joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095a0
Capabilities:
Modify service
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421e90
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x42a520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x20]
xor esi, esi
push 0x460cdc
xor ebx, ebx
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], esi
call fcn.004097a0
add esp, 8
mov ecx, dword [ebp - 0x20]
cmp dword [ecx - 0xc], esi
je 0x4096ca
push 5
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, esi
je 0x4096ca
mov edx, dword [ebp - 0x20]
push 0x17
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 0x24], eax
cmp ebx, esi
je 0x4096c0
lea eax, [ebp - 0x18]
push eax
push esi
push esi
mov dword [ebp - 0x18], esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
push ebx
call esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, ecx
je 0x4096ac
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
push eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x11]
lea edi, [ebp - 0x34]
mov byte [ebp - 0x11], cl
call fcn.00407660
mov eax, dword [ebp - 0x30]
mov edi, dword [ebp - 0x34]
sub eax, edi
cmp eax, dword [ebp - 0x18]
jne 0x40969f
test edi, edi
je 0x40969f
lea ecx, [ebp - 0x18]
push ecx
push eax
push edi
push ebx
call esi
test eax, eax
je 0x40969f
cmp dword [edi + 4], 2
je 0x40969f
mov edx, dword [edi + 8]
mov eax, dword [edi]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 2
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea esi, [ebp - 0x34]
call fcn.00407630
mov edi, dword [ebp - 0x1c]
xor ecx, ecx
push ecx
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebx, ebx
xor esi, esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4096fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4096fa
cmp ebx, esi
je 0x409705
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x1c]
cmp eax, esi
je 0x409713
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40acc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422050
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x42a520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
lea eax, [ebp - 0x18]
push 0x460c38
xor edi, edi
push eax
xor esi, esi
mov dword [ebp - 4], edi
call fcn.004097a0
mov ecx, dword [ebp - 0x18]
add esp, 8
cmp dword [ecx - 0xc], edi
je 0x40ad95
cmp edi, 2
jge 0x40ad95
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x14]
push edx
push 0
xor eax, eax
push 2
test edi, edi
push 0
setne al
push 0
push 0
push ecx
mov dword [ebp - 0x14], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40ad8c
mov esi, dword [ebp - 0x14]
mov ecx, esi
mov dword [ebp - 0x28], ecx
test ebx, ebx
jne 0x40ad58
lea eax, [ebx + 0xd]
jmp 0x40ad78
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push 0x426880
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x28]
xor edx, edx
test eax, eax
sete dl
mov esi, edx
test ecx, ecx
je 0x40ad8c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
inc edi
jmp 0x40ad11
lea eax, [ecx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40add5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ce20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4220d7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x42a520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x426814
mov dword [ebx + 0x60], 0x426790
mov dword [ebp - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], 0x4267d0
mov edx, dword [ebx]
mov esi, dword [edx + 4]
add esi, ebx
mov dword [ebp - 0x10], 1
call fcn.0040a160
lea edi, [ebx + 4]
push esi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], 0
call fcn.0040e8b0
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x40ceab
mov eax, dword [esi + 0xc]
or eax, 4
or eax, 4
push 0
mov ecx, esi
call fcn.0040a020
mov dword [ebp - 4], 2
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
push edi
mov dword [ebx + ecx], 0x426810
call fcn.0040e530
lea edx, [edi + 8]
mov dword [edi + 0x10], edx
lea ecx, [edi + 0x18]
mov dword [edi + 0x20], ecx
lea edx, [edi + 0x1c]
mov dword [edi + 0x24], edx
mov dword [edi], 0x4267d4
mov byte [edi + 0x50], 0
mov byte [edi + 0x49], 0
lea ecx, [edi + 0x28]
mov dword [edi + 0x30], ecx
xor ecx, ecx
lea eax, [edi + 0xc]
mov dword [edi + 0x14], eax
lea edx, [edi + 0x2c]
mov dword [edi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [edi + 0x24]
mov dword [eax], ecx
mov edx, dword [edi + 0x34]
mov dword [edx], ecx
mov eax, dword [edi + 0x10]
mov dword [eax], ecx
mov edx, dword [edi + 0x20]
mov dword [edx], ecx
mov eax, dword [edi + 0x30]
mov edx, dword [0x46273c]
mov dword [eax], ecx
mov dword [edi + 0x54], ecx
mov dword [edi + 0x4c], edx
mov dword [edi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40f0e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422088
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x42a520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x1c]
push 0x42b500
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004097a0
add esp, 8
lea ecx, [ebp - 0x18]
push 0x42b54c
push ecx
mov byte [ebp - 4], 1
call fcn.004097a0
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
push 0x6a
mov byte [ebp - 4], 3
call fcn.00406e90
add esp, 4
cmp eax, ebx
je 0x40f171
push eax
lea eax, [ebx + 0x6a]
lea edi, [ebp - 0x14]
call fcn.004069d0
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx - 0xc], ebx
je 0x40f1fd
mov edx, dword [ebp - 0x18]
cmp dword [edx - 0xc], ebx
je 0x40f1fd
cmp dword [esi - 0xc], ebx
je 0x40f1fd
xor eax, eax
mov dword [ebp - 0x14], eax
nop
cmp eax, 2
jge 0x40f1fd
xor ecx, ecx
cmp eax, ebx
setne cl
push 2
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
add ecx, 0x80000001
mov dword [ebp - 0x20], ebx
call fcn.0040f020
test eax, eax
jne 0x40f1e1
mov edi, dword [ebp - 0x18]
cmp esi, ebx
je 0x40f1e1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push ebx
push edi
mov edi, dword [ebp - 0x28]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40f1e4
mov edi, dword [ebp - 0x28]
cmp edi, ebx
je 0x40f1f2
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], ebx
jmp 0x40f190
lea eax, [esi - 0x10]
mov byte [ebp - 4], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40f21d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f240
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f262
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ecdc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00415fe2
and dword [ebp - 0x14], 0
cmp dword [0x462670], 0
mov dword [ebp - 0x18], eax
jne 0x41ed8f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41ee37
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41ee37
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x462670], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x462674], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x462678], eax
call edi
push eax
call esi
mov dword [0x462680], eax
test eax, eax
je 0x41ed8f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46267c], eax
mov eax, dword [0x46267c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ede8
cmp dword [0x462680], ecx
je 0x41ede8
push eax
call esi
push dword [0x462680]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ede8
test ebx, ebx
je 0x41ede8
call edi
test eax, eax
je 0x41eddf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41eddf
test byte [ebp - 8], 1
jne 0x41ede8
or dword [ebp + 0x10], 0x200000
jmp 0x41ee1b
mov eax, dword [0x462674]
cmp eax, dword [ebp - 0x18]
je 0x41ee1b
push eax
call esi
test eax, eax
je 0x41ee1b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41ee1b
mov eax, dword [0x462678]
cmp eax, dword [ebp - 0x18]
je 0x41ee1b
push eax
call esi
test eax, eax
je 0x41ee1b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x462670]
call esi
test eax, eax
je 0x41ee37
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41ee39
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041071c
leave
ret
Function at 0x405d43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x405d52
pop dword [ebp - 0x34]
mov eax, 0x6f7fe1d7
sub eax, 0x6f3f8485
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xa9daacec
add dword [ebp - 0x44], 0xa477985f
mov dword [ebp - 0x40], 0x8e45c0b5
sub dword [ebp - 0x40], 0x5c127470
mov dword [ebp - 0x3c], 0x34f214b2
sub dword [ebp - 0x3c], 0xe8a5d084
mov dword [ebp - 0x38], 0xc4945996
add dword [ebp - 0x38], 0x3b6ba66a
lea eax, [ebp - 0x44]
push eax
mov eax, 0x7c80ddd5
add eax, 0x83bf936f
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x2ce86b37
sub dword [ebp - 0x44], 0xb87601e1
mov dword [ebp - 0x40], 0x9022cd23
sub dword [ebp - 0x40], 0x4eb66bae
mov dword [ebp - 0x3c], 0x21f5539c
add dword [ebp - 0x3c], 0x417a18d0
mov dword [ebp - 0x38], 0xefa5c705
sub dword [ebp - 0x38], 0xefa5c705
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xc33efc80
add eax, 0x3d017490
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3ac1d
push 0
call eax
mov ecx, 0x816f23d2
add ecx, 0x7e91336b
xor ebx, ebx
add ebx, eax
mov esi, 0x436000
add esi, dword [ebp - 0x34]
mov edx, 0xa3da5062
sub edx, 0x7fc83b72
add dword [ebp - 0x18], 0x8abe6c56
mov edi, dword [esi]
add dword [ebp - 0x1c], ebx
xor edi, edx
mov dword [ebp - 0x24], 0x922cf1ce
mov dword [ebx], edi
xor dword [ebp - 0x30], 0x6648a5a6
add ebx, 4
add esi, 4
loop 0x405e70
add eax, 0x14fc7
mov ebx, eax
add eax, 0xb3c13bed
add eax, 0x4c3ec418
mov ecx, 0xbc2a6c15
add ecx, 0x441593eb
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x406120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422af4], 0
push esi
jne 0x406157
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406131
mov dword [ecx*4 + 0x422af0], eax
inc ecx
cmp ecx, 0x100
jl 0x40612c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406188
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422af0]
xor eax, esi
inc ecx
dec edx
jne 0x40616a
pop edi
not eax
pop esi
ret 0xc
Function at 0x102a8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.102a81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x102a807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102a806a
add dl, dl
jne 0x102a8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102a80dc
xor eax, eax
add dl, dl
jne 0x102a8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102a817d
add dl, dl
jne 0x102a80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102a80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102a80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102a80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x102a80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x102a8075
mov eax, 1
add dl, dl
jne 0x102a80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102a80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102a80e1
sub eax, ebx
mov ebx, 1
jne 0x102a8128
mov ecx, 1
add dl, dl
jne 0x102a810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x102a8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102a8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102a8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x102a813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x102a814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102a8136
cmp eax, 0x7d00
jae 0x102a816d
cmp eax, 0x500
jb 0x102a8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102a8075
cmp eax, 0x7f
ja 0x102a8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102a8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x102a819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x102a8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4011d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x4011f8
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x401206
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x40121f
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x40122d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x401246
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x401254
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x40126d
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x40127b
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call fcn.004012c2

Function at 0x4013b0
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x81d948
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4014d9
cmp dword fs:[0xc0], eax
je 0x4013db
mov dword [0x81d944], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x81d82c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x81d830], eax
movzx edx, word [esi + 0xac]
mov dword [0x81d834], edx
mov eax, dword [esi + 0xb0]
mov dword [0x81d838], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x40143b
push 0x7f
push eax
push 0x81d83c
call fcn.00401030
mov edx, dword [0x81d834]
add esp, 0xc
jmp 0x401443
xor eax, eax
mov word [0x81d83c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x81d93c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x81d93e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x81d940], ax
mov ecx, eax
mov byte [0x81d942], 0
cmp byte [0x7ffe0268], 0
je 0x40148a
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x81d942], bl
cmp ebx, 1
pop ebx
jne 0x4014a4
and ecx, 0xffef
mov word [0x81d940], cx
test edx, edx
jne 0x4014d9
call fcn.004013b0
cmp dword [0x81d82c], 6
ja 0x4014d9
jb 0x4014c1
cmp dword [0x81d830], 4
jae 0x4014d9
call fcn.004013b0
cmp dword [0x81d82c], 0xa
jae 0x4014d9
mov dword [0x81d834], 1
ret
Function at 0x401d00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x401d4b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x401d3b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x401d21
jmp 0x401d40
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x401d9b
mov edi, edx
lea ecx, [edi + 2]
jmp 0x401d60
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401d60
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x401d7c
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00401030
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x401dbd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x401e30
mov esi, dword [ebx]
cmp esi, ebx
je 0x401e30
test esi, esi
je 0x401e30
cmp word [esi + 0x24], 2
jbe 0x401e2a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x401e2a
cmp dword [esi + 0x18], 0
je 0x401e2a
test ebp, ebp
je 0x401de5
cmp ebp, eax
jne 0x401e2a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00401030
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x401e0a
cmp eax, dword [esi + 0x18]
jne 0x401e2a
cmp dword [esp + 0x10], 0
je 0x401e3d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00401350
add esp, 8
test eax, eax
je 0x401e3d
mov esi, dword [esi]
cmp esi, ebx
jne 0x401dc3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x402a00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x402a5b
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x402a20
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x402a3c
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00401030
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x402a7d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x402aef
mov esi, dword [ebx]
cmp esi, ebx
je 0x402aef
test esi, esi
je 0x402aef
cmp word [esi + 0x24], 2
jbe 0x402ae9
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x402ae9
cmp dword [esi + 0x18], 0
je 0x402ae9
test ebp, ebp
je 0x402aa5
cmp ebp, eax
jne 0x402ae9
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00401030
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x402aca
cmp edx, dword [esi + 0x18]
jne 0x402ae9
cmp dword [esp + 0x14], eax
je 0x402afc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00401350
add esp, 8
test eax, eax
je 0x402afc
mov esi, dword [esi]
cmp esi, ebx
jne 0x402a83
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret