joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4032c2
Capabilities:
Terminate process

Disassembly:
push 8
push 0x38
mov eax, 0x423636
call fcn.004228b5
mov esi, ecx
mov dword [ebp - 0x40], esi
xor eax, eax
mov byte [ebp - 0x24], al
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00402f15
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00402c52
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
call fcn.00402f84
mov dword [ebp - 4], 1
cmp byte [ebp - 0x28], 0
je 0x403390
movzx eax, byte [ebp - 0x38]
sub eax, 1
je 0x403389
sub eax, 3
je 0x403403
sub eax, 1
je 0x40337c
sub eax, 1
je 0x40336f
sub eax, 1
je 0x40335c
sub eax, 1
je 0x403349
sub eax, 1
jne 0x403390
lea eax, [ebp - 0x34]
push eax
call fcn.004101fe
jmp 0x403390
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x403390
push dword [eax + 4]
push dword [eax]
call fcn.0040f97b
jmp 0x403390
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x403390
push dword [eax]
mov ecx, dword [esi + 0x34]
call fcn.0040fcec
jmp 0x403390
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.004031ae
jmp 0x403390
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.00403100
jmp 0x403390
mov ecx, esi
call fcn.0040322d
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x28], 0
je 0x4033a2
lea ecx, [ebp - 0x34]
call fcn.00402c52
xor eax, eax
mov byte [ebp - 0x39], 2
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x39]
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.004027f4
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 4], 2
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
sub esi, edx
mov ecx, dword [ecx]
push ecx
push ecx
mov eax, esp
mov dword [eax], edx
mov dword [eax + 4], esi
call fcn.0040a24c
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
test al, al
je 0x40340b
call fcn.00402c52
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x40]
jmp 0x4032fb
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00402c52
mov eax, dword [0x433d68]
call dword [eax + 0x70]
mov ecx, dword [ebp - 0x14]
call fcn.00422893
ret

Function at 0x40375f
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x42366a
call fcn.00412071
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x14
call fcn.004117fb
mov ecx, dword [esi]
mov edx, eax
mov dword [ebp - 0x14], edx
mov dword [edx], ecx
mov ecx, dword [esi + 4]
mov dword [edx + 4], ecx
mov ecx, dword [esi + 8]
mov dword [edx + 0xc], ebx
mov dword [edx + 0x10], ebx
mov dword [edx + 8], ecx
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edx + 0x10], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea esi, [edi + 4]
mov dword [ebp - 4], ebx
push esi
push ebx
push edx
push 0x4038c4
push ebx
push ebx
call fcn.0041530c
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x4037d7
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.004037e1
call fcn.0041202f
ret 4
push 6
mov dword [esi], ebx
call fcn.00410dee
int3
Function at 0x407790
Capabilities:
Encode data using xor

Disassembly:
push 0x1dc
mov eax, 0x423ce8
call fcn.00412071
mov edi, ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
xor esi, esi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x40], esi
mov eax, dword fs:[0x2c]
push 2
mov dword [ebp - 0x48], 0x31
pop ebx
mov ecx, dword [eax]
mov eax, dword [0x434624]
cmp eax, dword [ecx + 4]
jle 0x407835
push 0x434624
call fcn.00411994
cmp dword [0x434624], 0xffffffff
pop ecx
jne 0x407835
mov dword [ebp - 4], esi
mov eax, dword [0x42bd74]
mov dword [ebp - 0x3c], eax
cmp word [str.9hKU_IJq__C_b9], si
je 0x40780c
mov ecx, esi
xor edx, edx
mov eax, ecx
div dword [ebp - 0x48]
add edx, 0x38
xor word [ebp + ecx*2 - 0x3c], dx
inc ecx
cmp ecx, ebx
jl 0x4077f8
lea eax, [ebp - 0x3c]
mov ecx, 0x43462c
push eax
call fcn.00401a82
push 0x424d3b
call fcn.00411ca6
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x434624
call fcn.0041194a
pop ecx
lea ecx, [ebp - 0x20]
call fcn.00402862
cmp byte [ebp - 0x17], 0
jne 0x407888
push edi
and edi, 0x9f21
jmp 0x407853
xor edi, 0xd177
pop edi
push eax
jmp 0x407860
or eax, 0x2803
and eax, 0x10a7e
jmp 0x407874
pop eax
push 0x42b680
mov ecx, edi
call fcn.00401a82
mov eax, edi
jmp 0x407bbd
lea eax, [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 1
push ecx
push eax
add esp, 4
sub ecx, 0x4932
or ecx, 0x3519
add ecx, 0xa425
pop ecx
push ebx
push ecx
add esp, 4
add ebx, 0x34f6
or ebx, 0x222c
pop ebx
push edx
xor edx, 0x196d
pop edx
push ecx
mov ecx, 0x10101010
pop ecx
push ecx
mov ecx, 0xffff04ff
pop ecx
xchg ecx, eax
xchg ecx, eax
sbb al, 2
add eax, dword [ebx]
in al, dx
rol byte [eax], cl
add eax, dword [ebx]
lea ecx, [ecx - 0x48]
xchg ecx, eax
xchg ecx, eax
xor al, 2
add eax, dword [ebx]
mov word [ecx], fs
in al, dx
inc esi
inc dword [ebx]
add ecx, dword [ebp + 0x49cabc49]
add byte [edi], al
invalid
call fcn.0041202f
ret

Function at 0x408308
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x408350
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x408318
jmp 0x40835d
cmp dword [esi], 0x4e0
jb 0x40835d
call fcn.00408397
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret
Function at 0x408397
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
mov ebp, closesocket
lea edi, [esi + 0x9c4]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, ebp
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x4083af
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, ebp
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x4083f0
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, ebp
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [esi], 0
and eax, 0x9908b0df
shr ecx, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x40a299
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push 0x1c
mov eax, 0x424297
call fcn.00412071
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov esi, dword [ebp + 8]
push ebx
or ebx, 0x877c
xor ebx, 0x5b8a
pop ebx
push eax
push eax
add esp, 4
add eax, 0x4b46
call fcn.0040a2d6
add byte [ebp + 0x4f], al
push eax
xor eax, 0x3b453539
Function at 0x40a2d6
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
add esp, 4
or eax, 0xe699
pop eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push 0x4004667f
push ecx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x40a333
push edx
or edx, 0x15a52
and edx, 0x17579
pop edx
push edi
and edi, 0x1185e
and edi, 0x1532b
jmp 0x40a31c
call 0x40a328
add byte [ebp + 0x41], al
cmp dword [ebp + 0x41], ecx
inc esp
add esp, 4
pop edi
xor al, al
jmp 0x40a445
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 0
je 0x40a3f8
push edx
push edx
add esp, 4
add edx, 0x35a6
pop edx
push ecx
push edi
add esp, 4
and ecx, 0xb692
and ecx, 0x6262
call 0x40a37a
add byte [edx + 0x33], al
cmp al, 0x3a
add esp, 4
jmp 0x40a382
pop ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
call fcn.00407fd7
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
push ebx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x40a43b
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
push ebx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x40a43b
push esi
push esi
add esp, 4
and esi, 0x12078
pop esi
push esi
push ebx
add esp, 4
call 0x40a3e1
add byte [eax + 0x4d], cl
dec esp
inc eax
inc esp
dec esp
aas
dec ebx
add esp, 4
jmp 0x40a3ed
sub esi, 0x4597
pop esi
mov bl, 1
jmp 0x40a43b
dec dword [esi]
push edx
or edx, 0x8d4
call 0x40a410
add byte [ebx + 0x4c], cl
xor ecx, dword [edi + 0x45]
cmp al, 0x4b
dec esi
dec eax
add esp, 4
call 0x40a422
add byte [ebx + 0x4f], al
dec ebx
xor al, 0x3c
xor eax, 0xc4833c4f
add al, 0x81
ret 0x170b
lea ecx, [ebp - 0x20]
call fcn.00402c52
mov al, bl
call fcn.0041202f
ret
Function at 0x40a37a
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
add esp, 4
or eax, 0xe699
pop eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push 0x4004667f
push ecx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x40a333
push edx
or edx, 0x15a52
and edx, 0x17579
pop edx
push edi
and edi, 0x1185e
and edi, 0x1532b
jmp 0x40a31c
call 0x40a328
add byte [ebp + 0x41], al
cmp dword [ebp + 0x41], ecx
inc esp
add esp, 4
pop edi
xor al, al
jmp 0x40a445
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 0
je 0x40a3f8
push edx
push edx
add esp, 4
add edx, 0x35a6
pop edx
push ecx
push edi
add esp, 4
and ecx, 0xb692
and ecx, 0x6262
call 0x40a37a
add byte [edx + 0x33], al
cmp al, 0x3a
add esp, 4
jmp 0x40a382
pop ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
call fcn.00407fd7
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
push ebx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x40a43b
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
push ebx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x40a43b
push esi
push esi
add esp, 4
and esi, 0x12078
pop esi
push esi
push ebx
add esp, 4
call 0x40a3e1
add byte [eax + 0x4d], cl
dec esp
inc eax
inc esp
dec esp
aas
dec ebx
add esp, 4
jmp 0x40a3ed
sub esi, 0x4597
pop esi
mov bl, 1
jmp 0x40a43b
dec dword [esi]
push edx
or edx, 0x8d4
call 0x40a410
add byte [ebx + 0x4c], cl
xor ecx, dword [edi + 0x45]
cmp al, 0x4b
dec esi
dec eax
add esp, 4
call 0x40a422
add byte [ebx + 0x4f], al
dec ebx
xor al, 0x3c
xor eax, 0xc4833c4f
add al, 0x81
ret 0x170b
lea ecx, [ebp - 0x20]
call fcn.00402c52
mov al, bl
call fcn.0041202f
ret

Function at 0x40a5f8
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x1c
mov eax, dword [0x432018]
xor eax, esp
mov dword [esp + 0x18], eax
push edi
xor eax, eax
lea edi, [esp + 0x10]
stosd dword es:[edi], eax
xor ecx, ecx
mov byte [esp + 4], cl
mov dword [esp + 6], ecx
mov word [esp + 0xa], cx
lea ecx, [esp + 4]
stosd dword es:[edi], eax
push ecx
stosd dword es:[edi], eax
mov al, byte [esp + 0x2c]
mov byte [esp + 9], al
lea eax, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.004027f4
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x10]
push 0
push eax
push dword [esp + 0x18]
push dword [esp + 0x30]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
lea ecx, [esp + 0x10]
setg byte [esp + 0xf]
call fcn.00402c52
mov ecx, dword [esp + 0x1c]
mov al, byte [esp + 0xf]
pop edi
xor ecx, esp
call fcn.004117ed
add esp, 0x1c
ret 8
Function at 0x40a70e
Capabilities:
Resolve dns

Disassembly:
push 0x40
mov eax, 0x424312
call fcn.00412071
mov esi, dword [ebp + 8]
xor edx, edx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ebx
mov dword [esi], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 0xf
mov byte [esi], dl
mov dword [ebp - 4], edx
lea ecx, [ebx + 8]
mov dword [ebp - 0x2c], 1
mov edi, edx
add ebx, 0x108
jmp 0x40a757
cmp byte [ecx], 0
je 0x40a75d
inc edi
inc ecx
cmp ecx, ebx
jne 0x40a750
jmp 0x40a75f
mov edx, edi
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
add eax, 9
add eax, edx
push eax
call fcn.00406973
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40a7b3
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00406973
push eax
mov ecx, esi
call fcn.0040a594
lea ecx, [ebp - 0x4c]
call fcn.00402d36
lea ecx, [ebp - 0x28]
call fcn.00402d36
mov eax, esi
call fcn.0041202f
ret 8
Function at 0x40a7c5
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0x17c
mov eax, 0x42436c
call fcn.00412071
mov eax, ecx
mov dword [ebp - 0x180], eax
lea edx, [eax + 0x18]
xor ebx, ebx
call fcn.0040a44b
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp esi, 0xffffffff
je 0x40a98a
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x184], eax
mov edi, 0x108
mov dword [ebp - 4], ebx
push edi
lea eax, [ebp - 0x17c]
push ebx
push eax
call fcn.004137a0
add esp, 0xc
lea eax, [ebp - 0x17c]
push ebx
push edi
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
jle 0x40a985
mov ecx, dword [ebp - 0x178]
lea edi, [ebp - 0x38]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, ecx
shr eax, 0x18
push eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
push eax
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
movzx eax, cl
push eax
lea eax, [ebp - 0x38]
push str._u._u._u._u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], bl
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x28]
call fcn.00406973
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
call fcn.0040a67a
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
mov bl, al
call fcn.00402d36
test bl, bl
je 0x40a8d3
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040a70e
push eax
lea ecx, [ebp - 0x5c]
call fcn.0040a594
lea ecx, [ebp - 0x28]
call fcn.00402d36
jmp 0x40a8df
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004069aa
push dword [ebp - 0x17a]
call dword [sym.imp.WS2_32.dll_ntohs]
movzx edx, ax
lea ecx, [ebp - 0x13]
call fcn.00402ead
push ecx
lea ecx, [ebp - 0x13]
push ecx
push eax
lea ecx, [ebp - 0x74]
call fcn.00402ed1
lea edx, [ebp - 0x74]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x5c]
call fcn.0040a44b
mov dword [ebp - 0x40], eax
cmp eax, 0xffffffff
je 0x40a975
lea eax, [ebp - 0x40]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x180]
mov byte [ebp - 4], 5
movzx eax, byte [eax + 0x31]
push eax
push dword [ebp - 0x3c]
call fcn.0040a5f8
test al, al
je 0x40a970
mov dword [ebp - 0x44], 0xbb8
jmp 0x40a95c
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
push eax
call fcn.0040a299
pop ecx
test al, al
je 0x40a970
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x44]
mov ecx, dword [ebp - 0x3c]
push eax
call fcn.0040a299
pop ecx
test al, al
jne 0x40a948
push dword [ebp - 0x40]
call esi
lea ecx, [ebp - 0x74]
call fcn.00402d36
lea ecx, [ebp - 0x5c]
call fcn.00402d36
push dword [ebp - 0x3c]
call esi
call fcn.0041202f
ret
Function at 0x40c5d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov dword [esp], 1
imul edx, dword [esp + 0x6c], 0x32
imul eax, dword [esp + 0x6c], 0x30
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x6c]
push ebp
mov ebp, 0x18f3672a
mov dword [esp + 0x14], ebx
sub edx, eax
add ecx, 0x30
mov eax, dword [esp + 0x74]
add edx, ebp
xor ecx, edx
imul eax, ecx
lea ecx, [esp + 0x30]
push esi
push edi
sub eax, 0x30
push eax
call fcn.0040b823
push 0x35
lea ecx, [esp + 0x44]
call fcn.0040b823
imul edx, dword [esp + 0x7c], 0x32
imul eax, dword [esp + 0x7c], 0x30
mov ecx, dword [esp + 0x78]
add ecx, 0x30
sub edx, eax
mov eax, dword [esp + 0x7c]
add edx, ebp
xor ecx, edx
imul eax, ecx
lea ecx, [esp + 0x48]
sub eax, 0x37
push eax
call fcn.0040b823
push 5
lea ecx, [esp + 0x24]
call fcn.0040b823
push 0
lea ecx, [esp + 0x2c]
call fcn.0040b823
mov esi, dword [esp + 0x78]
mov eax, dword [esp + 0x7c]
imul ecx, dword [esp + 0x2c], 0x32
mov dword [esp + 0x34], eax
imul eax, dword [esp + 0x2c], 0x30
mov edx, dword [esp + 0x2c]
sub ecx, eax
mov eax, dword [esp + 0x28]
add ecx, ebp
add eax, 0x30
xor eax, ecx
imul ecx, dword [esp + 0x34], 0x32
imul edx, eax
imul eax, dword [esp + 0x34], 0x30
sub ecx, eax
lea eax, [esi + 0x30]
add ecx, ebp
xor ecx, eax
mov eax, dword [esp + 0x34]
imul eax, ecx
cmp edx, eax
jae 0x40c91e
mov eax, dword [esp + 0x40]
mov ebp, dword [esp + 0x38]
add eax, 0x30
mov edi, dword [esp + 0x28]
add ebp, 0x30
mov dword [esp + 0x14], eax
add edi, 0x30
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x14]
add eax, 0x30
mov dword [esp + 0x18], eax
Function at 0x40eaaf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x432018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
mov esi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push edi
sub edi, 0xe86
and edi, 0x2760
or edi, 0x9e9b
pop edi
push ecx
jmp 0x40eae9
pop ecx
push eax
add eax, 0x101eb
add eax, 0xf448
sub eax, 0xdad
pop eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
jne 0x40eb44
push edi
push esi
add esp, 4
sub edi, 0xf984
or edi, 0x1791c
pop edi
push esi
add esi, 0xd0
add esi, 0x13a2c
xor esi, 0xcfa
pop esi
push esi
push edx
add esp, 4
xor esi, 0x666a
pop esi
jmp 0x40ec2a
movd xmm0, dword [ebp - 0x14]
cvtdq2pd xmm0, xmm0
comisd xmm0, xmmword [0x42c698]
jb 0x40ebaf
push ecx
push edi
add esp, 4
add ecx, 0x13d0d
and ecx, 0x1140d
xor ecx, 0xd4bd
xor ecx, 0x12915
pop ecx
push edi
xor edi, 0x16437
jmp 0x40eb82
sub edi, 0x9f43
pop edi
push 3
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x10]
push 1
push 0
push 0
add eax, 0xffffec78
push eax
push 0xffffec78
push 1
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
jmp 0x40ebb9
and edi, 0xda67
jmp 0x40ebc4
xor edi, 0xd23
pop edi
push esi
sub esi, 0x7bf4
pop esi
push edi
or edi, 0x1170c
xor edi, 0xfc5
pop edi
push ecx
push esi
call fcn.0040ec38
test al, al
je 0x40ec2a
push esi
push esi
add esp, 4
or esi, 0x25ca
pop esi
push eax
call fcn.0040ec06
add byte [esi + 0x4e], al
inc esi
inc ebx
xor eax, 0xc4833434
add esp, 4
or eax, 0x43dd
pop eax
push eax

Function at 0x412458
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x412497
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x412497
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412497
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x412497
cmp dword [ecx + 0x74], 0xe
jbe 0x412497
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4180a6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427df0
push 0x427de8
push str.FlsAlloc
push 0x1f
call fcn.00417f25
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4180da
push dword [ebp + 8]
mov ecx, esi
call dword [0x425314]
call esi
jmp 0x4180e0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x418124
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427e00
push 0x427df8
push str.FlsGetValue
push 0x21
call fcn.00417f25
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41815b
push dword [ebp + 8]
mov ecx, esi
call dword [0x425314]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x418163
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x427e08
push 0x427e00
push str.FlsSetValue
push 0x22
call fcn.00417f25
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41819d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x425314]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41b01a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41b0b7
push ebx
push esi
call fcn.0041afe3
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041af77
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41b064
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41b0b6
push edi
push eax
call fcn.004193d1
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41b084
call fcn.00417db8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41b0b5
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041af77
add esp, 0x20
test eax, eax
jne 0x41b0a3
push edi
call fcn.00417db8
jmp 0x41b0ab
push ebx
call fcn.00417db8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret