joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100eae30
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100eac70
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x100eaefb
mov dword [ebp - 4], 0
jmp 0x100eae8c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x100eaefb
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100ee256
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100eaef9
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.100ee256
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.100eaa90
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100ee256
jmp 0x100eae83
pop esi
add esp, 8
cmp ebp, esp
call fcn.100ee256
mov esp, ebp
pop ebp
ret

Function at 0x100eaf10
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x100eafbb
mov dword [ebp - 4], 0
jmp 0x100eaf43
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x100eaf9e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100ee256
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100eaf9c
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.100ee256
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100ee256
jmp 0x100eaf3a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x1023d554]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.100ee256
pop esi
add esp, 8
cmp ebp, esp
call fcn.100ee256
mov esp, ebp
pop ebp
ret
Function at 0x100eafd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x1023d900]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100eb033
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100ee256
test eax, eax
jne 0x100eb05e
mov eax, 0xa
jmp 0x100eb160
cmp dword [ebp + 0xc], 0
je 0x100eb0aa
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x100eb0a8
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x100eb0e6
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100eb0d1
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x100eb0e6
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100ee256
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.100ee256
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.100ee256
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x100eb184]
call fcn.100ee200
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.100ee256
mov esp, ebp
pop ebp
ret
Function at 0x100eb850
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x1023d8f8]
mov dword [ebp - 4], eax
jmp 0x100eb877
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100eb890
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100eb88e
mov eax, dword [ebp - 4]
jmp 0x100eb914
jmp 0x100eb86f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100ee256
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100eb911
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x100eb8d3
mov edx, dword [ebp - 4]
mov eax, dword [0x1023d8f8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1023d8f8], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.100ee256
mov esp, ebp
pop ebp
ret

Function at 0x100ebe00
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x100ebe50
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x100ebe50
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x100ebe50
xor eax, eax
jmp 0x100ebe91
mov dword [ebp - 4], 1
jmp 0x100ebe62
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100ebe8c
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x100ebe8a
xor eax, eax
jmp 0x100ebe91
jmp 0x100ebe59
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10002bb4
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
push ebx
push esi
lea eax, [ebp - 0x2b8]
push edi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 7
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], ebx
rep stosd dword es:[edi], eax
push 0x1f
lea edi, [ebp - 0x127]
pop ecx
mov byte [ebp - 0x128], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x80
mov dword [ebp - 0x24], ebx
push esi
mov dword [ebp - 0x20], 1
push dword [ebp + 8]
mov dword [ebp - 0x1c], 6
stosb byte es:[edi], al
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.MSVCRT.dll_wcstombs]
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0xa7]
mov byte [ebp - 0xa8], bl
push 0x1f
mov dword [ebp - 4], ebx
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x100061c0]
cmp eax, ebx
jne 0x10002c4c
push ebx
call fcn.10002ce7
mov dword [0x100061c0], eax
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x128]
push ebx
push ecx
call eax
mov edi, eax
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
cmp edi, ebx
jne 0x10002c72
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x10002c76
xor eax, eax
jmp 0x10002ce2
mov dword [ebp - 8], esi
mov ecx, dword [eax + 4]
cmp ecx, 2
jne 0x10002c91
mov eax, dword [eax + 0x18]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push 0x40
jmp 0x10002cb5
cmp ecx, 0x17
jne 0x10002cc5
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xa8]
push ecx
push ebx
push dword [eax + 0x10]
push dword [eax + 0x18]
call dword [sym.imp.WS2_32.dll_WSAAddressToStringA]
push esi
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_mbstowcs]
mov eax, dword [ebp - 4]
add esp, 0xc
mov esi, eax
mov eax, dword [0x100061bc]
cmp eax, ebx
jne 0x10002cdc
push 2
call fcn.10002ce7
mov dword [0x100061bc], eax
push esi
call eax
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002ce7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
cmp dword [0x100061c4], 0
mov dword [ebp - 0x1c], str.getaddrinfo
mov dword [ebp - 0x18], 0x10002e94
mov dword [ebp - 0x14], str.getnameinfo
mov dword [ebp - 0x10], 0x100033c6
mov dword [ebp - 0xc], str.freeaddrinfo
mov dword [ebp - 8], fcn.10002e58
je 0x10002d33
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x1000615c]
jmp 0x10002e54
push ebx
push esi
push edi
lea eax, [ebp - 0x230]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10002e3c
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x128]
push str.ws2_32
push eax
call sub.MSVCRT.dll_strcat
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
lea eax, [ebp - 0x128]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10002dab
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x10002da7
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
jne 0x10002dfa
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x128]
push str.wship6
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x128]
push eax
call edi
mov esi, eax
test esi, esi
je 0x10002e3c
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x10002df6
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x10002e3c
and dword [ebp - 4], 0
lea edi, [ebp - 0x18]
push dword [edi - 4]
push esi
call ebx
test eax, eax
mov dword [edi], eax
je 0x10002e1b
inc dword [ebp - 4]
add edi, 8
cmp dword [ebp - 4], 3
jl 0x10002e01
jmp 0x10002e24
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x10002e3c
xor eax, eax
mov ecx, dword [ebp + eax - 0x18]
mov dword [eax + 0x1000615c], ecx
add eax, 8
cmp eax, 0x18
jl 0x10002e2a
movzx eax, word [ebp + 8]
pop edi
pop esi
mov eax, dword [eax*8 + 0x1000615c]
mov dword [0x100061c4], 1
pop ebx
leave
ret 4
Function at 0x100032df
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
push dword [ebp + 8]
and dword [edi], 0
and byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x10003359
cmp word [ebx + 8], 2
jne 0x1000333a
cmp word [ebx + 0xa], 4
jne 0x1000333a
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x1000333a
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10003178
test eax, eax
mov dword [edi], eax
je 0x10003335
lea edi, [eax + 0x1c]
add esi, 4
jmp 0x10003311
push 8
pop eax
jmp 0x1000337f
mov esi, dword [ebp + 0x18]
push 0x400
push dword [ebx]
push esi
call dword [sym.imp.MSVCRT.dll_strncpy]
and byte [esi + 0x400], 0
add esp, 0xc
xor eax, eax
jmp 0x1000337f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x1000337f
dec ecx
je 0x1000337a
dec ecx
je 0x10003373
dec ecx
jmp 0x1000337f
mov eax, 0x2afb
jmp 0x1000337f
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x402510
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4026ad
mov esi, dword [ebp + 8]
test esi, esi
je 0x4026ad
mov dword [esi + 0xf0], 0xa
mov ecx, dword [edi]
mov eax, ecx
rol ecx, 8
and ecx, 0xff00ff
ror eax, 8
and eax, 0xff00ff00
or eax, ecx
mov dword [esi], eax
lea eax, [esi + 4]
mov edx, dword [edi + 4]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [eax], ecx
mov edx, dword [edi + 8]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [esi + 8], ecx
mov ecx, dword [edi + 0xc]
mov edi, 0x5fe404
push ebx
mov ebx, ecx
rol ecx, 8
and ecx, 0xff00ff
ror ebx, 8
and ebx, 0xff00ff00
or ebx, ecx
mov ecx, ebx
mov dword [esi + 0xc], ebx
shr ecx, 0x10
and ecx, 0xff
mov edx, dword [ecx*4 + 0x5ff930]
mov ecx, ebx
shr ecx, 8
xor edx, 0x1000000
and ecx, 0xff
and edx, 0xff000000
mov ecx, dword [ecx*4 + 0x5ff530]
and ecx, 0xff0000
xor edx, ecx
mov ecx, ebx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x5ffd30]
xor edx, ecx
movzx ecx, bl
mov ecx, dword [ecx*4 + 0x600130]
and ecx, 0xff00
xor edx, ecx
mov ecx, dword [eax]
xor edx, dword [esi]
xor ecx, edx
mov dword [esi + 0x10], edx
mov edx, dword [esi + 8]
xor edx, ecx
mov dword [esi + 0x14], ecx
mov ecx, ebx
mov dword [esi + 0x18], edx
xor ecx, edx
mov dword [esi + 0x1c], ecx
pop ebx
mov edi, edi
mov edx, dword [eax + 0x18]
lea eax, [eax + 0x10]
mov ecx, edx
shr ecx, 8
and ecx, 0xff
mov esi, dword [ecx*4 + 0x5ff530]
mov ecx, edx
shr ecx, 0x10
and esi, 0xff0000
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5ff930]
and ecx, 0xff000000
xor esi, ecx
mov ecx, edx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x5ffd30]
xor esi, ecx
movzx ecx, dl
mov ecx, dword [ecx*4 + 0x600130]
and ecx, 0xff00
xor esi, ecx
xor esi, dword [eax - 4]
xor esi, dword [edi]
add edi, 4
mov dword [eax + 0xc], esi
mov ecx, dword [eax]
xor ecx, esi
mov dword [eax + 0x10], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
cmp edi, 0x5fe428
jne 0x402620
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x4026c0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00402510
add esp, 4
test eax, eax
js 0x4028ac
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x402734
lea esi, [eax + 8]
add eax, 8
lea esi, [esi + edi*4]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x4026f4
mov ebx, dword [ebp + 8]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x4028a7
lea esi, [ebx + 2]
jmp 0x402750
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + 0x5ffd30]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x5ff130]
movzx eax, byte [eax*4 + 0x5ffd30]
xor ecx, dword [eax*4 + 0x5fe930]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x5ffd30]
xor ecx, dword [eax*4 + 0x5fe530]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x5ffd30]
xor ecx, dword [eax*4 + 0x5fed30]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x5ffd30]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x5ff130]
movzx eax, byte [eax*4 + 0x5ffd30]
xor ecx, dword [eax*4 + 0x5fe930]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x5ffd30]
xor ecx, dword [eax*4 + 0x5fed30]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x5ffd30]
xor ecx, dword [eax*4 + 0x5fe530]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x5ffd30]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x5ff130]
movzx eax, byte [eax*4 + 0x5ffd30]
xor ecx, dword [eax*4 + 0x5fe930]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x5ffd30]
xor ecx, dword [eax*4 + 0x5fed30]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x5ffd30]
xor ecx, dword [eax*4 + 0x5fe530]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x5ffd30]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x5ff130]
movzx eax, byte [eax*4 + 0x5ffd30]
xor ecx, dword [eax*4 + 0x5fe930]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x5ffd30]
xor ecx, dword [eax*4 + 0x5fed30]
movzx eax, dl
movzx eax, byte [eax*4 + 0x5ffd30]
xor ecx, dword [eax*4 + 0x5fe530]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x402750
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x403970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b068a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x62c330]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.00596118
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x403a16
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x5fe308
push eax
lea ecx, [ebp - 0x24]
call fcn.005746a5
push 0x626594
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.00578b45
push edi
push esi
call fcn.005963ae
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005745f2
mov esp, ebp
pop ebp
ret 4

Function at 0x403fb0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b0718
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x62c330]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.004047b0
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.00403ee0
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x404021
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.005746a5
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x40404a
push dword [esp + 0xc]
call fcn.0044ec68
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b08f8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x62c330]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x62c330]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea edx, [edi + 0x10]
lea ecx, [esp + 0x18]
call fcn.00421a20
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x28]
add eax, 0xa
mov dword [edi], eax
add eax, 4
push eax
call fcn.0044ec6d
mov esi, eax
mov dword [esp + 0x14], 0xe
mov eax, dword [edi]
sub esp, 0x14
mov ecx, esp
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
mov eax, dword [edi + 8]
mov dword [esi + 6], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xa], eax
lea eax, [esp + 0x30]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.00405f60
mov ecx, dword [edi]
add esp, 0x1c
add ecx, 4
mov dword [ebx], esi
cmp dword [esp + 0x2c], 0x10
mov dword [ebx + 4], ecx
jb 0x4060da
push dword [esp + 0x18]
call fcn.0044ec68
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005745f2
mov esp, ebp
pop ebp
ret 4

Function at 0x4071b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b0ac8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x62c330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00596ac2
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x28]
mov dword [ebp - 4], 0
mov dword [edi], vtable.std::_LaunchPad_class_std::_Bind_1__void__void____cdecl__const__struct_AgentPack::CreateAgentAppLinkPack___struct_AgentPack::CreateAgentAppLinkPack__.0
push 0xffffffffffffffff
mov eax, dword [esi]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x14], eax
movzx eax, byte [esi + 8]
mov byte [edi + 0x18], al
movzx eax, byte [esi + 9]
mov byte [edi + 0x19], al
mov eax, dword [esi + 0xc]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x10]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x14]
mov dword [edi + 0x24], eax
lea eax, [esi + 0x18]
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
mov ax, word [esi + 0x30]
mov word [edi + 0x40], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4