joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434500
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
test ebx, ebx
push edi
je 0x434515
mov dword [ebx], 0
call fcn.00438a10
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
je 0x434631
mov esi, dword [esp + 0x30]
lea ebp, [esi + 0x64]
cmp esi, ebp
jge 0x43458f
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push 0
push eax
push esi
push ebx
call fcn.004349b0
add esp, 0x10
push 0x7f000001
call sub.WSOCK32.dll_htonl
cmp dword [esp + 0x18], eax
jne 0x434568
mov dword [esp + 0x18], 0
lea ecx, [esp + 0x14]
push 0x10
push ecx
push edi
call sub.WSOCK32.dll_bind
test eax, eax
je 0x43458b
inc esi
cmp esi, ebp
jl 0x43453f
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x14
ret
mov ebx, dword [esp + 0x28]
test esi, esi
jne 0x4345cf
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push edi
mov dword [esp + 0x1c], 0x10
call sub.WSOCK32.dll_getsockname
test eax, eax
je 0x4345bc
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x16]
push ecx
call sub.WSOCK32.dll_ntohs
mov si, ax
and esi, 0xffff
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
push edi
push edi
push esi
push ebx
call fcn.00434640
add esp, 0x2c
test ebx, ebx
jne 0x43460e
mov dword [esp + 0x28], 0x56235c
mov ebx, dword [esp + 0x28]
mov eax, dword [ebx]
add eax, 0xec
push eax
push 0x6cfc
push 0x562360
push edi
call fcn.00434990
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret

Function at 0x4347c0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x120
push ebx
push esi
mov esi, dword [esp + 0x12c]
xor ebx, ebx
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], ebx
mov eax, dword [esi + 0xe4]
mov dword [esp + 0x10], ebx
cmp eax, ebx
je 0x434853
mov eax, dword [esi]
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x24]
push ecx
push ebx
push ebx
push edx
push 0x40
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x434853
cmp eax, ebx
je 0x434853
mov edx, dword [esi]
lea eax, [esp + 8]
lea ecx, [esp + 0x14]
push eax
push ecx
push ebx
push 0xff
push 0x5928c8
push edx
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
je 0x4347f9
lea ecx, [esp + 0x14]
mov byte [eax + 0x5928c8], bl
push ecx
push eax
push 0x5928c8
push esi
call fcn.00434cb0
add esp, 0x10
jmp 0x4347f9
pop esi
pop ebx
add esp, 0x120
ret
Function at 0x4349b0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push eax
xor ebp, ebp
mov word [ebx], 2
call sub.WSOCK32.dll_htons
mov esi, dword [esp + 0x10]
mov word [ebx + 2], ax
cmp esi, ebp
jne 0x4349d9
mov dword [ebx + 4], ebp
jmp 0x4349e2
push esi
call sub.WSOCK32.dll_inet_addr
mov dword [ebx + 4], eax
cmp dword [ebx + 4], 0xffffffff
jne 0x434a18
push edi
mov edi, str.255.255.255.255
mov ecx, 0x10
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
je 0x434a18
mov eax, dword [esp + 0x10]
push eax
call sub.WSOCK32.dll_gethostbyname
mov ebp, eax
test ebp, ebp
jne 0x434a0e
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x434a22
mov dword [eax], ebp
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x434b20
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x110
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x434b2c
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
push edi
mov byte [esp + 0x10], 0
xor esi, esi
lea edi, [esp + 0x20]
mov ebp, pe_nt_image_headers32
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x124]
and eax, 0xff
xor ecx, ecx
mov cl, byte [eax + edx]
xor edx, edx
mov dl, byte [edi]
add esi, ecx
add edx, esi
and edx, 0x800000ff
jns 0x434b7e
dec edx
or edx, 0xffffff00
inc edx
inc eax
mov byte [esp + 0x14], dl
cdq
idiv ebx
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esp + esi + 0x20]
push eax
push edi
mov byte [esp + 0x18], dl
call fcn.00434c90
add esp, 8
inc edi
dec ebp
jne 0x434b51
mov eax, dword [esp + 0x130]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x18], esi
jle 0x434c7a
xor edi, edi
xor ebx, ebx
mov edx, dword [esp + 0x12c]
xor ecx, ecx
mov cl, byte [esi + edx]
lea eax, [ecx + edi + 1]
and eax, 0x800000ff
jns 0x434bdd
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x10], al
xor ecx, ecx
mov edi, dword [esp + 0x10]
and edi, 0xff
mov cl, byte [esp + edi + 0x20]
lea ebp, [esp + edi + 0x20]
add ecx, ebx
and ecx, 0x800000ff
jns 0x434c07
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
and ebx, 0xff
lea eax, [esp + ebx + 0x20]
push eax
push ebp
mov dword [esp + 0x24], eax
call fcn.00434c90
mov ecx, dword [esp + 0x24]
xor edx, edx
mov dl, byte [ebp]
xor eax, eax
mov al, byte [ecx]
add esp, 8
add edx, eax
and edx, 0x800000ff
jns 0x434c46
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x12c]
and edx, 0xff
mov dl, byte [esp + edx + 0x20]
mov cl, byte [esi + eax]
xor cl, dl
mov byte [esi + eax], cl
mov eax, dword [esp + 0x18]
inc eax
movsx esi, ax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x130]
cmp esi, eax
jl 0x434bbf
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x435010
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x50
or ecx, 0xffffffff
xor eax, eax
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4350a4
push ebx
mov ebx, dword [esp + 0x60]
push esi
lea ecx, [esp + 0x10]
mov edi, dword [ebx + 0xe0]
inc edi
mov eax, edi
mov dword [ebx + 0xe0], edi
push eax
mov eax, dword [ebx + 0xdc]
push eax
push str.queryid_d._d
push ecx
call fcn.00532cbe
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x6c]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [ebx]
push ebp
push ecx
call sub.WSOCK32.dll_sendto
pop esi
mov byte [ebp], 0
pop ebx
pop edi
pop ebp
add esp, 0x50
ret

Function at 0x4354f0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x100
lea edx, [esp]
push esi
mov esi, dword [esp + 0x108]
push edi
mov ecx, dword [esi + 0xe4]
lea eax, [esi + 8]
push eax
push ecx
push str.heartbeat_dgamename_s
push edx
call fcn.00532cbe
mov eax, dword [esp + 0x120]
add esp, 0x10
test eax, eax
je 0x435548
push eax
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str._statechanged_d
lea eax, [esp + ecx + 0x10]
push eax
call fcn.00532cbe
add esp, 0xc
lea ecx, [esi + 0xec]
push 0x10
push ecx
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi + 4]
push 0
not ecx
dec ecx
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call sub.WSOCK32.dll_sendto
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0xd8], eax
pop edi
pop esi
add esp, 0x100
ret

Function at 0x435770
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x3a
push edi
call fcn.00533530
mov esi, eax
add esp, 8
test esi, esi
je 0x4357a4
push edi
mov byte [esi], 0
call sub.WSOCK32.dll_inet_addr
mov edi, dword [esp + 0xc]
inc esi
push esi
mov dword [edi], eax
call fcn.0053322b
add esp, 4
mov word [edi + 4], ax
pop edi
pop esi
ret

Function at 0x435ea0
Capabilities:
Create udp socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebp, ebp
xor ebx, ebx
mov eax, dword [esi + 0x6c]
push edi
cmp eax, ebp
jle 0x435f01
xor edi, edi
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
mov ecx, dword [esi + 8]
mov dword [edi + ecx], eax
mov edx, dword [esi + 8]
mov ecx, dword [edx + edi]
lea eax, [edx + edi]
cmp ecx, 0xffffffff
je 0x435ef0
mov dword [eax + 4], ebp
mov eax, dword [esi + 8]
inc ebx
mov dword [eax + edi + 8], ebp
mov eax, dword [esi + 0x6c]
add edi, 0x1c
cmp ebx, eax
jl 0x435eb5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp ebx, ebp
jne 0x435efe
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov dword [esi + 0x6c], ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x436230
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ecx
push 0x11
push 2
push 2
mov dword [esp + 0xc], 1
call sub.WSOCK32.dll_socket
mov ecx, dword [esp + 8]
cmp eax, 0xffffffff
mov dword [ecx + 0x88], eax
jne 0x43625a
mov eax, 1
pop ecx
ret
lea edx, [esp]
push 4
push edx
push 0x20
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
neg eax
sbb eax, eax
neg eax
pop ecx
ret

Function at 0x436280
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x28]
mov esi, eax
and eax, 0xffff
cmp eax, edi
mov word [esp + 0xc], 2
mov dword [esp + 0x10], 0xffffffff
jg 0x4362e7
push ebp
mov ebp, dword [esp + 0x30]
push esi
call sub.WSOCK32.dll_htons
mov ecx, dword [ebx + 0x88]
mov word [esp + 0x12], ax
lea eax, [esp + 0x10]
push 0x10
push eax
push 0
push 8
push str._status_
push ecx
call sub.WSOCK32.dll_sendto
add esi, ebp
mov edx, esi
and edx, 0xffff
cmp edx, edi
jle 0x4362b1
pop ebp
push 2
push ebx
call fcn.00436170
add esp, 8
call sub.KERNEL32.dll_GetTickCount
pop edi
mov dword [ebx + 0x8c], eax
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x4364a0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push eax
call sub.WSOCK32.dll_inet_addr
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, eax
push ebp
push ebx
push esi
call fcn.00436360
mov edi, eax
mov eax, dword [esi]
add esp, 0xc
test eax, eax
jne 0x43656e
push esi
call fcn.00435ea0
add esp, 4
test eax, eax
jne 0x436625
cmp edi, 0xffffffff
je 0x436523
mov ecx, dword [esi + 4]
push edi
push ecx
call fcn.0042fc80
mov eax, dword [eax]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
push edi
mov dword [eax + 8], edx
mov eax, dword [esp + 0x24]
mov word [eax + 6], 0x270f
mov ecx, dword [esi + 4]
push ecx
call fcn.0042fdd0
mov eax, dword [esi + 4]
lea edx, [esp + 0x28]
push edx
push eax
call fcn.0042fca0
add esp, 0x18
jmp 0x436533
mov ecx, dword [esp + 0x24]
push ecx
push ebp
push ebx
push esi
call fcn.00436310
add esp, 0x10
mov edx, dword [esi + 4]
push edx
call fcn.0042fc70
dec eax
push 3
push esi
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], 0
call fcn.00436170
mov eax, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x436623
push esi
call fcn.00436190
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp edi, 0xffffffff
jne 0x4365ab
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0x70]
push eax
push ecx
push ebp
push ebx
push esi
call fcn.00436630
mov eax, dword [esi]
add esp, 0x14
cmp eax, 1
je 0x436597
cmp eax, 2
jne 0x436623
mov eax, dword [esi + 0x98]
pop edi
inc eax
mov dword [esi + 0x98], eax
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edx, dword [esi + 4]
push edi
push edx
call fcn.0042fc80
mov ecx, dword [esi + 0x70]
mov eax, dword [eax]
add esp, 8
cmp edi, ecx
mov dword [esp + 0x18], eax
jge 0x436623
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov edx, dword [esp + 0x18]
mov word [edx + 6], 0x270f
mov eax, dword [esp + 0x18]
push eax
push esi
call fcn.00436470
add esp, 8
cmp eax, 0xffffffff
je 0x4365fd
mov edx, dword [esi + 8]
lea ecx, [eax*8]
sub ecx, eax
mov dword [edx + ecx*4 + 4], 0
mov eax, dword [esi + 0x70]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push eax
push ecx
push edx
call fcn.0042fcc0
mov eax, dword [esi + 4]
push edi
push eax
call fcn.0042fdd0
mov eax, dword [esi + 0x70]
add esp, 0x14
dec eax
mov dword [esi + 0x70], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x437810
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x10]
lea edx, [ebx + eax*4]
push edi
mov ebp, dword [esi + 0x4c0]
mov eax, dword [esi + 0x4c4]
mov ecx, dword [esi + 0x4c8]
mov edi, dword [esi + 0x4cc]
cmp ebx, edx
mov dword [esp + 0x1c], edx
jae 0x43795e
cmp edi, 0x10000
jae 0x4378c4
lea ebx, [esi + ebp*4 + 0x440]
add eax, edi
mov dword [ebx + 0x40], edi
add ecx, eax
add edi, edi
mov edx, ecx
add eax, ecx
mov dword [ebx], ecx
mov dword [ebx - 0x40], eax
shl edx, 0x18
shr ecx, 8
or edx, ecx
mov ecx, eax
and ecx, 0xff
inc ebp
add ebx, 4
xor eax, dword [esi + ecx*4]
mov ecx, edx
and ecx, 0xff
xor edx, dword [esi + ecx*4]
mov ecx, edx
shl ecx, 0x18
shr edx, 8
or ecx, edx
mov edx, eax
shr edx, 0x18
shl eax, 8
or edx, eax
mov eax, edx
and eax, 0xff
xor edx, dword [esi + eax*4]
mov eax, ecx
and eax, 0xff
xor ecx, dword [esi + eax*4]
mov eax, edx
shr eax, 0x18
shl edx, 8
or eax, edx
cmp edi, 0x10000
jb 0x437856
xor ecx, eax
mov eax, dword [esp + 0x18]
mov dword [eax], ecx
add eax, 4
dec ebp
mov dword [esp + 0x18], eax
jns 0x4378d8
xor ebp, ebp
mov eax, dword [esi + ebp*4 + 0x400]
mov edi, dword [esi + ebp*4 + 0x440]
not eax
mov ecx, eax
shl ecx, 0x18
shr eax, 8
or ecx, eax
mov eax, edi
mov edx, ecx
and eax, 0xff
and edx, 0xff
mov ebx, dword [esi + edx*4]
xor ecx, ebx
mov ebx, dword [esi + eax*4]
mov eax, ecx
xor edi, ebx
shl eax, 0x18
shr ecx, 8
or eax, ecx
mov edx, edi
mov ecx, eax
shr edx, 0x18
shl edi, 8
and ecx, 0xff
or edx, edi
mov ebx, dword [esi + ecx*4]
mov ecx, edx
and ecx, 0xff
xor eax, ebx
mov ebx, dword [esi + ecx*4]
xor edx, ebx
mov ebx, dword [esp + 0x18]
mov ecx, edx
shr ecx, 0x18
shl edx, 8
or ecx, edx
mov edx, dword [esi + ebp*4 + 0x480]
lea edi, [edx + edx + 1]
mov edx, dword [esp + 0x1c]
cmp ebx, edx
jb 0x437847
mov dword [esi + 0x4cc], edi
mov dword [esi + 0x4c0], ebp
mov dword [esi + 0x4c4], eax
mov dword [esi + 0x4c8], ecx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x437980
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x18]
push edi
xor edx, edx
mov ecx, pe_nt_image_headers32
xor eax, eax
mov edi, esi
mov dword [esi + 0x514], edx
mov dword [esp + 0x1c], edx
rep stosd dword es:[edi], eax
xor eax, eax
mov ecx, dword [esi + eax*4]
shl ecx, 8
add ecx, eax
mov dword [esi + eax*4], ecx
inc eax
cmp eax, 0x100
jl 0x4379a5
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], 2
xor ecx, ecx
mov eax, ecx
xor edx, edx
div dword [esp + 0x18]
mov ebx, dword [esi + ecx*4]
mov dl, byte [edx + ebp]
add edx, ebx
add edx, edi
and edx, 0xff
inc ecx
mov edi, edx
cmp ecx, 0x100
mov eax, dword [esi + edi*4]
mov dword [esi + ecx*4 - 4], eax
mov dword [esi + edi*4], ebx
jl 0x4379c6
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x4379c4
mov eax, dword [esp + 0x1c]
inc eax
cmp eax, 4
mov dword [esp + 0x1c], eax
jl 0x4379a3
xor eax, eax
mov edi, dword [esi + eax*4]
xor edi, eax
mov dword [esi + eax*4], edi
inc eax
cmp eax, 0x100
jl 0x437a0e
push 0
push 0
push esi
call fcn.004376d0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x437de0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x438a10
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
add esp, 0x190
ret
Function at 0x4454c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
push eax
push 1
push 0
push str.SoftwareElectronic_ArtsEA_GamesMedal_of_Honor_Allied_Assault_Spearheadergc
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
je 0x445520
lea ecx, [esp + 8]
push ecx
push 1
push 0
push str.SOFTWAREElectronic_ArtsEA_GamesMOHDA_En_Formationergc
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
je 0x445520
mov edx, dword [esp + 0x118]
push str.CDKEY_NOT_FOUND__n
mov byte [edx], 0
call fcn.0045b2a0
add esp, 4
pop edi
pop esi
add esp, 0x10c
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push 0
push 0
push eax
mov dword [esp + 0x24], pe_nt_image_headers32
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44557f
push str.Unable_to_find_the_CD_key_value__n
call fcn.0045b2a0
mov ecx, dword [esp + 0x11c]
add esp, 4
pop edi
mov byte [ecx], 0
pop esi
add esp, 0x10c
ret
mov edx, dword [esp + 0xc]
cmp edx, 0xfe
jle 0x445594
mov edx, 0xfe
mov dword [esp + 0xc], edx
push ebx
mov ebx, dword [esp + 0x11c]
mov ecx, 0x40
xor eax, eax
mov edi, ebx
test edx, edx
rep stosd dword es:[edi], eax
jle 0x4455c1
mov ecx, edx
lea esi, [esp + 0x18]
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4455c4
mov byte [ebx], 0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
add esp, 0x10c
ret
Function at 0x4535e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
mov ebx, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
xor eax, eax
mov al, byte [edi]
shr eax, 7
lea ecx, [ebx + eax*8]
lea eax, [edx + ecx*8]
xor edx, edx
mov dx, word [eax*8 + 0x10b38e0]
xor ecx, ecx
lea eax, [eax*8 + 0x10b38e0]
mov esi, edx
and esi, 1
mov ebp, esi
mov cx, word [eax + 4]
shl ebp, 6
sub ebp, esi
xor esi, esi
mov si, word [eax + 2]
add ebp, esi
xor esi, esi
mov si, word [edi + ebp*2 + 0x34]
and esi, edx
mov edx, ecx
and esi, 0xfffffffe
neg esi
sbb esi, esi
and edx, 1
mov ebp, edx
and esi, 2
shl ebp, 6
sub ebp, edx
xor edx, edx
mov dx, word [eax + 6]
xor eax, eax
add ebp, edx
mov ax, word [edi + ebp*2 + 0x34]
pop edi
and eax, ecx
mov ecx, dword [esp + 0x1c]
and al, 0xfe
neg eax
sbb eax, eax
add ebx, ecx
mov ecx, dword [esp + 0x10]
and eax, 4
or esi, eax
and ebx, 1
or esi, ebx
mov eax, dword [esi*4 + 0x5670e0]
pop esi
pop ebp
cmp eax, 2
mov dword [ecx + 0x20], eax
pop ebx
jne 0x4536af
mov eax, dword [esp + 8]
fld dword [ecx + 8]
fmul dword [eax + 8]
fld dword [ecx + 4]
fmul dword [eax + 4]
faddp st(1)
fld dword [ecx]
fmul dword [eax]
faddp st(1)
fcomp dword [ecx + 0xc]
fnstsw ax
test ah, 5
jp 0x4536d0
mov dword [ecx + 0x20], 1
ret
cmp eax, 5
je 0x4536b9
cmp eax, 6
jne 0x4536d0
mov edx, dword [ecx + 0x10]
mov eax, dword [ecx + 0x14]
mov dword [ecx], edx
mov edx, dword [ecx + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0x1c]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
ret
Function at 0x45b7d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x10ab884]
test eax, eax
jne 0x45b7fc
push str.Server_quit_n
call fcn.004871b0
call fcn.00445d60
call fcn.004911e0
call fcn.0045d020
push 1
call fcn.00462150
add esp, 8
jmp 0x4932d0
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
call fcn.00528b30
call fcn.00528890
call fcn.005275c0
call fcn.004673f0
call fcn.004907c0
call fcn.00499e20
call fcn.0046bfd0
mov eax, dword [0x99a5a8]
test eax, eax
jne 0x493309
call fcn.0042dc90
push 0
call fcn.00536ed0

Function at 0x46b180
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x48f5c0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push ebx
push eax
xor ebx, ebx
push 0x997460
push str.PATH
push ebx
mov byte [0x997460], bl
mov dword [esp + 0x18], pe_nt_image_headers32
call fcn.0048f760
add esp, 0x10
test eax, eax
je 0x48f6c5
push str.mohaa.exe
push 0x997460
push 0x571910
lea ecx, [esp + 0x18]
push pe_nt_image_headers32
push ecx
call fcn.00474640
lea edx, [esp + 0x20]
push 0x57190c
push edx
call fcn.0053504d
add esp, 0x1c
cmp eax, ebx
je 0x48f6bf
mov cl, byte [0x997460]
push eax
mov byte [esp + 8], cl
mov byte [esp + 9], 0x3a
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], bl
call fcn.00534f9f
add esp, 4
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x48f6bf
push edi
mov edi, 0x997460
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x48f698
cmp byte [edx + 0x997460], 0x5c
jne 0x48f684
mov byte [edx + 0x997460], 0x2f
mov edi, 0x997460
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jb 0x48f674
dec edx
pop edi
cmp edx, ebx
jle 0x48f6ac
cmp byte [edx + 0x997460], 0x2f
jne 0x48f6ac
dec edx
cmp edx, ebx
jg 0x48f69e
mov byte [edx + 0x997461], bl
mov eax, 0x997460
pop ebx
add esp, 0x108
ret
mov byte [0x997460], bl
mov eax, 0x997460
pop ebx
add esp, 0x108
ret

Function at 0x48f6e0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x48f6f9
lea eax, [esp + 4]
push eax
push str.SoftwareEA_GamesMedal_of_Honor_Allied_Assault_Spearhead2.0
push bind
jmp 0x48f708
lea ecx, [esp + 4]
push ecx
push str.SoftwareEA_GamesMedal_of_Honor_Allied_Assault_Spearhead2.0
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x48f715
xor eax, eax
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
xor eax, eax
push esi
test edx, edx
mov edx, dword [esp + 0x14]
sete al
push edx
mov edx, dword [esp + 0x10]
lea eax, [eax + eax + 1]
push ecx
push eax
mov eax, dword [esp + 0x14]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
ret