joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405542
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x40554d
xor eax, eax
ret
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x405608
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x461b38]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x461b38]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x461b38]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x461b38]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x461b38]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x461b38]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x461b38]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x461b38]
inc edx
sub eax, 8
dec edi
jne 0x40556d
pop edi
test eax, eax
je 0x405621
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x461b38]
inc edx
dec eax
jne 0x40560c
mov eax, esi
pop esi
not eax
pop ebx
ret

Function at 0x405628
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
movzx edx, byte [esp + 8]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x461b38]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x461b38]
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x406411
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x474e90]
xor eax, ebp
mov dword [ebp + 0x188], eax
push ebx
mov ebx, dword [ebp + 0x194]
test ebx, ebx
push edi
mov edi, dword [ebp + 0x198]
je 0x40648d
push 0x104
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0043f4a9
lea eax, [ebp - 0x80]
push eax
call fcn.0043d8f0
add esp, 0x10
test eax, eax
jbe 0x406473
lea eax, [ebp + eax - 0x81]
mov cl, byte [eax]
cmp cl, 0x2f
je 0x406470
cmp cl, 0x5c
jne 0x406473
mov byte [eax], 0
lea eax, [ebp - 0x80]
push eax
call fcn.00404f2a
test al, al
pop ecx
jne 0x40648d
push 0
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [edi]
test al, al
je 0x406543
push esi
mov esi, edi
mov ecx, edi
cmp al, 0x2f
je 0x4064a4
cmp al, 0x5c
jne 0x4064a6
mov esi, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x40649c
cmp esi, edi
je 0x4064d0
sub esi, edi
push esi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.0043f660
lea eax, [ebp - 0x80]
push eax
push ebx
mov byte [ebp + esi - 0x80], 0
call fcn.00406411
add esp, 0x14
test ebx, ebx
mov byte [ebp + 0x84], 0
pop esi
je 0x4064f1
push 0x104
lea eax, [ebp + 0x84]
push ebx
push eax
call fcn.0043f4a9
add esp, 0xc
lea eax, [ebp + 0x84]
push eax
mov byte [ebp + 0x187], 0
call fcn.0043d8f0
mov ecx, 0x104
sub ecx, eax
push ecx
lea eax, [ebp + eax + 0x84]
push edi
push eax
call fcn.0043f4a9
lea eax, [ebp + 0x84]
push eax
mov byte [ebp + 0x187], 0
call fcn.00404f2a
add esp, 0x14
test al, al
jne 0x406543
push 0
lea eax, [ebp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp + 0x188]
pop edi
xor ecx, ebp
pop ebx
call fcn.0043e613
add ebp, 0x18c
leave
ret
Function at 0x4376e3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x437726
call fcn.00432642
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x437726
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x437741
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0043729a
test ebx, ebx
mov esi, eax
je 0x43773f
test edi, edi
je 0x43773f
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4390fd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43912b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x439149
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00439067
jmp 0x439149
mov eax, dword [esi + 0x14]
test eax, eax
je 0x439149
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00439067
test edi, edi
mov eax, edi
jne 0x439133
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4780b0]
test ecx, ecx
je 0x43920c
jmp 0x4390fc
ret 8

Function at 0x43e613
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x474e90]
jne 0x43e61d
repz ret
jmp fcn.004445cc
Function at 0x44bd22
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0044309a
xor ebx, ebx
cmp dword [0x478e04], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x44bdf7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x44bd62
xor eax, eax
jmp 0x44bebb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x465050
push edi
call esi
cmp eax, ebx
je 0x44bd5b
push eax
call fcn.00443037
mov dword [esp], 0x465040
push edi
mov dword [0x478e04], eax
call esi
push eax
call fcn.00443037
mov dword [esp], 0x46502c
push edi
mov dword [0x478e08], eax
call esi
push eax
call fcn.00443037
mov dword [0x478e0c], eax
lea eax, [ebp - 8]
push eax
call fcn.00440e3f
test eax, eax
pop ecx
pop ecx
je 0x44bdc5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043dae4
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x44bdf7
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00443037
cmp eax, ebx
pop ecx
mov dword [0x478e14], eax
je 0x44bdf7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00443037
pop ecx
mov dword [0x478e10], eax
mov eax, dword [0x478e10]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x44be70
cmp dword [0x478e14], esi
je 0x44be70
push eax
call fcn.004430a3
pop ecx
call eax
cmp eax, ebx
je 0x44be3d
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x478e14]
call fcn.004430a3
pop ecx
call eax
test eax, eax
je 0x44be3d
test byte [ebp - 0x18], 1
jne 0x44be70
lea eax, [ebp - 0xc]
push eax
call fcn.00440e76
test eax, eax
pop ecx
je 0x44be58
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043dae4
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x44be67
or dword [ebp + 0x10], 0x200000
jmp 0x44bea1
or dword [ebp + 0x10], 0x40000
jmp 0x44bea1
mov eax, dword [0x478e08]
cmp eax, esi
je 0x44bea1
push eax
call fcn.004430a3
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44bea1
mov eax, dword [0x478e0c]
cmp eax, esi
je 0x44bea1
push dword [ebp - 4]
push eax
call fcn.004430a3
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x478e04]
call fcn.004430a3
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x453c48
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x474e90]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00453bdd
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0043da60
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x453c97
cmp dword [ebp - 0x1c], 5
jb 0x453caf
jmp 0x453cab
cmp dword [ebp - 0x10], 1
jne 0x453caf
cmp dword [ebp - 0x1c], 4
ja 0x453cab
jne 0x453caf
cmp dword [ebp - 0x18], 0
jbe 0x453caf
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4663fc
call fcn.00453ace
test eax, eax
jge 0x453cd0
mov byte [0x4764c0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043e613
add ebp, 0x78
leave
ret
Function at 0x46b7c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
jmp 0x46b95d
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
je 0x46b934
jne 0x46b934
mov eax, 0x10365870
mov dword [esi], 0xad59a4
cmp dword [esi + 0x13c], 0
cmp dword [0x423fc8], edi
mov dword [0xe443e0], eax
mov dword [0x41b11c], eax
push 0x30ba
mov eax, 0x54d3fc
cmp eax, 0x115349d8
pmaddwd mm4, qword [0xc09bc0]
push 0x49eb20
test cx, 0x1000
mov eax, 0xcd91f0
mov byte [ecx + edi + 4], bl
mov eax, dword [0x42795c]
push 0x42a5a8
mov dword [esi + 0x28], 0x519dbc
push 0xb037b8
mov dword [esi + 0x18], 0x111433c0
mov bh, 0xbf
mov cl, 0xae
push 0xffffffffffffff8c
shr ch, cl
pop es
out 0x74, al
cmp ch, cl
invalid
mov dword [eax + 8], 0x67452301
je 0x46b823
jne 0x46b823
push 0x697ac084
mov dword [edi + 0x118], 2
mov eax, 0x1057978c
mov eax, dword [0x10331e90]
mov edx, dword [0xdd6720]
cmp dword [ebp + 0xc], 0x1c
mov eax, 0x10d9d31c
push 0x4cc3f8
push 0x9c741c
push 0x114649b8
jmp dword [0x100291a0]
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
jmp 0x46b8bc
Function at 0x4abafe
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5b90d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004a4e92
mov dword [ebp - 0x14], eax
cmp dword [0x5bb018], edi
jne 0x4abbef
push 0x800
push edi
push 0x402d48
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4abb7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4abccf
push 0x402d48
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4abccf
push 0x402d60
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4abccf
push eax
call ebx
push 0x402d6c
push esi
mov dword [0x5bb018], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x402d7c
push esi
mov dword [0x5bb01c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x402d90
push esi
mov dword [0x5bb020], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5bb028], eax
test eax, eax
je 0x4abbec
push 0x402dac
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5bb024], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4abc14
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4abc07
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4abc29
push 4
pop eax
jmp 0x4abcd1
cmp dword [ebp - 0x14], edi
je 0x4abc29
push dword [0x5bb018]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4abc0e
mov eax, dword [0x5bb024]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4abc87
cmp dword [0x5bb028], esi
je 0x4abc87
push eax
call ebx
push dword [0x5bb028]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4abc87
test eax, eax
je 0x4abc87
call ecx
test eax, eax
je 0x4abc7c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4abc7c
test byte [ebp - 8], 1
jne 0x4abc87
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4abcb7
mov eax, dword [0x5bb01c]
cmp eax, esi
je 0x4abcb4
push eax
call ebx
test eax, eax
je 0x4abcb4
call eax
mov edi, eax
test edi, edi
je 0x4abcb4
mov eax, dword [0x5bb020]
cmp eax, esi
je 0x4abcb4
push eax
call ebx
test eax, eax
je 0x4abcb4
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x5bb018]
call ebx
test eax, eax
je 0x4abccf
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4abcd1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a0e46
leave
ret
Function at 0x40101a
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x41716e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [esi], 0x41a188
lea edi, [esi + 0x60]
xor ebp, ebp
mov ecx, edi
mov dword [esp + 0x20], ebp
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x74]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
mov ebx, 2
mov dword [esi], 0x41a0c8
mov byte [esp + 0x20], bl
mov dword [esi + 0x40], ebp
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov ecx, edi
mov dword [esi + 0x44], eax
mov dword [esi + 0x54], 3
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], ebp
mov dword [esi + 0x50], ebp
call sub.MFC42.DLL_CString::Empty
mov eax, dword [esi + 0x44]
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push ebp
push ebp
push 0x1d
push eax
call edi
dec eax
mov dword [esi + 0x5c], eax
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x44]
add esp, 4
inc ecx
mov dword [esi + 0x58], eax
push ecx
push eax
push 0x1d
push edx
call edi
mov ecx, dword [esi + 0x44]
lea eax, [esp + 0x12]
push ebx
push eax
push 0x21
push ecx
call edi
mov al, byte [esp + 0x12]
cmp al, 0x30
jne 0x4010c7
mov dword [esi + 0x70], ebp
jmp 0x4010d7
cmp al, 0x31
jne 0x4010d4
mov dword [esi + 0x70], 1
jmp 0x4010d7
mov dword [esi + 0x70], ebx
mov eax, dword [esi + 0x44]
lea edx, [esp + 0x12]
push ebx
push edx
push 0x26
push eax
call edi
mov dl, byte [esp + 0x12]
mov eax, dword [esi + 0x44]
xor ecx, ecx
cmp dl, 0x30
lea edx, [esp + 0x12]
push ebx
push edx
push 0x27
setne cl
push eax
mov dword [esi + 0x64], ecx
call edi
mov al, byte [esp + 0x12]
xor ecx, ecx
lea edx, [esp + 0x12]
cmp al, 0x30
mov eax, dword [esi + 0x44]
push ebx
push edx
push 0x24
setne cl
push eax
mov dword [esi + 0x68], ecx
call edi
mov cl, byte [esp + 0x12]
xor eax, eax
cmp cl, 0x31
mov ecx, dword [esi + 0x70]
sete al
sub ecx, ebp
mov dword [esi + 0x6c], eax
je 0x4011b2
dec ecx
je 0x40118b
dec ecx
jne 0x4011e1
mov ecx, dword [esi + 0x5c]
mov dword [esi + 0x88], ebp
neg eax
sbb eax, eax
mov dword [esi + 0x7c], 0xffffffff
and eax, ebx
add eax, ebx
mov dword [esi + 0x8c], eax
lea eax, [eax + ecx + 2]
mov dword [esi + 0x80], eax
add eax, 2
mov dword [esi + 0x84], eax
lea ecx, [eax + ecx + 2]
mov eax, esi
mov dword [esi + 0x78], ecx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x78], ebp
mov dword [esi + 0x7c], ebx
lea ecx, [eax + 4]
mov dword [esi + 0x80], ecx
add ecx, 2
mov dword [esi + 0x84], ecx
lea edx, [ecx + eax + 2]
mov dword [esi + 0x88], edx
jmp 0x4011d7
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x80], ebp
mov dword [esi + 0x84], ebx
lea ecx, [eax + 4]
mov dword [esi + 0x78], ecx
add ecx, 2
mov dword [esi + 0x7c], ecx
lea eax, [ecx + eax + 2]
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], 0xffffffff
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x4041d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4177c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 0x30], ecx
lea edi, [ebx + 8]
mov ecx, 8
mov esi, eax
mov dword [ebx], 0x41aad8
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x34], edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x18], 0
test eax, eax
je 0x404254
push eax
call dword [sym.imp.MSVCRT.dll__strdup]
add esp, 4
mov dword [ebx + 0x14], eax
test eax, eax
jne 0x404254
call sub.MFC42.DLL_AfxThrowMemoryException
mov ecx, dword [esp + 0x10]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 0x10
Function at 0x4049f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4178c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1fc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
mov dword [esi], 0x41a668
lea edi, [esi + 0x18]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x214], ebx
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov byte [esp + 0x214], 1
call sub.MFC42.DLL_CString::CString
mov ecx, edi
mov byte [esp + 0x214], 2
mov dword [esi], 0x41ac58
mov dword [esi + 0x30], 1
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x28], ebx
call sub.MFC42.DLL_CString::Empty
lea edi, [esi + 0xc]
lea ebp, [esi + 8]
push edi
lea eax, [esi + 4]
push ebp
push eax
mov dword [esi + 0x20], 4
call fcn.0040fc60
add esp, 0xc
test eax, eax
jne 0x404ac5
push 0x10
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x214], 3
je 0x404aa8
push ebx
push 1
mov ecx, eax
call fcn.0040a800
jmp 0x404aaa
xor eax, eax
lea ecx, [esp + 0x10]
push 0x41d408
push ecx
mov byte [esp + 0x21c], 2
mov dword [esp + 0x18], eax
call sub.MSVCRT.dll__CxxThrowException
push 0xc
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [esi + 0x10], eax
add esp, 4
mov word [eax], bx
mov edx, dword [ebp]
mov ecx, dword [edi]
push edx
lea eax, [esp + 0x90]
push pe_nt_image_headers32
push eax
push ecx
mov dword [esp + 0x2c], 5
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.0040ffb0
add esp, 0x10
lea edi, [esi + 0x14]
lea edx, [esp + 0x1c]
mov dword [esp + 0x2c], eax
push edi
push edx
call sub.ZRC60.dll_zrcctcr_Create
add esp, 8
cmp eax, ebx
je 0x404b5e
push 0x10
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x214], 4
je 0x404b41
push ebx
push 1
mov ecx, eax
call fcn.0040a800
jmp 0x404b43
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push 0x41d408
push eax
mov byte [esp + 0x21c], 2
call sub.MSVCRT.dll__CxxThrowException
mov edx, dword [edi]
lea ecx, [esp + 0x10c]
push ecx
push edx
call sub.ZRC60.dll_szrcctun_GetUserName
add esp, 8
lea eax, [esp + 0x10c]
lea ecx, [esi + 0x24]
push eax
call fcn.0041643c
mov ecx, dword [esp + 0x20c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x208
ret
Function at 0x4057a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x417a68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
push edi
mov ebp, ecx
mov eax, 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x40]
mov byte [esp + 0x30], 4
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x405874
mov ecx, dword [esp + 0x3c]
push 0x2f
mov esi, dword [ecx - 8]
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CString::Find
mov edi, eax
lea edx, [esp + 0x20]
push edi
push edx
lea ecx, [esp + 0x44]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 5
call fcn.00416430
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 4
call fcn.004163f4
sub esi, edi
lea eax, [esp + 0x20]
dec esi
lea ecx, [esp + 0x3c]
push esi
push eax
call sub.MFC42.DLL_CString::Right
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 6
call fcn.00416430
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 4
call fcn.004163f4
jmp 0x405890
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.00416430
lea edx, [esp + 0x40]
lea ecx, [esp + 0xc]
push edx
call fcn.00416430
lea eax, [esp + 0x24]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [ebp + 0x14]
push ecx
push edx
push eax
call sub.ZRC60.dll_zrcctsl_SysLogin
mov ecx, dword [esp + 0x2c]
add esp, 0x1c
mov edx, dword [ecx - 8]
test edx, edx
je 0x40595e
test eax, eax
jne 0x40595e
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40595e
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x44]
cmp edi, 0xc
sete dl
mov byte [eax], dl
mov edx, dword [esp + 0xc]
mov eax, dword [ebp + 0x14]
push edx
push ecx
push eax
call sub.ZRC60.dll_zrcctsa_SetAuthId
add esp, 0xc
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 3
call fcn.004163f4
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 2
call fcn.004163f4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call fcn.004163f4
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call fcn.004163f4
lea ecx, [esp + 0x40]
mov dword [esp + 0x30], 0xffffffff
call fcn.004163f4
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x28
ret 0x10
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 3
call fcn.004163f4
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 2
call fcn.004163f4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 1
call fcn.004163f4
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call fcn.004163f4
lea ecx, [esp + 0x40]
mov dword [esp + 0x30], 0xffffffff
call fcn.004163f4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebp
add esp, 0x28
ret 0x10
Function at 0x411730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4191a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ebp, [esi + 0xc]
mov ecx, ebp
call sub.MFC42.DLL_CString::CString
lea ebx, [esi + 0x10]
mov dword [esp + 0x20], 0
mov ecx, ebx
call sub.MFC42.DLL_CString::CString
mov edi, dword [esp + 0x30]
mov byte [esp + 0x20], 1
mov dword [esi], 0x41c280
lea eax, [edi*4 + 4]
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov byte [esp + 0x20], 2
je 0x4117bc
push fcn.004163f4
mov dword [eax], edi
push sub.MFC42.DLL_CString::CString
add eax, 4
push edi
push 4
push eax
mov dword [esp + 0x44], eax
call fcn.00416cd0
mov eax, dword [esp + 0x30]
jmp 0x4117be
xor eax, eax
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x20], 1
push ecx
mov ecx, ebp
mov dword [esi + 8], eax
mov dword [esi + 4], edi
call fcn.0041643c
mov edx, dword [esp + 0x2c]
mov ecx, ebx
push edx
call fcn.0041643c
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 0xc