joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433ffe
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x434025
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x434028
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00433fda
pop esi
leave
ret 8

Function at 0x435cf6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x435d35
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x435d35
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x435d35
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x435d35
cmp dword [ecx + 0x74], 0xe
jbe 0x435d35
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4362a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x459780]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4362c7
mov ecx, 5
int 0x29
push 2
call fcn.00435d9a
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x4363d2
test esi, esi
jne 0x4363d2
push 2
call fcn.00435d9a
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00435098
mov esp, ebp
pop ebp
ret
Function at 0x43b080
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.0043b0b0
mov esi, dword [ebp + 8]
test al, al
je 0x43b09e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.0043b0c0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x43b1f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43b24c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43b24c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43b24c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43b24c
cmp dword [ecx + 0x74], 0xe
jbe 0x43b24c
cmp dword [ecx + 0xe8], 0
je 0x43b24c
push dword [ebp + 8]
call fcn.0043b0c0
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x45a818
call fcn.0043ae90
add esp, 8
cmp dword [ebp - 8], 0
jne 0x43b281
push dword [ebp + 8]
call fcn.0043b080
mov esp, ebp
pop ebp
ret

Function at 0x43b2c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43b31c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43b31c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43b31c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43b31c
cmp dword [ecx + 0x74], 0xe
jbe 0x43b31c
cmp dword [ecx + 0xe8], 0
je 0x43b31c
push dword [ebp + 8]
call fcn.0043b0c0
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x45a818
call fcn.0043ae90
add esp, 8
cmp dword [ebp - 8], 0
jne 0x43b351
push dword [ebp + 8]
call fcn.0043b080
mov esp, ebp
pop ebp
ret

Function at 0x43c6b0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60000
jae 0x43c6da
mov eax, 2
pop ebp
ret
push esi
call fcn.004360f0
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x70]
mov ecx, edx
and cl, 2
movzx ecx, cl
neg ecx
sbb ecx, ecx
inc eax
cmp eax, 3
ja case.default.0x43c6fa
jmp dword [eax*4 + 0x43c730]
or edx, 2
lea eax, [ecx + 2]
mov dword [esi + 0x70], edx
pop esi
pop ebp
ret
and edx, 0xfffffffd
mov dword [esi + 0x70], edx
lea eax, [ecx + 2]
pop esi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
call fcn.00436230
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x43c740
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x459780]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x43c83b
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x43c83b
xor ecx, ecx
mov al, byte [ecx + esi]
lea edx, [ecx + ecx]
test al, al
je 0x43c79a
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x43c778
jmp 0x43c83b
cmp edx, 0x200
jae 0x43c8a1
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x43c83b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call edi
test eax, eax
je 0x43c83a
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call edi
test eax, eax
je 0x43c83a
lea edi, [ebp - 0x504]
xor eax, eax
nop
movzx ecx, word [edi + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x43c883
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x43c820
pop edi
mov eax, dword [0x45a820]
test eax, eax
jne 0x43c861
push str.setlocale
call fcn.0043d0f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x43c85c
or eax, 0xffffffff
mov dword [0x45a820], eax
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x43c88f
push esi
push ebx
call ecx
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435098
mov esp, ebp
pop ebp
ret
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x43c83a
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00435098
mov esp, ebp
pop ebp
ret
call fcn.00435219
int3
Function at 0x40103c
Capabilities:
Acquire debug privileges

Disassembly:
jmp 0x40f5c0
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push edi
push ebx
push 0
push 0x400
call esi
push ebx
call fcn.00401389
add esp, 4
test eax, eax
je 0x40f703
mov edi, dword [eax + 8]
push eax
call sub.MFC42u.DLL_operatordelete
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x2000000
call esi
mov esi, eax
push esi
push str.SeDebugPrivilege
call fcn.00401500
add esp, 8
test eax, eax
je 0x40f703
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push 0x200
push eax
push edi
call fcn.00401695
add esp, 0xc
mov eax, 0x80
cmp dword [esp + eax + 0x14], ebx
je 0x40f65e
add eax, 4
cmp eax, 0x200
jl 0x40f644
mov ecx, dword [esp + 0xc]
mov ebx, dword [esp + 0xc]
jmp 0x40f664
lea ecx, [eax + 4]
lea ebx, [eax + 8]
lea esi, [ecx + edi]
lea ecx, [esp + 0x10]
push 4
push ecx
push esi
call fcn.00401695
add esp, 0xc
test eax, eax
je 0x40f697
lea edx, [esp + 0xc]
push 4
lea eax, [ebx + edi]
push edx
push eax
call fcn.00401695
add esp, 0xc
test eax, eax
mov eax, 4
jne 0x40f69b
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push 4
add eax, edx
push ecx
push eax
call fcn.00401618
add esp, 0xc
test eax, eax
je 0x40f703
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push 4
push eax
push ecx
call fcn.00401618
add esp, 0xc
test eax, eax
je 0x40f703
lea edx, [esp + 0x10]
push 4
push edx
push esi
mov dword [esp + 0x1c], 0
call fcn.00401618
lea eax, [esp + 0x1c]
push 4
add ebx, edi
push eax
push ebx
call fcn.00401618
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x208
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x208
ret

Function at 0x40105f
Capabilities:
Encode data using xor

Disassembly:
jmp 0x40d750
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, 4
test edi, edi
jne 0x40d764
pop edi
xor eax, eax
pop esi
ret
push 0
mov dword [edi], 0x66
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginMutation]
mov al, 0x55
mov dl, byte [esi + edi]
add esi, 2
xor dl, al
add al, 0x7c
mov byte [esi + edi - 2], dl
cmp esi, 0x2cc
jb 0x40d774
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
pop edi
mov eax, 1
pop esi
ret
Function at 0x4010d7
Capabilities:
Create thread

Disassembly:
jmp 0x406f90
sub esp, 0x2cc
push esi
mov esi, ecx
push 1
call fcn.004015c3
push 0
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginVirtualization]
mov ecx, esi
call fcn.00401820
test eax, eax
je 0x406ff1
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00401203
lea edx, [esp + 0x108]
push 0
push edx
lea ecx, [esi + 0xed38]
call fcn.00401339
test eax, eax
mov dword [esi + 0xed50], eax
jne 0x406fe6
pop esi
add esp, 0x2cc
ret
mov ecx, eax
call fcn.0040104b
test eax, eax
jne 0x40700b
mov eax, dword [esi + 0xed50]
pop esi
mov dword [eax + 0x2d8], 6
xor eax, eax
add esp, 0x2cc
ret
push edi
lea ecx, [esp + 8]
push 5
push ecx
mov ecx, dword [esi + 0xed50]
mov dword [esp + 0x2b0], 0xb3
call fcn.00401802
lea edx, [esp + 8]
push edx
call fcn.004014c4
add esp, 4
push 0
push 0
push esi
push 0x401451
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
push 0x404
mov ecx, esi
call sub.MFC42u.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42u.DLL_CWnd::SetFocus
mov ecx, 0x42a328
call fcn.00401195
mov eax, edi
pop edi
pop esi
add esp, 0x2cc
ret

Function at 0x4010fa
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x4113a0
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push ebp
mov dword [esp + 0x10], 0x400
call edi
mov esi, eax
add esp, 4
test esi, esi
jbe 0x4113ed
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_wcsncmp]
lea edi, [ebp + esi*2]
push 1
push 0x426058
push edi
call ebx
add esp, 0xc
test eax, eax
je 0x4113e6
dec esi
sub edi, 2
test esi, esi
ja 0x4113cd
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
pop ebx
lea eax, [esp + 0x14]
lea ecx, [ebp + esi*2]
push eax
push 1
push 0
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41145c
lea edx, [esp + 0xc]
push edx
push 0x42b698
push eax
push eax
mov eax, dword [esp + 0x24]
push str.Content_Type
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x411445
push str.application_octet_stream
call edi
push eax
push str.application_octet_stream
push 0x42b698
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0x10
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0x42b698
pop ebp
pop ecx
ret 4
push str.application_octet_stream
call edi
push eax
push str.application_octet_stream
push 0x42b698
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0x10
mov eax, 0x42b698
pop edi
pop esi
pop ebp
pop ecx
ret 4
Function at 0x4011cc
Capabilities:
Send data
Send http request

Disassembly:
jmp 0x40fd60
push 0xffffffffffffffff
push 0x41f158
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0xea68]
push 0
lea eax, [esp + 8]
push 0x4400000
push eax
push 0x4269c8
push str.HTTP_1.0
push ecx
push 0x425ca0
push edx
mov dword [esp + 0x24], 0x425c94
mov dword [esp + 0x28], 0
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
test eax, eax
mov dword [esi + 0xea6c], eax
jne 0x40fdf3
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x1c]
mov dword [esi + 0xea84], eax
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
push connect
push str.Accept:_image_gif__image_x_xbitmap__image_jpeg__image_pjpeg__application_x_shockwave_flash__application_vnd.ms_excel__application_vnd.ms_powerpoint__application_msword____r_n
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
push eax
mov eax, dword [esi + 0xea6c]
push str.Accept:_image_gif__image_x_xbitmap__image_jpeg__image_pjpeg__application_x_shockwave_flash__application_vnd.ms_excel__application_vnd.ms_powerpoint__application_msword____r_n
push eax
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersW]
test eax, eax
jne 0x40fe4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x1c]
mov dword [esi + 0xea84], eax
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
mov ecx, dword [esi + 0xea6c]
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x40fe98
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x1c]
mov dword [esi + 0xea84], eax
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x40122b
Capabilities:
Read data from internet
Receive data

Disassembly:
jmp 0x410500
push esi
mov esi, ecx
mov eax, dword [esi + 0xea6c]
test eax, eax
jne 0x41051f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xea84], eax
xor eax, eax
pop esi
ret 8
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
mov ecx, edx
push ebp
mov ebp, ecx
push edi
xor eax, eax
mov edi, ebx
push 0x42b694
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
push edx
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esi + 0xea6c]
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
pop edi
pop ebp
test eax, eax
pop ebx
jne 0x41056f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xea84], eax
mov dword [0x42b694], 0
mov eax, dword [0x42b694]
pop esi
ret 8
Function at 0x40137f
Capabilities:
Create thread

Disassembly:
jmp 0x412790
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x4127b7
push 0
push 0
push esi
push 0x40183e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x4127b7
pop esi
ret
mov eax, 1
pop esi
ret

Function at 0x401442
Capabilities:
Delete file

Disassembly:
jmp 0x4079a0
sub esp, 0x208
lea eax, [esp]
push 0x104
push eax
call fcn.00401276
lea ecx, [esp]
push str.winmm.dll
push ecx
push 0x425660
lea edx, [esp + 0x110]
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x208
ret

Function at 0x401460
Capabilities:
Get file size

Disassembly:
jmp 0x4112c0
sub esp, 8
mov eax, dword [ecx + 0xea78]
mov edx, dword [ecx + 0xea7c]
push edi
xor edi, edi
cmp eax, edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
jae 0x41135a
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
lea ebx, [eax + 0x200]
mov edx, dword [ebx + 0x800]
dec edx
je 0x411331
dec edx
jne 0x411337
push 0
push 0x80
push 3
push 0
push 1
push connect
push ebx
call ebp
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
lea edi, [edi + eax + 0x1800]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x411337
add edi, 0x2000
mov edx, dword [ecx + 0xea7c]
add eax, 0xa04
add ebx, 0xa04
cmp eax, edx
mov dword [esp + 0x10], eax
jb 0x4112ed
pop esi
pop ebp
mov eax, edi
pop ebx
pop edi
add esp, 8
ret
mov eax, edi
pop edi
add esp, 8
ret

Function at 0x401479
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x415620
sub esp, 0x10
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginMutation]
mov edx, dword [esp + 0x24]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push edx
mov byte [esp + 0x18], 0x4f
mov byte [esp + 0x19], 0x41
mov byte [esp + 0x1a], 0x42
mov byte [esp + 0x1b], 0x54
mov byte [esp + 0x1c], 0x46
mov byte [esp + 0x1d], 0x55
mov byte [esp + 0x1e], 0x48
mov byte [esp + 0x1f], 0x59
mov byte [esp + 0x20], 0x58
mov byte [esp + 0x21], 0x4e
mov ebx, ecx
call dword [sym.imp.MSVCRT.dll__strupr]
mov ebp, eax
add esp, 4
lea eax, [ebx - 1]
mov dword [esp + 0x10], esi
test ebx, ebx
mov dword [esp + 0x24], eax
jle 0x4156d5
mov cl, byte [esi + ebp]
xor edi, edi
xor eax, eax
cmp cl, byte [esp + eax + 0x14]
je 0x4156a4
inc eax
cmp eax, 0xa
jl 0x415696
jmp 0x4156a6
mov edi, eax
fld qword [0x4223e0]
fild dword [esp + 0x24]
call sub.MSVCRT.dll__CIpow
call sub.MSVCRT.dll__ftol
imul eax, edi
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
add edi, eax
dec edx
inc esi
mov dword [esp + 0x10], edi
cmp esi, ebx
mov dword [esp + 0x24], edx
jl 0x41568f
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x4014a6
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
jmp 0x407a10
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41e908
push eax
mov dword fs:[0], esp
sub esp, 0x58
xor eax, eax
push esi
mov esi, ecx
push edi
mov ecx, 0x11
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xf0d4]
mov eax, dword [eax - 8]
test eax, eax
jg 0x407a6b
push 0
push 0x42b504
push str.Please_Install_AION
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_3
add esi, 0xeb00
push str.PlayNCLauncher.exe
push esi
lea ecx, [esp + 0x10]
push 0x425824
push ecx
mov dword [esp + 0x78], 0
call sub.MFC42u.DLL_CString::Format
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
lea ecx, [esp + 8]
push edx
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push pe_nt_image_headers32
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x407ae4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push str.CreateProcess_Failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x407b1e
mov ecx, dword [esp + 0x14]
push ecx
push 0
push 0x2000038
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x407b0c
push eax
push eax
push str.OpenProcess_Failed
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x407b1e
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 8]
mov dword [esp + 0x68], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x60]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x64
ret
Function at 0x40150f
Capabilities:
Read file on windows

Disassembly:
jmp 0x414d20
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginMutation]
mov ebp, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push ebp
call edi
lea edx, [esp + 0x14]
push 0
lea ebx, [esi + 0xc]
push edx
push 4
push ebx
push ebp
call edi
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x20]
push 4
push ecx
push ebp
call edi
mov edx, dword [esp + 0x18]
mov edi, dword [ebx]
mov eax, dword [esp + 0x10]
xor edi, edx
mov dword [ebx], edi
mov dword [esi + 8], eax
lea edi, [eax + eax*8]
lea edi, [edi + edi*8]
shl edi, 2
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x414da2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov eax, dword [esp + 0x10]
lea ecx, [eax*4 + 1]
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x414dc7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov eax, dword [esi + 4]
lea edx, [esp + 0x14]
push 0
push edx
push edi
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
jle 0x414e0b
xor edx, edx
mov eax, dword [esi + 4]
mov edi, dword [ebx]
mov eax, dword [eax + edx]
sub eax, edi
js 0x414e0b
cmp eax, dword [esi + 8]
jge 0x414e0b
mov edi, dword [esi]
add edx, 0x144
mov dword [edi + eax*4], ecx
mov eax, dword [esp + 0x10]
inc ecx
cmp ecx, eax
jl 0x414de6
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 4

Function at 0x401569
Capabilities:
Write file on windows

Disassembly:
jmp 0x40cbc0
sub esp, 0x310
lea eax, [esp + 0x108]
push esi
push edi
push 0x104
mov edi, ecx
push eax
call fcn.0041a360
add esp, 8
lea ecx, [esp + 0xc]
push ecx
push 0x2a
mov ecx, 0x42a830
call fcn.0040173a
lea edx, [esp + 0xc]
lea eax, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0x21c]
push 0x425660
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [esp + 0x214]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40cc45
pop edi
xor eax, eax
pop esi
add esp, 0x310
ret
lea eax, [esp + 8]
push 0
push eax
add edi, 0x110
push 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x310
ret