joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ee10
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x43cf70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.0043b2e8
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x20]
mov eax, dword [ecx]
call dword [eax + 0xc8]
mov ecx, eax
call fcn.0043b5c4
lea ecx, [esp + 0x1c]
mov edi, eax
call fcn.0043b642
mov ecx, dword [esi + 0x20]
mov ebp, dword [fcn.0043fd14]
push ecx
mov dword [esp + 0x58], 0
call ebp
push eax
call fcn.0043b648
mov edx, dword [eax + 0x20]
push edx
call dword [fcn.0043fd0c]
mov ebx, eax
lea ecx, [esp + 0x1c]
push ebx
call fcn.0043b636
mov eax, dword [edi + 0x20]
push 0x105
push 0
push 0
push eax
call dword [fcn.0043fc08]
mov ecx, dword [esi + 0x20]
push ecx
call ebp
push eax
call fcn.0043b648
mov eax, dword [eax + 0x20]
lea edx, [esp + 0x3c]
push edx
push eax
call dword [fcn.0043fc00]
lea ecx, [esi + 0x64]
call fcn.0043b61e
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
call dword [fcn.0043f310]
push eax
lea ecx, [esi + 0x64]
call fcn.0043b63c
lea ecx, [esp + 0x2c]
call fcn.0043b642
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x1c]
neg eax
sbb eax, eax
mov byte [esp + 0x54], 1
and eax, ecx
push eax
call dword [fcn.0043f314]
push eax
lea ecx, [esp + 0x30]
call fcn.0043b636
mov ecx, dword [esi + 0x68]
mov edx, dword [esp + 0x30]
push ecx
push edx
call dword [fcn.0043f2e8]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.0043b6e4
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x1c]
mov edx, dword [esp + 0x44]
push 0xcc0020
neg eax
sbb eax, eax
push 0
and eax, ecx
mov ecx, dword [esp + 0x50]
push 0
push eax
mov eax, dword [esp + 0x40]
push ecx
push edx
push 0
push 0
push eax
call dword [fcn.0043f30c]
lea ecx, [esp + 0x2c]
push 0
push ecx
mov ecx, edi
call fcn.00424200
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
push edx
push eax
call dword [fcn.0043f2e8]
lea ecx, [esp + 0x1c]
call fcn.0043b624
mov ecx, dword [esi + 0x20]
push ecx
call ebp
push eax
call fcn.0043b648
mov edx, dword [eax + 0x20]
push ebx
push edx
call dword [fcn.0043fd10]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 0
call fcn.0043b618
lea ecx, [esp + 0x1c]
mov dword [esp + 0x54], 0xffffffff
call fcn.0043b618
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret
Function at 0x415c90
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x43d0bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x19c
push esi
xor esi, esi
push esi
lea ecx, [esp + 0x4c]
call fcn.00415bf0
push 0x177e
mov dword [esp + 0x1ac], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x18], 0x64
mov dword [esp + 0x1c], 0x177d
mov dword [esp + 0x3c], 0xfa0
mov dword [esp + 0x34], 0x44a9f8
mov dword [esp + 0x38], esi
mov dword [esp + 0x44], esi
call fcn.0043b240
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 4]
mov dword [esp + 0xa8], ecx
lea ecx, [esp + 0x48]
mov dword [esp + 4], esi
mov dword [esp + 0xc], 0x190
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0xba
mov dword [esp + 0x44], eax
call fcn.0043b32a
lea ecx, [esp + 0x48]
mov dword [esp + 0x1a8], 0xffffffff
mov dword [esp + 0x48], 0x440e64
call fcn.0043b29a
mov ecx, dword [esp + 0x1a0]
pop esi
mov dword fs:[0], ecx
add esp, 0x1a8
ret
Function at 0x41fbd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43da00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x28]
push esi
mov dword [esp + 4], eax
mov dword [esp + 0x2c], 0x4404cc
lea ecx, [eax + 1]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 8], ecx
mov dword [esp + 0x30], 0
lea edx, [ecx + 1]
mov dword [esp + 0x10], edx
mov esi, dword [esp + 0x24]
push ecx
push eax
mov dword [esp + 0x24], 0
mov eax, dword [esi + 4]
push eax
call dword [0x43f2ec]
cmp al, 0x7f
jae 0x41fc4a
xor ecx, ecx
mov cl, ah
cmp cl, 0x7f
jae 0x41fc4a
shr eax, 0x10
cmp al, 0x7f
jae 0x41fc4a
mov eax, 0xffffff
jmp 0x41fc4c
xor eax, eax
push eax
call dword [fcn.0043f2e4]
push eax
lea ecx, [esp + 0x30]
call fcn.0043b63c
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x2c]
neg eax
sbb eax, eax
and eax, edx
lea edx, [esp + 4]
push eax
mov eax, dword [esi + 4]
push edx
push eax
call dword [0x43fd24]
lea ecx, [esp + 0x2c]
call fcn.0043b61e
mov dword [esp + 0x2c], 0x4404b8
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], 1
call fcn.0043b61e
mov ecx, dword [esp + 0x14]
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x41fcb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43da30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0x4404cc
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x4404e0
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x38]
mov ebx, 0xffffff
push 0xd
mov ecx, esi
mov byte [esp + 0x2c], 1
sub ebx, edi
call fcn.0043b690
push edi
mov ebp, eax
call dword [fcn.0043f2e4]
push eax
lea ecx, [esp + 0x1c]
call fcn.0043b63c
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.0043b62a
mov edi, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
mov eax, dword [edi + 4]
push ecx
mov ecx, dword [edi]
push edx
mov edx, dword [esi + 4]
push eax
push ecx
push edx
call dword [fcn.0043f364]
push ebp
mov ecx, esi
call fcn.0043b690
mov eax, dword [esp + 0x38]
mov ecx, esi
push eax
call fcn.0043b62a
lea ecx, [esp + 0x18]
call fcn.0043b61e
push 0xd
mov ecx, esi
call fcn.0043b690
push ebx
push 1
push 0
mov ebp, eax
call dword [fcn.0043f2f0]
push eax
lea ecx, [esp + 0x14]
call fcn.0043b63c
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0043b630
mov edx, dword [esi]
push 5
mov ecx, esi
mov ebx, eax
call dword [edx + 0x2c]
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
mov dword [esp + 0x38], eax
mov eax, dword [edi + 0xc]
push eax
mov eax, dword [edi]
push ecx
push edx
push eax
mov ecx, dword [esi + 4]
push ecx
call dword [fcn.0043f364]
push ebp
mov ecx, esi
call fcn.0043b690
push ebx
mov ecx, esi
call fcn.0043b630
mov edx, dword [esp + 0x38]
mov ecx, esi
push edx
call fcn.0043b62a
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.0043b61e
mov ecx, esi
call fcn.0043b61e
mov esi, 0x4404b8
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.0043b61e
mov dword [esp + 0x10], 0x4404a4
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 3
call fcn.0043b61e
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x42f870
Capabilities:
Check http status code

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
xor esi, esi
push edi
cmp eax, 0x3c
mov edi, ecx
jg 0x42f90a
je 0x42f903
dec eax
cmp eax, 0x31
ja case.0x42f923.74
xor ecx, ecx
mov cl, byte [eax + 0x42fa40]
jmp dword [ecx*4 + 0x42fa14]
mov esi, 1
jmp case.0x42f923.74
mov esi, 2
jmp case.0x42f923.74
mov esi, 3
jmp case.0x42f923.74
mov esi, 4
jmp case.0x42f923.74
mov esi, 5
jmp case.0x42f923.74
mov esi, 6
jmp case.0x42f923.74
mov esi, 7
jmp case.0x42f923.74
mov esi, 8
jmp case.0x42f923.74
mov esi, 9
jmp case.0x42f923.74
mov esi, 0xa
jmp case.0x42f923.74
mov esi, 0xb
jmp case.0x42f923.74
cmp eax, 0xc8
jg 0x42f94d
je 0x42f946
add eax, 0xffffffba
cmp eax, 0x1e
ja case.0x42f923.74
xor edx, edx
mov dl, byte [eax + 0x42fa88]
jmp dword [edx*4 + 0x42fa74]
mov esi, 0xc
jmp case.0x42f923.74
mov esi, 0xd
jmp case.0x42f923.74
mov esi, 0xe
jmp case.0x42f923.74
mov esi, 0xf
jmp case.0x42f923.74
mov esi, 0x10
jmp case.0x42f923.74
cmp eax, 0x1f4
jg 0x42f977
je 0x42f970
sub eax, 0x12c
je 0x42f969
sub eax, 0x64
jne case.0x42f923.74
mov esi, 0x12
jmp case.0x42f923.74
mov esi, 0x11
jmp case.0x42f923.74
mov esi, 0x13
jmp case.0x42f923.74
cmp eax, 0x258
jne case.0x42f923.74
mov esi, 0x14
mov ax, word [edi + 0x8e]
mov ebx, dword [fcn.0043fc4c]
cmp ax, 0x3f6
je 0x42f99c
cmp ax, 0x3f7
jne 0x42f9a6
mov eax, dword [edi + 0x20]
push 1
push 0
push eax
call ebx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x42fa0b
mov ax, word [edi + 0x8e]
cmp ax, 0x3f6
jne 0x42f9e3
mov ecx, dword [edi + 0xb84]
push esi
push 1
push 0x405
push ecx
call dword [fcn.0043fc68]
mov edx, dword [edi + 0xb84]
push 1
push 0
push edx
call ebx
pop edi
pop esi
pop ebx
ret 8
cmp ax, 0x3f7
jne 0x42fa0b
mov eax, dword [edi + 0xc60]
push esi
push 1
push 0x405
push eax
call dword [fcn.0043fc68]
mov ecx, dword [edi + 0xc60]
push 1
push 0
push ecx
call ebx
pop edi
pop esi
pop ebx
ret 8
Function at 0x439020
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov bx, word [esp + 0x18]
mov dword [esi + 4], 0
movsx eax, word [edi + 4]
movsx ecx, word [edi + 2]
imul eax, ecx
movsx edx, bx
imul eax, edx
cmp word [edi + 6], 8
jle 0x439051
add eax, eax
push esi
push eax
call fcn.00438e70
mov ecx, dword [esi + 4]
add esp, 8
test ecx, ecx
je 0x439080
mov ax, word [edi + 2]
mov word [esi + 8], ax
mov cx, word [edi + 4]
mov word [esi + 0xa], cx
mov dx, word [edi + 6]
mov word [esi + 0xc], dx
mov word [esi + 0xe], bx
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x541898
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00541824
ret
Function at 0x407ea9
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x407f5d
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00407e39
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x407f36
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407f69
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x407f84
test ebp, ebp
je 0x407f84
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x407f8c
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x407fcc
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x408028
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x408023
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40800e
test dl, dl
je 0x40800a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40800e
add ecx, 2
add eax, 2
test dl, dl
jne 0x407fee
xor eax, eax
jmp 0x408013
sbb eax, eax
or eax, 1
test eax, eax
je 0x408032
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x407fdb
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x408049
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.00407ea9
test eax, eax
jne 0x408061
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.00407f69
mov esi, eax
test esi, esi
jne 0x408097
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x4080b1
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x4081a9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.00407ea9
mov esi, eax
test esi, esi
jne 0x4081c7
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.00407f69
mov dword [esp + 0x18], eax
test eax, eax
je 0x4081bf
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.00407f69
mov dword [esp + 0x34], eax
test eax, eax
je 0x4081bf
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.00407f69
mov dword [esp + 0x28], eax
test eax, eax
je 0x4081bf
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.00407f69
mov dword [esp + 0x30], eax
test eax, eax
je 0x4081bf
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x40838e
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x40838e
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x4082f1
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x408372
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x408314
movzx esi, ax
jmp 0x408319
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x408338
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x408347
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x40839b
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x408309
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x4082ce
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x4083c4
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x4083c4
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x4083a9
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x4083d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.00407ea9
mov esi, eax
test esi, esi
je 0x408495
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.00407f69
mov ebp, eax
test ebp, ebp
je 0x408494
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.00407f69
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x408494
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x408494
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x408493
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x408479
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x40878d
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x408841
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040871d
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40881a
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40884d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x408868
test ebp, ebp
je 0x408868
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x408870
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x4088b0
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40890c
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x408907
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4088f2
test dl, dl
je 0x4088ee
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4088f2
add ecx, 2
add eax, 2
test dl, dl
jne 0x4088d2
xor eax, eax
jmp 0x4088f7
sbb eax, eax
or eax, 1
test eax, eax
je 0x408916
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x4088bf
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret

Function at 0x40892d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0040878d
mov esi, eax
test esi, esi
je 0x4089e9
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0040884d
mov ebp, eax
test ebp, ebp
je 0x4089e8
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0040884d
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x4089e8
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x4089e8
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4089e7
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x4089cd
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret
Function at 0x429d80
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5e9eeb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.005c4cb9
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x429e02
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.005c0d67
mov eax, dword [eax]
push 0x1a75fb4
push eax
call fcn.004ae3e4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.005c4f44
test bl, bl
je 0x429e02
push 0x1a75fb4
lea ecx, [esp + 0xc]
call fcn.005c5320
push 0x1a75fc0
lea ecx, [esp + 0xc]
call fcn.005c5320
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x429e3e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.005c4f44
jmp 0x429f09
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x429ec2
lea edx, [esp + 0x7c]
push 0x1a75fbc
push edx
call fcn.004ae3e4
add esp, 8
test eax, eax
je 0x429ec2
lea eax, [esp + 0x7c]
push 0x1a75fb8
push eax
call fcn.004ae3e4
add esp, 8
test eax, eax
je 0x429ec2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x429e52
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.005c4f44
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x42a730
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42a792
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc