joyce8/EMBER2024-capa huggingface dataset:
Function at 0x501fee
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x502026
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00500018
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ffff0
jmp 0x502032
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5036e5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x503727
call fcn.00509772
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x503727
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x50371e
xor eax, eax
jmp 0x50372f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00503735
pop edi
pop esi
pop ebx
ret 4

Function at 0x508e61
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x508e8f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x508ead
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00508dc7
jmp 0x508ead
mov eax, dword [esi + 0x14]
test eax, eax
je 0x508ead
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00508dc7
test edi, edi
mov eax, edi
jne 0x508e97
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4010e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010f9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40110d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40112e
cmp esi, eax
jae 0x401107
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401120
cmp esi, eax
jae 0x401107
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401270
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x118
mov edx, dword [esp + 0x11c]
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
push edx
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 8]
mov esi, eax
test esi, esi
jne 0x4012ce
test ecx, ecx
je 0x4012c0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x10]
mov esi, eax
mov dword [esp + 8], ecx
je 0x4012ea
test ecx, ecx
je 0x40138d
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
add esp, 0x118
ret 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push ecx
mov dword [esp + 0x2c], 0x100
call esi
test eax, eax
jne 0x401354
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0xc]
call fcn.00401270
mov edi, eax
test edi, edi
jne 0x40139a
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0xc]
push eax
push eax
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
push ecx
push edi
push edx
mov dword [esp + 0x2c], 0x100
call esi
test eax, eax
je 0x401316
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 8]
test eax, eax
je 0x40136b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 8], 0
mov eax, dword [esp + 0x124]
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x40138d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
add esp, 0x118
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x4013a9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 0x118
ret 4
Function at 0x401ff0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4381c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00401a40
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.004014c0
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x402082
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402df0
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
mov ebx, 0x400
sub eax, 0x10
push edi
mov edi, ecx
mov dword [esp + 0xc], ebx
mov edx, dword [eax + 0xc]
mov ecx, 1
sub ecx, edx
mov edx, dword [eax + 8]
sub edx, ebx
or ecx, edx
jge 0x402e23
push ebx
mov ecx, esi
call fcn.00401470
mov eax, dword [esi]
push 0
push 0
push 0
push 0
mov dword [eax - 0xc], ebx
mov ecx, dword [esi]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x2c]
mov byte [ecx + 0x400], 0
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edx, dword [esi]
test edx, edx
jne 0x402e57
xor ecx, ecx
jmp 0x402e69
mov ecx, edx
lea edi, [ecx + 1]
lea esp, [esp]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x402e60
sub ecx, edi
mov dword [edx - 0xc], ecx
mov edx, dword [esi]
mov byte [ecx + edx], 0
xor ecx, ecx
test eax, eax
sete cl
pop edi
pop esi
pop ebx
mov eax, ecx
pop ecx
ret 8
Function at 0x403190
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x438388
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
test byte [0x46b51c], 1
jne 0x4031d7
or dword [0x46b51c], 1
call sub.MFC70.DLL_Ordinal_982
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
push 0x4394d0
mov dword [0x46b518], eax
call fcn.00405b46
add esp, 4
mov cl, byte [0x46b51c]
mov eax, 2
test al, cl
jne 0x40320d
or dword [0x46b51c], eax
call sub.MFC70.DLL_Ordinal_982
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
push 0x4394c0
mov dword [0x46b514], eax
call fcn.00405b46
add esp, 4
mov edx, dword [esp + 0x18]
test edx, edx
push ebx
push esi
jne 0x40321b
xor eax, eax
jmp 0x403229
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403220
sub eax, esi
push eax
push edx
mov ecx, 0x46b518
call fcn.00401690
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x403241
xor eax, eax
jmp 0x40324f
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403246
sub eax, esi
push eax
push edx
mov ecx, 0x46b514
call fcn.00401690
mov ecx, dword [0x46b518]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push 0x20019
push 0
push ecx
push edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], 0x104
xor bl, bl
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4032f5
mov esi, dword [esp + 0x20]
mov edx, dword [0x46b514]
mov dword [esp + 0x20], eax
lea eax, [esp + 8]
push eax
push 0x46b410
lea ecx, [esp + 0x28]
push ecx
push 0
push edx
push esi
mov dword [esp + 0x3c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4032ea
mov eax, 0x46b410
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4032d0
mov ecx, dword [esp + 0x28]
sub eax, edx
push eax
push 0x46b410
call fcn.00401690
mov bl, 1
test esi, esi
je 0x4032f5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x405b9d
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x43ab10
call fcn.00405f18
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x405bda
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405bda
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x405bf2
cmp eax, 0x20b
je 0x405bdf
mov dword [ebp - 0x1c], ebx
jmp 0x405c06
cmp dword [ecx + 0x84], 0xe
jbe 0x405bda
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x405c00
cmp dword [ecx + 0x74], 0xe
jbe 0x405bda
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR70.dll___set_app_type]
pop ecx
or dword [0x46f7bc], 0xffffffff
or dword [0x46f7c0], 0xffffffff
call dword [sym.imp.MSVCR70.dll___p__fmode]
mov ecx, dword [0x46b954]
mov dword [eax], ecx
call dword [sym.imp.MSVCR70.dll___p__commode]
mov ecx, dword [0x46b950]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR70.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x46f7b8], eax
call fcn.00405e72
call fcn.00405f12
cmp dword [0x443054], ebx
jne 0x405c66
push fcn.00405f12
call dword [sym.imp.MSVCR70.dll___setusermatherr]
pop ecx
call fcn.00405f00
push 0x443038
push 0x443034
call sub.MSVCR70.dll__initterm
push 0x405eb6
call fcn.00405b46
mov eax, dword [0x46b94c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x46b948]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCR70.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp eax, ebx
jge 0x405cba
push 8
call sub.MSVCR70.dll__amsg_exit
pop ecx
push 0x443030
push section..data
call sub.MSVCR70.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR70.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x405d14
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x405ce8
cmp al, 0x22
jne 0x405cda
cmp byte [esi], 0x22
jne 0x405cf1
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x405cfb
cmp al, 0x20
jbe 0x405ced
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x405d1f
movzx eax, word [ebp - 0x48]
jmp 0x405d22
cmp byte [esi], 0x20
jbe 0x405cf1
inc esi
mov dword [ebp - 0x34], esi
jmp 0x405d14
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.0040c522
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x405d3f
push esi
call dword [sym.imp.MSVCR70.dll_exit]
call dword [sym.imp.MSVCR70.dll__cexit]
jmp 0x405d74
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00405f53
ret
Function at 0x406630
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4386bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push esi
push edi
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call fcn.00409960
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.004098e0
mov ecx, eax
shr ecx, 0x10
add esp, 8
cmp cx, ax
mov dword [esp + 0x10], ecx
ja 0x4066a1
mov dword [esp + 0x10], eax
lea ecx, [esp + 0xc]
call fcn.004088f0
push 0
push 0x9cb1
push 0x7e5b
push 0x3d6f
lea ecx, [esp + 0x1c]
mov dword [esp + 0x13c], 0
call fcn.00408a30
test al, al
lea ecx, [esp + 0xc]
jne 0x406715
call fcn.00408940
mov eax, dword [ebp + 8]
xor eax, 0x86cd
cmp ax, 0x40a3
je 0x406702
cmp ax, 0xf1e
je 0x406702
cmp ax, 0x1fcf
je 0x406702
xor eax, 0x76dd
mov esi, eax
jmp 0x40678f
push eax
call fcn.00405fe0
xor esi, esi
mov si, ax
xor esi, 0x86cd
jmp 0x40678f
push 0x7a1d
call fcn.00408900
test al, al
lea ecx, [esp + 0xc]
jne 0x406737
call fcn.00408940
mov esi, dword [ebp + 8]
xor esi, 0x76dd
jmp 0x40678f
lea eax, [esp + 0x10]
push eax
push 0x21
push 0
call fcn.004089b0
test al, al
jne 0x40675d
lea ecx, [esp + 0xc]
call fcn.00408940
mov esi, dword [ebp + 8]
xor esi, 0x76df
jmp 0x40678f
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp + 8]
push edi
lea ecx, [esp + 0x10]
call fcn.00408a80
neg al
lea ecx, [esp + 0xc]
sbb eax, eax
and eax, 0xfffffffe
add eax, 2
mov esi, eax
call fcn.00408940
xor esi, edi
xor esi, 0x76dc
lea ecx, [esp + 0xc]
mov dword [esp + 0x12c], 0xffffffff
call fcn.00405fd0
mov ecx, dword [esp + 0x124]
pop edi
mov ax, si
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4067c0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4386bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push esi
push edi
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call fcn.00409960
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.004098e0
mov ecx, eax
shr ecx, 0x10
add esp, 8
cmp cx, ax
mov esi, ecx
ja 0x40682d
mov esi, eax
lea ecx, [esp + 0xc]
call fcn.004088f0
push 0
push 0x9cb1
push 0x7e5b
push 0x3d6f
lea ecx, [esp + 0x1c]
mov dword [esp + 0x13c], 0
call fcn.00408a30
test al, al
lea ecx, [esp + 0xc]
jne 0x4068a7
call fcn.00408940
mov ecx, dword [ebp + 8]
mov eax, ecx
xor eax, 0x86cd
cmp ax, 0x40a3
je 0x406891
cmp ax, 0xf1e
je 0x406891
cmp ax, 0x1fcf
je 0x406891
xor ecx, 0x76dd
mov esi, ecx
jmp 0x40692c
push eax
call fcn.00405fe0
xor esi, esi
mov si, ax
xor esi, 0x86cd
jmp 0x40692c
push 0x7a1d
call fcn.00408900
test al, al
lea ecx, [esp + 0xc]
jne 0x4068c9
call fcn.00408940
mov esi, dword [ebp + 8]
xor esi, 0x76dd
jmp 0x40692c
lea eax, [esp + 0x10]
push eax
push 0x21
push 0
call fcn.00408970
test al, al
lea ecx, [esp + 0xc]
jne 0x4068ef
call fcn.00408940
mov esi, dword [ebp + 8]
xor esi, 0x76df
jmp 0x40692c
cmp word [esp + 0x10], si
je 0x406906
call fcn.00408940
mov esi, dword [ebp + 8]
xor esi, 0x76d8
jmp 0x40692c
mov edi, dword [ebp + 8]
push edi
call fcn.00408a80
neg al
lea ecx, [esp + 0xc]
sbb eax, eax
and eax, 0xfffffffe
add eax, 2
mov esi, eax
call fcn.00408940
xor esi, edi
xor esi, 0x76dc
lea ecx, [esp + 0xc]
mov dword [esp + 0x12c], 0xffffffff
call fcn.00405fd0
mov ecx, dword [esp + 0x124]
pop edi
mov ax, si
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x407320
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x438758
push eax
mov dword fs:[0], esp
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, 0xffff
mov ebx, ebp
call sub.MFC70.DLL_Ordinal_982
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x20], esi
mov eax, dword [esi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, 0x104
or eax, ecx
mov dword [esp + 0x18], 0
jge 0x407387
push 0x104
lea ecx, [esp + 0x24]
call fcn.00401470
mov esi, dword [esp + 0x20]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test esi, esi
jne 0x40739b
xor eax, eax
jmp 0x4073a9
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4073a0
sub eax, edx
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
mov eax, dword [0x46b964]
cmp eax, 2
jne 0x407414
cmp word [0x46bdce], bp
jne 0x4073e7
push ebp
mov ecx, 0x46b9a8
call fcn.0040a200
test al, al
jne 0x407444
mov ecx, 0x46b9a8
mov word [0x46bdce], 0
call fcn.00409ae0
jmp 0x407446
cmp word [0x46c1fe], bp
jne 0x407446
push ebp
mov ecx, 0x46bdd8
call fcn.0040a200
test al, al
jne 0x407444
mov ecx, 0x46bdd8
mov word [0x46c1fe], 0
call fcn.00409ae0
jmp 0x407446
cmp eax, 3
jne 0x40748a
mov ecx, dword [0x46b95c]
mov eax, dword [ecx]
push ebp
call dword [eax + 0x34]
test eax, eax
mov dword [0x46b960], eax
je 0x407446
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
test eax, eax
jne 0x407446
mov ecx, dword [0x46b960]
mov eax, dword [ecx]
call dword [eax + 0x10]
xor edi, edi
xor ebx, edi
xor ebx, 0x7cd8
lea eax, [esi - 0x10]
mov edi, ebx
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407472
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x10]
mov ax, di
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
cmp eax, 1
jne 0x407446
xor ebp, 0xc971
push ebp
mov ecx, 0x46b968
call fcn.00409840
test al, al
jne 0x407444
mov ax, word [0x46b976]
cmp ax, 0x200
jne 0x4074b7
mov edi, 0x100
jmp 0x407446
cmp ax, 0x201
jne 0x4074c4
mov edi, 0x101
jmp 0x407446
cmp ax, 0x202
jne 0x4074d4
mov edi, 0x102
jmp 0x407446
xor ecx, ecx
cmp ax, 0x203
setne cl
dec ecx
and ecx, 0xffff0002
add ecx, 0xffff
mov edi, ecx
jmp 0x407446
Function at 0x407500
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x438758
push eax
mov dword fs:[0], esp
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
mov edi, 0xffff
mov ebp, ebx
call sub.MFC70.DLL_Ordinal_982
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x20], esi
mov eax, dword [esi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, 0x104
or eax, ecx
mov dword [esp + 0x18], 0
jge 0x407567
push 0x104
lea ecx, [esp + 0x24]
call fcn.00401470
mov esi, dword [esp + 0x20]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test esi, esi
jne 0x40757b
xor eax, eax
jmp 0x407589
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407580
sub eax, edx
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
mov eax, dword [0x46b964]
cmp eax, 2
jne 0x407638
cmp word [0x46bdce], bx
jne 0x40760e
mov ecx, 0x46b9a8
mov word [0x46bdce], 0
call fcn.00409aa0
mov ecx, 0x46b9a8
call fcn.00409ae0
test al, al
je 0x4075ca
xor edi, edi
xor ebp, edi
xor ebp, 0x7cd8
lea eax, [esi - 0x10]
mov edi, ebp
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4075f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x10]
mov ax, di
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
cmp word [0x46c1fe], bx
jne 0x407631
mov ecx, 0x46bdd8
mov word [0x46c1fe], 0
call fcn.00409aa0
mov ecx, 0x46bdd8
jmp 0x4075bf
mov edi, 0xffff
jmp 0x4075ca
cmp eax, 3
jne 0x40765c
mov ecx, dword [0x46b960]
test ecx, ecx
je 0x40764c
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [0x46b95c]
mov edx, dword [ecx]
call dword [edx + 8]
jmp 0x4075ca
cmp eax, 1
jne 0x4075ca
xor ebx, 0xc971
push ebx
mov ecx, 0x46b968
call fcn.004098b0
test al, al
jne 0x4075c8
mov ax, word [0x46b976]
cmp ax, 0x200
jne 0x407694
mov edi, 0x100
jmp 0x4075ca
cmp ax, 0x201
jne 0x4076a4
mov edi, 0x101
jmp 0x4075ca
cmp ax, 0x202
jne 0x4076b4
mov edi, 0x102
jmp 0x4075ca
xor ecx, ecx
cmp ax, 0x203
setne cl
dec ecx
and ecx, 0xffff0002
add ecx, 0xffff
mov edi, ecx
jmp 0x4075ca
Function at 0x408d70
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x41c
push ebx
push esi
mov esi, ecx
mov al, byte [esi + 2]
xor ebx, ebx
cmp al, bl
jne 0x408d8e
pop esi
xor al, al
pop ebx
add esp, 0x41c
ret
cmp byte [esi + 3], bl
je 0x408da2
mov word [esi + 0xe], bx
pop esi
mov al, 1
pop ebx
add esp, 0x41c
ret
xor eax, eax
mov ax, word [esi + 6]
xor ecx, ecx
mov cx, word [esi + 8]
mov dword [esp + 0x1c], eax
cmp byte [esi + 1], bl
mov dword [esp + 0x14], ecx
je 0x408dd1
xor edx, edx
mov dx, word [esi + 0xa]
xor eax, eax
mov ax, word [esi + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
jmp 0x408dd9
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov ecx, dword [esi + 0x14]
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x24]
push eax
push 3
call sub.RyClient.dll_Ordinal_1
cmp ax, bx
mov word [esi + 0xe], ax
jne 0x408e26
mov cx, word [esp + 8]
mov bl, 1
mov word [esi + 0x10], cx
mov byte [esi + 3], bl
pop esi
mov al, bl
pop ebx
add esp, 0x41c
ret

Function at 0x4098e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
test edx, edx
je 0x409910
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
mov esi, dword [esi*4 + 0x46c208]
shr eax, 8
xor eax, esi
inc ecx
dec edx
jne 0x4098f1
pop edi
pop esi
not eax
ret

Function at 0x409960
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push esi
xor esi, esi
push 8
push esi
call fcn.00409920
shl eax, 0x18
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
add eax, eax
and ecx, 0x4c11db7
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x4c11db7
add ecx, ecx
xor eax, ecx
push 0x20
push eax
call fcn.00409920
add esp, 0x10
mov dword [esi*4 + 0x46c208], eax
inc esi
cmp esi, 0xff
jle 0x409963
pop esi
ret