joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402b80
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
mov dword [edx + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov dword [eax + 4], 0
cmp dword [ebp - 4], 0
jbe 0x402c57
mov ecx, dword [ebp - 4]
push ecx
call fcn.00402aa0
add esp, 4
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x402c31
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x402c1f
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x34]
push ecx
push 0x42c73c
mov edx, dword [ebp - 0x30]
push edx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x402c1f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
mov edx, dword [edx + 0x10]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.00409657
add esp, 4
lea edx, [ebp - 0x2c]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x402c57
push 8
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.004147e0
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x402cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 1], 0
push 0
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402d8a
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x402d8a
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
push eax
call fcn.00402aa0
add esp, 4
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp + 0x14]
cmp dword [edx], 0
je 0x402d80
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
call fcn.004147e0
add esp, 0xc
mov byte [ebp - 1], 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x402e70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x402e9f
cmp dword [ebp - 4], 0
je 0x402e9b
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x402edf
cmp dword [ebp - 4], 0
jne 0x402ea9
xor eax, eax
jmp 0x402edf
mov edx, dword [ebp + 8]
push edx
push str.SeDebugPrivilege
mov eax, dword [ebp - 4]
push eax
call fcn.00402da0
add esp, 0xc
test eax, eax
jne 0x402ed0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x402edf
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403160
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x435b3c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x250]
push eax
push 0x42c768
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x5c
lea ecx, [ebp - 0x250]
push ecx
call fcn.004064c0
add esp, 8
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
je 0x40321e
mov edx, dword [ebp - 0x254]
mov byte [edx], 0
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0xffffffff
jne 0x4031e7
push 0
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x4031f4
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x250]
push ecx
call fcn.00402ef0
add esp, 4
call fcn.00402b00
movzx edx, al
test edx, edx
je 0x40321e
lea eax, [ebp - 0x250]
push eax
call fcn.004030b0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413d9d
mov esp, ebp
pop ebp
ret
Function at 0x4037c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.00403500
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
test eax, eax
je 0x40384b
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0x2021f
push 0
push 0
push 0
push str.SOFTWARENVIDIA_CorporationGlobalStereo3DPersistent
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40384b
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 4
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push str.3D_Vision
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403841
cmp dword [ebp - 0x10], 0
jne 0x403841
push str._update
call fcn.00403670
add esp, 4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x4041d0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x435b3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x130], 0
push 0x124
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.00414b50
add esp, 0xc
mov byte [ebp - 0x135], 0
mov byte [ebp - 0x135], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x40422e
jmp 0x4042fd
mov dword [ebp - 0x130], 0x128
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4042e1
push str.SDManifoldsComEx.exe
lea eax, [ebp - 0x10c]
push eax
call fcn.00415519
add esp, 8
test eax, eax
jne 0x4042c6
mov ecx, dword [ebp - 0x128]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x13c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x13c], 0
je 0x4042c6
push 0
mov edx, dword [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x135], 1
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x404253
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, byte [ebp - 0x135]
test ecx, ecx
jne 0x40420a
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413d9d
mov esp, ebp
pop ebp
ret

Function at 0x404310
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x436edc], eax
mov ecx, dword [ebp + 0xc]
mov dword [0x436ee0], ecx
mov edx, dword [ebp + 8]
mov dword [0x436ef0], edx
mov eax, dword [ebp + 0x10]
mov dword [0x436ef4], eax
mov ecx, 0x436f78
call fcn.00406590
mov ecx, 0x436f78
call fcn.00406590
push 0x436ef8
push 0
push 0x436edc
push 0x404470
push 0
push 0
call fcn.0041566c
add esp, 0x18
mov dword [0x436ee4], eax
push 0x436eec
push 0
push 0x436ef0
push 0x4043c0
push 0
push 0
call fcn.0041566c
add esp, 0x18
mov dword [0x436ee8], eax
cmp dword [0x436ee4], 0
je 0x4043a9
cmp dword [0x436ee8], 0
je 0x4043a9
mov dword [ebp - 4], 1
jmp 0x4043b0
mov dword [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4056c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x435b3c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 5], 0
mov ecx, 0x436f48
call fcn.00406480
push 0x437fa8
call fcn.00401000
add esp, 4
mov eax, dword [0x437fa8]
sub eax, dword [0x437fa0]
mov ecx, dword [0x437fac]
sbb ecx, dword [0x437fa4]
push 0
push 0x989680
push ecx
push eax
call fcn.00415aa0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x21
jle 0x405726
mov dword [0x437f98], 0
mov edx, dword [0x437f98]
add edx, 1
mov dword [0x437f98], edx
cmp dword [0x437f98], 7
jl 0x405763
cmp dword [ebp - 4], 0x21
jg 0x405759
mov eax, 0x21
sub eax, dword [ebp - 4]
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x437f98], 1
cmp dword [0x436f40], 0
jne 0x405771
call fcn.00405650
cmp dword [0x436f40], 0
je 0x40578c
push 0x1388
mov ecx, dword [0x436f40]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x104
lea edx, [ebp - 0x118]
push edx
push str._SystemRoot_System32_taskkill.exe__F__IM_dwm.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x118]
push eax
call fcn.00415298
add esp, 4
push 0x437fa0
call fcn.00401000
add esp, 4
mov ecx, dword [0x436f40]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, 0x436f48
call fcn.004064a0
mov al, byte [ebp - 5]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00413d9d
mov esp, ebp
pop ebp
ret
Function at 0x406410
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0x20219
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallNVIDIAStereo
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40646e
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.InstallLocation
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406464
mov byte [ebp - 1], 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x406830
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x435b3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 0
push 0x105
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40689e
mov ecx, dword [ebp + 8]
push ecx
push 0x42cb60
lea edx, [ebp - 0x110]
push edx
call fcn.00415380
add esp, 4
lea eax, [ebp + eax - 0x110]
push eax
call fcn.00414291
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413d9d
mov esp, ebp
pop ebp
ret
Function at 0x408cc0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov byte [ebp - 5], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x408cec
xor al, al
jmp 0x408d8e
push 0xf01ff
mov eax, dword [ebp - 0x34]
add eax, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x408d77
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x408d5b
lea edx, [ebp - 0x28]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x2c], 0
je 0x408d5b
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x408d5b
cmp dword [ebp - 0x24], 1
je 0x408d5b
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408d39
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x408d6d
mov byte [ebp - 5], 1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx + 0xc]
call eax
mov esp, ebp
pop ebp
ret

Function at 0x409040
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x435b3c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x9c
push 0
lea eax, [ebp - 0xa8]
push eax
call fcn.00414b50
add esp, 0xc
mov dword [ebp - 0xa8], 0x9c
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 6
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413d9d
mov esp, ebp
pop ebp
ret

Function at 0x412efe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x412f0f
jmp fcn.00412f14
jmp fcn.00412810

Function at 0x413d9d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435b3c]
jne 0x413da7
repz ret
jmp fcn.00419b79
Function at 0x420e40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x420e71
call fcn.00416911
mov dword [eax], esi
call fcn.004168fe
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00415dee
add esp, 0x14
push 0x16
pop eax
jmp 0x420ec6
test dword [ebp + 0xc], 0xfffffff9
jne 0x420e4d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x420e9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00416924
pop ecx
call fcn.004168fe
mov eax, dword [eax]
jmp 0x420ec6
test al, 0x10
jne 0x420ec4
test al, 1
je 0x420ec4
test byte [ebp + 0xc], 2
je 0x420ec4
call fcn.00416911
mov dword [eax], 5
call fcn.004168fe
mov dword [eax], 0xd
jmp 0x420e95
xor eax, eax
pop esi
pop ebp
ret

Function at 0x423f20
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00418b7e
and dword [ebp - 4], 0
cmp dword [0x43a7d8], 0
mov ebx, eax
jne 0x423fd1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x424082
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42ec54
push edi
call esi
test eax, eax
je 0x424082
push eax
call fcn.00418b0c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43a7d8], eax
call esi
push eax
call fcn.00418b0c
mov dword [esp], 0x42ec30
push edi
mov dword [0x43a7dc], eax
call esi
push eax
call fcn.00418b0c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43a7e0], eax
call esi
push eax
call fcn.00418b0c
pop ecx
mov dword [0x43a7e8], eax
test eax, eax
je 0x423fd1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00418b0c
pop ecx
mov dword [0x43a7e4], eax
mov eax, dword [0x43a7e4]
cmp eax, ebx
je 0x424029
cmp dword [0x43a7e8], ebx
je 0x424029
push eax
call fcn.00418b87
push dword [0x43a7e8]
mov esi, eax
call fcn.00418b87
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x424029
test edi, edi
je 0x424029
call esi
test eax, eax
je 0x424020
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x424020
test byte [ebp - 0xc], 1
jne 0x424029
or dword [ebp + 0x10], 0x200000
jmp 0x424062
mov eax, dword [0x43a7dc]
cmp eax, ebx
je 0x424062
push eax
call fcn.00418b87
pop ecx
test eax, eax
je 0x424062
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x424062
mov eax, dword [0x43a7e0]
cmp eax, ebx
je 0x424062
push eax
call fcn.00418b87
pop ecx
test eax, eax
je 0x424062
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43a7d8]
call fcn.00418b87
pop ecx
test eax, eax
je 0x424082
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x424084
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40104d
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.004719f5
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004719f5
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], 0
push 0x10
call fcn.004719f5
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x20], esp
mov eax, 0
call fcn.00471a13
cmp dword [ebp - 0x20], esp
je 0x401114
push 0x19
push 0x405aaeb
push 6
call fcn.00471a01
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, 0x5602fc
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40112d
push ebx
call fcn.004719fb
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0xc]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 1
call fcn.00471a13
cmp dword [ebp - 0x20], esp
je 0x401166
push 0x5d
push 0x405aaeb
push 6
call fcn.00471a01
add esp, 0xc
mov dword [ebp - 0x20], esp
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x56030d
mov eax, 2
call fcn.00471a13
cmp dword [ebp - 0x20], esp
je 0x40119a
push 0x87
push 0x405aaeb
push 6
call fcn.00471a01
add esp, 0xc
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x14]
add ebx, 8
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 0xc
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 2
mov dword [ebp - 0x20], esp
mov eax, 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push 0x1c
push dword [ebp - 0x14]
push 0
push dword [ebp - 0xc]
mov eax, 3
call fcn.00471a13
cmp dword [ebp - 0x20], esp
je 0x401238
push 0x185
push 0x405aaeb
push 6
call fcn.00471a01
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0xc]
mov eax, 4
call fcn.00471a13
cmp dword [ebp - 0x20], esp
je 0x401267
push 0x1c9
push 0x405aaeb
push 6
call fcn.00471a01
add esp, 0xc
mov eax, dword [ebp - 0x18]
jmp 0x40126f
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401280
push ebx
call fcn.004719fb
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.004719fb
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.004719fb
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
call fcn.004719fb
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40351f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.00403581
test eax, eax
je 0x403562
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x403562
cmp word [eax], 0x5a4d
jne 0x403562
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x403562
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.00403653
mov eax, dword [ebp + 8]
jmp 0x40357b
mov esp, ebp
pop ebp
ret 4

Function at 0x403581
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x403634
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x403a27
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x403ada
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x40902d
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x40904f
mov eax, 0xfffffffd
jmp 0x40912f
mov ebx, dword [0x5eb400]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x4090fd
mov ebx, dword [0x5eb400]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x40909e
mov ebx, dword [0x5eb400]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x40909e
mov eax, 1
jmp 0x4090a3
mov eax, 0
test eax, eax
je 0x4090cf
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x4090b8
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x5eb400]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x409125
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x40912f
mov esp, ebp
pop ebp
ret 4

Function at 0x409a0a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.00403a27
test eax, eax
je 0x409a4d
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x409a4d
cmp word [eax], 0x5a4d
jne 0x409a4d
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x409a4d
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.00403af9
mov eax, dword [ebp + 8]
jmp 0x409a66
mov esp, ebp
pop ebp
ret 4

Function at 0x41156a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x41161d
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]