joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b607c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4b60aa
mov eax, ebx
call fcn.004b6b30
cmp dword [ebx + 0x40], 0
je 0x4b60a3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4b611b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4b610d
cmp dword [ebx + 8], 0
je 0x4b60cc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4b60de
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4b610d
cmp dword [ebx + 8], 0
je 0x4b60bf
cmp eax, 3
je 0x4b60f1
dec eax
jne 0x4b60bf
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4b60bf
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4b60bf
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4b6139
cmp dword [ebx + 0x14], 0xcc
je 0x4b6139
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004b6144
pop ebx
ret

Function at 0x4ca1a4
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0xc]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
pop ebx
ret
Function at 0x4f9de4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f9e9b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405774
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4f9e26
call fcn.00404ce0
jmp 0x4f9ea2
mov eax, ebx
call fcn.00402f84
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00405774
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x4f9e4f
call fcn.00404ce0
jmp 0x4f9ea2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4f9eb0
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x4f9e70
call fcn.00404ce0
jmp 0x4f9ea2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9ea2
mov eax, dword [ebp - 8]
call fcn.00402fa0
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ff0f0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
test ebx, ebx
je 0x4ff184
mov edx, dword [0x4fbe64]
mov eax, 8
call fcn.00406414
mov esi, eax
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00405338
mov byte [esi + 4], 0
mov edx, esi
mov eax, ebx
call fcn.0048eac4
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.0048ec74
mov eax, dword [edi + 0x3fc]
cmp eax, dword [ebp + 8]
jne 0x4ff154
mov edx, dword [edi + 0x3f8]
mov eax, ebx
call fcn.0048ecd0
jmp 0x4ff184
push 0x4003
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
call fcn.00405774
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x160]
mov eax, ebx
call fcn.0048ecd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x544a2c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x544ae6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405ac4
mov eax, dword [0x5876b0]
cmp byte [eax], 0
je 0x544a9b
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405e68
mov eax, dword [ebx]
call fcn.00405c94
push eax
mov eax, dword [ebx]
call fcn.00405c84
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405c94
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405e68
jmp 0x544acd
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040b3d0
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405c74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x544aed
lea eax, [ebp - 0x3f0]
call fcn.004052e4
ret

Function at 0x544af4
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.0040b3d0
add esp, 0x3ec
pop ebx
ret

Function at 0x544cb4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov esi, edx
mov ebp, eax
mov edx, esi
mov eax, dword [ebp + 0x3c]
call dword [ebp + 0x38]
cmp dword [esi + 0xc], 0
jne 0x544d7c
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.004708f4
mov ebx, eax
movzx edx, word [esi + 4]
mov eax, ebp
call fcn.00544970
mov edi, eax
test edi, edi
je 0x544d15
movzx eax, byte [0x544d88]
cmp al, bl
jne 0x544d15
mov edx, edi
mov eax, ebp
call fcn.005448a8
mov dword [esi + 0xc], 1
mov byte [ebp + 0x31], 1
jmp 0x544d7c
cmp byte [ebp + 0x161], 2
jne 0x544d40
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x587db8]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
mov edx, 0xb006
call fcn.0045e644
test eax, eax
jne 0x544d7c
jmp 0x544d77
mov edx, dword [0x587b9c]
mov edx, dword [edx]
mov edx, dword [edx + 0x44]
mov eax, dword [ebp + 0x128]
cmp edx, eax
je 0x544d77
test byte [eax + 0x358], 8
jne 0x544d77
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x587b9c]
mov eax, edx
mov edx, 0xb006
call fcn.0045e644
xor eax, eax
mov dword [esi + 0xc], eax
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x54b09c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [0x587db8]
mov eax, dword [eax]
cmp dword [eax + 0x58], 0
jne 0x54b142
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x54b0e1
cmp eax, dword [esp]
pop edx
pop eax
jae 0x54b11d
jmp 0x54b0e5
pop edx
pop eax
jge 0x54b11d
mov eax, dword [0x587db8]
mov eax, dword [eax]
mov dword [eax + 0x38], 2
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00545ab8
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x54b142
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x54b142
cmp dword [ebx + 0x11c], 0
je 0x54b142
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.00447124
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x551ffc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5520b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405ac4
mov eax, dword [0x5876b0]
cmp byte [eax], 0
je 0x55206b
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405e68
mov eax, dword [ebx]
call fcn.00405c94
push eax
mov eax, dword [ebx]
call fcn.00405c84
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405c94
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405e68
jmp 0x55209d
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040b3d0
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405c74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5520bd
lea eax, [ebp - 0x3f0]
call fcn.004052e4
ret

Function at 0x555224
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x55527e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x310], ecx
mov dword [esi + 0x314], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x304], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x310]
mov eax, esi
call fcn.00555288
mov eax, dword [esi + 0x310]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x6c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x555285
ret
Function at 0x55badc
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_IsWindow
test eax, eax
jne 0x55bb12
jmp 0x55bbb8
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, esp
push eax
push 0
push 0x419
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
test esi, 2
jbe 0x55bb56
mov edx, dword [ebx + 0x4c]
cmp dword [edx + 0x184], 0
je 0x55bb56
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 0x184]
mov eax, dword [eax + 0x14]
jmp 0x55bb66
mov edx, dword [ebx + 0x4c]
mov edx, dword [edx + 0x180]
test edx, edx
je 0x55bb66
mov eax, dword [edx + 0x14]
test eax, eax
je 0x55bb7f
push eax
push 2
push 5
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0xc]
mov eax, ebx
call fcn.00558468
jmp 0x55bbb8
mov dl, 1
mov eax, dword [0x42c494]
call fcn.0042e810
mov esi, eax
mov edx, dword [edi + 0x10]
mov eax, esi
call fcn.0042f418
mov eax, dword [ebx + 0x4c]
mov edx, dword [eax + 0xc4]
mov eax, dword [esi + 0x10]
call fcn.0042e308
mov edx, esp
mov eax, esi
call fcn.0042ef68
mov eax, esi
call fcn.00404380
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x55e3e8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.00465324
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x2c1], 0
xor edx, edx
mov eax, ebx
call fcn.0045d274
pop ebx
ret
Function at 0x568a60
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x98], 0
je 0x568a86
push 0
mov eax, dword [ebx + 0x94]
call fcn.00465324
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x98], 0
pop ebx
ret

Function at 0x568ba0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x568d12
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xa4], 1
mov eax, dword [ebp - 0xc]
test byte [eax + 0x1c], 0x10
jne 0x568cf7
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x10d]
call fcn.0040b3d0
mov dl, 1
mov eax, dword [0x53e948]
call fcn.0053e9a0
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x9c], eax
mov dl, 1
mov eax, dword [0x41aa50]
call fcn.00404350
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xa0]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x9c]
call fcn.0053ea1c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x568cf3
mov dl, 1
mov eax, dword [0x5405ec]
call fcn.00540654
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x34], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x9c]
mov edx, 0x568d28
call fcn.0053f190
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004055fc
xor eax, eax
push ebp
push 0x568cec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x34]
call fcn.0054095c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00568d30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568cf3
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x9c]
call fcn.00404380
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.00404380
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x34]
call fcn.00404380
ret
movzx ebx, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x568d19
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405308
ret
Function at 0x56f6e4
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov eax, dword [ebp - 4]
call fcn.00405764
mov eax, dword [ebp + 0xc]
call fcn.00405764
mov eax, dword [ebp + 8]
call fcn.00405764
xor eax, eax
push ebp
push 0x56f7fd
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp + 0xc]
call fcn.0040a95c
test al, al
je 0x56f781
push 0x1124
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x587700]
mov eax, dword [eax]
mov ecx, 0x56f818
mov edx, 0x56f838
call fcn.004a42ac
mov eax, dword [ebp - 0xc]
call fcn.00405774
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x587700]
mov eax, dword [eax]
mov ecx, 0x56f854
mov edx, 0x56f838
call fcn.004a42ac
mov eax, dword [ebp - 0x10]
call fcn.00405774
push eax
push 0
call sub.user32.dll_MessageBoxA_1
cmp eax, 7
je 0x56f7d5
lea eax, [ebp - 8]
call fcn.004a5c28
mov eax, dword [ebp + 8]
call fcn.00405774
push eax
mov eax, dword [ebp - 8]
call fcn.00405774
push eax
push esi
call sub.eb_efs.dll_FX_Fxcopy
push 0
mov eax, dword [ebp + 0xc]
call fcn.00405774
push eax
mov eax, dword [ebp - 4]
call fcn.00405774
push eax
call sub.kernel32.dll_CopyFileA
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
call fcn.004a5378
mov eax, dword [ebp - 8]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56f804
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405308
lea eax, [ebp + 8]
mov edx, 2
call fcn.00405308
ret
Function at 0x5778fc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x5779b1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x57799b
lea eax, [ebp - 4]
call fcn.004a5aa4
push 0
mov eax, dword [ebp - 4]
call fcn.00405774
mov ebx, eax
push ebx
call sub.kernel32.dll_CreateDirectoryA
push 1
push 1
push esi
push ebx
push 0
call sub.eb_efs.dll_FX_Outputall
mov dl, 1
mov eax, dword [0x41a74c]
call fcn.00404350
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004a5cd8
push 1
push 0x5779c4
push 0
push 0x5779c4
push 0x5779c4
mov eax, dword [ebp - 8]
push eax
push edi
push 2
call sub.eb_efs.dll_FX_Inputall
mov eax, dword [ebp - 8]
call fcn.00404380
mov eax, dword [ebp - 4]
call fcn.004a5660
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5779b8
lea eax, [ebp - 4]
call fcn.004052e4
ret
Function at 0x40a860
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40a881
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x40a878
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x40a870
mov eax, ebx
leave
ret

Function at 0x40a8a7
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x40a906
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40a933
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40a922
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40a913
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x40a959
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x40a8fa
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x40b199
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword ds:[ebp - 0x20], 0xff8bff8b
mov dword ds:[ebp - 0x14], 0xff8bff8b
mov dword ds:[ebp - 0x1c], 0xff8bff8b
push 0x7fc
push dword [ebp - 0x20]
call fcn.0040a826
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ebx, eax
pop ecx
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x40b378
push dword [ebp - 4]
call fcn.0040a80a
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40b269
jmp 0x40b378
push dword [ebp - 4]
call fcn.0040a80a
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
jne 0x40b2bd
lea eax, [ebp - 4]
push eax
call fcn.0040b17f
mov dword [ebp - 0x28], eax
push 0
push 4
push dword [ebp - 0x28]
push dword [ebp - 4]
push 0xffffffff
push dword [ebp - 0x14]
call fcn.0040aa31
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40b2bd
mov eax, 1
jmp 0x40b2bf
xor eax, eax
test eax, eax
je 0x40b36d
push ebx
push esi
push edx
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov eax, dword [eax]
add eax, ebx
lea eax, [eax + 0x78]
mov eax, dword [eax]
lea esi, [eax + ebx]
mov dword [ebp - 0x10], esi
lea edx, [esi + 0x20]
mov edx, dword [edx]
add edx, ebx
mov edx, dword [edx]
add edx, ebx
mov dword [ebp - 0x18], edx
lea eax, [esi + 0x18]
mov eax, dword [eax]
dec eax
mov dword [ebp - 4], eax
pop ebx
pop esi
pop edx
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x40b365
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [ebp - 0x1c]
call fcn.0040af9c
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x40b354
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
lea eax, [eax + edi*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop edi
leave
ret 8
push dword [ebp - 0xc]
call fcn.0040b158
add dword [ebp - 8], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x40b307
add esp, 0xc
jmp 0x40b378
pop ebx
pop ecx
pop edx
add ecx, 4
jmp 0x40b242
add esp, 0xc
mov edi, edi
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0
jmp 0x40b399
mov esp, ebp
pop ebp
ret 8
Function at 0x4105b5
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 8
call fcn.0043b33c
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0043b33c
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x18], 0
push 0x10
call fcn.0043b33c
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x20], esp
mov eax, 0x1f
call fcn.0043b35a
cmp dword [ebp - 0x20], esp
je 0x410672
push 6
call fcn.0043b354
add esp, 4
mov dword [ebp - 4], eax
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41068b
push ebx
call fcn.0043b336
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0xc]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0x20
call fcn.0043b35a
cmp dword [ebp - 0x20], esp
je 0x4106ba
push 6
call fcn.0043b354
add esp, 4
mov dword [ebp - 0x20], esp
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x4ea688
mov eax, 0x21
call fcn.0043b35a
cmp dword [ebp - 0x20], esp
je 0x4106e4
push 6
call fcn.0043b354
add esp, 4
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x14]
add ebx, 8
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x20]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x14]
add ebx, 0xc
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 2
mov dword [ebp - 0x20], esp
mov eax, 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
push 0x1c
push dword [ebp - 0x14]
push 0
push dword [ebp - 0xc]
mov eax, 0x22
call fcn.0043b35a
cmp dword [ebp - 0x20], esp
je 0x410778
push 6
call fcn.0043b354
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0xc]
mov eax, 0x23
call fcn.0043b35a
cmp dword [ebp - 0x20], esp
je 0x41079d
push 6
call fcn.0043b354
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x4107a5
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4107b6
push ebx
call fcn.0043b336
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0043b336
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0043b336
add esp, 4
mov ebx, dword [ebp - 0x1c]
push ebx
call fcn.0043b336
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret