0xffff0000
cmc
shrd eax, edx, 0x19
sub dl, bl
mov edx, dword [ebp - 0x1c]
aad 0xbe
aas
mov eax, dword [edx]
clc
pushal
clc
lea esp, [esp + 0x20]
jge 0xc3c63a
add eax, ecx
movsx cx, cl
bswap ecx
jmp 0xc3ccd6
pushal
call fcn.00c3f4bc
cmp al, dh
add eax, ecx
call fcn.00c3984c
mov ecx, dword [ebp - 0x1c]
jmp 0xc32d06
and eax, 0xffff
pushal
cmp eax, 0x1000
call fcn.00c3687a
jmp 0xc3821b

Function at 0xc3f42f
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
cmp bl, 0x4c
mov byte [esp], cl
lea esp, [esp + 4]
jne 0xc3eab4
ror bl, cl
mov bl, 0xf3
push 0x61d04490
mov bl, byte [eax + 5]
pushfd
mov byte [esp + 4], 0x45
call fcn.00c3713e

Function at 0xc3f475
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
jne 0xc3e7be

Function at 0xc3f49d
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp bl, 0x4c
mov word [esp + 4], dx
call fcn.00c33478

Function at 0xc3f4bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x24]
jne 0xc33089
shrd edx, ebx, cl
shrd cx, cx, cl
mov ecx, dword [ebp - 4]
rcr dh, cl
and ecx, 0xffff0000
bts ax, dx
bsr ax, ax
setge al
adc dh, 0xa3
mov edx, dword [ebp - 0x1c]
clc
movzx eax, bl
mov eax, dword [edx]
pushal
clc
clc
add eax, ecx
pop ecx
call fcn.00c335ad

Function at 0xc3f51d
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp eax, 0x6c
push esp
jmp 0xc3e3de
push 0xa4c36eb9
mov byte [esp], dh
lea esp, [esp + 0x10]
je 0xc393ee
btr cx, 0xb
stc
push 0x2167d97
mov ecx, dword [ebp - 0x44]
call fcn.00c37286
sub eax, eax
mov al, 0xd7
mov al, byte [edx + 8]
push 0x12811190
jmp 0xc3a351

Function at 0xc3f549
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x88], ecx
jmp 0xc3c81c
Function at 0xc3f5dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pushfd
pushfd
lea esp, [esp + 0x30]
jne 0xc329e2
bsf dx, di
test cl, 0x23
mov edx, dword [ebp - 0x44]
clc
xor eax, eax
dec al
add al, dh
mov al, byte [edx + 5]
cmp bh, bh
cmp eax, 0x32
push edx
lea esp, [esp + 4]
je 0xc3c327
bsf ecx, ebx
shl cx, 5
clc
mov ecx, dword [ebp - 0x44]
pushfd
clc
sub edx, edx
inc dl
inc dl
mov dl, byte [ecx + 5]
bt edx, edi
cmp edx, 0x32
pushal
pushal
pushfd
lea esp, [esp + 0x48]
jne 0xc329e2
lea eax, [edi*8 + 0x1ff8486]
movsx ax, al
lahf
mov eax, dword [ebp - 0x44]
jmp 0xc3c848

Function at 0xc3f954
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp], ebp
lea esp, [esp + 0x2c]
je 0xc3555d
lea ecx, [edi + 0x299f8e26]
bsf ax, bx
mov eax, dword [ebp - 0x104]
setnp cl
rcl ch, 7
btr ecx, 1
mov ecx, dword [eax + 0x30]
cmc
test bl, 0xbd
xor edx, edx
add dl, 0x4e
mov dx, word [ecx]
push ecx
cmc
cmp edx, 0x6b
call fcn.00c383b8
jmp 0xc351a5

Function at 0xc3f999
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
setp dh
rcl dl, cl
sal dh, 4
mov dx, word [ecx + 0x10]
mov byte [esp], 0xbf
push 0xc1352e0a
cmp edx, 0x2e
mov byte [esp + 8], 0x70
push 0x5f3fa0c8
push dword [esp]
pushfd
lea esp, [esp + 0x18]
jne 0xc3555d
aaa
cmp bh, bl
sar ch, cl
mov eax, dword [ebp - 0x104]
dec cl
sal ch, cl
sbb ch, bl
mov ecx, dword [eax + 0x30]
test ebp, eax
stc
sub edx, edx
shld dx, cx, 0xc
shld dx, dx, 1
mov dx, word [ecx + 0x12]
stc
call fcn.00c3b8e7
lea esp, [esp + 0x2c]
je 0xc338b1
jmp 0xc3e2a7

Function at 0xc3fad9
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
cmp cx, 0x1925
cmc
cmp eax, 0x2e
push esi
mov byte [esp], bh
pushfd
lea esp, [esp + 0x30]
jne 0xc329e2
rol ch, 2
mov ecx, dword [ebp - 0x44]
bt edi, 0x19
xor edx, edx
inc dl
call fcn.00c3b9b4

Function at 0xc3fb05
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [ebp - 0x44]
clc
xor edx, edx
or dl, bh
sbb dl, ch
rcl dl, 2
mov dl, byte [ecx + 0xa]
test al, al
test edx, edx
call fcn.00c375d0

Function at 0xc3fbe6
Capabilities:
Access peb ldr_data
Check http status code
Execute anti-debugging instructions
Get number of processors

Disassembly:
pushal
lea esp, [esp + 0x28]
je fcn.00c36a1d
pushfd
jmp 0xc3b523

Function at 0xc3fbf7
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
jb 0xc4017c
add ch, dl
call fcn.00c3b3f9

Function at 0xc3fcce
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
stc
cmp bl, 0x4e
push 0x9f9f8aaa
call fcn.00c35cea
lea esp, [esp + 0x10]
je 0xc35cff
jmp 0xc395a1
jmp 0xc3b7d0

Function at 0xc3fcf4
Capabilities:
Execute anti-debugging instructions

Disassembly:
aaa
rcr ax, cl
mov ecx, dword [ecx + 0x80]
not ax
add ecx, edx
shrd eax, eax, 0xc
sub eax, edx
mov eax, dword [ecx + 0xc]
pushfd
test eax, eax
mov dword [esp], 0xeae2816b
jmp 0xc37b52
Function at 0xc3fd4f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dl
cmp bl, 0x6c
pushfd
call fcn.00c3f94e
lea esp, [esp + 4]
jne 0xc3eab4
neg bl
mov bl, byte [eax + 3]
cmp bh, dl
pushfd
jmp 0xc3a1f4

Function at 0xc3fdfc
Capabilities:
Authenticate hmac
Check http status code
Execute anti-debugging instructions

Disassembly:
pushal
push 0xde036f1b
lea esp, [esp + 0x28]
jne 0xc324b4

Function at 0xc3fedc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x24]
jne 0xc3eab4
cmp bx, cx
mov bl, byte [eax + 3]
push 0x26819ed5
cmp si, bp
cmp bl, 0x6c
call fcn.00c3bff0
jmp 0xc3a58b

Function at 0xc3ff6c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
pushal
test ebx, ebx
jmp 0xc36eb2
lea esp, [esp + 8]
je 0xc3cecb
stc
and ebx, 0x80000000
jmp 0xc3c2ce

Function at 0xc3ff8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
test bx, 0x7982
stc
cmp edx, 0x54
pushfd
lea esp, [esp + 4]
jne 0xc324b4
sub cx, 0x641b
mov eax, dword [ebp - 0x100]
rcl cl, cl
sar cx, cl
lea ecx, [ebp + 0x4d453114]
mov ecx, dword [eax + 0x30]
stc
xor edx, edx
shl dh, 4
sub dh, 0x49
and dl, dh
mov dx, word [ecx + 4]
cmp bp, ax
stc
cmp edx, 0x64
pushfd
push 0xc3778302
push 0xafce8687
push dword [esp + 8]
lea esp, [esp + 0x10]
je 0xc347cf
sar ecx, 0x11
dec ch
sal ch, 4
sub ah, 0x7e
mov eax, dword [ebp - 0x100]
bswap cx
shld cx, bp, cl
rcr cl, cl
mov ecx, dword [eax + 0x30]
pushfd
mov byte [esp], 0x18
sub edx, edx
shrd dx, sp, cl
shld dx, sp, 7
rcr dh, 5
mov dx, word [ecx + 4]
mov byte [esp], ch
cmp edx, 0x44
pushfd
mov byte [esp + 4], cl
lea esp, [esp + 8]
jne 0xc324b4
test bl, bl
mov eax, dword [ebp - 0x100]
cmc
sbb ch, cl
mov ecx, dword [eax + 0x30]
clc
call fcn.00c326e6
cmp bh, dl
clc
cmp edx, 0x74
pushfd
push esp
lea esp, [esp + 0x10]
je 0xc3bef8
aaa
sar cl, cl
test bp, 0x2fb0
aad 0xe5
mov eax, dword [ebp - 0x100]
movzx cx, al
rcr ch, 3
sal cx, 3
sar cx, cl
mov ecx, dword [eax + 0x30]
clc
stc
xor edx, edx
shr dl, 2
bt bx, 0xd
mov dx, word [ecx + 2]
jmp 0xc3dafc

Function at 0xc4007d
Capabilities:
Authenticate hmac

Disassembly:
cmp edx, 0x4c
call fcn.00c3b059
push 0x67c14461
xor edx, edx
push 0x5d4eff84
add dl, 0x5c
test ch, bh
shl dl, 2
mov dl, byte [ecx + 8]
mov byte [esp + 8], dl
clc
jmp 0xc37dd4
Function at 0x401043
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push 0x1f4
push dword [ebp + 8]
call sub.USER32.dll_LoadIconA
mov dword [0x43600c], eax
jmp 0x40106b
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 0x3000
mov dword [ebp - 0x28], 0x401197
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x40105d
push dword [0x43600c]
pop dword [ebp - 0x18]
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
push dword [0x43600c]
pop dword [ebp - 4]
lea eax, [ebp - 0x30]
push eax
call sub.USER32.dll_RegisterClassExA
mov dword [ebp - 0x50], 0xc0
mov dword [ebp - 0x54], 0x96
push 0
call sub.USER32.dll_GetSystemMetrics
push eax
push dword [ebp - 0x50]
call fcn.00401283
mov dword [ebp - 0x58], eax
push 1
call sub.USER32.dll_GetSystemMetrics
push eax
push dword [ebp - 0x54]
call fcn.00401283
mov dword [ebp - 0x5c], eax
push 0
push dword [ebp + 8]
push 0
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [ebp - 0x5c]
push dword [ebp - 0x58]
push 0x80000
push str.Animate
push 0x40105d
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [0x436004], eax
push 0x258
push dword [ebp + 8]
call sub.USER32.dll_LoadMenuA
push eax
push dword [0x436004]
call sub.USER32.dll_SetMenu
push 1
push dword [0x436004]
call sub.USER32.dll_ShowWindow
push dword [0x436004]
call sub.USER32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.USER32.dll_GetMessageA
cmp eax, 0
je 0x401190
lea eax, [ebp - 0x4c]
push eax
call sub.USER32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.USER32.dll_DispatchMessageA
jmp 0x401168
mov eax, dword [ebp - 0x44]
leave
ret 0x10

Function at 0x4013f0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 1
jne 0x401404
mov eax, dword [0x4360ec]
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
jmp 0x401416
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [0x4360f0]
shr edx, 1
cmp dword [ebp - 4], edx
jae 0x40149b
mov eax, dword [ebp - 4]
mov ecx, dword [0x4360d4]
movzx edx, word [ecx + eax*2]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 0xc
cmp eax, 3
jne 0x401496
mov ecx, dword [ebp - 0xc]
and ecx, 0xfff
add ecx, 0x638f
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x638f
mov dword [ebp - 8], edx
cmp dword [ebp - 4], 0
jne 0x401477
push 0x20e
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401477
xor eax, eax
jmp 0x40149b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx], eax
jmp 0x40140d
mov esp, ebp
pop ebp
ret
Function at 0x401810
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4360e0], 0x24e1
mov eax, dword [0x4360e0]
sub eax, 0x24e1
mov dword [0x4360e0], eax
mov ecx, 1
test ecx, ecx
je 0x4018bb
mov edx, dword [0x4360e0]
cmp edx, dword [ebp + 0xc]
jb 0x401847
jmp 0x4018bb
cmp dword [0x4360e0], 0
jne 0x401865
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401865
xor eax, eax
jmp 0x4018bb
mov eax, dword [ebp + 8]
add eax, dword [0x4360e0]
mov ecx, dword [eax]
add ecx, dword [0x4360e0]
mov edx, dword [ebp + 8]
add edx, dword [0x4360e0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x6c6da
mov eax, dword [0x4360e0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4360e0]
push eax
call fcn.004015c0
add esp, 8
mov ecx, dword [0x4360e0]
add ecx, 4
mov dword [0x4360e0], ecx
jmp 0x40182d
mov esp, ebp
pop ebp
ret
Function at 0x401e70
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401ee0
xor eax, eax
jmp 0x401fc1
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
jne 0x401ef8
xor eax, eax
jmp 0x401fc1
push ebp
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
add eax, 0x638f
call fcn.004018c0
mov esp, ebp
pop ebp
ret
Function at 0x19c9058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x19c91a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x19c907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x19c906a
add dl, dl
jne 0x19c9089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x19c90dc
xor eax, eax
add dl, dl
jne 0x19c9096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x19c917d
add dl, dl
jne 0x19c90a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19c90b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19c90bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19c90c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x19c90d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x19c9075
mov eax, 1
add dl, dl
jne 0x19c90ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x19c90f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x19c90e1
sub eax, ebx
mov ebx, 1
jne 0x19c9128
mov ecx, 1
add dl, dl
jne 0x19c910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x19c9119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x19c9105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x19c9075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x19c913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x19c914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x19c9136
cmp eax, 0x7d00
jae 0x19c916d
cmp eax, 0x500
jb 0x19c9168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x19c9075
cmp eax, 0x7f
ja 0x19c9170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x19c9075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x19c919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x19c9075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401350
Capabilities:
Get hostname

Disassembly:
sub esp, 0x14
mov al, 0xff
xor ecx, ecx
mov byte [0x49d4d8], al
mov byte [0x49d4d9], al
xor eax, eax
mov dword [0x48d0a0], ecx
mov dword [0x48b960], eax
mov dword [0x48d0a4], ecx
mov dword [0x48b964], eax
mov dword [0x48d0a8], ecx
mov dword [0x48b968], eax
lea edx, [esp]
mov dword [0x48b96c], eax
push esi
mov dword [0x48b970], eax
lea eax, [esp + 8]
xor esi, esi
mov dword [0x48d0ac], ecx
push edx
push eax
mov dword [0x48b94c], esi
mov dword [0x49d4dc], 0xffffffff
mov dword [0x48bd18], esi
mov dword [0x48b984], esi
mov dword [0x48d1c4], esi
mov dword [0x48d1f4], esi
mov dword [0x49e7f0], esi
mov dword [0x43b810], esi
mov dword [0x49d4c4], esi
mov dword [0x49d4e0], esi
mov dword [0x48d0b0], ecx
mov dword [0x48be70], esi
mov dword [esp + 0xc], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [esp + 8]
push 0x14
push ecx
push 0x48bd00
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [0x48bd44], esi
mov eax, 1
pop esi
add esp, 0x14
ret

Function at 0x401430
Capabilities:
Get common file path
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x2110
call fcn.0041e000
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push DirectSoundCreate
push str.KDERB.DAT
call fcn.004019b0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
jne 0x4012ad
push edi
mov ecx, 0x800
or eax, 0xffffffff
lea edi, [esp + 0x11c]
rep stosd dword es:[edi], eax
pop edi
jmp 0x4012cb
lea eax, [esp + 0xc]
push 0
push eax
lea ecx, [esp + 0x120]
push 0x2000
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call ebx
lea edx, [esp + 0x10]
push 0x105
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
push 0x438cdc
push eax
call esi
lea ecx, [esp + 0x10]
push str.GameNet.Lck
push ecx
call esi
push 0
push 0x80
push 2
push 0
push 0
lea edx, [esp + 0x24]
push 0x40000000
push edx
call fcn.004019b0
mov esi, eax
add esp, 0x1c
cmp esi, 0xffffffff
je 0x40133d
lea eax, [esp + 8]
push 0
push eax
lea ecx, [esp + 0x120]
push 0x2000
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call ebx
pop esi
pop ebx
add esp, 0x2110
ret
mov eax, dword [0x49e7f0]
test eax, eax
je 0x401457
mov eax, dword [0x48b984]
mov edx, dword [0x49d4d0]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [0x49e7f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x48d1f4]
test eax, eax
je 0x40147a
mov eax, dword [0x48b984]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov edx, dword [0x48d1f4]
push edx
call fcn.0041e02f
add esp, 4
mov eax, dword [0x48b984]
test eax, eax
je 0x401489
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [0x48d1c4]
test eax, eax
je 0x40149b
push eax
call fcn.0041e02f
add esp, 4
mov eax, dword [0x43b810]
test eax, eax
je 0x4014ad
push eax
call fcn.0041e02f
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x48be70]
test eax, eax
je 0x4014c1
jmp 0x401260
ret