joyce8/EMBER2024-capa huggingface dataset:
Function at 0x806fa0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 8
test ebx, ebx
jne 0x806faf
xor eax, eax
add esp, 8
ret 4
lea eax, [esp]
push eax
push 0x85066c
push 1
push 0
push 0x85067c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x806fa7
mov eax, dword [esp]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
mov eax, dword [esp]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push 0
push esi
push eax
call edx
mov eax, dword [esp]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push 0x8506ac
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x806fa7
mov eax, dword [esp]
mov edx, dword [esp + 0xc]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
test edi, edi
je 0x807023
cmp word [edi], 0
je 0x807023
mov eax, dword [esp]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push edi
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 2
push ebx
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, 1
add esp, 8
ret 4

Function at 0x80a7a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x848898
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x85f690]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov edi, dword [esp + 0x2c]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x14], ecx
push 1
mov ecx, edi
mov dword [esp + 0x1c], edx
call fcn.0082024c
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x31
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.00820ae3
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x28]
mov ecx, edi
call eax
mov ecx, dword [esi + 0x74]
mov eax, dword [esp + 0x30]
add dword [esp + 0xc], ecx
mov edx, dword [esi + 0x78]
add dword [esp + 0x10], 3
sub dword [esp + 0x14], edx
push eax
lea ecx, [esp + 0x38]
call fcn.00802d50
mov dword [esp + 0x24], 0
mov esi, dword [esi + 0x7c]
mov eax, dword [esp + 0x34]
mov ecx, dword [eax - 0xc]
mov edx, dword [edi]
push esi
lea esi, [esp + 0x10]
push esi
push ecx
push eax
mov eax, dword [edx + 0x68]
mov ecx, edi
call eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x80a87f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 0x10
Function at 0x80b1a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x847f88
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x85f690]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
xor ebp, ebp
cmp esi, ebp
je 0x80b243
movzx edi, word [esp + 0x4c]
push ebp
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
call sub.gdiplus.dll_GdiplusStartup
push edi
push esi
call dword [sym.imp.USER32.dll_LoadBitmapW]
mov dword [esp + 0x1c], eax
cmp eax, ebp
jne 0x80b339
mov dword [esp + 0x18], ebp
push 0x8517d8
push edi
push esi
mov dword [esp + 0x50], ebp
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
cmp ebx, ebp
jne 0x80b259
mov dword [esp + 0x44], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x80b243
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebp
jne 0x80b295
mov dword [esp + 0x44], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x80b27f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
lea eax, [esp + 0x18]
push eax
push 1
push ebp
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov esi, dword [ecx]
mov ebx, ecx
lea ecx, [esp + 0x20]
push ecx
push eax
push edi
add esi, 0x10
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [esi]
push eax
push ebx
call edx
mov eax, dword [esp + 0x18]
push eax
call fcn.0080b160
add esp, 4
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp esi, ebp
je 0x80b267
push 0xff00ff
push esi
call fcn.0080b360
add esp, 8
mov dword [esp + 0x1c], eax
cmp eax, ebp
jne 0x80b317
mov ecx, dword [esi + 4]
push 0xffff00ff
lea eax, [esp + 0x20]
push eax
push ecx
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
cmp eax, ebp
je 0x80b317
mov dword [esi + 8], eax
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov dword [esp + 0x44], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x80b339
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x24]
push eax
call sub.gdiplus.dll_GdiplusShutdown
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x80cd50
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x290
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0x28c], eax
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x92]
push ecx
mov word [esp + 0x94], ax
call fcn.00834280
lea edi, [esp + 0x94]
call fcn.008057f0
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x5e]
push eax
mov word [esp + 0x60], dx
call fcn.00834280
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x2a]
push edx
mov word [esp + 0x2c], cx
call fcn.00834280
add esp, 0x24
mov eax, edi
push eax
push 0x20
lea ecx, [esp + 0x10]
push ecx
push str.0_121
push str.ShortKey
push str.Sjsg
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
call fcn.00802d50
mov eax, dword [esp + 4]
cmp dword [eax - 0xc], 0
pop edi
jle 0x80ce25
push 0x2c
push eax
call fcn.00833801
add esp, 8
test eax, eax
je 0x80ce25
sub eax, dword [esp]
sar eax, 1
cmp eax, 0xffffffff
je 0x80ce25
lea edx, [esp + eax*2 + 6]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 8], cx
lea eax, [esp + 0x48]
push 0x20
push eax
call fcn.00832e70
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call fcn.00833866
lea edx, [esp + 0x48]
push edx
mov dword [esi], eax
call fcn.00833866
mov dword [ebx], eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x80ce60
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28c]
xor ecx, esp
mov eax, 1
call fcn.008321db
add esp, 0x290
ret

Function at 0x80ce80
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x290
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0x28c], eax
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x92]
push ecx
mov word [esp + 0x94], ax
call fcn.00834280
lea edi, [esp + 0x94]
call fcn.008057f0
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x5e]
push eax
mov word [esp + 0x60], dx
call fcn.00834280
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x2a]
push edx
mov word [esp + 0x2c], cx
call fcn.00834280
add esp, 0x24
mov eax, edi
push eax
push 0x20
lea ecx, [esp + 0x10]
push ecx
push 0x852f2c
push str.AltWndKey
push str.Sjsg
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
call fcn.00802d50
mov eax, dword [esp + 4]
cmp dword [eax - 0xc], 0
pop edi
jle 0x80cf55
push 0x2c
push eax
call fcn.00833801
add esp, 8
test eax, eax
je 0x80cf55
sub eax, dword [esp]
sar eax, 1
cmp eax, 0xffffffff
je 0x80cf55
lea edx, [esp + eax*2 + 6]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 8], cx
lea eax, [esp + 0x48]
push 0x20
push eax
call fcn.00832e70
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call fcn.00833866
lea edx, [esp + 0x48]
push edx
mov dword [esi], eax
call fcn.00833866
mov dword [ebx], eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x80cf90
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28c]
xor ecx, esp
mov eax, 1
call fcn.008321db
add esp, 0x290
ret
Function at 0x80cfb0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x290
mov eax, dword [0x85f690]
xor eax, esp
mov dword [esp + 0x28c], eax
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x92]
push ecx
mov word [esp + 0x94], ax
call fcn.00834280
lea edi, [esp + 0x94]
call fcn.008057f0
xor edx, edx
push 0x3e
push edx
lea eax, [esp + 0x5e]
push eax
mov word [esp + 0x60], dx
call fcn.00834280
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x2a]
push edx
mov word [esp + 0x2c], cx
call fcn.00834280
add esp, 0x24
mov eax, edi
push eax
push 0x20
lea ecx, [esp + 0x10]
push ecx
push str.2_83
push str.SndKey
push str.Sjsg
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
call fcn.00802d50
mov eax, dword [esp + 4]
cmp dword [eax - 0xc], 0
pop edi
jle 0x80d085
push 0x2c
push eax
call fcn.00833801
add esp, 8
test eax, eax
je 0x80d085
sub eax, dword [esp]
sar eax, 1
cmp eax, 0xffffffff
je 0x80d085
lea edx, [esp + eax*2 + 6]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 8], cx
lea eax, [esp + 0x48]
push 0x20
push eax
call fcn.00832e70
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call fcn.00833866
lea edx, [esp + 0x48]
push edx
mov dword [esi], eax
call fcn.00833866
mov dword [ebx], eax
mov eax, dword [esp + 8]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x80d0c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28c]
xor ecx, esp
mov eax, 1
call fcn.008321db
add esp, 0x290
ret

Function at 0x80f510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push esi
push edi
call fcn.0082002c
mov esi, dword [eax + 0xc]
push 0x8517d8
push 0x8d
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x80f538
pop edi
pop esi
pop ecx
ret 4
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x80f580
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push edi
push eax
call fcn.00836f50
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x80f589
pop ebx
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0080f1f0
mov edx, dword [esp + 0x18]
add esp, 4
push esi
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop edi
mov eax, 1
pop esi
pop ecx
ret 4
Function at 0x813ffd
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x846c0e
call fcn.008346fa
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x814022
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x814068
lea ecx, [ebp - 0x10]
call fcn.00801ce0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00812e50
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00802150
mov eax, esi
call fcn.008347d2
ret 8

Function at 0x819b6d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x819bb4
call fcn.0082002c
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x819bb4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x819bd0
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.008196e5
mov esi, eax
test edi, edi
je 0x819bce
test ebx, ebx
je 0x819bce
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x81e4e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x81e528
call fcn.0082002c
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x81e528
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x81e56b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x81e554
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x81e554
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x81e568
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x8321db
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x85f690]
jne 0x8321e5
repz ret
jmp fcn.00836d17

Function at 0x83eab2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00836726
and dword [ebp - 4], 0
cmp dword [0x863c78], 0
mov ebx, eax
jne 0x83eb63
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x83ec14
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x83ec14
push eax
call fcn.008366b4
mov dword [esp], 0x84f564
push edi
mov dword [0x863c78], eax
call esi
push eax
call fcn.008366b4
mov dword [esp], 0x84f550
push edi
mov dword [0x863c7c], eax
call esi
push eax
call fcn.008366b4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x863c80], eax
call esi
push eax
call fcn.008366b4
pop ecx
mov dword [0x863c88], eax
test eax, eax
je 0x83eb63
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.008366b4
pop ecx
mov dword [0x863c84], eax
mov eax, dword [0x863c84]
cmp eax, ebx
je 0x83ebbb
cmp dword [0x863c88], ebx
je 0x83ebbb
push eax
call fcn.0083672f
push dword [0x863c88]
mov esi, eax
call fcn.0083672f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x83ebbb
test edi, edi
je 0x83ebbb
call esi
test eax, eax
je 0x83ebb2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x83ebb2
test byte [ebp - 0xc], 1
jne 0x83ebbb
or dword [ebp + 0x10], 0x200000
jmp 0x83ebf4
mov eax, dword [0x863c7c]
cmp eax, ebx
je 0x83ebf4
push eax
call fcn.0083672f
pop ecx
test eax, eax
je 0x83ebf4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x83ebf4
mov eax, dword [0x863c80]
cmp eax, ebx
je 0x83ebf4
push eax
call fcn.0083672f
pop ecx
test eax, eax
je 0x83ebf4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x863c78]
call fcn.0083672f
pop ecx
test eax, eax
je 0x83ec14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x83ec16
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402779
Capabilities:
Parse pe header

Disassembly:
push ebp
cmp ebx, 0x10000
jae 0x402790
push 5
push 0xffffc060
push 0xfffffc60
jmp 0x40279c
push 8
push 0xffff8300
push 0xfffffb00
jmp 0x4225f8

Function at 0x40281d
Capabilities:
Authenticate hmac

Disassembly:
inc ecx
call fcn.00402811
jmp fcn.0041fd7e
Function at 0x4018c0
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
ret
Function at 0x409cf0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43251b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x43a4a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], 0x436744
call fcn.004200f2
push 4
mov dword [ebp - 4], 0
call fcn.00420a45
mov edi, eax
add esp, 4
test edi, edi
je 0x409d6c
call fcn.0041f782
mov dword [edi], eax
call fcn.0041f541
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0041f476
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x409d62
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0041f49e
jmp 0x409d6e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432b88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x43a4a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x40b669
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40b4c3
sub eax, edx
sar eax, 1
je 0x40b669
push edi
call dword [0x4331e8]
test eax, eax
je 0x40b669
push 0x14
push 0x65
push ebx
call dword [0x4330d8]
mov esi, eax
cmp esi, ebx
je 0x40b65b
push esi
push ebx
call dword [0x4330e4]
mov edi, eax
cmp edi, ebx
je 0x40b669
push esi
push ebx
call dword [0x4330dc]
cmp eax, ebx
je 0x40b669
push eax
call dword [0x4330e0]
cmp eax, ebx
je 0x40b669
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x30]
push ecx
push edi
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00405860
add esp, 8
cmp eax, ebx
je 0x40b642
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
cmp edi, esi
je 0x40b642
mov edx, dword [ebp + 8]
push 0x4368b8
push edx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.004213c4
add esp, 0xc
test eax, eax
jne 0x40b642
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x40b642
push eax
sub esi, edi
push esi
push 1
push edi
call fcn.00421562
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
cmp esi, eax
sete cl
push edx
mov esi, ecx
call fcn.00421649
add esp, 0x14
cmp esi, ebx
je 0x40b642
lea esi, [ebp - 0x20]
call fcn.00404ba0
push 0x6b
mov byte [ebp - 4], 2
call fcn.00405140
add esp, 4
cmp eax, ebx
je 0x40b63a
push eax
mov eax, 0x6b
mov edi, esi
call fcn.00404d10
cmp eax, ebx
je 0x40b63a
mov edi, dword [ebp - 0x20]
cmp dword [edi - 0xc], ebx
je 0x40b63a
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.00404bc0
lea esi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0040def0
mov eax, edi
call fcn.0040ddd0
cmp eax, ebx
je 0x40b632
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push ecx
push edx
call dword [0x43305c]
test eax, eax
je 0x40b632
mov eax, dword [ebp - 0x14]
push 1
push ebx
push ebx
push eax
push ebx
push ebx
call dword [0x4331d8]
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x14]
call fcn.0040b680
lea eax, [ebp - 0x20]
call fcn.0040b680
lea esi, [ebp - 0x30]
call fcn.004058e0
jmp 0x40b669
push edi
call dword [0x433060]
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40df50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432867
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x43a4a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x4369ac
mov dword [ebx + 0x60], 0x43692c
mov dword [ebp - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], 0x436784
mov edx, dword [ebx]
mov esi, dword [edx + 4]
add esi, ebx
mov dword [ebp - 0x10], 1
call fcn.00408810
lea edi, [ebx + 4]
push esi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], 0
call fcn.0040f970
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x40dfdb
mov eax, dword [esi + 0xc]
or eax, 4
or eax, 4
push 0
mov ecx, esi
call fcn.004086d0
mov dword [ebp - 4], 2
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
push edi
mov dword [ebx + ecx], 0x4369a8
call fcn.0040f5f0
lea edx, [edi + 8]
mov dword [edi + 0x10], edx
lea ecx, [edi + 0x18]
mov dword [edi + 0x20], ecx
lea edx, [edi + 0x1c]
mov dword [edi + 0x24], edx
mov dword [edi], 0x43696c
mov byte [edi + 0x50], 0
mov byte [edi + 0x49], 0
lea ecx, [edi + 0x28]
mov dword [edi + 0x30], ecx
xor ecx, ecx
lea eax, [edi + 0xc]
mov dword [edi + 0x14], eax
lea edx, [edi + 0x2c]
mov dword [edi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [edi + 0x24]
mov dword [eax], ecx
mov edx, dword [edi + 0x34]
mov dword [edx], ecx
mov eax, dword [edi + 0x10]
mov dword [eax], ecx
mov edx, dword [edi + 0x20]
mov dword [edx], ecx
mov eax, dword [edi + 0x30]
mov edx, dword [0x468954]
mov dword [eax], ecx
mov dword [edi + 0x54], ecx
mov dword [edi + 0x4c], edx
mov dword [edi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4