joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018f0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x148
mov eax, dword [0x425fe0]
xor eax, esp
mov dword [esp + 0x144], eax
fldz
push ebp
push esi
mov dword [esp + 0x14], 0
xor eax, eax
push edi
mov dword [esp + 0x10], 0
mov word [esp + 0xc], ax
fstp qword [esp + 0x20]
push 0x104
mov dword [esp + 0x18], eax
call fcn.0040aeea
mov cx, word [esp + 0x10]
mov edx, dword [0x424420]
mov edi, eax
movsx eax, cx
mov ecx, dword [esp + 0x1c]
sub eax, edx
imul ecx, eax
add esp, 4
push 0
mov dword [esp + 0x1c], ecx
mov ebp, 1
add dword [esp + 0x10], ebp
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
je 0x401afb
add dword [esp + 0xc], ebp
mov dx, word [esp + 0xc]
movsx eax, dx
add eax, dword [0x4230c0]
lea ecx, [esp + 0x28]
push ecx
mov dword [0x4230c0], eax
mov dword [esp + 0x2c], 0x128
add dword [esp + 0x14], 0xc566f9ba
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401af4
mov esi, edi
lea edx, [esp + 0x4c]
sub esi, edx
mov dword [esp + 0xc], esi
jmp 0x4019c0
lea eax, [esp + 0x4c]
mov cl, byte [eax]
mov byte [esi + eax], cl
add eax, ebp
test cl, cl
jne 0x4019c4
dec dword [0x423104]
fld qword [0x424398]
mov eax, dword [0x423104]
mov ecx, 0xed9c07b8
sub ecx, eax
mov dword [esp + 0x20], ecx
fild dword [esp + 0x20]
push edi
fsubp st(1)
fstp qword [0x424398]
call fcn.0041e0b3
mov edx, dword [0x4243c0]
mov ecx, dword [esp + 0x15c]
add esp, 4
sub edx, 0x3a85285
mov dword [esp + 0x20], edx
fild dword [esp + 0x20]
mov eax, edi
fadd dword [0x423d18]
fstp dword [0x423d18]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401a50
test dl, dl
je 0x401a4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401a50
add eax, 2
add ecx, 2
test dl, dl
jne 0x401a30
xor eax, eax
jmp 0x401a55
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401acb
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], ebp
sub eax, 0x5246e230
cmp eax, ecx
jg 0x401a8d
mov eax, dword [0x4242e0]
mov edx, dword [0x4243ec]
add eax, 0x468078b8
imul edx, eax
mov dword [0x4243ec], edx
add dword [0x4242e0], ebp
cmp dword [esp + 0x15c], 0
je 0x401aec
mov eax, dword [esp + 0x30]
push eax
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401ac7
add dword [esp + 0x14], ebp
push 0xffffffffffffffff
push esi
mov dword [esp + 0x20], 0x4b5de74b
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4019c0
jmp 0x401af0
add dword [esp + 0x14], ebp
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.0040b325
mov ecx, dword [esp + 0x154]
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040b3b3
add esp, 0x148
ret
Function at 0x4027a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
fldz
xor eax, eax
mov word [esp], ax
xor ecx, ecx
mov word [esp], cx
fstp dword [esp]
or ecx, 0xffffffff
add word [0x424778], cx
movzx edx, word [0x424778]
fld qword [0x4243f8]
movsx eax, dx
mov edx, dword [0x4241a4]
sub eax, edx
mov dword [esp], eax
xor eax, eax
mov edx, 1
fild dword [esp]
fsubp st(1)
fstp qword [0x4243f8]
add dword [0x4241a4], ecx
xor ecx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0x44
add dword [0x4252f0], 0x428d6653
mov word [esp + 0x46], cx
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x60]
mov word [esp + 0x48], dx
lea edx, [esp + 0x18]
push edx
push eax
push eax
push 8
push eax
push eax
push eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x80]
push eax
push ecx
mov dword [esp + 0x68], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [0x4241c8]
movzx edx, word [0x4241a0]
add eax, 0xd22ee214
imul edx, eax
mov word [0x4241a0], dx
add esp, 0x58
ret

Function at 0x402870
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
fldz
push ebx
push esi
fstp qword [esp + 0xc]
push edi
xor eax, eax
xor ecx, ecx
push 3
mov word [esp + 0x10], ax
mov word [esp + 0x14], cx
push 0x423d14
call fcn.00401340
movzx edx, word [esp + 0x14]
mov ebx, dword [esp + 0x24]
imul edx, edx, 0x93f9bc34
mov esi, eax
push esi
push ebx
mov word [esp + 0x1c], dx
call fcn.0040b81f
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4028e8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, word [esp + 0x10]
mov ecx, 0x3f9ec905
sub ecx, eax
push esi
push ebx
mov word [esp + 0x18], cx
call fcn.0040b81f
mov edi, eax
add esp, 8
test edi, edi
je 0x40290a
push edi
push 1
lea edx, [esp + 0x28]
push 4
push edx
call fcn.0040b6d9
mov eax, 0x54f5
push edi
mov word [esp + 0x20], ax
call fcn.0040b4fb
add esp, 0x14
fldz
xor eax, eax
mov word [esi], ax
fstp qword [esp + 0x10]
push esi
mov dword [esp + 0x14], 0
mov byte [esi + 2], al
call fcn.0040b325
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x4038f0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x18
fldz
push ebp
xor eax, eax
mov dword [esp + 4], 0
push 0x2e
mov word [esp + 8], ax
fstp qword [esp + 0x18]
push 0x42421c
call fcn.00401340
add esp, 8
lea ecx, [esp + 8]
push ecx
mov ebp, eax
push ebp
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40398e
push esi
push edi
push 0x34
push 0x423d1c
call fcn.00401340
mov edx, dword [esp + 0x30]
mov esi, eax
mov eax, edx
add esp, 8
lea edi, [eax + 1]
jmp 0x403950
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403950
sub eax, edi
push eax
push edx
mov edx, dword [esp + 0x18]
push 1
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
fldz
push 0x34
fstp qword [esp + 0x18]
push 0
push esi
mov dword [esp + 0x20], 0
call fcn.0040b3d0
push esi
call fcn.0040b325
add esp, 0x10
pop edi
pop esi
fld qword [esp + 0x14]
fld1
fsub st(1), st(0)
fxch st(1)
fstp qword [esp + 0x14]
fld qword [esp + 0x14]
fadd qword [0x4230c8]
fld qword [0x423ce0]
fsubr qword [0x41f528]
fadd qword [esp + 0x14]
fcompp
fnstsw ax
fld qword [0x423ce0]
fadd st(1)
fstp qword [0x423ce0]
test ah, 0x41
jp 0x4039e4
fstp st(0)
fld qword [esp + 0x14]
fsubr qword [0x41f520]
call fcn.0040adf0
mov dword [esp + 4], eax
jmp 0x403a42
mov ax, word [esp + 4]
movsx ecx, ax
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
fld dword [0x423db4]
fucompp
fnstsw ax
fsubr dword [0x423db4]
fstp dword [0x423db4]
inc dword [esp + 4]
test ah, 0x44
jnp 0x403a42
mov dx, word [0x42448c]
movsx eax, dx
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
fld qword [esp + 0x14]
fsub qword [0x425918]
fsub qword [0x41f518]
fsubp st(1)
call fcn.0040adf0
mov word [0x42448c], ax
fldz
push 0x2e
push 0
fstp qword [esp + 0x1c]
push ebp
mov dword [esp + 0x18], 0
call fcn.0040b3d0
push ebp
call fcn.0040b325
mov ecx, dword [esp + 0x18]
add esp, 0x10
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
add esp, 0x18
ret
Function at 0x40a480
Capabilities:
Encrypt data using rc4 prga
Set socket configuration

Disassembly:
sub esp, 0x1c
fldz
push ebx
fst qword [esp + 0x10]
xor eax, eax
fldz
xor ebx, ebx
fst dword [esp + 8]
mov edx, 0xf341790b
fxch st(1)
push ebp
fstp qword [esp + 0x1c]
mov dword [0x42780c], ebx
push esi
mov word [esp + 0xc], ax
xor esi, esi
fstp dword [esp + 0x14]
mov dword [esp + 0x14], ebx
movzx ecx, word [0x424288]
fld1
sub edx, ecx
mov word [0x424318], dx
inc word [0x424288]
push edi
cmp dword [0x4258b8], ebx
je 0x40a52a
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, edi
fld dword [0x424274]
mov dword [esi*4 + 0x427348], ebx
fadd dword [esp + 0x14]
push ebx
push ebx
push esi
fadd qword [0x424770]
push 0x4010c0
push ebx
push ebx
fstp qword [0x424770]
fld dword [esp + 0x2c]
fsub st(1)
fstp dword [esp + 0x2c]
fsubr dword [0x424274]
fstp dword [0x424274]
call edi
fld1
inc esi
cmp esi, dword [0x4258b8]
jne 0x40a4e0
mov ax, word [esp + 0x10]
movsx ecx, ax
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fadd dword [esp + 0x14]
call fcn.0040adf0
mov word [esp + 0x10], ax
fld dword [esp + 0x14]
fsub st(1)
fstp dword [esp + 0x14]
fld qword [esp + 0x1c]
fsub st(1)
fstp qword [esp + 0x1c]
fld qword [esp + 0x24]
fld qword [esp + 0x1c]
fadd qword [0x41f990]
fsubp st(1)
fstp qword [esp + 0x24]
fld qword [0x4243c8]
mov edx, dword [esp + 0x18]
fadd qword [0x41f988]
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
faddp st(1)
call fcn.0040adf0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x18], eax
fsubr qword [0x4243c8]
push 0xa
fstp qword [0x4243c8]
mov eax, dword [0x424470]
mov ecx, dword [esp + 0x1c]
sub eax, ecx
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fmul dword [0x423db4]
fstp dword [0x423db4]
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, 0x4258bc
movzx edx, word [esi]
mov eax, dword [edx*4 + 0x427348]
push eax
call ebp
movzx ecx, word [esi]
cmp dword [ecx*4 + 0x427348], ebx
je 0x40a600
lea esp, [esp]
push 0xa
call edi
movzx edx, word [esi]
cmp dword [edx*4 + 0x427348], ebx
jne 0x40a5f0
add esi, 2
cmp esi, 0x4258c4
jne 0x40a5d3
call dword [0x42780c]
sar dword [ecx - 0x57394eec], 0xe5
xor dword [edx - 0x7c573b84], ebp
xchg dword [edx - 0x7afb7274], edi
push ds
jbe 0x40a66f
lcall 0xd1f3, 0x154fc257
or byte [edx - 0x5f], dl
sbb al, 0xfc
jno 0x40a63d
shr byte [eax - 0x24], cl
push eax
push gs
mov dh, 0x9f
lahf
mov edi, 0xeb5838c
push ds
sbb ebx, esp
int1
push edi
push esp
mov dl, 0xf9
jb 0x40a694
aad 0xa1
loope 0x40a63a
sbb eax, 0x922ea808
fmul qword [edi + ebp + 0x7e9eb6f0]
pop ds
adc dword [edi], 0x25
sbb ebx, edx
add ebp, dword [ecx + 0x753e3154]
jb 0x40a6ad
jne 0x40a6de
inc eax
mov al, 0xd9
loope 0x40a669
push esp
movsb byte es:[edi], byte [esi]
test al, 0xa4
dec esi
in al, dx
mov word [edx - 0x6261c274], cs
loop 0x40a6f3
pop ss
xchg esi, eax
hlt
jo 0x40a63d
sub al, 0x8a
loopne 0x40a69e
jmp 0x1700cf3c
push ss
out dx, al
add cl, ch
xchg esp, eax
cld
jmp 0xd5ba18eb
jne 0x40a647
enter 0xfffffffffffffda1, 0xffffffffffffffb7
movsd dword es:[edi], dword [esi]
mov edi, 0xf93b1d64
add byte [eax], al
add byte [edi + 0x5e], bl
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0x10
inc ecx
invalid
Function at 0x40b3b3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425fe0]
jne 0x40b3bd
repz ret
jmp fcn.0040f581

Function at 0x416494
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00410f6a
and dword [ebp - 4], 0
cmp dword [0x428274], 0
mov ebx, eax
jne 0x416545
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4165f6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420a38
push edi
call esi
test eax, eax
je 0x4165f6
push eax
call fcn.00410ef8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428274], eax
call esi
push eax
call fcn.00410ef8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428278], eax
call esi
push eax
call fcn.00410ef8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42827c], eax
call esi
push eax
call fcn.00410ef8
pop ecx
mov dword [0x428284], eax
test eax, eax
je 0x416545
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410ef8
pop ecx
mov dword [0x428280], eax
mov eax, dword [0x428280]
cmp eax, ebx
je 0x41659d
cmp dword [0x428284], ebx
je 0x41659d
push eax
call fcn.00410f73
push dword [0x428284]
mov esi, eax
call fcn.00410f73
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41659d
test edi, edi
je 0x41659d
call esi
test eax, eax
je 0x416594
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416594
test byte [ebp - 0xc], 1
jne 0x41659d
or dword [ebp + 0x10], 0x200000
jmp 0x4165d6
mov eax, dword [0x428278]
cmp eax, ebx
je 0x4165d6
push eax
call fcn.00410f73
pop ecx
test eax, eax
je 0x4165d6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4165d6
mov eax, dword [0x42827c]
cmp eax, ebx
je 0x4165d6
push eax
call fcn.00410f73
pop ecx
test eax, eax
je 0x4165d6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428274]
call fcn.00410f73
pop ecx
test eax, eax
je 0x4165f6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4165f8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x447fb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x30000]
push edi
or ebp, 0xffffffff
jmp 0x447fd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x447fd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x447fc8
mov eax, 1
add ebx, ebx
jne 0x447feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x447ffc
jne 0x44801b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44801b
dec eax
add ebx, ebx
jne 0x448008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x447fe0
add ebx, ebx
jne 0x448017
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x44806d
xor ecx, ecx
sub eax, 3
jb 0x448033
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4480a2
sar eax, 1
mov ebp, eax
jmp 0x44803e
add ebx, ebx
jne 0x44803e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44800c
inc ecx
add ebx, ebx
jne 0x44804c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44800c
add ebx, ebx
jne 0x448059
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44804e
jne 0x44806a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44804e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44808c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44807e
jmp 0x447fce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44808c
add edi, ecx
jmp 0x447fce
pop esi
mov edi, esi
mov ecx, 0xac1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4480aa
cmp byte [edi], 9
jne 0x4480aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4480af
lea edi, [esi + 0x45000]
mov eax, dword [edi]
or eax, eax
je 0x448127
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x54cb8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x54d94]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4480dc
mov ecx, edi
jns 0x44810b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x54d98]
or eax, eax
je 0x448121
mov dword [ebx], eax
add ebx, 4
jmp 0x4480f9
call dword [esi + 0x54da8]
mov ebp, dword [esi + 0x54d9c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44815b
sub esp, 0xffffff80
jmp 0x40f247
Function at 0x40a940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426eb3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x42e2f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x20], 0xff
mov byte [ebp - 0x1f], 0xfe
push 0x4284cc
mov ecx, dword [ebp + 8]
call fcn.004056f0
push eax
call fcn.00410c41
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40a997
xor al, al
jmp 0x40aa6d
push 0x4284d4
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.0040b250
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00406880
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00411b27
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0
jmp 0x40a9f1
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x18]
jge 0x40aa0f
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x1c]
mov dx, word [esi + edx*2]
mov word [ecx + eax*2], dx
jmp 0x40a9e8
mov eax, dword [ebp - 0x14]
push eax
push 2
push 1
lea ecx, [ebp - 0x20]
push ecx
call fcn.00410b09
add esp, 0x10
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 2
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00410b09
add esp, 0x10
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0041015b
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0041093e
add esp, 4
mov byte [ebp - 0x2d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404890
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40e870
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42755c
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x42e2f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
call fcn.0040ec70
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x14]
call fcn.00404640
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
call fcn.004056f0
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00404890
mov edx, dword [ebp - 0x1c]
cmp dword [edx], 0
jne 0x40e948
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.00404640
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2c]
call fcn.004056f0
push eax
lea ecx, [ebp + 0xc]
call fcn.00401cb0
add eax, 4
push eax
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, dword [ebp - 0x1c]
mov dword [edx], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00404890
lea ecx, [ebp + 0xc]
call fcn.00401cb0
add eax, 4
push eax
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 0xc]
call fcn.00401cb0
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
lea ecx, [ebp + 0xc]
call fcn.00401cb0
push eax
lea ecx, [ebp + 0xc]
call fcn.004013f0
push eax
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
call fcn.004102e0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004013d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40eb10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4275d3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x42e2f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
call fcn.0040ec70
lea ecx, [ebp + 0xc]
call fcn.00406880
lea eax, [eax + eax + 2]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00404640
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2c]
call fcn.004056f0
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00404890
cmp dword [ebp - 0x14], 0
jne 0x40ebe0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00404640
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x34]
call fcn.004056f0
push eax
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00404890
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
push 2
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x24]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + 4], 0
jne 0x40ec2e
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp + 0xc]
call fcn.004056f0
push eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
call fcn.004126d6
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00404890
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x40fa40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x42e2f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00410250
add esp, 4
mov esi, eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00410250
add esp, 4
lea edx, [esi + eax + 0xa]
mov dword [ebp - 8], edx
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x40fa8a
mov ecx, dword [ebp - 8]
add ecx, 0xa
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0041229c
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax], 0
movzx ecx, byte [ebp + 0x14]
test ecx, ecx
je 0x40fade
push 0xa
lea edx, [ebp - 0x1c]
push edx
call fcn.0040f930
add esp, 8
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004136d0
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
push 0x4286e4
mov ecx, dword [ebp - 4]
push ecx
call fcn.004136d0
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004136d0
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x40fb17
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
test eax, eax
je 0x40fb17
mov ecx, dword [ebp - 8]
push ecx
push str.___
mov edx, dword [ebp - 4]
push edx
call fcn.004136d0
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004136d0
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
push 0x4286f0
mov ecx, dword [ebp - 4]
push ecx
call fcn.004136d0
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.0040f9b0
add esp, 0xc
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call fcn.00410166
add esp, 4
cmp dword [ebp - 8], 0xffffffff
jne 0x40fb6b
jmp 0x40fb81
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00410166
add esp, 4
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fd17
mov esp, ebp
pop ebp
ret

Function at 0x40fd17
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e2f4]
jne 0x40fd21
repz ret
jmp fcn.00413ddd