joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x402e4f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.00402b44
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov dword [esp + 0x1c], 1
call esi
push 1
mov edi, eax
call esi
push eax
push edi
lea eax, [esp + 0x10]
push str.Resolution:__d_d
push eax
call sub.MFC42.DLL_CString::Format
mov esi, dword [esp + 0x30]
add esp, 0x10
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00402b4a
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4015c0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x402eaf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
lea ecx, [esp + 8]
mov dword [esp + 0x10], 0
call fcn.00402b44
lea eax, [esp + 0xc]
mov edi, 1
push eax
push edi
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40162b
call fcn.004013e0
mov esi, dword [esp + 0x28]
push 0x4054c8
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x10], edi
jmp 0x401692
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
push 0
push str.ProxyEnable
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40164f
call fcn.004013e0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x401663
call fcn.004013e0
cmp dword [esp + 0x14], edi
jne 0x401670
push str.Using_Proxy
jmp 0x401675
push str.Not_Using_Proxy
lea ecx, [esp + 0xc]
call fcn.00402b56
mov esi, dword [esp + 0x28]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00402b4a
mov dword [esp + 0x10], edi
lea ecx, [esp + 8]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4016c0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x402ee5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x298
lea ecx, [esp]
mov dword [esp + 4], 0
call fcn.00402b44
lea eax, [esp + 0x108]
mov dword [esp + 0x2a0], 1
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x40174c
lea ecx, [esp + 8]
push 0xff
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x401746
lea edx, [esp + 8]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x401746
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [esp + 4]
call fcn.00402b56
call dword [sym.imp.WS2_32.dll_WSACleanup]
push esi
mov esi, dword [esp + 0x2ac]
lea eax, [esp + 4]
mov ecx, esi
push eax
call fcn.00402b4a
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x2a4], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x29c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2a4
ret
Function at 0x4017a0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x402f20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa0
push ebx
lea eax, [esp + 0x10]
push esi
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push str.Unknown_OS
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x24]
mov ebx, 1
test eax, eax
mov dword [esp + 0xb0], ebx
jne 0x401804
push str.Win32s_Windows_3.1
jmp 0x401894
cmp eax, ebx
jne 0x401846
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x401817
push str.Windows_95
jmp 0x40182d
cmp eax, 0xa
jne 0x401823
push str.Windows_98
jmp 0x40182d
cmp eax, 0x5a
jne 0x401836
push str.Windows_ME
lea ecx, [esp + 0xc]
call fcn.00402b56
mov ecx, dword [esp + 0x20]
and ecx, 0xffff
mov dword [esp + 0x20], ecx
jmp 0x40189d
cmp eax, 2
jne 0x40189d
cmp dword [esp + 0x18], 4
ja 0x401860
push str.Windows_NT
lea ecx, [esp + 0xc]
call fcn.00402b56
mov eax, dword [esp + 0x18]
mov esi, 5
cmp eax, esi
jne 0x40189d
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x401889
push str.Windows_2000
lea ecx, [esp + 0xc]
call fcn.00402b56
cmp dword [esp + 0x18], esi
jne 0x40189d
cmp dword [esp + 0x1c], ebx
jne 0x40189d
push str.Windows_XP
lea ecx, [esp + 0xc]
call fcn.00402b56
lea ecx, [esp + 0xc]
call fcn.00402b44
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
push eax
push ecx
lea edx, [esp + 0x18]
push str._Major:_d_Minor:_d_Build:_d_
push edx
mov byte [esp + 0xc4], 2
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
call fcn.00402b62
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator
mov esi, dword [esp + 0xb8]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00402b4a
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0xb0], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0xb0], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xa8]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xac
ret
Function at 0x401940
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x402f6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe4
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0
call fcn.00402b44
mov eax, 0x64
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
mov dword [esp + 0xfc], 1
push eax
push 1
push 0
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call edi
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x2c]
push ecx
push edx
push 0
push 0
push str.Version
push eax
call ebp
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov esi, eax
call ebx
test esi, esi
jne 0x401a04
mov eax, dword [esp + 0x20]
cmp eax, 0x64
jb 0x4019e8
mov eax, 1
mov dword [esp + 0x20], eax
lea edx, [esp + 0x2c]
mov byte [esp + eax + 0x2b], 0
push edx
lea eax, [esp + 0x18]
push 0x4051d4
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000002
call edi
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x90]
push edx
push eax
push 0
push 0
push str.MinorVersion
push ecx
call ebp
mov edx, dword [esp + 0x10]
mov esi, eax
push edx
call ebx
test esi, esi
jne 0x401ad4
mov eax, dword [esp + 0x1c]
cmp eax, 0x64
jb 0x401a59
mov eax, 1
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x18]
mov byte [esp + eax + 0x8f], 0
call fcn.00402b44
lea eax, [esp + 0x90]
lea ecx, [esp + 0x18]
push eax
mov bl, 2
push str.___s
push ecx
mov byte [esp + 0x108], bl
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push edx
push eax
push ecx
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x100], 3
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x24]
mov byte [esp + 0xfc], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0xfc], 1
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x104]
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.00402b4a
mov dword [esp + 0x28], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0xfc], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xf4]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xf0
ret
Function at 0x401b20
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
sub esp, 0x88
push esi
push edi
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 1
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
mov dword [esp + 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401b76
call fcn.004013e0
push 0x4054c8
jmp 0x401bc1
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push 0
push str.ProcessorNameString
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401b9f
call fcn.004013e0
jmp 0x401ba8
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0xf], 0
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x401bbc
call fcn.004013e0
lea eax, [esp + 0x10]
push eax
mov esi, dword [esp + 0x98]
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop edi
pop esi
add esp, 0x88
ret

Function at 0x401ce0
Capabilities:
Get memory capacity

Disassembly:
push 0xffffffffffffffff
push 0x402fcf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call fcn.00402b44
lea eax, [esp + 0x14]
mov dword [esp + 0x3c], 1
push eax
mov dword [esp + 0x18], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
fild qword [esp + 0xc]
fmul qword [0x4041a0]
call sub.MSVCRT.dll__ftol
push eax
lea edx, [esp + 8]
push str._ld_M
push edx
call sub.MFC42.DLL_CString::Format
mov esi, dword [esp + 0x50]
add esp, 0xc
lea eax, [esp + 4]
mov ecx, esi
push eax
call fcn.00402b4a
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x3c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x34]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x402cdf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4041a8
push 0x402e18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x4054ec], 0xffffffff
or dword [0x4054f0], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4054e4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x4054e0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4054e8], eax
call fcn.00402e17
cmp dword [0x4053f0], 0
jne 0x402d62
push 0x402e14
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00402e02
push 0x405020
push 0x40501c
call sub.MSVCRT.dll__initterm
mov eax, dword [0x4054dc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4054d8]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x405018
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.004021b0
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x408e68
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408e1c
test al, al
jne 0x408e89
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408ed5
xor eax, eax
push ebp
push 0x408ec5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004033cc
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ecc
lea eax, [ebp - 0xc]
call fcn.00408e58
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4091dc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4092cb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406bf0
mov edx, dword [ebp - 8]
mov ecx, 0x4092e4
xor eax, eax
call fcn.004090d0
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x409299
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x4091fc
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408ca4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404b80
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407180
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00408c74
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x40454c
call fcn.0040577c
call fcn.00402e88
jmp 0x4091fc
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004031e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4092d2
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403170
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403170
ret

Function at 0x4092f4
Capabilities:
Shutdown system

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov esi, edx
mov ebx, eax
cmp dword [0x40b07c], 2
jne 0x409361
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40931c
xor eax, eax
jmp 0x40936e
lea eax, [esp + 8]
push eax
push 0x409374
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x409361
xor eax, eax
jmp 0x40936e
push esi
push ebx
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x409388
Capabilities:
Check if file exists

Disassembly:
xor edx, edx
mov eax, 2
call fcn.004092f4
ret
Function at 0x409398
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4093f2
inc esi
xor edi, edi
cmp edi, 1
jne 0x4093be
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4093cc
cmp edi, 1
jle 0x4093cc
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408e68
test eax, eax
jne 0x4093f2
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x4093f2
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x4093f2
inc edi
dec esi
jne 0x4093ae
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x409684
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
cmp dword [0x40cca0], 0
je 0x4096cd
mov edi, dword [0x40cddc]
dec edi
test edi, edi
jl 0x4096cd
inc edi
xor esi, esi
mov eax, esi
shl eax, 6
add eax, esi
mov edx, dword [0x40cdd8]
mov edx, dword [edx + eax]
mov eax, dword [0x40cca0]
call fcn.00404b2c
test eax, eax
jne 0x4096c9
mov eax, esi
call fcn.00409638
jmp 0x409792
inc esi
dec edi
jne 0x40969f
mov al, byte [0x40cdc8]
sub al, 1
jb 0x4096da
je 0x4096e3
jmp 0x4096ec
call fcn.00406f20
mov ebp, eax
jmp 0x4096ee
call sub.kernel32.dll_GetUserDefaultLangID
mov ebp, eax
jmp 0x4096ee
xor ebp, ebp
test bp, bp
je 0x40978b
mov edi, dword [0x40cddc]
dec edi
test edi, edi
jl 0x40973a
inc edi
xor esi, esi
mov eax, esi
shl eax, 6
add eax, esi
mov edx, dword [0x40cdd8]
lea ebx, [edx + eax]
movzx eax, bp
cmp eax, dword [ebx + 0x28]
jne 0x409736
cmp dword [ebx + 0x2c], 0
je 0x40972d
call sub.kernel32.dll_GetACP
cmp eax, dword [ebx + 0x2c]
jne 0x409736
mov eax, esi
call fcn.00409638
jmp 0x409792
inc esi
dec edi
jne 0x409705
mov edi, dword [0x40cddc]
dec edi
test edi, edi
jl 0x40978b
inc edi
xor esi, esi
mov eax, esi
shl eax, 6
add eax, esi
mov edx, dword [0x40cdd8]
lea ebx, [edx + eax]
mov eax, dword [ebx + 0x28]
and eax, 0x3ff
mov edx, ebp
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x409787
cmp dword [ebx + 0x2c], 0
je 0x40977e
call sub.kernel32.dll_GetACP
cmp eax, dword [ebx + 0x2c]
jne 0x409787
mov eax, esi
call fcn.00409638
jmp 0x409792
inc esi
dec edi
jne 0x409748
xor eax, eax
call fcn.00409638
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x409824
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4098f7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409910
push ebx
push 0x40991c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040336c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4098a4
mov al, 0x62
call fcn.004093fc
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004097f8
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x4098ad
call fcn.004097f8
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4098fe
lea eax, [ebp - 4]
call fcn.00403150
ret

Function at 0x409990
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409a44
jmp 0x409a39
cmp dword [esi + 0x10], 0x1000
jne 0x409a25
test byte [esi + 0x15], 1
jne 0x409a25
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x4099e4
cmp eax, 2
je 0x4099e4
cmp eax, 0x10
je 0x4099e4
cmp eax, 0x20
jne 0x4099f9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4099f9
mov bl, 1
xor ebp, ebp
jmp 0x409a0a
mov eax, dword [esi]
add eax, ebp
call fcn.00409988
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x4099fd
test bl, bl
je 0x409a25
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409a44
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4099bc
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.004016ae
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x4013cf
Capabilities:
Encode data using xor

Disassembly:
jmp 0x411f5d
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x412080
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebx, str.Soviet_aristo_baristo
mov ebp, 0x503778
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x5b
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xde
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x6d
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0x4d
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x29
push ebx
push ebp
call fcn.00403490
add esp, 0x44
push eax
call fcn.004013b6
xor byte [esi + edi], 0x10
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x64
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 5
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 9
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
xor byte [esi + edi], 0x4c
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x73
add esp, 0x40
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0xc8
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x40
push ebx
push ebp
call fcn.00403490
push eax
call fcn.004013b6
add byte [esi + edi], 0x5a
add esp, 0x24
inc esi
cmp esi, dword [esp + 0x18]
jb 0x411f7b
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x402946
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x412674
sub esp, 0x20
mov eax, dword [0x501358]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + esi + 0x78]
add edi, esi
mov ebx, dword [edi + 0x20]
mov eax, dword [edi + 0x18]
add ebx, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4126f3
mov eax, dword [ebx]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401e2e
push str.Hardline
push 0x503860
call fcn.00402d60
push eax
call fcn.00406082
lea eax, [esp + 0x20]
push 0x36c
push eax
call fcn.00402cc5
add esp, 0x14
cmp eax, dword [esp + 0x38]
je 0x41270d
lea ecx, [esp + 0x14]
add ebx, 4
call fcn.00402982
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x4126a5
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00403030
add esp, 0x20
ret 8
mov eax, dword [edi + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00402982
jmp 0x4126f5