joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413446
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
mov ebp, dword [edx + 0x60]
push edi
mov edi, dword [edx + 0x6c]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x20]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x41357b
push ebx
push esi
mov esi, 0xff00
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x68]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x41355b
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xff
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 2]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x200]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x200]
shr eax, 2
and edx, 0xffff00ff
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x4134a6
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x60]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x60]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x413480
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x413583
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x20]
mov eax, dword [edx + 0x20]
push esi
mov esi, dword [edx + 0x6c]
push edi
mov edi, dword [edx + 0x60]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x4136aa
push ebx
mov edx, dword [edx + 0x68]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x41368b
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0xf
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 2]
mov ecx, eax
and ecx, 0xffff00f0
mov ebx, ebp
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00f0
shr edx, 2
lea ecx, [ecx + ebx + 0x20]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xf0
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0xf
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x20]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x4135d9
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x60]
mov edx, dword [ecx]
mov edi, dword [edx + 0x60]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x4135b8
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x4258c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
xor esi, esi
cmp dword [ebx], esi
push edi
je 0x4258d7
call fcn.004258a5
cmp dword [ebp + 0x14], esi
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
jne 0x4258e8
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp dword [ebp + 0x10], esi
je 0x4258fd
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov esi, eax
test esi, esi
jne 0x42590d
push 0xa
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov esi, eax
test esi, esi
je 0x42593c
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov dword [ebx + 8], eax
je 0x42593c
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebx], eax
je 0x42593c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebx + 4], eax
jne 0x425949
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x42594b
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x425960
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x425983
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x4259a9
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x425990
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret

Function at 0x425a60
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x425a92
push esi
call fcn.0042d130
mov eax, dword [esi + 0x40]
test eax, eax
je 0x425a8b
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret 4
mov dword [esi + 0x14], 0xcb
mov ecx, dword [esi + 0x14]
cmp ecx, 0xcb
jne 0x425b15
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x425b00
lea ebx, [ebx]
mov eax, dword [esi + 8]
test eax, eax
je 0x425aba
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
test eax, eax
je 0x425afa
cmp eax, 2
je 0x425b00
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x425ab0
cmp eax, 3
je 0x425add
cmp eax, 1
jne 0x425ab0
mov eax, dword [ecx + 4]
inc eax
mov edx, eax
mov dword [ecx + 4], eax
mov eax, dword [ecx + 8]
cmp edx, eax
jl 0x425ab0
mov edx, dword [esi + 0x144]
add edx, eax
mov dword [ecx + 8], edx
jmp 0x425ab0
xor eax, eax
pop esi
ret 4
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
call fcn.00425960
pop esi
ret 4
cmp ecx, 0xcc
je 0x425b2c
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
push esi
mov dword [eax + 0x18], ecx
call dword [eax]
call fcn.00425960
pop esi
ret 4
Function at 0x425f70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x425fc7
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x425fc7
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x425fc7
xor eax, eax
inc eax
jmp 0x425fc9
xor eax, eax
leave
ret 0x10

Function at 0x425ff2
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x426060
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x426057
cmp dword [ebp - 0xc], 4
jne 0x426057
cmp dword [ebp - 0x10], edi
je 0x426057
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x4627a4], edi
xor eax, eax
jmp 0x42609f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4627a4], edi
jge 0x42609a
lea eax, [ebp - 0x34]
push eax
mov dword [0x4627a4], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x42609a
cmp word [ebp - 0x14], 5
jb 0x42609a
call fcn.00425fcd
test eax, eax
je 0x42609a
emms
mov dword [0x4627a4], 1
mov eax, dword [0x4627a4]
pop edi
leave
ret
Function at 0x42eb02
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x42eb11
xor eax, eax
jmp 0x42ebf4
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x42ebd4
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x454160]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x454160]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x454160]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x454160]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x454160]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x454160]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x454160]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x454160]
inc edx
dec edi
jne 0x42eb31
pop edi
test eax, eax
je 0x42ebee
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x454160]
inc edx
dec eax
jne 0x42ebd8
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
Function at 0x42ed95
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x42edc1
test ecx, ecx
jne 0x42edcb
test esi, esi
jne 0x42edcb
mov eax, edx
jmp 0x42ee3c
cmp eax, 0xffffffff
jne 0x42edcb
push 0xfffffffffffffffe
pop eax
jmp 0x42ee3c
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x42ee3c
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x42ee01
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x42ee20
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x42eee9
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x42ee61
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42ee6b
xor ecx, ecx
jmp 0x42eeaa
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x42ee8d
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.00441aad
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x42eed5
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x42eee9
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x42eda3
pop edi
pop esi
leave
ret
Function at 0x41f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
or ebp, 0xffffffff
jmp 0x41f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41f098
mov eax, 1
add ebx, ebx
jne 0x41f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41f0b0
jne 0x41f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f0b0
xor ecx, ecx
sub eax, 3
jb 0x41f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41f152
mov ebp, eax
add ebx, ebx
jne 0x41f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41f11c
inc ecx
add ebx, ebx
jne 0x41f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41f0fd
jne 0x41f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41f12d
jmp 0x41f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41f13c
add edi, ecx
jmp 0x41f09e
pop esi
mov edi, esi
mov ecx, 0x7ad
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41f15a
cmp byte [edi], 5
jne 0x41f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41f15f
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41f1d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x20940]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x209e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41f18c
mov ecx, edi
jns 0x41f1bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x209e4]
or eax, eax
je 0x41f1d1
mov dword [ebx], eax
add ebx, 4
jmp 0x41f1a9
call dword [esi + 0x209e8]
popal
jmp section.UPX0
Function at 0x4045c8
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov eax, 0x4246fc
call sub.MSVCRT.dll__EH_prolog
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x10]
and dword [esi + 0x314], 0
call fcn.00423918
mov eax, dword [esi + 0xf0]
mov ebx, dword [sym.imp.KERNEL32.dll_SuspendThread]
and dword [ebp - 4], 0
lea edi, [esi + 0xf0]
push dword [eax + 0x2c]
call ebx
test eax, eax
jbe 0x404611
mov eax, dword [edi]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi + 0xe8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [edi + 0x30]
je 0x40463c
push dword [edi + 0x2c]
call ebx
test eax, eax
jbe 0x404646
mov eax, dword [esi + 0xe8]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x404646
mov dword [esi + 0x318], 1
mov eax, dword [esi + 0xec]
lea edi, [esi + 0xec]
push dword [eax + 0x2c]
call ebx
test eax, eax
jbe 0x404666
mov eax, dword [edi]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0040490c
push 2
mov ecx, esi
call fcn.00406299
test eax, eax
je 0x4046a5
xor edi, edi
push 2
push edi
mov ecx, esi
call fcn.00404b70
cmp eax, edi
je 0x404696
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 4]
push 2
mov ecx, esi
call fcn.00406299
test eax, eax
jne 0x40467d
jmp 0x4046a7
xor edi, edi
cmp dword [ebp + 8], 1
jne 0x404713
mov eax, dword [0x430144]
mov eax, dword [eax + 0x18]
cmp dword [eax + 0x60], edi
jne 0x404713
push dword [esi + 4]
lea eax, [ebp - 0x10]
push str.Channel__s_Disabled
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push dword [0x430220]
push dword [ebp - 0x10]
call fcn.0041ded0
pop ecx
pop ecx
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push 0x42fd28
call sub.MFC42.DLL_CString::CString_1
push edi
push edi
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_3
mov ecx, dword [0x430234]
and byte [ebp - 4], 0
push edi
call fcn.0041c8d7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x40ad58
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x424aef
call sub.MSVCRT.dll__EH_prolog
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
push 0xa
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [esi], 0x427150
call fcn.00423912
xor ebx, ebx
mov dword [esi], 0x427128
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push esi
mov edi, 0x42fd60
push str.Creating_new_CDataScopeConnect_Object__0x_p__at__ld_ms_n
push edi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x42fd28
call sub.MFC42.DLL_CString::CString_1
push ebx
push ebx
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [0x430234]
push 6
mov byte [ebp - 4], bl
call fcn.0041c8d7
mov eax, dword [ebp + 8]
mov dword [esi + 0x4c], ebx
mov dword [esi + 8], eax
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x50], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4

Function at 0x40ae07
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x424b07
call sub.MSVCRT.dll__EH_prolog
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x427128
mov eax, dword [0x430144]
and dword [ebp - 4], 0
and dword [eax + 8], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x40ae3a
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor edi, edi
cmp dword [esi + 0x4c], 0
je 0x40ae52
cmp edi, 0xa
jge 0x40ae52
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
jmp 0x40ae3c
mov eax, dword [esi + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40ae62
push eax
call edi
mov eax, dword [esi + 0x10]
test eax, eax
je 0x40ae6c
push eax
call edi
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x30]
call sub.MFC42.DLL_CObList::CObList
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x40fdf4
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x424fc1
call sub.MSVCRT.dll__EH_prolog
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x18]
mov dword [esi], 0x4272b0
call fcn.00423918
xor edi, edi
lea ecx, [esi + 0x28]
mov dword [ebp - 4], edi
call fcn.00423918
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 1
call fcn.00423918
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00423918
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 3
call fcn.00423918
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 4
call fcn.00423918
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 5
call fcn.00423918
mov byte [ebp - 4], 6
mov dword [esi], 0x4271d8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push esi
mov ebx, 0x42fd60
push str.Creating_new_CDriverApp_Object__0x_p__at__ld_ms_n
push ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x42fd28
call sub.MFC42.DLL_CString::CString_1
push edi
push edi
push ecx
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [0x430234]
push 6
mov byte [ebp - 4], 6
call fcn.0041c8d7
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x34]
mov dword [esi + 0x14], eax
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
call sub.MFC42.DLL_CString::Empty
lea ecx, [esi + 0x38]
call sub.MFC42.DLL_CString::Empty
lea ecx, [esi + 0x3c]
call sub.MFC42.DLL_CString::Empty
lea ecx, [esi + 0x28]
call sub.MFC42.DLL_CString::Empty
lea ecx, [esi + 0x2c]
call sub.MFC42.DLL_CString::Empty
lea ecx, [esi + 0x30]
call sub.MFC42.DLL_CString::Empty
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], edi
mov dword [esi + 4], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x50], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x40ff55
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x425019
call sub.MSVCRT.dll__EH_prolog
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4271d8
mov dword [ebp - 4], 6
call dword [sym.imp.ole32.dll_CoReleaseServerProcess]
mov ecx, esi
call fcn.004108a1
push dword [esi + 0x1c]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push dword [esi + 0x20]
call edi
push dword [esi + 0x24]
call edi
mov ecx, dword [esi + 0x44]
xor ebx, ebx
cmp ecx, ebx
je 0x40ffa7
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, dword [esi + 0x48]
cmp ecx, ebx
je 0x40ffb5
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, dword [esi + 0x4c]
cmp ecx, ebx
je 0x40ffc3
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov edi, dword [esi + 8]
cmp edi, ebx
je 0x40ffd8
mov ecx, edi
call fcn.00414c8e
push edi
call sub.MFC42.DLL_operatordelete
pop ecx
mov edi, dword [esi + 0xc]
cmp edi, ebx
je 0x40ffed
mov ecx, edi
call fcn.0041497b
push edi
call sub.MFC42.DLL_operatordelete
pop ecx
mov edi, dword [esi + 0x10]
cmp edi, ebx
je 0x410002
mov ecx, edi
call fcn.00417047
push edi
call sub.MFC42.DLL_operatordelete
pop ecx
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x410010
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 4], ebx
mov eax, dword [0x430144]
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 5
mov dword [eax + 8], ebx
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x28]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x18]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret