joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412290
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov edx, dword [esp + 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x410]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x41c]
push 0x400
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0xc]
xor edi, edi
xor esi, esi
lea edx, [esp + 0xc]
test al, al
lea ecx, [esp + 0xc]
je 0x412316
cmp al, 0x20
je 0x412307
cmp al, 9
je 0x412307
test edi, edi
jne 0x41230e
mov edi, 1
mov edx, ecx
jmp 0x41230e
cmp edi, 1
jne 0x41230e
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4122f2
mov ebx, dword [esp + 0x420]
test edx, edx
mov byte [ebx], 0
je 0x412385
test esi, esi
jne 0x41235f
test ebx, ebx
je 0x412385
mov esi, dword [esp + 0x424]
test esi, esi
jle 0x412385
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jae 0x412385
push edx
push esi
push ebx
call dword [0x425080]
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
sub esi, edx
test ebx, ebx
je 0x412385
test esi, esi
jle 0x412385
mov eax, dword [esp + 0x424]
cmp eax, esi
jle 0x412385
push esi
push edx
push eax
push ebx
call dword [0x42507c]
add esp, 0x10
mov byte [esi + ebx], 0
pop edi
pop esi
pop ebx
add esp, 0x400
ret 0x18
Function at 0x4123a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov ebx, dword [esp + 0x11c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
push str.Path
push str.Redirect
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x14]
test edx, edx
je 0x41240d
mov al, byte [esp + 0x14]
test al, al
je 0x41240d
cmp al, 0x20
je 0x412405
cmp al, 9
jne 0x412450
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4123fd
mov esi, dword [esp + 0x120]
test esi, esi
je 0x412443
mov edx, dword [esp + 0x124]
test edx, edx
jle 0x412443
test ebx, ebx
je 0x412443
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jae 0x412443
push ebx
push edx
push esi
call dword [0x425080]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
lea eax, [esp + 0x14]
push 0x3a
push eax
call fcn.004153e3
add esp, 8
test eax, eax
jne 0x412513
cmp byte [esp + 0x14], 0x5c
je 0x412513
test ebx, ebx
je 0x412443
mov edi, dword [esp + 0x120]
test edi, edi
je 0x412443
mov ebp, dword [esp + 0x124]
test ebp, ebp
jle 0x412443
push 0x5c
push ebx
call fcn.0041547a
add esp, 8
test eax, eax
jne 0x4124a6
push 0x2f
push ebx
call fcn.0041547a
add esp, 8
test eax, eax
mov byte [edi], 0
je 0x4124ea
sub eax, ebx
inc eax
mov esi, eax
test esi, esi
jle 0x4124cb
cmp ebp, esi
jle 0x4124cb
push esi
push ebx
push ebp
push edi
call dword [0x42507c]
add esp, 0x10
mov byte [esi + edi], 0
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.004127b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
push ebp
push ebx
mov ecx, esi
call fcn.00412700
test eax, eax
je 0x412503
push ebx
push ebp
push edi
call dword [0x425080]
add esp, 0xc
push 0x425888
push ebp
push edi
mov ecx, esi
call fcn.004127b0
jmp 0x4124cf
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
call fcn.004123a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 0xc
Function at 0x41b42d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4264a8
cmp edx, dword [eax]
je 0x41b44f
add eax, 8
inc ecx
cmp eax, 0x426538
jl 0x41b440
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4264a8]
jne 0x41b57d
mov eax, dword [0x427938]
cmp eax, 1
je 0x41b557
test eax, eax
jne 0x41b480
cmp dword [0x425b14], 1
je 0x41b557
cmp edx, 0xfc
je 0x41b57d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41b4b7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041b5c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00415980
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41b4fa
lea eax, [ebp - 0x1a4]
push eax
call fcn.00415980
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42280c
push edi
call fcn.00414e00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041b5c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041b5d0
lea eax, [ebp - 0xa0]
push 0x4227ec
push eax
call fcn.0041b5d0
push dword [esi + 0x4264ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041b5d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041d712
add esp, 0x2c
pop edi
jmp 0x41b57d
lea eax, [ebp + 8]
lea esi, [esi + 0x4264ac]
push 0
push eax
push dword [esi]
call fcn.00415980
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401200
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
sub esp, 0x40c
mov eax, dword [0x430090]
xor eax, esp
mov dword [esp + 0x408], eax
push esi
push 0
push 0
push 0
push 1
push 0
call dword [0x429268]
mov esi, eax
mov dword [esp + 8], esi
test esi, esi
jne 0x401247
xor al, al
pop esi
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.0040dd4b
add esp, 0x40c
ret
push edi
push 0x400
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004101c0
push 0x2000
lea ecx, [esp + 0x20]
push str.Range:bytes_d_
push ecx
call fcn.0040dd5a
add esp, 0x18
push 0
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x1c]
push edx
push str.http:__www.kuaizip.com_update_update2.php_pver1cver1.0.0.0isauto0
push esi
call dword [0x429274]
mov edi, eax
test edi, edi
jne 0x4012ad
push esi
call dword [0x429264]
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.0040dd4b
add esp, 0x40c
ret
mov eax, dword [ebx]
push ebp
push 0x2000
push 0
push eax
call fcn.004101c0
mov edx, dword [ebx]
mov ebp, dword [0x429270]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x2000
push edx
push edi
mov dword [esp + 0x1c], 0
xor esi, esi
call ebp
test eax, eax
je 0x401310
mov eax, dword [esp + 0xc]
test eax, eax
je 0x401310
add esi, eax
cmp esi, 0x2000
ja 0x40130e
mov ecx, dword [ebx]
lea eax, [esp + 0xc]
push eax
push 0x2000
add ecx, esi
push ecx
push edi
call ebp
test eax, eax
jne 0x4012e4
jmp 0x401310
xor esi, esi
push edi
mov edi, dword [0x429264]
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
mov ecx, dword [esp + 0x414]
xor eax, eax
pop ebp
cmp eax, esi
pop edi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0040dd4b
add esp, 0x40c
ret
Function at 0x401590
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov eax, 0x800c
call fcn.00419870
mov eax, dword [0x430090]
xor eax, esp
mov dword [esp + 0x8008], eax
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push str.http_download
mov esi, ecx
mov edi, edx
call dword [0x429268]
mov ebx, eax
test ebx, ebx
jne 0x4015e0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8008]
xor ecx, esp
call fcn.0040dd4b
add esp, 0x800c
ret
push 0
push 0x80000000
push 0
push 0
push esi
push ebx
call dword [0x429274]
mov esi, eax
test esi, esi
jne 0x401600
push ebx
call dword [0x429264]
push ebp
push edi
call dword [0x429058]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push edi
call dword [0x4290ec]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40163b
push esi
mov esi, dword [0x429264]
call esi
push ebx
call esi
xor eax, eax
jmp 0x4016f6
push 0x7fff
lea eax, [esp + 0x1d]
push 0
push eax
mov dword [esp + 0x20], 1
mov byte [esp + 0x24], 0
call fcn.004101c0
mov edi, dword [0x429270]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x8000
lea edx, [esp + 0x20]
push edx
push esi
mov dword [esp + 0x20], 0x8000
call edi
test eax, eax
je 0x4016d7
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4016df
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x24]
push edx
push ebp
call dword [0x429064]
test eax, eax
je 0x4016d7
push 0x7fff
lea eax, [esp + 0x1d]
push 0
push eax
mov byte [esp + 0x24], 0
call fcn.004101c0
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x8000
lea edx, [esp + 0x20]
push edx
push esi
mov dword [esp + 0x20], 0x8000
call edi
test eax, eax
jne 0x401680
mov dword [esp + 0x14], 0
push ebp
call dword [0x429050]
push esi
mov esi, dword [0x429264]
call esi
push ebx
call esi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x8018]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040dd4b
add esp, 0x800c
ret
Function at 0x401a70
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x430090]
xor eax, esp
mov dword [esp + 0x110], eax
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareKuaiZipSFX_
push 0x80000001
mov dword [esp + 0x14], 0
call dword [0x429004]
test eax, eax
je 0x401ac2
xor eax, eax
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0040dd4b
add esp, 0x114
ret
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push str.path
push ecx
mov dword [esp + 0x1c], 0x104
call dword [0x429014]
push str.KuaiZip.exe
lea edx, [esp + 0x10]
push edx
call dword [0x42920c]
lea eax, [esp + 0xc]
push eax
call dword [0x429208]
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0040dd4b
add esp, 0x114
ret

Function at 0x405150
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x54
mov eax, dword [0x430090]
xor eax, esp
mov dword [esp + 0x50], eax
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWAREUniMonitor_
push 0x80000002
call dword [section..rdata]
test eax, eax
jne 0x4051bc
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push str.DeviceId
push ecx
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0x42
call dword [0x429010]
test eax, eax
je 0x4051cd
mov edx, dword [esp]
push edx
call dword [0x429018]
xor al, al
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0040dd4b
add esp, 0x54
ret
mov eax, dword [esp]
push eax
call dword [0x429018]
mov ecx, dword [esp + 0x50]
xor ecx, esp
mov al, 1
call fcn.0040dd4b
add esp, 0x54
ret

Function at 0x4051f0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREUniMonitor_
push 0x80000002
or esi, 0xffffffff
call dword [0x42900c]
test eax, eax
jne 0x40526e
mov eax, 0x435450
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405230
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [esp + 4]
push edx
push 0x435450
push 7
push 0
push str.DeviceId
push eax
call dword [0x429008]
test eax, eax
jne 0x405263
xor esi, esi
mov ecx, dword [esp + 4]
push ecx
call dword [0x429018]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x407820
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x430090]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
lea eax, [esp + 8]
push eax
push 0x101
call fcn.0040dc0a
test eax, eax
je 0x407863
mov eax, 0xff
pop esi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.0040dd4b
add esp, 0x1a0
ret
push 0x42c510
call dword [0x42914c]
mov dword [0x4356f4], eax
test eax, eax
jne 0x4078af
push str.Unable_to_locate_ICMP.DLL_
push 0x4325b8
call fcn.004055c0
push eax
call fcn.00404a00
add esp, 0xc
call fcn.0040dc04
mov eax, 1
pop esi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.0040dd4b
add esp, 0x1a0
ret
mov esi, dword [0x429038]
push str.IcmpCreateFile
push eax
call esi
mov ecx, dword [0x4356f4]
push str.IcmpCloseHandle
push ecx
mov dword [0x4356f8], eax
call esi
mov edx, dword [0x4356f4]
push str.IcmpSendEcho
push edx
mov dword [0x4356fc], eax
call esi
cmp dword [0x4356f8], 0
mov dword [0x435700], eax
je 0x407916
cmp dword [0x4356fc], 0
je 0x407916
test eax, eax
je 0x407916
xor eax, eax
pop esi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.0040dd4b
add esp, 0x1a0
ret
push str.Failed_to_get_proc_addr_for_function.
push 0x4325b8
call fcn.004055c0
push eax
call fcn.00404a00
mov eax, dword [0x4356f4]
add esp, 0xc
push eax
call dword [0x429074]
call fcn.0040dc04
mov ecx, dword [esp + 0x19c]
pop esi
xor ecx, esp
mov eax, 2
call fcn.0040dd4b
add esp, 0x1a0
ret

Function at 0x40b270
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x70
mov eax, dword [0x430090]
xor eax, esp
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x74]
push esi
push edi
push eax
mov eax, 0x2c
lea esi, [esp + 0xc]
mov edi, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
call fcn.0040a910
add esp, 4
mov eax, esi
call fcn.0040aa20
mov byte [edi + 0x20], 0
xor esi, esi
movzx eax, byte [esp + esi + 0x60]
push eax
push str._02X
push edi
call fcn.0040dd5a
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x10
jl 0x40b2d5
mov ecx, dword [esp + 0x74]
pop edi
pop esi
xor ecx, esp
call fcn.0040dd4b
add esp, 0x70
ret
Function at 0x40b400
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x430090]
xor eax, esp
mov dword [esp + 0x418], eax
push esi
test edx, edx
je 0x40b50d
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b422
sub eax, esi
sar eax, 1
cmp eax, 0x104
ja 0x40b50d
push str.Connection
push edx
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_
lea eax, [esp + 0x21c]
push str._s_s_s
push eax
call dword [0x429214]
add esp, 0x14
lea ecx, [esp + 4]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x21c]
push edx
push 0x80000002
call dword [section..rdata]
test eax, eax
jne 0x40b50d
push 0x1fe
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004101c0
add esp, 0xc
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push str.PnpInstanceID
push edx
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x100
call dword [0x429010]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [0x429018]
test esi, esi
jne 0x40b50d
push 3
lea ecx, [esp + 0x14]
push 0x42c788
push ecx
call fcn.0040fdfe
add esp, 0xc
neg eax
sbb eax, eax
inc eax
pop esi
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.0040dd4b
add esp, 0x41c
ret
mov ecx, dword [esp + 0x41c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040dd4b
add esp, 0x41c
ret
Function at 0x40b530
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 0x224
mov eax, dword [0x430090]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov edi, ecx
push 0x288
mov dword [esp + 0x1c], edi
mov byte [esp + 0x13], 0
call fcn.0040ea09
mov esi, eax
xor eax, eax
add esp, 4
mov dword [esp + 0x1d], eax
mov byte [esp + 0x21], al
lea eax, [esp + 0x14]
push eax
xor bl, bl
push esi
mov dword [esp + 0x18], esi
mov byte [esp + 0x24], bl
mov dword [esp + 0x1c], 0x288
call fcn.00424840
cmp eax, 0x6f
jne 0x40b5a6
push esi
call fcn.0040eb2e
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0040edf9
add esp, 8
mov dword [esp + 0x10], eax
mov esi, eax
lea edx, [esp + 0x14]
push edx
push esi
call fcn.00424840
test eax, eax
jne 0x40b6c9
test esi, esi
je 0x40b68f
push ebp
mov ebp, dword [0x429148]
push 0
push 0
push 0xffffffffffffffff
lea edi, [esi + 8]
push edi
push 0
push 0
call ebp
push eax
lea eax, [esp + 0x2c]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call ebp
lea edx, [esp + 0x28]
call fcn.0040b400
test eax, eax
je 0x40b678
cmp byte [esi + 0x194], bl
ja 0x40b63c
mov cl, byte [esp + 0x21]
cmp byte [esi + 0x195], cl
ja 0x40b63c
mov dl, byte [esp + 0x22]
cmp byte [esi + 0x196], dl
ja 0x40b63c
mov al, byte [esp + 0x23]
cmp byte [esi + 0x197], al
ja 0x40b63c
mov cl, byte [esp + 0x24]
cmp byte [esi + 0x198], cl
ja 0x40b63c
mov dl, byte [esp + 0x25]
cmp byte [esi + 0x199], dl
jbe 0x40b678
movzx eax, byte [esi + 0x195]
movzx ecx, byte [esi + 0x196]
mov dl, byte [esi + 0x197]
mov bl, byte [esi + 0x194]
mov byte [esp + 0x21], al
movzx eax, byte [esi + 0x198]
mov byte [esp + 0x22], cl
movzx ecx, byte [esi + 0x199]
mov byte [esp + 0x23], dl
mov byte [esp + 0x24], al
mov byte [esp + 0x25], cl
mov esi, dword [esi]
test esi, esi
jne 0x40b5c8
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov byte [esp + 0x20], bl
pop ebp
test bl, bl
je 0x40b6c9
cmp byte [esp + 0x1d], 0
je 0x40b6c9
cmp byte [esp + 0x1e], 0
je 0x40b6c9
cmp byte [esp + 0x1f], 0
je 0x40b6c9
cmp byte [esp + 0x20], 0
je 0x40b6c9
cmp byte [esp + 0x21], 0
je 0x40b6c9
mov edx, dword [esp + 0x1c]
mov ax, word [esp + 0x20]
mov dword [edi], edx
mov word [edi + 4], ax
mov bl, 1
jmp 0x40b6cd
mov bl, byte [esp + 0xf]
test esi, esi
je 0x40b6da
push esi
call fcn.0040dd40
add esp, 4
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0040dd4b
add esp, 0x224
ret
Function at 0x40c830
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, dword [esp + 8]
cmp ebp, 0x1a
jle 0x40c9a7
movzx eax, byte [ebx]
mov byte [esi], al
movzx ecx, byte [ebx + 1]
mov byte [esi + 1], cl
movzx ax, byte [ebx + 3]
shl ax, 8
mov word [esi + 2], ax
movzx edx, byte [ebx + 2]
add dx, ax
mov word [esi + 2], dx
movzx ax, byte [ebx + 5]
shl ax, 8
mov word [esi + 4], ax
movzx ecx, byte [ebx + 4]
add cx, ax
mov word [esi + 4], cx
movzx ax, byte [ebx + 7]
shl ax, 8
mov word [esi + 6], ax
movzx edx, byte [ebx + 6]
add dx, ax
mov word [esi + 6], dx
movzx ax, byte [ebx + 9]
shl ax, 8
mov word [esi + 8], ax
movzx ecx, byte [ebx + 8]
add cx, ax
mov word [esi + 8], cx
movzx ax, byte [ebx + 0xb]
shl ax, 8
mov word [esi + 0xa], ax
movzx edx, byte [ebx + 0xa]
add dx, ax
mov word [esi + 0xa], dx
movzx ax, byte [ebx + 0xd]
shl ax, 8
mov word [esi + 0xc], ax
movzx ecx, byte [ebx + 0xc]
add cx, ax
mov word [esi + 0xc], cx
movzx edx, byte [ebx + 0xe]
mov byte [esi + 0xe], dl
movzx eax, byte [ebx + 0xf]
mov byte [esi + 0xf], al
movzx ecx, byte [ebx + 0x10]
mov byte [esi + 0x10], cl
movzx edx, byte [ebx + 0x11]
mov byte [esi + 0x11], dl
movzx eax, byte [ebx + 0x12]
mov byte [esi + 0x12], al
movzx ax, byte [ebx + 0x14]
shl ax, 8
mov word [esi + 0x14], ax
movzx ecx, byte [ebx + 0x13]
add cx, ax
mov word [esi + 0x14], cx
movzx ax, byte [ebx + 0x16]
shl ax, 8
mov word [esi + 0x16], ax
movzx edx, byte [ebx + 0x15]
add dx, ax
mov word [esi + 0x16], dx
movzx eax, byte [ebx + 0x17]
mov byte [esi + 0x18], al
movzx ecx, byte [ebx + 0x18]
mov byte [esi + 0x19], cl
movzx edx, byte [ebx + 0x19]
mov byte [esi + 0x1a], dl
movzx eax, byte [ebx + 0x1a]
mov dl, byte [esi + 0x18]
push edi
mov byte [esi + 0x1b], al
movzx eax, byte [esi + 1]
mov edi, ebp
sub edi, eax
add eax, ebx
push eax
lea ecx, [esi + 0x20]
push ecx
call fcn.0040c610
movzx eax, byte [esi + 1]
mov dl, byte [esi + 0x19]
mov edi, ebp
sub edi, eax
add eax, ebx
lea ecx, [esi + 0x74]
push eax
push ecx
call fcn.0040c610
movzx eax, byte [esi + 1]
mov edi, ebp
sub edi, eax
add eax, ebx
lea edx, [esi + 0x58]
push eax
push edx
mov dl, byte [esi + 0x1a]
call fcn.0040c610
movzx eax, byte [esi + 1]
mov dl, byte [esi + 0x1b]
mov edi, ebp
sub edi, eax
add eax, ebx
push eax
lea eax, [esi + 0x74]
push eax
call fcn.0040c610
pop edi
pop ebp
ret 4
Function at 0x40cf00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, ebx
cmp dword [edi + 4], ebx
jne 0x40cf0c
xor eax, eax
pop ebx
ret
movzx eax, byte [edi]
dec eax
push esi
cmp eax, 0x10
ja case.0x40cf21.2
movzx eax, byte [eax + 0x40d088]
jmp dword [eax*4 + 0x40d074]
push 0xc4
call fcn.0040ea09
add esp, 4
cmp eax, ebx
je 0x40cf42
call fcn.0040c4a0
mov esi, eax
jmp 0x40cf44
xor esi, esi
push 0xc4
push ebx
push esi
call fcn.004101c0
mov ecx, dword [edi + 4]
mov ebx, dword [edi + 8]
add esp, 0xc
push ecx
call fcn.0040c500
mov eax, esi
pop esi
pop ebx
ret
push 0x7c
call fcn.0040ea09
add esp, 4
cmp eax, ebx
je 0x40cfa2
mov dword [eax + 0x20], ebx
mov ecx, 0xf
mov dword [eax + 0x24], ecx
mov byte [eax + 0x10], bl
mov dword [eax + 0x40], ecx
mov dword [eax + 0x3c], ebx
mov byte [eax + 0x2c], bl
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x58], ebx
mov byte [eax + 0x48], bl
mov dword [eax + 0x78], ecx
mov dword [eax + 0x74], ebx
mov byte [eax + 0x64], bl
mov byte [eax], 3
mov esi, eax
jmp 0x40cfa4
xor esi, esi
push 0x7c
push ebx
push esi
call fcn.004101c0
mov edx, dword [edi + 4]
mov ebx, dword [edi + 8]
add esp, 0xc
push edx
call fcn.0040c6e0
mov eax, esi
pop esi
pop ebx
ret
push 0x2c
call fcn.0040ea09
add esp, 4
cmp eax, ebx
je 0x40cfe3
mov dword [eax + 0x28], 0xf
mov dword [eax + 0x24], ebx
mov byte [eax + 0x14], bl
mov byte [eax], 6
mov esi, eax
jmp 0x40cfe5
xor esi, esi
push 0x2c
push ebx
push esi
call fcn.004101c0
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
add esp, 0xc
mov eax, esi
call fcn.0040c7a0
mov eax, esi
pop esi
pop ebx
ret
push 0x90
call fcn.0040ea09
add esp, 4
cmp eax, ebx
je 0x40d04a
mov dword [eax + 0x34], ebx
mov ecx, 0xf
mov dword [eax + 0x38], ecx
mov byte [eax + 0x24], bl
mov dword [eax + 0x54], ecx
mov dword [eax + 0x50], ebx
mov byte [eax + 0x40], bl
mov dword [eax + 0x70], ecx
mov dword [eax + 0x6c], ebx
mov byte [eax + 0x5c], bl
mov dword [eax + 0x8c], ecx
mov dword [eax + 0x88], ebx
mov byte [eax + 0x78], bl
mov byte [eax], 0x11
mov esi, eax
jmp 0x40d04c
xor esi, esi
push 0x90
push ebx
push esi
call fcn.004101c0
mov eax, dword [edi + 4]
mov ebx, dword [edi + 8]
add esp, 0xc
push eax
call fcn.0040c830
mov eax, esi
pop esi
pop ebx
ret
pop esi
xor eax, eax
pop ebx
ret
Function at 0x45c300
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
jmp 0x45c31a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45c321
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c310
mov eax, 1
add ebx, ebx
jne 0x45c333
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45c328
jne 0x45c344
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c328
xor ecx, ecx
sub eax, 3
jb 0x45c358
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45c3ca
mov ebp, eax
add ebx, ebx
jne 0x45c363
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45c370
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45c394
inc ecx
add ebx, ebx
jne 0x45c380
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45c375
jne 0x45c391
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c375
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45c3b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45c3a5
jmp 0x45c316
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45c3b4
add edi, ecx
jmp 0x45c316
pop esi
mov edi, esi
mov ecx, 0x1d4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45c3d2
cmp byte [edi], 3
jne 0x45c3d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45c3d7
mov ebp, dword [esi + 0x5c034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x5c459]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45c44a
sub esp, 0xffffff80
jmp 0x4012e0