joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e00
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [esp + 4]
lea edx, [eax + eax*4]
lea edx, [edx + edx*8]
shl edx, 1
sub edx, eax
mov ax, word [ecx + edx*8 + 0xda]
cmp ax, 0x3e
jne 0x409e24
mov eax, 1
ret 4
cmp ax, 0x3f
jne 0x409e32
mov eax, 1
ret 4
cmp ax, 0x40
jne 0x409e40
mov eax, 1
ret 4
cmp ax, 0x5b
jne 0x409e4e
mov eax, 1
ret 4
cmp ax, 0x5c
jne 0x409e5c
mov eax, 1
ret 4
cmp ax, 0x5d
jne 0x409e6a
mov eax, 1
ret 4
cmp ax, 0x5e
jne 0x409e78
mov eax, 1
ret 4
cmp ax, 0x5f
jne 0x409e86
mov eax, 1
ret 4
cmp ax, 0x60
jne 0x409e94
mov eax, 1
ret 4
cmp ax, 0x61
jne 0x409ea2
mov eax, 1
ret 4
cmp ax, 0x62
jne 0x409eb0
mov eax, 1
ret 4
cmp ax, 0x41
jne 0x409ebe
mov eax, 1
ret 4
cmp ax, 0x42
jne 0x409ecc
mov eax, 1
ret 4
cmp ax, 0x64
jne 0x409eda
mov eax, 1
ret 4
cmp ax, 0x65
jne 0x409ee8
mov eax, 1
ret 4
cmp ax, 0x67
jne 0x409ef6
mov eax, 1
ret 4
cmp ax, 0x68
jne 0x409f04
mov eax, 1
ret 4
cmp ax, 0x1b
jne 0x409f12
mov eax, 1
ret 4
xor ecx, ecx
cmp ax, 0x66
sete cl
mov eax, ecx
ret 4
Function at 0x40ab70
Capabilities:
Parse credit card information

Disassembly:
mov eax, 0xb22c80
xor edx, edx
mov dword [eax - 4], edx
mov dword [eax], edx
mov dword [eax + 4], edx
add eax, 0x1758
cmp eax, 0xb2e740
jl 0x40ab75
mov eax, dword [ecx + 4]
push ebx
push esi
push edi
mov edi, 1
cmp eax, edi
jle 0x40acaf
lea esi, [ecx + 0x3a2]
mov ax, word [esi - 2]
test ax, ax
je 0x40ac9d
cmp ax, 3
je 0x40ac9d
mov ax, word [esi]
cmp ax, 0x3e
jne 0x40abcc
or eax, 0xffffffff
jmp 0x40ac69
cmp ax, 0x3f
jne 0x40abda
or eax, 0xffffffff
jmp 0x40ac69
cmp ax, 0x40
jne 0x40abe8
or eax, 0xffffffff
jmp 0x40ac69
cmp ax, 0x5b
jne 0x40abf3
or eax, 0xffffffff
jmp 0x40ac69
cmp ax, 0x5c
jne 0x40abfe
or eax, 0xffffffff
jmp 0x40ac69
cmp ax, 0x5d
jne 0x40ac09
or eax, 0xffffffff
jmp 0x40ac69
cmp ax, 0x5e
jne 0x40ac14
or eax, 0xffffffff
jmp 0x40ac69
cmp ax, 0x5f
jne 0x40ac1f
or eax, 0xffffffff
jmp 0x40ac69
cmp ax, 0x60
jne 0x40ac2a
or eax, 0xffffffff
jmp 0x40ac69
cmp ax, 0x61
jne 0x40ac35
or eax, 0xffffffff
jmp 0x40ac69
cmp ax, 0x62
jne 0x40ac40
or eax, 0xffffffff
jmp 0x40ac69
cmp ax, 0x41
je 0x40ac64
cmp ax, 0x42
je 0x40ac64
cmp ax, 0x64
je 0x40ac64
cmp ax, 0x65
je 0x40ac64
cmp ax, 0x67
je 0x40ac64
cmp ax, 0x68
jne 0x40ac9d
mov eax, 1
movsx edx, word [esi + 4]
test eax, eax
jge 0x40ac87
mov eax, edx
shl eax, 5
sub eax, edx
lea eax, [edx + eax*8]
lea eax, [eax + eax*2]
inc dword [eax*8 + 0xb21524]
jmp 0x40ac9d
jle 0x40ac9d
mov eax, edx
shl eax, 5
sub eax, edx
lea eax, [edx + eax*8]
lea eax, [eax + eax*2]
inc dword [eax*8 + 0xb21528]
mov eax, dword [ecx + 4]
inc edi
add esi, 0x2c8
cmp edi, eax
jl 0x40aba4
mov ebx, 0x12b10e8
mov esi, 0xb22c84
mov eax, dword [esi + 0x4c]
mov edi, dword [esi - 4]
cdq
and edx, 0xf
add eax, edx
mov ecx, eax
mov eax, dword [esi - 8]
sar ecx, 4
inc ecx
sub edi, eax
jns 0x40acf6
neg edi
mov eax, edi
cdq
idiv ecx
neg eax
mov dword [esi], eax
mov eax, edi
cdq
idiv ecx
sub ecx, edx
mov dword [esi + 4], ecx
mov eax, dword [esi]
cmp eax, 0xfffffffb
jge 0x40ad21
mov dword [esi], 0xfffffffb
jmp 0x40ad21
test edi, edi
jle 0x40ad1a
mov eax, edi
cdq
idiv ecx
mov dword [esi], eax
mov eax, edi
cdq
idiv ecx
sub ecx, edx
mov dword [esi + 4], ecx
mov eax, dword [esi]
cmp eax, 5
jle 0x40ad21
mov dword [esi], 5
jmp 0x40ad21
mov dword [esi + 4], 0
mov eax, dword [esi + 0xc4]
test eax, eax
je 0x40ad6e
mov ecx, eax
mov edx, dword [esi + 0xc8]
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*4]
shl eax, 2
cmp edx, dword [eax + 0x12bc638]
jne 0x40ad6e
cmp word [eax + 0x12bc62c], 2
jne 0x40ad6e
mov eax, dword [esi]
test eax, eax
jle 0x40ad66
cmp eax, dword [ebx - 0x264]
jle 0x40ad6e
mov dword [ebx - 0x264], eax
jmp 0x40ad6e
jge 0x40ad6e
cmp eax, dword [ebx]
jge 0x40ad6e
mov dword [ebx], eax
add esi, 0x1758
add ebx, 4
cmp esi, 0xb2e744
jl 0x40acb9
pop edi
pop esi
pop ebx
ret
Function at 0x448360
Capabilities:
Check http status code

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x11f40]
test eax, eax
jne 0x448377
call fcn.00404d50
jmp 0x448521
cmp eax, 0xa
jl 0x448394
cmp eax, 0x13
jge 0x448394
add eax, 0xfffffff6
mov ecx, 0x12bc308
push eax
call fcn.0051f5f0
jmp 0x448521
cmp eax, 0x14
jne 0x4483a5
mov ecx, esi
call fcn.00404d50
jmp 0x448521
cmp eax, 0x19
jne 0x4483b9
mov ecx, 0x11b9ad0
call fcn.004af4e0
jmp 0x448521
cmp eax, 0x1e
jne 0x4483ca
mov ecx, esi
call fcn.00404d50
jmp 0x448521
cmp eax, 0x28
jne 0x4483de
mov ecx, 0xcdfd50
call fcn.004d1620
jmp 0x448521
cmp eax, 0x32
jne 0x4483ef
mov ecx, esi
call fcn.00404d50
jmp 0x448521
cmp eax, 0x3c
jl 0x44840c
cmp eax, 0x45
jge 0x44840c
add eax, 0xffffffc4
mov ecx, 0x12bc308
push eax
call fcn.0051f5f0
jmp 0x448521
cmp eax, 0x46
jne 0x44841d
mov ecx, esi
call fcn.00404d50
jmp 0x448521
cmp eax, 0x50
jne 0x44842e
mov ecx, esi
call fcn.004499d0
jmp 0x448521
cmp eax, 0x5a
jne 0x44843f
mov ecx, esi
call fcn.00404d50
jmp 0x448521
cmp eax, 0x5f
jne 0x448450
mov ecx, esi
call fcn.0044a210
jmp 0x448521
cmp eax, 0x64
jne 0x448461
mov ecx, esi
call fcn.00404d50
jmp 0x448521
jl 0x44847b
cmp eax, 0x6d
jge 0x44847b
add eax, 0xffffff9c
mov ecx, 0x12bc308
push eax
call fcn.0051f5f0
jmp 0x448521
cmp eax, 0x6e
jl 0x44849a
cmp eax, 0x96
jge 0x44849f
add eax, 0xffffff92
mov ecx, 0xa196f0
push eax
call fcn.004e3bb0
jmp 0x448521
cmp eax, 0x96
jne 0x4484ad
mov ecx, 0xa196f0
call fcn.004e4010
jmp 0x448521
cmp eax, 0x97
jne 0x4484c0
mov ecx, 0xa196f0
call fcn.004e4110
jmp 0x448521
cmp eax, 0x98
jne 0x4484d3
mov ecx, 0xa196f0
call fcn.004e5730
jmp 0x448521
cmp eax, 0xa0
jl 0x4484f3
cmp eax, 0xa9
jge 0x4484f3
add eax, 0xffffff60
mov ecx, 0x12bc308
push eax
call fcn.0051f5f0
jmp 0x448521
cmp eax, 0xaa
jne 0x448503
mov ecx, esi
call fcn.00404d50
jmp 0x448521
cmp eax, 0xb4
jne 0x448513
mov ecx, esi
call fcn.00449800
jmp 0x448521
cmp eax, 0xbe
jne 0x448521
mov ecx, esi
call fcn.0044b790
mov eax, dword [0x1215de0]
test eax, eax
je 0x448534
mov ecx, 0x12157c8
call fcn.00467d90
mov ecx, dword [esi + 0x11f40]
inc ecx
mov eax, ecx
mov dword [esi + 0x11f40], ecx
cmp eax, 0xc8
jl 0x448569
mov dword [esi + 0x11f40], 0
mov eax, dword [0x1215de0]
test eax, eax
je 0x448569
push 0
mov ecx, 0x12157c8
call fcn.00467e90
mov edx, dword [esi + 0xd568]
inc edx
mov dword [esi + 0xd568], edx
mov eax, dword [0xb08954]
cmp eax, 1
je 0x4485f7
cmp eax, 6
je 0x4485f7
mov eax, dword [esi + 0x11f40]
test eax, eax
jne 0x448594
push eax
push 1
jmp 0x448597
push eax
push 0
mov ecx, esi
call fcn.00448180
mov eax, dword [esi + 0xd558]
test eax, eax
je 0x4485d5
mov ecx, esi
call fcn.0044a610
mov ecx, esi
call fcn.00449dd0
mov ecx, esi
call fcn.0044b050
mov ecx, esi
call fcn.0044a580
mov ecx, 0x143b720
call fcn.0040ab70
mov ecx, esi
call fcn.0044a670
mov eax, dword [esi + 0xd550]
test eax, eax
je 0x4485e9
mov ecx, 0x143b720
call fcn.00410670
mov ecx, esi
call fcn.0044a710
mov ecx, esi
call fcn.004495e0
pop esi
ret
Function at 0x458c20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
push 0x10
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call edi
test ax, ax
je 0x458c46
mov dword [esi + 8], 1
push 0x11
call edi
test ax, ax
je 0x458c56
mov dword [esi + 4], 1
push 0x12
call edi
test ax, ax
je 0x458c66
mov dword [esi + 0xc], 1
push 0x28
call edi
test ax, ax
jne 0x458c72
mov dword [esi + 0x10], ebx
push 0x56
call edi
test ax, ax
jne 0x458c7e
mov dword [esi + 0x14], ebx
pop edi
pop esi
pop ebx
ret

Function at 0x45c680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc]
push ebx
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp ebx, 0x100
jl 0x45c7df
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], eax
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], eax
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], eax
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], eax
mov dword [edi + 0x80], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
mov dword [edi + 0x8c], eax
mov dword [edi + 0x90], eax
mov dword [edi + 0x94], eax
mov dword [edi + 0x98], eax
mov dword [edi + 0x9c], eax
mov dword [edi + 0xa0], eax
mov dword [edi + 0xa4], eax
mov dword [edi + 0xa8], eax
mov dword [edi + 0xac], eax
mov dword [edi + 0xb0], eax
mov dword [edi + 0xb4], eax
mov dword [edi + 0xb8], eax
mov dword [edi + 0xbc], eax
mov dword [edi + 0xc0], eax
mov dword [edi + 0xc4], eax
mov dword [edi + 0xc8], eax
mov dword [edi + 0xcc], eax
mov dword [edi + 0xd0], eax
mov dword [edi + 0xd4], eax
mov dword [edi + 0xd8], eax
mov dword [edi + 0xdc], eax
mov dword [edi + 0xe0], eax
mov dword [edi + 0xe4], eax
mov dword [edi + 0xe8], eax
mov dword [edi + 0xec], eax
mov dword [edi + 0xf0], eax
mov dword [edi + 0xf4], eax
mov dword [edi + 0xf8], eax
mov dword [edi + 0xfc], eax
sub ebx, 0x100
add edi, 0x100
jmp 0x45c6a3
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
pop edi
mov dword [ecx + 4], edx
mov dword [ecx + 8], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e700
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push 0x8000
mov eax, dword [esi + 0xac]
lea eax, [eax + eax*8]
lea ecx, [esi + eax*8]
lea edx, [eax + ecx + 0x9ee8]
push edx
call fcn.00535d2b
add esp, 8
cmp eax, 0xffffffff
mov dword [esi + 0xadb0], eax
jne 0x45e735
xor eax, eax
pop esi
ret 8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
push edx
push eax
call fcn.00531af7
mov dword [esi + 4], eax
mov eax, dword [esi + 0xadb0]
push eax
call fcn.00531833
add esp, 0x10
mov eax, 1
pop esi
ret 8

Function at 0x45e7c0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, 0xc75780
lea edi, [esi + 0x9ee8]
push edi
push 0
push 0x50
call fcn.0045c4f0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0xac]
push edi
lea eax, [eax + eax*8]
lea ecx, [esi + eax*8]
lea edx, [eax + ecx + 0x9ee8]
mov ecx, 0xc75780
push edx
call fcn.0045cb90
push 0x8000
push edi
call fcn.00535d2b
add esp, 8
cmp eax, 0xffffffff
mov dword [esi + 0xadb0], eax
jne 0x45e81d
pop edi
xor eax, eax
pop esi
ret 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
push eax
call fcn.00531af7
mov dword [esi + 4], eax
mov eax, dword [esi + 0xadb0]
push eax
call fcn.00531833
add esp, 0x10
mov eax, 1
pop edi
pop esi
ret 0xc

Function at 0x45e850
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, 0xc75780
lea edi, [esi + 0x9ee8]
push edi
push 0
push 0x50
call fcn.0045c4f0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0xac]
push edi
lea eax, [eax + eax*8]
lea ecx, [esi + eax*8]
lea edx, [eax + ecx + 0x9ee8]
mov ecx, 0xc75780
push edx
call fcn.0045cb90
push 0x8000
push edi
call fcn.00535d2b
add esp, 8
cmp eax, 0xffffffff
mov dword [esi + 0xadb0], eax
jne 0x45e8ad
pop edi
xor eax, eax
pop esi
ret 0xc
mov ecx, dword [esi + 4]
push 0
push ecx
push eax
call fcn.005321eb
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0xadb0]
push edx
push eax
push ecx
call fcn.00531af7
mov edx, dword [esi + 4]
add edx, eax
mov dword [esi + 4], edx
mov edx, dword [esi + 0xadb0]
push edx
call fcn.00531833
add esp, 0x1c
mov eax, 1
pop edi
pop esi
ret 0xc
Function at 0x45fcd0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xd0
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push 0x16e360
mov eax, dword [esi + 0x20]
mov dword [esi + 0x20], ebx
mov dword [esp + 0x10], eax
call fcn.0052d8ce
add esp, 4
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x45fea5
push 0x8000
mov ecx, 0x12b1550
call fcn.0045e130
push eax
call fcn.00535d2b
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x45fd39
mov ecx, dword [esi + 0x10]
push ecx
call fcn.0052d65c
add esp, 4
mov dword [esi + 0x10], ebx
pop edi
pop esi
pop ebx
add esp, 0xd0
ret 8
push ebp
lea ebp, [esi + 0x14]
push 4
push ebp
push edi
call fcn.00531af7
mov eax, dword [ebp]
add esp, 0xc
cmp eax, ebx
jge 0x45fd82
lea edx, [esp + 0x14]
push 4
push edx
push edi
call fcn.00531af7
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
je 0x45fd76
push 1
push eax
push edi
call fcn.005321eb
add esp, 0xc
jmp 0x45fd50
push 4
push ebp
push edi
call fcn.00531af7
add esp, 0xc
mov eax, dword [ebp]
lea ebx, [esi + 0x24]
sub eax, 4
push eax
push ebx
push edi
call fcn.00531af7
mov ecx, dword [ebx]
mov edx, dword [esi + 0x10]
push ecx
push edx
push edi
call fcn.00531af7
push edi
call fcn.00531833
mov eax, dword [esi + 0x2c]
xor ebp, ebp
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
add esp, 0x1c
cmp eax, ebp
je 0x45fdc0
push 0x32
call eax
add esp, 4
mov eax, dword [esi + 0x28]
mov dword [ebx], ebp
mov ebx, dword [esp + 0xe4]
cmp eax, ebp
mov dword [esi + 0xc], ebp
jle 0x45fe95
mov eax, dword [esi + 0xc]
mov edi, ebx
cmp eax, 0x64
jge 0x45fe05
mov ecx, dword [edi]
mov dword [esi + 0x18], ecx
mov edx, dword [edi + 8]
cmp ecx, ebp
mov dword [esi + 0x1c], edx
jbe 0x45fe05
movsx ecx, word [edi + 0xe]
cmp dword [esi + eax*4 + 0x360], ecx
je 0x45fe05
add edi, 0x10
cmp eax, 0x64
jl 0x45fde1
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jbe 0x45fe81
movsx edx, word [edi + 0xe]
cmp edx, dword [esp + 0xe8]
jne 0x45fe81
cmp dword [esi + eax*4 + 0x4f0], ebp
je 0x45fe64
cmp dword [esi + 8], ebp
jne 0x45fe64
mov eax, dword [esi + eax*4 + 0x680]
mov edx, dword [esi + 0x10]
add eax, edx
push ecx
push eax
mov ecx, 0x15f7cf0
call fcn.00460250
mov ecx, dword [esi + 0xc]
mov edx, dword [edi + 8]
cmp edx, dword [esi + ecx*4 + 0x40]
je 0x45fe81
movsx eax, word [edi + 0xe]
push eax
lea ecx, [esp + 0x1c]
push str.Error:save_data___comp__d
push ecx
call fcn.0052d60a
add esp, 0xc
jmp 0x45fe81
mov edx, dword [esi + eax*4 + 0x680]
mov eax, dword [esi + eax*4 + 0x40]
push ecx
mov ecx, dword [esi + 0x10]
add edx, ecx
mov ecx, 0xc75780
push edx
push eax
call fcn.0045c440
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x28]
inc edx
mov eax, edx
mov dword [esi + 0xc], edx
cmp eax, ecx
jl 0x45fdd7
mov ecx, dword [esi + 0x10]
push ecx
call fcn.0052d65c
add esp, 4
mov dword [esi + 0x10], ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xd0
ret 8
Function at 0x461770
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
test eax, eax
je 0x4618cf
mov eax, dword [esi + 4]
test eax, eax
je 0x4618cf
mov eax, dword [esi + 0x170]
push eax
call dword [sym.imp.mss32.dll__AIL_sample_buffer_ready_4]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4618cf
mov ecx, dword [esi + 0x184]
mov edx, dword [esi + ebx*4 + 0x17c]
mov eax, dword [esi + 0x174]
push ecx
push edx
push eax
call fcn.00531af7
mov edi, eax
mov eax, dword [esi + 0x2464]
add esp, 0xc
cmp eax, 0x15
jne 0x4617ef
cmp dword [esi + 0x184], edi
je 0x4618b8
test edi, edi
je 0x4617ef
add edi, 0x1ff
and edi, 0xfffffe00
jmp 0x4618b8
cmp dword [esi + 0x184], edi
je 0x4618b8
mov ecx, esi
call fcn.00463310
cmp dword [0xb08908], 0x2d
jne 0x461812
mov ecx, esi
call fcn.00463260
cmp dword [esi + 0x178], 0xffffffff
je 0x46185b
mov ecx, dword [esi + 0x174]
push ecx
call fcn.00531833
mov edx, dword [esi + 0x178]
mov eax, dword [esi + 0x184]
mov dword [esi + 0x174], edx
mov dword [esi + 0x178], 0xffffffff
mov ecx, dword [esi + ebx*4 + 0x17c]
sub eax, edi
add ecx, edi
push eax
push ecx
push edx
call fcn.00531af7
add esp, 0x10
jmp 0x4618b6
mov eax, dword [esi + 0x34]
and eax, 0xffff
cmp eax, 1
jne 0x461882
xor edi, edi
mov ecx, esi
push edi
call fcn.00461120
mov dword [esi + 0x154], edi
mov dword [esi + 0x2464], edi
pop edi
pop esi
pop ebx
ret
test eax, eax
jne 0x4618b8
push eax
push eax
mov eax, dword [esi + 0x174]
push eax
call fcn.005321eb
mov ecx, dword [esi + 0x184]
mov edx, dword [esi + ebx*4 + 0x17c]
mov eax, dword [esi + 0x174]
sub ecx, edi
add edx, edi
push ecx
push edx
push eax
call fcn.00531af7
add esp, 0x18
add edi, eax
mov ecx, dword [esi + ebx*4 + 0x17c]
mov edx, dword [esi + 0x170]
push edi
push ecx
push ebx
push edx
call dword [sym.imp.mss32.dll__AIL_load_sample_buffer_16]
pop edi
pop esi
pop ebx
ret

Function at 0x4658a0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x1e0
push esi
push edi
mov esi, ecx
xor edi, edi
mov ecx, 0x12157c8
mov dword [esi + 0x694], edi
mov dword [0x12157cc], edi
mov dword [0x12157d0], edi
mov dword [0x1215828], edi
mov dword [0x121582c], edi
call fcn.004648f0
mov ecx, 0x12157c8
call fcn.00465690
xor eax, eax
lea ecx, [esp + 0x58]
mov dword [esi + 0x734], eax
push ecx
push 0x101
mov dword [esi + 0x738], eax
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x46595a
push ebp
lea edx, [esp + 0xc]
push 0x50
push edx
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x465954
lea eax, [esp + 0xc]
push eax
call sub.WSOCK32.dll_gethostbyname
cmp eax, edi
je 0x465954
mov ecx, dword [eax + 0xc]
cmp dword [ecx], edi
je 0x465954
xor ecx, ecx
lea edx, [esi + 0x73c]
cmp ecx, 8
jge 0x465954
mov dword [edx - 8], 1
mov ebp, dword [eax + 0xc]
add edx, 4
mov ebp, dword [ecx + ebp]
add ecx, 4
mov ebp, dword [ebp]
mov dword [edx - 4], ebp
mov ebp, dword [eax + 0xc]
cmp dword [ecx + ebp], edi
jne 0x46592e
call sub.WSOCK32.dll_WSACleanup
pop ebp
mov ecx, 0x12157c8
call fcn.00466380
lea eax, [esi + 0x395d4]
mov ecx, 9
mov dword [eax - 4], edi
mov dword [eax], edi
add eax, 0x24
dec ecx
jne 0x46596f
pop edi
pop esi
add esp, 0x1e0
ret
Function at 0x466150
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0x20019
mov ebp, ecx
push 0
push str.SoftwareGameSpyGameSpy_Arcade
push reloc.DPLAYX.dll_Ordinal_1
mov dword [esp + 0x28], 0x200
mov dword [ebp + 0x510], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x466294
lea ecx, [esp + 0x14]
lea ebx, [ebp + 0x2b9]
push ecx
lea edx, [esp + 0x20]
push ebx
push edx
push eax
mov eax, dword [esp + 0x20]
push str.InstDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x466294
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebp + 0x2b8], 0x5c
je 0x466206
mov edi, 0x5f740c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.aphex.exe
or ecx, 0xffffffff
xor eax, eax
push 0x5e5abc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0052db84
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x466294
lea edx, [ebp + 0x2b8]
mov edi, str.__svc_stronghold
or ecx, 0xffffffff
xor eax, eax
mov byte [edx], 0x22
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov dword [esp + 0x1c], eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x1c]
dec edi
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 0x510], 1
call fcn.0052d790
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x466a00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov eax, 1
mov dword [esi + 0x618], eax
mov dword [0xb089e4], 0
mov dword [0xb0923c], 0
mov ecx, dword [esi + 0x744]
test ecx, ecx
je 0x466a34
mov dword [esi + 0x748], eax
pop esi
ret
push edi
push 2
mov ecx, esi
call fcn.0046bd80
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [esi + 0x9bd80], eax
call edi
sub eax, dword [esi + 0x9bd80]
cmp eax, 0x4e20
jae 0x466a7b
mov eax, dword [esi + 0x748]
test eax, eax
jne 0x466a7b
mov ecx, esi
call fcn.00466fc0
call edi
sub eax, dword [esi + 0x9bd80]
cmp eax, 0x4e20
jb 0x466a5b
mov eax, dword [esi + 0x748]
pop edi
test eax, eax
jne 0x466ab0
mov ecx, esi
call fcn.00465990
mov ecx, esi
call fcn.004658a0
push 0
push 0x13
mov ecx, 0xb08900
call fcn.0045cf90
push 0
push 0x11
mov ecx, 0xcdf6c8
call fcn.00483a20
pop esi
ret
Function at 0x52d240
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [eax]
mov esi, dword [ecx]
mov edx, esi
dec esi
test edx, edx
je 0x52d27a
mov edx, dword [esp + 8]
xor ecx, ecx
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x61c920]
xor ecx, eax
mov eax, ecx
mov ecx, esi
dec esi
test ecx, ecx
jne 0x52d258
pop esi
ret

Function at 0x533dbc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x533ddc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00533a58
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x533dfd
test byte [esp + 8], 2
je 0x533dfd
mov dword [0x15f7d78], 0xd
mov dword [0x15f7d7c], 5
jmp 0x533dd8
xor eax, eax
ret

Function at 0x15fd000
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, 0x6f
or eax, 0x1968087d
insb byte es:[edi], dx
js 0x15fcfba
adc eax, dword [eax]
add al, 1
add byte [eax], al
add byte [eax + 0x2dc0013], ah
add byte [eax], al
in al, 0xf8
pop ds
add dword [eax], eax
rcr byte [edi], 1
add byte [eax + 0x22], dh
add byte [ecx], cl
rcr byte [edi], 1
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + 0x51], ah
jb 0x15fd080
outsd dx, dword [esi]
inc ebp
inc bp
dec edx
insd dword es:[edi], dx
inc esi
imul eax, dword [esi + 0x73], 0x46
add byte [eax], al
add byte [ebp + 0x6e], ah
je 0x15fd0c2
jns 0x15fd0c2
push ebp
mov ebp, esp
pushal
mov ebx, 0x15fc052
xor ecx, ecx
mov cl, byte [0x15fc035]
test ecx, ecx
je 0x15fd073
mov eax, 0x15fc0b8
sub eax, ebx
sub eax, 5
jmp 0x15fd081
push ecx
mov ecx, 0x15fc0f1
mov eax, ecx
sub eax, ebx
add eax, dword [ecx + 1]
pop ecx
mov byte [ebx], 0xe9
mov dword [ebx + 1], eax
push 0x15fc009
xor eax, eax
test ecx, ecx
je 0x15fd097
mov eax, dword [ebp + 8]
jmp 0x15fd097
push eax
call fcn.015fd0f6
add esp, 8
cmp eax, 0
je 0x15fd0b4
mov byte [ebx], 0xc2
mov byte [ebx + 1], 0xc
push eax
mov eax, dword [0x15fc029]
call eax
popal
pop ebp
jmp 0x15fd0f1
and al, 4
mov dword [0x15fc0eb], ecx
mov ecx, 0x15fc0d6
mov dword [esp + 4], ecx
pop ecx
jmp 0x15fd0f1
jmp 0x52f894