joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410a80
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x410b4f
mov eax, dword [esi + 0x68]
lea ecx, [eax + 4]
mov eax, dword [eax + 4]
call dword [eax + 4]
test eax, eax
jbe 0x410b4f
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
push 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x110]
push 0x1a
push ecx
push 0
stosb byte es:[edi], al
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov eax, dword [esi + 0x68]
mov edx, dword [eax + 4]
lea ecx, [eax + 4]
call dword [edx + 4]
push eax
lea eax, [esp + 0x110]
push eax
push str._sTencentQQGameusers_ugamecomm.ini
lea ecx, [esp + 0x14]
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea edx, [esp + 8]
mov ecx, esi
push edx
call fcn.00410c60
lea eax, [esp + 8]
push eax
push 0
push str.panelpage
push str.sprit
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
push eax
mov ecx, esi
call fcn.0040fff0
mov dword [esi + 4], 0
pop edi
pop esi
add esp, 0x208
ret

Function at 0x410b60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x30c
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
lea ecx, [eax + 4]
mov eax, dword [eax + 4]
call dword [eax + 4]
test eax, eax
jbe 0x410c53
push ebp
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea ecx, [esp + 0x114]
push 0x1a
push ecx
push 0
stosb byte es:[edi], al
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov eax, dword [esi + 0x68]
mov edx, dword [eax + 4]
lea ecx, [eax + 4]
call dword [edx + 4]
mov ebp, dword [sym.imp.MSVCRT.dll__snprintf]
push eax
lea eax, [esp + 0x114]
lea ecx, [esp + 0x10]
push eax
push str._sTencentQQGameusers_ugamecomm.ini
push 0x103
push ecx
call ebp
add esp, 0x14
lea edx, [esp + 0xc]
mov ecx, esi
push edx
call fcn.00410c60
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x215]
mov byte [esp + 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 0x4c]
lea ecx, [esp + 0x214]
push eax
push 0x43c3b0
push 0x103
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x214]
push edx
push eax
push str.panelpage
push str.sprit
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop ebp
pop esi
add esp, 0x30c
ret
Function at 0x410c60
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x118]
push 0x103
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
mov ebp, dword [sym.imp.MSVCRT.dll__access]
mov ebx, dword [sym.imp.MSVCRT.dll__mbschr]
add esp, 0xc
lea edi, [esp + 0x10]
push 0x5c
push edi
call ebx
mov esi, eax
add esp, 8
test esi, esi
jne 0x410cc6
push 0x2f
push edi
call ebx
mov esi, eax
add esp, 8
test esi, esi
je 0x410d06
lea edx, [esp + 0x10]
push 0
push edx
mov byte [esi], 0
call ebp
add esp, 8
test eax, eax
je 0x410ceb
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
test eax, eax
jne 0x410cf7
test esi, esi
mov byte [esi], 0x5c
lea edi, [esi + 1]
je 0x410d06
jmp 0x410caa
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x104
ret 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret 4
Function at 0x415390
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x42f1cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x518
push ebx
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x322]
mov word [esp + 0x320], 0
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x103
stosw word es:[edi], ax
lea eax, [esp + 0x324]
push eax
push 0
call ebx
mov esi, dword [sym.imp.MSVCRT.dll_wcsrchr]
lea ecx, [esp + 0x320]
push 0x5c
push ecx
call esi
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x41540e
lea edx, [esp + 0x320]
push 0x2f
push edx
call esi
add esp, 8
mov ebp, eax
mov word [ebp], 0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x11a]
mov word [esp + 0x118], 0
push 0x103
rep stosd dword es:[edi], eax
mov ecx, dword [0x440df4]
stosw word es:[edi], ax
lea eax, [esp + 0x11c]
push eax
push ecx
call ebx
mov edi, 2
lea edx, [esp + 0x118]
push 0x5c
push edx
call esi
add esp, 8
test eax, eax
jne 0x41546d
lea eax, [esp + 0x118]
push 0x2f
push eax
call esi
add esp, 8
dec edi
mov word [eax], 0
jne 0x41544b
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push str..config.ini
push 0
push str.Version
push 0x43c7d8
call ebx
mov ecx, eax
mov eax, 0x431bde83
mul ecx
mov esi, edx
mov eax, ecx
xor edx, edx
mov edi, 0xf4240
div edi
mov eax, 0xd1b71759
shr esi, 0x12
mul edx
mov edi, edx
mov eax, ecx
xor edx, edx
mov ecx, 0x2710
div ecx
lea ecx, [esp + 0x118]
lea eax, [ebp + 2]
push ecx
push 0xffffffffffffffff
push 0
push 0x804
push 1
push 1
shr edi, 0xd
push edx
push edi
push esi
lea edx, [esp + 0x344]
push eax
push edx
push eax
push 0x43c7c8
call fcn.004298e0
add esp, 0x34
lea eax, [esp + 0x118]
lea ecx, [esp + 0x10]
push eax
call fcn.0042b9d8
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x534], 0
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::GetBuffer
push eax
push str._sconfigDynamicInfo.ini
lea ecx, [esp + 0x1c]
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea edx, [esp + 0x14]
push edx
push 0x2710
push 0x43c7a0
push 0x43c7d8
call ebx
push 0
push eax
call fcn.00429fd0
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x530], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x518]
mov dword fs:[0], ecx
add esp, 0x524
ret
Function at 0x416d60
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x42f588
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push 0x440a78
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x20], ebx
call fcn.0042c810
add esp, 4
push str...GameListMenu1.dll
lea ecx, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 0x10e4], eax
je 0x416f07
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateRMenuObject
push eax
call edi
mov dword [esi + 0x10e8], eax
mov eax, dword [esi + 0x10e4]
push str.ReleaseRMenuWnd
push eax
call edi
mov ecx, dword [esi + 0x10e4]
push str.AddNewMenu
push ecx
mov dword [esi + 0x10ec], eax
call edi
mov edx, dword [esi + 0x10e4]
push str.CreateRMenu
push edx
mov dword [esi + 0x10f0], eax
call edi
mov dword [esi + 0x10f4], eax
mov eax, dword [esi + 0x10e4]
push str.SetLpIGameSite
push eax
call edi
mov dword [esi + 0x10f8], eax
mov eax, dword [esi + 0xd0]
cmp eax, ebx
je 0x416e78
mov ecx, dword [esi + 0x10e4]
push str.MenuOnOtherMsg
push ecx
call edi
mov dword [esi + 0xc8], eax
mov eax, dword [esi + 0x10e8]
pop edi
cmp eax, ebx
je 0x416eca
cmp dword [esi + 0x10ec], ebx
je 0x416eca
cmp dword [esi + 0x10f0], ebx
je 0x416eca
cmp dword [esi + 0x10f4], ebx
je 0x416eca
cmp dword [esi + 0x10f8], ebx
je 0x416eca
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push ebx
push ebx
push str.Load_Menu_Module_Failed_2
call sub.MFC42.DLL_AfxMessageBox_1
mov edx, dword [esi + 0x10e4]
mov dword [esi + 0x10e8], ebx
push edx
mov dword [esi + 0x10ec], ebx
mov dword [esi + 0x10f0], ebx
mov dword [esi + 0x10f4], ebx
mov dword [esi + 0x10f8], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x10e4], ebx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x417590
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42f630
push eax
mov dword fs:[0], esp
mov dword [esp + 8], 0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
push eax
push 5
push ecx
push str.public
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [esp + 0x14]
cmp eax, 5
mov byte [esp + 8], 0
lea ecx, [esp + 0x10]
mov dword [edx], eax
jne 0x417601
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 8], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 8], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0xc
ret 0xc

Function at 0x4176d0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42f680
push eax
mov dword fs:[0], esp
mov dword [esp + 8], 0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
push eax
push 5
push ecx
push str.sprit
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [esp + 0x14]
cmp eax, 5
mov byte [esp + 8], 0
lea ecx, [esp + 0x10]
mov dword [edx], eax
jne 0x417741
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 8], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 8], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0xc
ret 0xc
Function at 0x41ce00
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x441010]
sub esp, 0x20
cmp eax, 1
jne 0x41ce54
push esi
push edi
mov ecx, 5
mov esi, str.qqgame:__exchangecoin
lea edi, [esp + 8]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [esp + 0x1e], eax
lea ecx, [esp + 8]
mov dword [esp + 0x22], eax
push ecx
lea edi, [esp + 0xc]
or ecx, 0xffffffff
mov word [esp + 0x2a], ax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x55
mov ecx, 0x440e4c
call fcn.00415660
pop edi
pop esi
add esp, 0x20
ret
mov eax, dword [0x440da8]
test eax, eax
je 0x41ce60
mov eax, dword [eax + 0x20]
push 1
push 0
push 0
push str.http:__gb.qq.com_hall_money_index.shtml
push 0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x20
ret
Function at 0x429210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x430e18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
lea ebp, [ecx + 4]
mov ecx, dword [esp + 0x38]
push edi
push eax
push ecx
mov ecx, ebp
call fcn.004129e0
test eax, eax
je 0x429362
mov ecx, ebp
call fcn.00412a30
mov ecx, ebp
mov esi, eax
call fcn.00412a60
xor ebx, ebx
mov edi, eax
cmp esi, ebx
jle 0x429362
cmp edi, ebx
jle 0x429362
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CDC::CDC
push ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CDC::Attach
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0x433f78
mov eax, esi
push edi
cdq
and edx, 3
mov byte [esp + 0x38], 1
add eax, edx
mov edx, dword [esp + 0x24]
mov esi, eax
sar esi, 2
push esi
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CGdiObject::Attach
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
neg eax
sbb eax, eax
and eax, ecx
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.MFC42.DLL_CDC::SelectGdiObject
push edi
push esi
lea ecx, [esi + esi*2]
push 0
push ecx
push 0
lea edx, [esp + 0x30]
push 0
push edx
mov ecx, ebp
mov ebx, eax
call fcn.00412a90
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push 0
push eax
push ecx
call fcn.0042d75e
mov edx, dword [esp + 0x1c]
add esp, 0xc
test ebx, ebx
mov dword [edx + 0x34], eax
je 0x429318
mov ebx, dword [ebx + 4]
mov eax, dword [esp + 0x20]
push ebx
push eax
call sub.MFC42.DLL_CDC::SelectGdiObject
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x14], 0x432e78
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0x432c14
mov dword [esp + 0x34], 0xffffffff
call fcn.0042b90c
mov eax, 1
jmp 0x429364
xor eax, eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8

Function at 0x429c80
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x441f80]
sub esp, 0x208
cmp dword [eax + 0x1c], 0x2710
ja 0x429cfa
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x441f74]
pop edi
test eax, eax
jne 0x429cba
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push eax
push str._s....configDynamicInfo.ini
lea ecx, [esp + 8]
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov eax, dword [0x441f80]
add esp, 0x10
lea edx, [esp]
mov ecx, dword [eax + 0x1c]
push edx
push ecx
push str.LastQQUin
push str.Public
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [0x441f80]
mov dword [edx + 0x1c], eax
add esp, 0x208
ret
Function at 0x42a420
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x94
xor eax, eax
mov edx, dword [esp + 0x98]
mov dword [esp + 9], eax
push ebx
mov dword [esp + 0x11], eax
mov ebx, ecx
mov ecx, dword [esp + 0xa8]
mov word [esp + 0x15], ax
mov byte [esp + 0x17], al
mov dword [esp + 8], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0xc], ecx
test eax, eax
mov dword [esp + 0x14], edx
je 0x42a566
mov eax, dword [str.EPIPEMAGQQ]
mov ecx, dword [0x43d044]
mov dx, word [0x43d048]
mov dword [esp + 0x18], eax
mov al, byte [0x43d04a]
push ebp
push esi
push edi
mov dword [esp + 0x28], ecx
mov byte [esp + 0x2e], al
mov ecx, 0x1d
xor eax, eax
lea edi, [esp + 0x2f]
mov word [esp + 0x2c], dx
rep stosd dword es:[edi], eax
mov edx, dword [ebx + 0x24]
lea esi, [ebx + 0x24]
stosb byte es:[edi], al
mov edi, dword [esp + 0xac]
mov ecx, esi
push edi
call dword [edx]
push eax
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_operatornew
add esp, 4
lea ecx, [esp + 0x10]
mov ebp, eax
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0xb4]
lea edx, [esp + 0x28]
push ebp
push edx
push edi
push ecx
mov ecx, esi
call dword [eax + 4]
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [ebx + 0x10]
lea eax, [esp + 0x14]
push esi
mov dword [esp + 0x20], edx
mov edx, dword [ebx + 8]
push eax
lea ecx, [esp + 0x20]
push 0xc
push ecx
push edx
call edi
test eax, eax
jne 0x42a53e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xc
push eax
mov ecx, ebx
call fcn.0042a5a0
cmp eax, 1
jne 0x42a55a
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx + 8]
lea eax, [esp + 0x14]
push esi
push eax
push ecx
push ebp
push edx
call edi
test eax, eax
jne 0x42a547
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
push ecx
push eax
mov ecx, ebx
call fcn.0042a5a0
jmp 0x42a55a
cmp dword [esp + 0x14], 0xc
je 0x42a513
jmp 0x42a553
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp edx, eax
je 0x42a55a
mov ecx, ebx
call fcn.0042a5f0
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret 0x10

Function at 0x42a690
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], eax
mov dword [0x441fd4], ecx
mov ecx, esi
call fcn.0042a9d0
mov eax, dword [esi + 4]
lea edx, [esp + 8]
push edx
push 0
push eax
push 0x42a6e0
push 0
push 0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret 8
Function at 0x42ad40
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi]
push eax
call sub.WSOCK32.dll_ntohl
mov ecx, dword [edi + 4]
mov esi, eax
push ecx
call sub.WSOCK32.dll_ntohl
mov ebp, dword [esp + 0x28]
lea edx, [esp + 0x10]
mov edi, eax
lea ebx, [esp + 0x10]
sub ebp, edx
mov dword [esp + 0x24], 4
mov eax, dword [ebx + ebp]
push eax
call sub.WSOCK32.dll_ntohl
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
add ebx, 4
dec eax
mov dword [esp + 0x24], eax
jne 0x42ad76
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x24], 0x10
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
mov edx, edi
sub eax, 0x61c88647
shr edx, 5
add edx, ebx
mov ebx, edi
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
add esi, edx
mov edx, esi
mov ebx, esi
shr edx, 5
shl ebx, 4
add edx, ecx
add ebx, ebp
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
add edi, edx
mov edx, dword [esp + 0x24]
dec edx
mov dword [esp + 0x24], edx
jne 0x42ad9d
push esi
call sub.WSOCK32.dll_htonl
mov esi, dword [esp + 0x2c]
push edi
mov dword [esi], eax
call sub.WSOCK32.dll_htonl
mov dword [esi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x42ae10
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov eax, dword [esi]
push eax
call sub.WSOCK32.dll_ntohl
mov ecx, dword [esi + 4]
mov edi, eax
push ecx
call sub.WSOCK32.dll_ntohl
mov ebp, dword [esp + 0x28]
lea edx, [esp + 0x10]
mov esi, eax
lea ebx, [esp + 0x10]
sub ebp, edx
mov dword [esp + 0x24], 4
mov eax, dword [ebx + ebp]
push eax
call sub.WSOCK32.dll_ntohl
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
add ebx, 4
dec eax
mov dword [esp + 0x24], eax
jne 0x42ae46
mov ecx, dword [esp + 0x14]
mov eax, 0xe3779b90
mov dword [esp + 0x24], 0x10
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, edi
shr edx, 5
add edx, ebx
mov ebx, edi
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x10]
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
sub esi, edx
mov edx, esi
mov ebx, esi
shr edx, 5
shl ebx, 4
add edx, ecx
add ebx, ebp
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
add eax, 0x61c88647
sub edi, edx
mov edx, dword [esp + 0x24]
dec edx
mov dword [esp + 0x24], edx
jne 0x42ae70
push edi
call sub.WSOCK32.dll_htonl
mov edi, dword [esp + 0x2c]
push esi
mov dword [edi], eax
call sub.WSOCK32.dll_htonl
mov dword [edi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x42caf9
Capabilities:
Get file version info

Disassembly:
mov eax, 0x430eec
call fcn.0042e320
sub esp, 0x24
push esi
push edi
xor edi, edi
push edi
mov dword [ebp - 4], edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
lea ecx, [ebp - 0x18]
mov esi, eax
call sub.MFC42.DLL_CString::CString_3
cmp esi, edi
mov byte [ebp - 4], 1
jne 0x42cb30
or esi, 0xffffffff
jmp 0x42cbb3
lea eax, [esi + 2]
push ebx
push eax
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp - 0x10], eax
push eax
push esi
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x43c140
push dword [ebp - 0x10]
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp - 0x14]
push 0x64
xor edx, edx
pop ebx
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov esi, eax
mov edi, ecx
and eax, 0xffff
push dword [ebp - 0x10]
shr edi, 0x10
mov dword [ebp - 0x2c], eax
mov eax, edi
div ebx
and ecx, 0xffff
shr esi, 0x10
mov dword [ebp - 0x20], ecx
mov ebx, eax
imul eax, eax, 0x64
sub edi, eax
call sub.MFC42.DLL_operatordelete
imul esi, esi, 0x64
add esi, dword [ebp - 0x2c]
pop ecx
lea eax, [esi + esi*4]
lea esi, [ebx + eax*2]
pop ebx
imul esi, esi, 0x64
add esi, edi
imul esi, esi, 0x64
add esi, dword [ebp - 0x20]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x404224
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [0x1e510]
and dword [ebp - 4], 0
push esi
mov esi, dword [0x1e50c]
push edi
mov edi, dword [0x1e514]
add eax, edi
add eax, dword [0x1e508]
xor ecx, esi
xor edx, esi
add eax, esi
mov esi, dword [ebp + 0xc]
mov edi, dword [esi + 4]
mov dword [ebp - 0xc], edi
mov edi, dword [esi]
mov dword [ebp + 0xc], edi
mov edi, dword [esi + 0xc]
mov esi, dword [esi + 8]
mov dword [ebp - 8], 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
add dword [ebp - 4], eax
dec dword [ebp - 8]
mov esi, edx
shl esi, 4
add esi, dword [ebp + 0xc]
mov edi, edx
shr edi, 5
add edi, dword [ebp - 0xc]
xor esi, edi
mov edi, dword [ebp - 4]
add edi, edx
xor esi, edi
add ecx, esi
mov esi, ecx
shl esi, 4
add esi, dword [ebp - 0x10]
mov edi, ecx
shr edi, 5
add edi, dword [ebp - 0x14]
xor esi, edi
mov edi, dword [ebp - 4]
add edi, ecx
xor esi, edi
add edx, esi
cmp dword [ebp - 8], 0
ja 0x40427a
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop esi
leave
ret 8

Function at 0x4042d0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov ecx, dword [0x1e514]
push esi
mov esi, dword [eax + 4]
mov eax, dword [0x1e510]
add ecx, eax
mov eax, dword [ebp + 0xc]
add ecx, dword [0x1e50c]
push edi
mov edi, dword [eax + 0xc]
add ecx, dword [0x1e508]
mov dword [ebp - 0xc], edi
mov edi, dword [eax + 8]
mov dword [ebp + 0xc], edi
mov edi, dword [eax + 4]
mov eax, dword [eax]
mov edx, ecx
mov dword [ebp - 8], 0x20
shl edx, 5
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp + 0xc]
dec dword [ebp - 8]
shr edi, 5
add edi, dword [ebp - 0xc]
xor eax, edi
mov edi, dword [ebp - 4]
add edi, edx
xor eax, edi
sub esi, eax
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x10]
mov edi, esi
shr edi, 5
add edi, dword [ebp - 0x14]
xor eax, edi
lea edi, [edx + esi]
xor eax, edi
sub dword [ebp - 4], eax
sub edx, ecx
cmp dword [ebp - 8], 0
ja 0x404324
mov eax, dword [0x1e50c]
xor eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [0x1e50c]
xor eax, esi
pop edi
mov dword [ecx + 4], eax
pop esi
leave
ret 8

Function at 0x40442c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor ecx, ecx
or eax, 0xffffffff
cmp dword [ebp + 0xc], ecx
jbe 0x40445a
mov edx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x22280]
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x40443b
not eax
pop ebp
ret 8