joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100948e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x1c
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp edx, edi
jne 0x100948fe
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x1c], esi
xor ecx, eax
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [esi + eax*8]
mov dword [ebp - 0x10], ecx
lea eax, [esi + eax*8]
mov esi, dword [edx]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
call fcn.1001f3b0
dec dword [ebx + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0xc]
je 0x1009498e
nop dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x1009499d
mov edx, esi
mov esi, dword [esi]
call fcn.1001f3b0
dec dword [ebx + 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x18], eax
jne 0x10094970
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x10], eax
jne 0x100949bd
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x100949c0
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x100949aa
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov dword [ecx + 4], eax
cmp esi, edi
je 0x100949aa
nop word [eax + eax]
movzx eax, byte [esi + 8]
mov edx, esi
xor eax, 0x811c9dc5
mov edi, esi
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
mov esi, dword [esi]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
call fcn.1001f3b0
dec dword [ebx + 8]
cmp edi, dword [ebp + 8]
je 0x10094a4a
nop word [eax + eax]
mov eax, dword [ebp + 0xc]
mov edi, esi
cmp esi, eax
je 0x10094a73
mov edx, esi
mov esi, dword [esi]
call fcn.1001f3b0
dec dword [ebx + 8]
cmp edi, dword [ebp + 8]
jne 0x10094a30
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
cmp esi, edi
jne 0x100949d0
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100951f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a0355
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100b3040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.10075610
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1009527a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100953c0
cmp dword [ebx + 8], 0xfffffff
jne 0x1009528e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.10097a88
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100a9ff0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100a9ff0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10095373
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.10098f90
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x10095355
cmp eax, 0x200
jae 0x10095353
shl eax, 3
cmp eax, ecx
jae 0x10095355
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10063510
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10075610
mov edx, dword [eax]
jmp 0x10095376
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100953a1
mov dword [ecx + eax*8], esi
jmp 0x100953b3
cmp ebx, edx
jne 0x100953aa
mov dword [ecx + eax*8], esi
jmp 0x100953b7
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100953b7
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100959c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a0355
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100b3040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.10075610
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10095a4a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x10095b92
cmp dword [ebx + 8], 0xfffffff
jne 0x10095a5e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.10097a88
mov edx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100a9ff0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100a9ff0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10095b45
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.10098f90
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x10095b27
cmp eax, 0x200
jae 0x10095b25
shl eax, 3
cmp eax, ecx
jae 0x10095b27
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10063510
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10075610
mov edx, dword [eax]
jmp 0x10095b48
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x10095b73
mov dword [ecx + eax*8], esi
jmp 0x10095b85
cmp ebx, edx
jne 0x10095b7c
mov dword [ecx + eax*8], esi
jmp 0x10095b89
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10095b89
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x664f4b02
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0xa147d67
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x403df7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x52b934
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0043ad00
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, 0x3f800000
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov byte [esi + 0x3c], bl
mov byte [esi + 0x3d], bl
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 3
mov dword [esi + 0x44], ebx
call fcn.00404020
lea ecx, [esi + 0x90]
mov byte [esp + 0x14], 4
call fcn.00404020
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi], 0x531414
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x412fe0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x52c3ea
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, 0x3f800000
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], eax
mov dword [esp + 8], esi
mov dword [esi + 0xd8], edi
mov dword [esp + 0x14], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
push sym.MOHAA.exe_public:_void___thiscall_str::destructor_void_
push sym.MOHAA.exe_public:_void___thiscall_str::constructor_void_
push 3
lea eax, [esi + 0xe4]
push 4
push eax
mov byte [esp + 0x28], 2
call fcn.005170ba
mov ecx, 0x64
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x108], edi
mov eax, 0x14
mov dword [esi + 0xc], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x1c], ecx
push 3
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi + 8], 0x10
mov dword [esi + 0xfc], edi
push edi
lea ecx, [esi + 0xf0]
push ecx
call fcn.0044c5f0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x425d90
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00425d20
add esp, 4
test al, al
je 0x425da9
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret
Function at 0x425eb0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 8], 0
je 0x425f30
mov ecx, 0x80
mov edi, 0x56d3b8
mov edx, 0x56d3b8
rep stosd dword es:[edi], eax
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x425ee2
mov eax, dword [str.command.ln]
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x425f30
lea ecx, [esp + 8]
push 0
push ecx
push 0x200
push 0x56d3b8
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ecx
ret

Function at 0x425f40
Capabilities:
Delete file
Read file on windows

Disassembly:
push ecx
mov eax, dword [str.command.ln]
push esi
push eax
mov dword [esp + 8], 0
call fcn.00425d20
add esp, 4
test al, al
jne 0x425f63
mov eax, dword [esp + 0xc]
pop esi
pop ecx
ret
xor eax, eax
push edi
mov ecx, 0x80
mov edi, 0x56d3b8
push eax
push 0x80
rep stosd dword es:[edi], eax
mov ecx, dword [str.command.ln]
push 3
push eax
push 3
push bind
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
pop edi
cmp esi, 0xffffffff
jne 0x425f9e
mov eax, dword [esp + 0xc]
pop esi
pop ecx
ret
lea edx, [esp + 4]
push 0
push edx
push 0x200
push 0x56d3b8
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [str.command.ln]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0x56d3b8
pop esi
pop ecx
ret

Function at 0x4281e0
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x3a
push edi
call fcn.005172d0
mov esi, eax
add esp, 8
test esi, esi
je 0x428214
push edi
mov byte [esi], 0
call sub.WSOCK32.dll_inet_addr
mov edi, dword [esp + 0xc]
inc esi
push esi
mov dword [edi], eax
call fcn.005171fb
add esp, 4
mov word [edi + 4], ax
pop edi
pop esi
ret

Function at 0x4288a0
Capabilities:
Create udp socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebp, ebp
xor ebx, ebx
mov eax, dword [esi + 0x6c]
push edi
cmp eax, ebp
jle 0x428901
xor edi, edi
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
mov ecx, dword [esi + 8]
mov dword [edi + ecx], eax
mov edx, dword [esi + 8]
mov ecx, dword [edx + edi]
lea eax, [edx + edi]
cmp ecx, 0xffffffff
je 0x4288f0
mov dword [eax + 4], ebp
mov eax, dword [esi + 8]
inc ebx
mov dword [eax + edi + 8], ebp
mov eax, dword [esi + 0x6c]
add edi, 0x1c
cmp ebx, eax
jl 0x4288b5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp ebx, ebp
jne 0x4288fe
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov dword [esi + 0x6c], ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x428910
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push 0x70e4
mov word [esp + 8], 2
call sub.WSOCK32.dll_htons
push 0x542834
mov word [esp + 0xa], ax
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 8], eax
jne 0x428960
push 0x542834
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x428955
mov eax, 2
pop esi
add esp, 0x10
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esp + 8], edx
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi + 0x88], eax
jne 0x428984
mov eax, 1
pop esi
add esp, 0x10
ret
lea ecx, [esp + 4]
push 0x10
push ecx
push eax
call sub.WSOCK32.dll_connect
test eax, eax
je 0x4289ab
mov edx, dword [esi + 0x88]
push edx
call sub.WSOCK32.dll_closesocket
mov eax, 3
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x4289c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x140
lea eax, [esp]
push esi
mov esi, dword [esp + 0x148]
push edi
push 0
mov ecx, dword [esi + 0x88]
push 0xff
push eax
push ecx
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x428b42
lea edx, [esp + 8]
push str._secure_
push edx
mov byte [esp + eax + 0x10], 0
call fcn.005175e0
mov edi, eax
add esp, 8
test edi, edi
jne 0x428a1b
pop edi
mov eax, 5
pop esi
add esp, 0x140
ret
add edi, 8
push 6
push edi
lea eax, [esi + 0x2c]
push 6
push eax
call fcn.00429d80
lea ecx, [esp + 0x118]
push ecx
push 6
push edi
call fcn.00429cd0
lea edx, [esp + 0x124]
lea eax, [esi + 0x4c]
push edx
push 0x5428e4
push eax
lea ecx, [esp + 0x30]
push str.gamename_sgamever_slocation0_validate_s_finalqueryid1.1_
push ecx
call fcn.00516c8e
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x30
repne scasb al, byte es:[edi]
mov eax, dword [esi + 0x88]
push 0
not ecx
dec ecx
lea edx, [esp + 0xc]
push ecx
push edx
push eax
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x428b42
test eax, eax
je 0x428b42
mov eax, dword [esi + 0x90]
cmp eax, 6
jne 0x428aae
mov eax, str.groups
mov dword [esi + 0x98], 0
jmp 0x428ac9
cmp eax, 7
jne 0x428ac4
mov eax, str.info2
mov dword [esi + 0x98], 0
jmp 0x428ac9
mov eax, 0x54288c
mov ecx, dword [esp + 0x150]
lea edx, [esp + 8]
test ecx, ecx
je 0x428aee
push ecx
lea ecx, [esi + 0xc]
push ecx
push eax
push str.list_sgamename_swhere_s_final_
push edx
call fcn.00516c8e
add esp, 0x14
jmp 0x428b01
lea ecx, [esi + 0xc]
push ecx
push eax
push str.list_sgamename_s_final_
push edx
call fcn.00516c8e
add esp, 0x10
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x88]
push eax
push ecx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x428b42
test eax, eax
je 0x428b42
push 1
push esi
call fcn.00428b50
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x140
ret
pop edi
mov eax, 3
pop esi
add esp, 0x140
ret
Function at 0x428c10
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ecx
push 0x11
push 2
push 2
mov dword [esp + 0xc], 1
call sub.WSOCK32.dll_socket
mov ecx, dword [esp + 8]
cmp eax, 0xffffffff
mov dword [ecx + 0x88], eax
jne 0x428c3a
mov eax, 1
pop ecx
ret
lea edx, [esp]
push 4
push edx
push 0x20
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
neg eax
sbb eax, eax
neg eax
pop ecx
ret

Function at 0x428c60
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
movsx eax, si
push edi
mov edi, dword [esp + 0x28]
cmp eax, edi
mov word [esp + 0xc], 2
mov dword [esp + 0x10], 0xffffffff
jg 0x428cbe
push ebp
mov ebp, dword [esp + 0x30]
push esi
call sub.WSOCK32.dll_htons
mov edx, dword [ebx + 0x88]
lea ecx, [esp + 0x10]
push 0x10
push ecx
push 0
push 8
push str._status_
push edx
mov word [esp + 0x2a], ax
call sub.WSOCK32.dll_sendto
add esi, ebp
movsx eax, si
cmp eax, edi
jle 0x428c8d
pop ebp
push 2
push ebx
call fcn.00428b50
add esp, 8
call sub.KERNEL32.dll_GetTickCount
pop edi
mov dword [ebx + 0x8c], eax
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret