joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2770a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x2d2014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x23609dc
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x277289
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x277289
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.002a40f0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x2360adc
nop
test eax, eax
je 0x277289
push 4
push 0x1000
push 4
push 0
call 0x2360295
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x7e00b5
nop
test eax, eax
je 0x277289
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x2c8df8
push dword [esp + 0x30]
call 0x7e0443
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x2771ac
push 0x2c8dfc
push 0x2c8e14
call 0x2210df3
nop
push eax
call 0x7e0211
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x7e02f5
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0x277289
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x2360941
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x277243
mov dword [esp + 0xc], eax
call fcn.00276ef0
push eax
call 0x22005e9
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x2360941
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x2771f2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x2360941
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x7e06b5
nop
push dword [esp + 0x24]
call 0x2210ea5
nop
push 0x8000
push 0
push esi
call 0x2360890
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.0028cff1
mov esp, ebp
pop ebp
ret
Function at 0x28dcc7
Capabilities:
Parse pe header

Disassembly:
push 0
call 0x24f034e
nop
test eax, eax
je 0x28dd07
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x28dd07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x28dd07
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x28dd07
cmp dword [ecx + 0x74], 0xe
jbe 0x28dd07
cmp dword [ecx + 0xe8], 0
je 0x28dd07
mov al, 1
ret
xor al, al
ret
Function at 0x4010c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4010d7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401108
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x401104
cmp esi, eax
jae 0x401108
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4010f4
cmp esi, eax
jb 0x40110e
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x404b70
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x4596d8]
sub esp, 0x14
push ebx
mov ebx, dword [0x4596d4]
cmp ebx, eax
push ebp
push esi
push edi
jbe 0x404b90
call fcn.0042e792
mov eax, dword [0x4596d8]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x4596d4], eax
mov esi, eax
jbe 0x404baa
call fcn.0042e792
mov eax, dword [0x4596d8]
cmp ebx, esi
je 0x404c40
cmp ebx, eax
jb 0x404bbb
call fcn.0042e792
mov eax, dword [ebx]
push 0
push 0
push eax
push 0x404430
push 0
push 0
call ebp
mov esi, dword [0x459704]
test esi, esi
mov edi, dword [0x459708]
mov dword [esp + 0x14], eax
je 0x404c06
mov edx, dword [0x45970c]
mov ecx, edi
sub ecx, esi
sub edx, esi
sar ecx, 2
sar edx, 2
cmp ecx, edx
jae 0x404c06
mov ecx, edi
add ecx, 4
mov dword [edi], eax
mov dword [0x459708], ecx
jmp 0x404c25
cmp esi, edi
jbe 0x404c0f
call fcn.0042e792
push edi
mov eax, 0x459700
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00405130
mov eax, dword [0x4596d8]
cmp ebx, eax
jb 0x404c38
call fcn.0042e792
mov eax, dword [0x4596d8]
add ebx, 4
jmp 0x404b96
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x404c50
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x4596e8]
push ebx
push ebp
push esi
mov esi, dword [0x4596e4]
cmp esi, eax
push edi
jbe 0x404c73
call fcn.0042e792
mov eax, dword [0x4596e8]
cmp dword [0x4596e4], eax
mov edi, eax
jbe 0x404c87
call fcn.0042e792
mov eax, dword [0x4596e8]
cmp esi, edi
je 0x404cb0
cmp esi, eax
jb 0x404c94
call fcn.0042e792
mov eax, dword [esi]
call eax
mov eax, dword [0x4596e8]
cmp esi, eax
jb 0x404cab
call fcn.0042e792
mov eax, dword [0x4596e8]
add esi, 4
jmp 0x404c73
cmp dword [0x4596e4], eax
mov edi, eax
jbe 0x404cc4
call fcn.0042e792
mov eax, dword [0x4596e8]
mov esi, dword [0x4596e4]
cmp esi, eax
jbe 0x404cd8
call fcn.0042e792
mov eax, dword [0x4596e8]
cmp esi, edi
je 0x404d01
sub eax, edi
sar eax, 2
test eax, eax
lea ecx, [eax*4]
lea ebx, [ecx + esi]
jle 0x404cfb
push ecx
push edi
push ecx
push esi
call fcn.0042e4a1
add esp, 0x10
mov dword [0x4596e8], ebx
mov esi, dword [0x459704]
mov eax, dword [0x459708]
cmp esi, eax
jbe 0x404d1a
call fcn.0042e792
mov eax, dword [0x459708]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [0x459704], eax
mov edi, eax
jbe 0x404d3a
call fcn.0042e792
mov eax, dword [0x459708]
cmp esi, edi
je 0x404d8e
cmp esi, eax
jb 0x404d47
call fcn.0042e792
mov ecx, dword [esi]
push ecx
call ebx
test eax, eax
jne 0x404d76
cmp esi, dword [0x459708]
jb 0x404d5d
call fcn.0042e792
mov edx, dword [esi]
push 0
push edx
call ebp
cmp esi, dword [0x459708]
jb 0x404d71
call fcn.0042e792
mov eax, dword [esi]
push eax
call ebx
mov eax, dword [0x459708]
cmp esi, eax
jb 0x404d89
call fcn.0042e792
mov eax, dword [0x459708]
add esi, 4
jmp 0x404d26
cmp dword [0x459704], eax
mov edi, eax
jbe 0x404da2
call fcn.0042e792
mov eax, dword [0x459708]
mov esi, dword [0x459704]
cmp esi, eax
jbe 0x404db6
call fcn.0042e792
mov eax, dword [0x459708]
cmp esi, edi
je 0x404ddf
sub eax, edi
sar eax, 2
test eax, eax
lea ecx, [eax*4]
lea ebx, [ecx + esi]
jle 0x404dd9
push ecx
push edi
push ecx
push esi
call fcn.0042e4a1
add esp, 0x10
mov dword [0x459708], ebx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406200
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x448138
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x457118]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push ecx
mov eax, 2
mov esi, esp
mov dword [esp + 0x14], esp
call fcn.004071c0
push ecx
mov dword [esp + 0x28], 0
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov ecx, str.SoftwareDeviceVMBrowser_Configuration_Utility
call fcn.00401720
lea ecx, [esp + 0x14]
or edi, 0xffffffff
push ecx
mov dword [esp + 0x2c], edi
call fcn.00421f10
mov edx, dword [esp + 0x34]
mov dword [esp + 0x2c], 1
mov eax, dword [edx]
add esp, 8
sub eax, 0x10
mov dword [esp + 0x18], esp
mov esi, esp
call fcn.00401a70
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x24], 2
mov eax, dword [esp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x30], esp
mov esi, esp
call fcn.00401a70
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x28], 1
call fcn.0041fc90
mov esi, eax
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x4062d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret

Function at 0x4063e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x448238
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x457118]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
push ecx
mov esi, esp
mov dword [esp + 0x14], esp
call fcn.004071c0
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov ecx, str.SoftwareDeviceVMBrowser_Configuration_Utility
mov dword [esp + 0x2c], 0
call fcn.00401720
lea ecx, [esp + 0x14]
or edi, 0xffffffff
push ecx
mov dword [esp + 0x2c], edi
call fcn.00421f10
add esp, 0xc
mov dword [esp + 0x20], 1
mov edx, dword [esp + 0x2c]
push edx
push ecx
mov eax, esp
mov dword [esp + 0x34], esp
push eax
mov ecx, str.LastUpdateTime
call fcn.00401720
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x14]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
call fcn.00401a70
add eax, 0x10
mov dword [esi], eax
push SysReAllocString
mov byte [esp + 0x30], 1
call fcn.0041f840
add esp, 0x10
mov dword [esp + 0x20], edi
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x4064ca
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x4064b6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x4064e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x406500
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x448238
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x457118]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
push ecx
mov esi, esp
mov dword [esp + 0x14], esp
call fcn.004071c0
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov ecx, str.SoftwareDeviceVMBrowser_Configuration_Utility
mov dword [esp + 0x2c], 0
call fcn.00401720
lea ecx, [esp + 0x14]
or edi, 0xffffffff
push ecx
mov dword [esp + 0x2c], edi
call fcn.00421f10
add esp, 0xc
mov dword [esp + 0x20], 1
mov edx, dword [esp + 0x2c]
push edx
push ecx
mov eax, esp
mov dword [esp + 0x34], esp
push eax
mov ecx, str.LastUpdateTime
call fcn.00401720
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x14]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
call fcn.00401a70
add eax, 0x10
mov dword [esi], eax
push SysReAllocString
mov byte [esp + 0x30], 1
call fcn.0041f9c0
add esp, 0x10
mov dword [esp + 0x20], edi
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x4065ea
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x4065d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x406603
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x406620
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x448238
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x457118]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
push ecx
mov esi, esp
mov dword [esp + 0x14], esp
call fcn.004071c0
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov ecx, str.SoftwareDeviceVMBrowser_Configuration_Utility
mov dword [esp + 0x2c], 0
call fcn.00401720
lea ecx, [esp + 0x14]
or edi, 0xffffffff
push ecx
mov dword [esp + 0x2c], edi
call fcn.00421f10
add esp, 0xc
mov dword [esp + 0x20], 1
mov edx, dword [esp + 0x2c]
push edx
push ecx
mov eax, esp
mov dword [esp + 0x34], esp
push eax
mov ecx, str.QueryInterval
call fcn.00401720
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x14]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
call fcn.00401a70
add eax, 0x10
mov dword [esi], eax
push SysReAllocString
mov byte [esp + 0x30], 1
call fcn.0041f840
add esp, 0x10
mov dword [esp + 0x20], edi
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x40670a
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x4066f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x406723
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x406740
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x448238
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x457118]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
push ecx
mov esi, esp
mov dword [esp + 0x14], esp
call fcn.004071c0
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov ecx, str.SoftwareDeviceVMBrowser_Configuration_Utility
mov dword [esp + 0x2c], 0
call fcn.00401720
lea ecx, [esp + 0x14]
or edi, 0xffffffff
push ecx
mov dword [esp + 0x2c], edi
call fcn.00421f10
add esp, 0xc
mov dword [esp + 0x20], 1
mov edx, dword [esp + 0x2c]
push edx
push ecx
mov eax, esp
mov dword [esp + 0x34], esp
push eax
mov ecx, str.QueryInterval
call fcn.00401720
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x14]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
call fcn.00401a70
add eax, 0x10
mov dword [esi], eax
push SysReAllocString
mov byte [esp + 0x30], 1
call fcn.0041f9c0
add esp, 0x10
mov dword [esp + 0x20], edi
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x40682a
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x406816
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x406843
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x406aa0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x448138
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x457118]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push ecx
xor eax, eax
mov esi, esp
mov dword [esp + 0x14], esp
call fcn.004071c0
push ecx
mov dword [esp + 0x28], 0
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov ecx, str.SoftwareDeviceVMBrowser_Configuration_Utility
call fcn.00401720
lea ecx, [esp + 0x14]
or edi, 0xffffffff
push ecx
mov dword [esp + 0x2c], edi
call fcn.00421f10
add esp, 8
mov dword [esp + 0x24], 1
mov edx, esp
mov dword [esp + 0x18], esp
push edx
mov ecx, str.Version
call fcn.00401720
mov byte [esp + 0x24], 2
mov eax, dword [esp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
call fcn.00401a70
mov ecx, dword [esp + 0x30]
add eax, 0x10
mov dword [esi], eax
push SysReAllocString
mov byte [esp + 0x2c], 1
call fcn.0041f440
add esp, 0xc
mov dword [esp + 0x20], edi
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x406b86
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x406b72
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x406b9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x406cf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4481b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x457118]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push ecx
xor eax, eax
mov esi, esp
mov dword [esp + 0x14], esp
call fcn.004071c0
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov ecx, str.SoftwareDeviceVMBrowser_Configuration_Utility
mov dword [esp + 0x2c], 0
call fcn.00401720
lea ecx, [esp + 0x14]
or edi, 0xffffffff
push ecx
mov dword [esp + 0x2c], edi
call fcn.00421f10
add esp, 0xc
mov dword [esp + 0x20], 1
mov edx, dword [esp + 0x28]
push edx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push eax
mov ecx, str.KeepDefaultSearchEngine
call fcn.00401720
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x14]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
call fcn.00401a70
add eax, 0x10
mov dword [esi], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x30], 1
call fcn.0041f840
add esp, 0x10
mov dword [esp + 0x20], edi
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x406dd8
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x406dc4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x406df1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x406e10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4481b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x457118]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push ecx
xor eax, eax
mov esi, esp
mov dword [esp + 0x14], esp
call fcn.004071c0
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov ecx, str.SoftwareDeviceVMBrowser_Configuration_Utility
mov dword [esp + 0x2c], 0
call fcn.00401720
lea ecx, [esp + 0x14]
or edi, 0xffffffff
push ecx
mov dword [esp + 0x2c], edi
call fcn.00421f10
add esp, 0xc
mov dword [esp + 0x20], 1
mov edx, dword [esp + 0x28]
push edx
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push eax
mov ecx, str.EnableAddressbarSearch
call fcn.00401720
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x14]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
call fcn.00401a70
add eax, 0x10
mov dword [esi], eax
push SysReAllocString
mov byte [esp + 0x30], 1
call fcn.0041f9c0
add esp, 0x10
mov dword [esp + 0x20], edi
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x406ef8
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x406ee4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x406f11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x40a440
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x447f90
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x457118]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push ecx
mov ecx, str.DVMFlag
mov dword [esp + 0x18], 0
call fcn.00401720
mov edx, dword [esp + 0x30]
push ecx
mov dword [esp + 0x2c], 0
mov eax, dword [edx]
mov dword [esp + 0x20], esp
mov edi, esp
push ecx
sub eax, 0x10
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.00401a70
add eax, 0x10
mov dword [esi], eax
push ecx
mov eax, esp
mov dword [esp + 0x3c], esp
push eax
mov ecx, str.SoftwareMicrosoftInternet_ExplorerSearchScopes
mov byte [esp + 0x38], 1
call fcn.00401720
push edi
mov byte [esp + 0x38], 0
call fcn.00421f10
add esp, 0xc
push SysReAllocString
mov dword [esp + 0x30], 0xffffffff
call fcn.0041f840
xor eax, eax
add esp, 0x10
cmp dword [esp + 0xc], eax
setne al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 4

Function at 0x40d941
Capabilities:
Read .ini file

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
call edx
test eax, eax
je 0x40d9a3
push ebx
add esi, 4
lea eax, [esp + 8]
push esi
push eax
mov ebx, str.BCUConfig.ini
call fcn.004017d0
mov ecx, dword [esp + 0x10]
add esp, 8
push ecx
push 0xffffffffffffffff
push str.IsConfiged
push str.ConfigInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
mov eax, dword [esp + 8]
pop ebx
je 0x40d9a8
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d9a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop esi
pop ecx
ret
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d9c4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
pop esi
pop ecx
ret
Function at 0x411b80
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [eax]
sub esp, 0xc
cmp dword [eax - 0xc], 0
push ebx
push esi
push edi
je 0x411c2e
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x411c2e
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x411c2e
push ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
sub eax, 0x10
mov dword [esp + 0x14], esp
mov edi, esp
call fcn.00401a70
add eax, 0x10
lea ebx, [esp + 0x10]
mov dword [edi], eax
call fcn.00421370
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 0xc]
add esp, 4
push 0
lea edx, [esp + 0x18]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edi, edi
jne 0x411c39
test edx, edx
jg 0x411c2e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
test edx, edx
jg 0x411c47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret 4