joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402724
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004033b0
test esi, esi
jne 0x40275a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004034a0
jmp 0x402778
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004025d8
mov edi, eax
test esi, esi
je 0x402778
cmp dword [ebx], 0
je 0x402778
dec esi
jmp 0x402761
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402928
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40e00c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4029c0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4029a0
xor eax, eax
push ebp
push 0x402999
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4029dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4029a0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40e00c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40e00c], ax
mov esp, ebp
pop ebp
ret

Function at 0x403234
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40f03c], 0
je 0x403295
cmp word [0x40f210], 0xd7b2
jne 0x40325d
cmp dword [0x40f218], 0
jbe 0x40325d
mov eax, 0x40f20c
call dword [0x40f228]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40e04c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4032bc
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40e018], 0
jne 0x4032b1
push 0
push 0x40e06c
push 0x40e04c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4049c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je 0x4049dc
mov eax, ebx
call fcn.0040371c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x406604
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 8], 1
jne 0x406622
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
je 0x406622
mov dword [ebx + 8], 2
cmp dword [ebx + 8], 2
sete al
pop ebx
ret
Function at 0x4066d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
sub eax, 1
jb 0x4066f1
je 0x4067c4
jmp 0x4067d3
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00406578
test al, al
je 0x4067d3
xor eax, eax
push ebp
push 0x4067bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 4]
test al, al
je 0x4067a7
mov eax, dword [ebp - 4]
mov dword [eax + 8], 3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
xor edx, edx
call fcn.00405c3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
xor edx, edx
call fcn.00405c3c
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push 0x40662c
push 0
push 0
call sub.kernel32.dll_CreateThread
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
test esi, esi
je 0x4067a7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
push esi
call sub.kernel32.dll_SetThreadPriority
test eax, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.00405c54
test al, al
jne 0x4067a7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4067d3
mov eax, dword [ebp - 4]
call fcn.004065f8
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 4]
call fcn.00406604
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 2
sete al
mov edx, dword [ebp - 4]
cmp byte [edx + 0x1b], 0
je 0x4067ed
mov edx, dword [ebp - 4]
mov byte [edx + 0x1a], 1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x406afc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x406b05
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406c3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403534
mov esi, eax
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00403860
test esi, esi
jle 0x406b61
lea eax, [ebp - 0xc]
call fcn.00403774
push eax
mov eax, edi
call fcn.0040371c
mov ecx, esi
pop edx
call fcn.00402598
cmp dword [ebp - 0xc], 0
jne 0x406b6e
mov esi, 0x406c4c
jmp 0x406b78
mov eax, dword [ebp - 0xc]
call fcn.0040371c
mov esi, eax
mov eax, dword [ebx + 4]
call fcn.0040371c
push eax
push 0xffff
lea eax, [ebp - 0x1000b]
push eax
push esi
mov eax, dword [ebp - 4]
call fcn.0040371c
push eax
mov eax, dword [ebx + 8]
call fcn.0040371c
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov esi, eax
cmp dword [ebp - 0xc], 0
jne 0x406c15
cmp esi, 1
jne 0x406c15
cmp byte [ebp - 0x1000b], 0x30
jne 0x406c15
mov esi, 0x406c50
mov eax, dword [ebx + 4]
call fcn.0040371c
push eax
push 3
lea eax, [ebp - 7]
push eax
push esi
mov eax, dword [ebp - 4]
call fcn.0040371c
push eax
mov eax, dword [ebx + 8]
call fcn.0040371c
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov esi, eax
cmp esi, 1
jne 0x406c00
cmp byte [ebp - 7], 0x32
jne 0x406c00
mov eax, dword [ebp + 8]
mov edx, edi
call fcn.00403404
jmp 0x406c25
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x1000b]
mov ecx, 0xffff
call fcn.0040351c
jmp 0x406c25
lea edx, [ebp - 0x1000b]
mov eax, dword [ebp + 8]
mov ecx, esi
call fcn.004034a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c42
lea eax, [ebp - 0xc]
call fcn.004033b0
ret

Function at 0x40c210
Capabilities:
Create process on windows

Disassembly:
and edx, 0xffff
sub edx, 0xa
jne 0x40c232
push 1
push 0
push 0
push 0x40c238
push 0x40c254
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
jmp int.00401219
Function at 0xd99bbc
Capabilities:
Encode data using xor

Disassembly:
jmp 0xd99bc6
pushal
call 0xd99bcc
pop ebp
sub ebp, 0x10
sub ebp, 0x999bbc
jmp 0xd99be2
mov eax, 0x999bbc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c2
mov edx, 0x93e59ab6
xor byte [eax], dl
inc eax
dec ecx
jne 0xd99bf9
jmp 0xd99c0c
cmp eax, 0x8a3f3d7b
mov dh, 0xb6
mov dh, 0x37
ja 0xd99c65
mov dh, 0xb6
mov dh, 0xb5
jnp 0xd99c2b
mov dl, 0xb6
mov dh, 0xb6
or al, 0x9e
mov dh, 0xb6
mov dh, 0x41
push esp
mov ch, 0x7e
cmp eax, 0xb6b6ba37
mov dh, 0xb5
aaa
mov edx, 0xb5b6b6b6
jae 0xd99c19
out 0xde, al
out 0xdf, al
mov eax, 0x84dfdeb6
cmp eax, 0x929ab7b6
fidiv word [ebp - 0x3e]
in eax, dx
ret
ja 0xd99cc6
mov ah, 0x87
mov ah, 0x35
je 0xd99c1f
invalid
dec ebp
pop esi
mov ecx, 0xb6b6ac32
mov dh, 0x36
dec ebp
pop edi
mov ecx, 0xb6b6a732
mov dh, 0xd0
aaa
dec ebp
dec ecx
xchg ebx, eax
mov ecx, 0xb6b6a332
mov dh, 0xf7
pop edi
jp 0xd99d2f
dec ecx
dec ecx
lahf
cli
invalid
mov dh, 0xb6
mov ah, 0x64
mov ecx, 0xb6b6b333
mov dh, 0xb4
mov ecx, 0xb6b6b333
mov dh, 0x3c
mov al, byte [0xb964a4f0]
xor eax, 0x4949496e
mov ah, 0x64
mov ecx, 0xb6b6b333
mov dh, 0x3c
mov al, byte [0xb964a4f0]
xor eax, 0xb6b6b6dc
test dword [esi - 0x4c], esi
mov ecx, 0xb6b6b333
mov dh, 0x3c
invalid
mov al, byte [0xb964a4f0]
xor eax, 0xb6b6b79c
mov ah, 0x64
mov ecx, 0xb6b6b333
mov dh, 0x3c
mov al, byte [0xa564a4f0]
jbe 0xd99d30
mov ecx, 0xb6b6b333
mov dh, 0x3c
mov al, byte [0xa564a4f0]
jbe 0xd99d3f
mov ecx, 0xb6b6b333
mov dh, 0x3c
mov al, byte [0xa564a4f0]
jbe 0xd99d4e
mov ecx, 0xb6b6b333
mov dh, 0x3c
mov al, byte [0xa564a4f0]
jbe 0xd99d62
xor dh, byte [eax + 0x3db6b6b6]
imul ebx, dword [ebp + 0x3eb53c6e], 0xb40df1b1
mov dh, 0xb6
mov dh, 0x5f
invalid
Function at 0x40f5c2
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x43c7df
call fcn.0043c250
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00403775
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.00403775
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00403775
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00403775
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00403775
and byte [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.00403775
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.00403775
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40fd41
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x43c907
call fcn.0043c250
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0040388d
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040388d
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0040388d
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.0040388d
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.0040388d
mov al, byte [edi + 0x3c]
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], al
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.0040388d
add edi, 0x4c
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
call fcn.0040388d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x414f1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 4]
push ebx
push esi
mov esi, dword [ecx]
xor edx, edx
push edi
test eax, eax
mov ebx, 0x159a55e5
mov edi, 0x1f123bb5
mov dword [ebp - 4], eax
jbe 0x414f6c
mov eax, 0xffff
mov ecx, ebx
and ecx, eax
imul ecx, ecx, 0x9069
shr ebx, 0x10
add ebx, ecx
mov ecx, edi
and ecx, eax
imul ecx, ecx, 0x4650
shr edi, 0x10
add edi, ecx
mov ecx, edi
xor cl, byte [ebp + 8]
mov byte [edx + esi], cl
inc edx
cmp edx, dword [ebp - 4]
jb 0x414f40
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x414f73
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 4]
and dword [ebp - 4], 0
mov ecx, dword [ecx]
push ebx
push edi
push 1
pop edx
mov edi, 0x159a55e5
test eax, eax
mov ebx, 0x1f123bb5
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edx
jbe 0x415137
push esi
mov esi, 0xffff
jmp 0x414fb0
push 1
pop edx
mov eax, edi
and eax, esi
imul eax, eax, 0x9069
shr edi, 0x10
add edi, eax
mov eax, ebx
and eax, esi
imul eax, eax, 0x4650
shr ebx, 0x10
add ebx, eax
mov eax, edi
shl eax, 0x10
add eax, ebx
xor eax, dword [ebp + 0xc]
mov ecx, eax
and ecx, edx
shr eax, 1
test ecx, ecx
mov dword [ebp - 8], eax
je 0x41511e
cmp dword [ebp - 4], 0x400
jb 0x41511e
lea ecx, [ebp - 8]
call fcn.0041513d
mov ecx, eax
mov eax, dword [ebp - 8]
shr dword [ebp - 8], 3
and eax, 7
inc ecx
test eax, eax
mov dword [ebp - 0xc], ecx
je 0x4150e7
lea ecx, [ebp - 8]
call fcn.0041513d
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
push 1
pop eax
shl eax, cl
cmp eax, dword [ebp - 4]
jae 0x41503c
push 1
inc ecx
pop eax
shl eax, cl
cmp eax, dword [ebp - 4]
jb 0x41502e
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
cmp eax, ecx
mov dword [ebp - 0x10], eax
jbe 0x415049
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x15
mov dword [ebp - 0x18], 5
ja 0x41505d
mov dword [ebp - 0x18], 4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
push 1
pop eax
shl eax, cl
mov ecx, edi
and ecx, esi
imul ecx, ecx, 0x9069
shr edi, 0x10
add edi, ecx
mov ecx, ebx
and ecx, esi
dec eax
imul ecx, ecx, 0x4650
shr ebx, 0x10
add ebx, ecx
mov ecx, edi
shl ecx, 0x10
add ecx, ebx
and eax, edx
xor ecx, dword [ebp + 0xc]
add eax, 6
cmp eax, dword [ebp - 0x10]
mov edx, ecx
mov dword [ebp - 8], edx
ja 0x415060
mov dword [ebp - 0x24], 1
mov ecx, eax
mov eax, dword [ebp - 0x24]
shl eax, cl
dec eax
and eax, edx
cmp eax, dword [ebp - 4]
jb 0x4150e0
mov eax, edi
and eax, esi
imul eax, eax, 0x9069
shr edi, 0x10
add edi, eax
mov eax, ebx
and eax, esi
mov edx, edi
imul eax, eax, 0x4650
shr ebx, 0x10
add ebx, eax
shl edx, 0x10
add edx, ebx
xor edx, dword [ebp + 0xc]
jmp 0x415060
mov ecx, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
cmp ecx, eax
jbe 0x4150f6
mov dword [ebp - 0xc], eax
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
add dword [ebp - 4], ecx
add eax, edx
mov dword [ebp - 0x24], eax
sub eax, dword [ebp - 0x18]
test ecx, ecx
jbe 0x41512a
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x24]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 0x10]
jne 0x415111
jmp 0x41512a
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
inc dword [ebp - 4]
mov byte [ecx + edx], al
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x20]
jb 0x414fad
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x4172b1
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
mov eax, ecx
jbe 0x4173c8
mov ecx, edx
mov edx, dword [esp + 4]
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
dec ecx
jne 0x4172c1
ret 4

Function at 0x41a371
Capabilities:
Encode data using xor

Disassembly:
push esi
or eax, 0xffffffff
xor esi, esi
test edx, edx
jbe 0x41a39e
push ebx
push edi
movzx edi, byte [esi + ecx]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x44e780]
xor eax, edi
inc esi
cmp esi, edx
jb 0x41a37d
pop edi
pop ebx
not eax
pop esi
ret
Function at 0x41b5c8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43d5f2
call fcn.0043c250
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
mov byte [esi + 0x33], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
call fcn.0041b674
lea eax, [esi + 0x8c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.0040fe56
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x41b5d4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43d5f2
call fcn.0043c250
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
mov byte [esi + 0x33], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
call fcn.0041b674
lea eax, [esi + 0x8c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.0040fe56
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41dfa3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x43d9ea
call fcn.0043c250
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.00403775
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0041dffd
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41dfae
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x43d9ea
call fcn.0043c250
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.00403775
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0041dffd
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41e04f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x43da35
call fcn.0043c250
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.00429e82
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0041e0a5
push dword [esi + 0x24]
call fcn.00402854
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.0042ff05
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0041e669
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41e05a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x43da35
call fcn.0043c250
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.00429e82
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0041e0a5
push dword [esi + 0x24]
call fcn.00402854
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.0042ff05
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0041e669
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41f7a7
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43dc4a
call fcn.0043c250
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x442b18
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.00403775
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00403775
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi], 0x442b04
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41f7b2
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43dc4a
call fcn.0043c250
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x442b18
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.00403775
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00403775
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi], 0x442b04
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x42034a
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x43dcd9
call fcn.0043c250
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], bl
mov byte [esi + 0xb], bl
call fcn.00403115
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00403115
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00403115
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00403115
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x422590
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x43dfbe
call fcn.0043c250
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 1
call fcn.0042ff05
and byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.004225d2
push dword [esi + 0xc]
call fcn.00402854
pop ecx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret