joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001acd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001acfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001acfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x4a1270
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section..Ray_1
lea edi, [esi - 0x9c000]
push edi
jmp 0x4a128a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a1291
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a1280
mov eax, 1
add ebx, ebx
jne 0x4a12a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a12b4
jne 0x4a12d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a12d3
dec eax
add ebx, ebx
jne 0x4a12c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a1298
add ebx, ebx
jne 0x4a12cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a1325
xor ecx, ecx
sub eax, 3
jb 0x4a12eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a135a
sar eax, 1
mov ebp, eax
jmp 0x4a12f6
add ebx, ebx
jne 0x4a12f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a12c4
inc ecx
add ebx, ebx
jne 0x4a1304
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a12c4
add ebx, ebx
jne 0x4a1311
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a1306
jne 0x4a1322
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a1306
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a1344
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a1336
jmp 0x4a1286
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a1344
add edi, ecx
jmp 0x4a1286
pop esi
mov edi, esi
mov ecx, 0x234
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a1362
cmp byte [edi], 1
jne 0x4a1362
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a1367
lea edi, [esi + 0x9f000]
mov eax, dword [edi]
or eax, eax
je 0x4a13df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa53f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa54ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a1394
mov ecx, edi
jns 0x4a13c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa54b0]
or eax, eax
je 0x4a13d9
mov dword [ebx], eax
add ebx, 4
jmp 0x4a13b1
call dword [esi + 0xa54c0]
mov ebp, dword [esi + 0xa54b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a1413
sub esp, 0xffffff80
jmp 0x403325
Function at 0x402530
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4026cd
mov esi, dword [ebp + 8]
test esi, esi
je 0x4026cd
mov dword [esi + 0xf0], 0xa
mov ecx, dword [edi]
mov eax, ecx
rol ecx, 8
and ecx, 0xff00ff
ror eax, 8
and eax, 0xff00ff00
or eax, ecx
mov dword [esi], eax
lea eax, [esi + 4]
mov edx, dword [edi + 4]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [eax], ecx
mov edx, dword [edi + 8]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [esi + 8], ecx
mov ecx, dword [edi + 0xc]
mov edi, 0x5fa7a4
push ebx
mov ebx, ecx
rol ecx, 8
and ecx, 0xff00ff
ror ebx, 8
and ebx, 0xff00ff00
or ebx, ecx
mov ecx, ebx
mov dword [esi + 0xc], ebx
shr ecx, 0x10
and ecx, 0xff
mov edx, dword [ecx*4 + 0x5fbcd0]
mov ecx, ebx
shr ecx, 8
xor edx, 0x1000000
and ecx, 0xff
and edx, 0xff000000
mov ecx, dword [ecx*4 + 0x5fb8d0]
and ecx, 0xff0000
xor edx, ecx
mov ecx, ebx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x5fc0d0]
xor edx, ecx
movzx ecx, bl
mov ecx, dword [ecx*4 + 0x5fc4d0]
and ecx, 0xff00
xor edx, ecx
mov ecx, dword [eax]
xor edx, dword [esi]
xor ecx, edx
mov dword [esi + 0x10], edx
mov edx, dword [esi + 8]
xor edx, ecx
mov dword [esi + 0x14], ecx
mov ecx, ebx
mov dword [esi + 0x18], edx
xor ecx, edx
mov dword [esi + 0x1c], ecx
pop ebx
mov edi, edi
mov edx, dword [eax + 0x18]
lea eax, [eax + 0x10]
mov ecx, edx
shr ecx, 8
and ecx, 0xff
mov esi, dword [ecx*4 + 0x5fb8d0]
mov ecx, edx
shr ecx, 0x10
and esi, 0xff0000
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5fbcd0]
and ecx, 0xff000000
xor esi, ecx
mov ecx, edx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x5fc0d0]
xor esi, ecx
movzx ecx, dl
mov ecx, dword [ecx*4 + 0x5fc4d0]
and ecx, 0xff00
xor esi, ecx
xor esi, dword [eax - 4]
xor esi, dword [edi]
add edi, 4
mov dword [eax + 0xc], esi
mov ecx, dword [eax]
xor ecx, esi
mov dword [eax + 0x10], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
cmp edi, 0x5fa7c8
jne 0x402640
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x4026e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00402530
add esp, 4
test eax, eax
js 0x4028cc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x402754
lea esi, [eax + 8]
add eax, 8
lea esi, [esi + edi*4]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x402714
mov ebx, dword [ebp + 8]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x4028c7
lea esi, [ebx + 2]
jmp 0x402770
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + 0x5fc0d0]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x5fb4d0]
movzx eax, byte [eax*4 + 0x5fc0d0]
xor ecx, dword [eax*4 + 0x5facd0]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x5fc0d0]
xor ecx, dword [eax*4 + 0x5fa8d0]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x5fc0d0]
xor ecx, dword [eax*4 + 0x5fb0d0]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x5fc0d0]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x5fb4d0]
movzx eax, byte [eax*4 + 0x5fc0d0]
xor ecx, dword [eax*4 + 0x5facd0]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x5fc0d0]
xor ecx, dword [eax*4 + 0x5fb0d0]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x5fc0d0]
xor ecx, dword [eax*4 + 0x5fa8d0]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x5fc0d0]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x5fb4d0]
movzx eax, byte [eax*4 + 0x5fc0d0]
xor ecx, dword [eax*4 + 0x5facd0]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x5fc0d0]
xor ecx, dword [eax*4 + 0x5fb0d0]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x5fc0d0]
xor ecx, dword [eax*4 + 0x5fa8d0]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x5fc0d0]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x5fb4d0]
movzx eax, byte [eax*4 + 0x5fc0d0]
xor ecx, dword [eax*4 + 0x5facd0]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x5fc0d0]
xor ecx, dword [eax*4 + 0x5fb0d0]
movzx eax, dl
movzx eax, byte [eax*4 + 0x5fc0d0]
xor ecx, dword [eax*4 + 0x5fa8d0]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x402770
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x403990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac83a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x628490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.005922e8
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x403a36
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.00570c47
push 0x623284
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.00575f85
push edi
push esi
call fcn.0059257e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570b94
mov esp, ebp
pop ebp
ret 4

Function at 0x403fd0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ac8c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x628490]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.004047d0
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.00403f00
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x404041
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.00570c47
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x40406a
push dword [esp + 0xc]
call fcn.00448ca8
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5acaa8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x628490]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x628490]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea edx, [edi + 0x10]
lea ecx, [esp + 0x18]
call fcn.004211c0
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x28]
add eax, 0xa
mov dword [edi], eax
add eax, 4
push eax
call fcn.00448cad
mov esi, eax
mov dword [esp + 0x14], 0xe
mov eax, dword [edi]
sub esp, 0x14
mov ecx, esp
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
mov eax, dword [edi + 8]
mov dword [esi + 6], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xa], eax
lea eax, [esp + 0x30]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.00405f80
mov ecx, dword [edi]
add esp, 0x1c
add ecx, 4
mov dword [ebx], esi
cmp dword [esp + 0x2c], 0x10
mov dword [ebx + 4], ecx
jb 0x4060fa
push dword [esp + 0x18]
call fcn.00448ca8
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00570b94
mov esp, ebp
pop ebp
ret 4

Function at 0x4071d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5acc78
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x628490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00592c92
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x28]
mov dword [ebp - 4], 0
mov dword [edi], vtable.std::_LaunchPad_class_std::_Bind_1__void__void____cdecl__const__struct_AgentPack::CreateAgentAppLinkPack___struct_AgentPack::CreateAgentAppLinkPack__.0
push 0xffffffffffffffff
mov eax, dword [esi]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x14], eax
movzx eax, byte [esi + 8]
mov byte [edi + 0x18], al
movzx eax, byte [esi + 9]
mov byte [edi + 0x19], al
mov eax, dword [esi + 0xc]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x10]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x14]
mov dword [edi + 0x24], eax
lea eax, [esi + 0x18]
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
mov ax, word [esi + 0x30]
mov word [edi + 0x40], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40b980
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ad3bb
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x628490]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
push edi
mov eax, dword [0x628490]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0045eb4d
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.00463496
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x40ba83
call fcn.0045fab6
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40ba02
push 0x80004005
call fcn.0040ccd0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
push 0x65
mov dword [esp + 0x1c4], 0
call fcn.00462db1
test eax, eax
je 0x40ba36
push 0x65
push eax
lea ecx, [esp + 0x20]
call fcn.0040c660
mov esi, dword [esp + 0x18]
cmp dword [esi - 0xc], 0
je 0x40ba5e
push 0
push 0
push 0x800
push dword [edi + 4]
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
call edi
mov eax, dword [esp + 0x14]
push esi
push 0x10
push 0
push dword [eax + 4]
call edi
add esi, 0xfffffff0
mov dword [esp + 0x1c0], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ba83
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xbc]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0xbc]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
lea eax, [esp + 0x1c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, ebx
call fcn.0040b840
mov eax, 1
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.00570b94
mov esp, ebp
pop ebp
ret

Function at 0x40c2f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0045e455

Function at 0x40c530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c545
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40c584
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40c580
lea ebx, [ebx]
cmp esi, edx
jae 0x40c584
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x40c570
cmp esi, edx
jb 0x40c589
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40f3d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ad87b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x628490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea edx, [edi + 0x30]
mov byte [edi + 0x1c], 0
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp + 8], 0x2c
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
mov byte [edi + 4], al
movzx eax, byte [esi + 5]
mov byte [edi + 5], al
movzx eax, word [esi + 6]
mov word [edi + 6], ax
movzx eax, word [esi + 8]
mov word [edi + 8], ax
movzx eax, word [esi + 0xa]
mov word [edi + 0xa], ax
movzx eax, word [esi + 0xc]
mov word [edi + 0xc], ax
movzx eax, word [esi + 0xe]
mov word [edi + 0xe], ax
movzx eax, word [esi + 0x10]
mov word [edi + 0x10], ax
movzx eax, word [esi + 0x12]
mov word [edi + 0x12], ax
movzx eax, word [esi + 0x14]
mov word [edi + 0x14], ax
movzx eax, word [esi + 0x16]
mov word [edi + 0x16], ax
movzx eax, word [esi + 0x18]
mov word [edi + 0x18], ax
movzx eax, word [esi + 0x1a]
mov word [edi + 0x1a], ax
movzx eax, byte [esi + 0x1c]
mov byte [edi + 0x1c], al
mov eax, dword [esi + 0x1d]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x21]
mov dword [edi + 0x24], eax
movzx eax, byte [esi + 0x25]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x26]
mov byte [edi + 0x29], al
movzx eax, byte [esi + 0x27]
mov byte [edi + 0x2a], al
mov eax, dword [esi + 0x28]
push eax
mov dword [edi + 0x2c], eax
lea eax, [ebp + 8]
push edx
push eax
call fcn.00408290
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, dword [ecx + esi]
mov dword [edi + 0x48], eax
movzx eax, word [ecx + esi + 4]
mov word [edi + 0x4c], ax
movzx eax, byte [ecx + esi + 6]
mov byte [edi + 0x4e], al
mov eax, dword [ecx + esi + 7]
mov dword [edi + 0x50], eax
mov eax, dword [ecx + esi + 0xb]
mov dword [edi + 0x54], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x418a60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ae578
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x628490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x5c], 0
call fcn.0043e5f0
push 0x5fd0e4
lea edx, [ebp - 0x58]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004098c0
add esp, 4
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x40]
call fcn.0042c730
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov edx, 0x5fc907
push 0
cmovae ecx, dword [ebp - 0x28]
call fcn.00405ee0
add esp, 4
test eax, eax
jne 0x418b12
cmp dword [ebp - 0x18], eax
setne al
test eax, eax
jne 0x418b12
push eax
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], eax
push 0x5fc915
mov byte [esi], al
call fcn.00404c00
jmp 0x418b46
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418b3a
test al, 0x10
je 0x418b3a
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004044f0
jmp 0x418b46
push 0x5fc916
mov ecx, esi
call fcn.00404490
cmp dword [ebp - 0x14], 0x10
jb 0x418b57
push dword [ebp - 0x28]
call fcn.00448ca8
add esp, 4
cmp dword [ebp - 0x2c], 0x10
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jb 0x418b7a
push dword [ebp - 0x40]
call fcn.00448ca8
add esp, 4
cmp dword [ebp - 0x44], 0x10
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jb 0x418b9d
push dword [ebp - 0x58]
call fcn.00448ca8
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570b94
mov esp, ebp
pop ebp
ret
Function at 0x41c080
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [ecx + 0x130]
sub eax, dword [ecx + 0x134]
cmp eax, 0x28
jge 0x41c0a6
cmp byte [ecx + 0x61], 0
jne 0x41c0a6
cmp byte [ecx + 0x60], 0
je 0x41c0a6
mov byte [ecx + 0x60], 0
jmp fcn.00443660
ret