joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55af50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xdf000]
push edi
or ebp, 0xffffffff
jmp 0x55af72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x55af79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55af68
mov eax, 1
add ebx, ebx
jne 0x55af8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x55af9c
jne 0x55afbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55afbb
dec eax
add ebx, ebx
jne 0x55afa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x55af80
add ebx, ebx
jne 0x55afb7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x55b00d
xor ecx, ecx
sub eax, 3
jb 0x55afd3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x55b042
sar eax, 1
mov ebp, eax
jmp 0x55afde
add ebx, ebx
jne 0x55afde
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55afac
inc ecx
add ebx, ebx
jne 0x55afec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55afac
add ebx, ebx
jne 0x55aff9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x55afee
jne 0x55b00a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x55afee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x55b02c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x55b01e
jmp 0x55af6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x55b02c
add edi, ecx
jmp 0x55af6e
pop esi
mov edi, esi
mov ecx, 0x3cb5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x55b04a
cmp byte [edi], 0x16
jne 0x55b04a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x55b04f
lea edi, [esi + 0x157000]
mov eax, dword [edi]
or eax, eax
je 0x55b0be
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16cc08]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16cce4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x55b07c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16cce8]
or eax, eax
je 0x55b0b8
mov dword [ebx], eax
add ebx, 4
jmp 0x55b099
call dword [esi + 0x16ccf0]
mov ebp, dword [esi + 0x16ccec]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x55b0f2
sub esp, 0xffffff80
jmp 0x477f20
Function at 0x41cd70
Capabilities:
Encode data using xor

Disassembly:
in al, 0x71
call 0x30bf7c29
scasb al, byte es:[edi]
jge 0x41cda3
scasb al, byte es:[edi]
jge 0x41cda3
cdq
arpl word [ecx - 0x325ba9e5], ax
jge 0x41cd9f
mov ch, 0x4c
cwde
mov esp, 0xbb3ebdab
aam 0xdb
dec edx
mov cs, word [ebx - 0x517cbeca]
pop esi
xor dword [ebx - 0x66d8204f], ebp
mov esi, dword [esi]
inc ecx
sub dword [esi - 0x4e54cea2], 0xffffffdf
daa
cdq
or byte [ebx - 0x65fce0b7], dh
arpl word [ebp - 0x2a5f3d1d], ax
js 0x41cd7c
aad 0x78
fcmovu st(0), st(0)
fcomp dword [eax - 0xe371d20]
rol ecx, 1
cwde
loopne 0x41cd88
enter 0xffffffffffffd1f1, 0xffffffffffffffc1
inc esp
outsd dx, dword [esi]
pop esp
sbb al, 5
jno 0x41cd6c
sbb dword [ecx], 0xffffffd7
inc eax
cmpsb byte [esi], byte es:[edi]
mov al, 0xcf
push edx
invalid
Function at 0x401000
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor esi, esi
inc esi
push esi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
mov dword [ebp - 4], ebx
call sub.iphlpapi.dll_GetIpForwardTable
cmp dword [ebp - 4], ebx
je 0x4010d4
push dword [ebp - 4]
call fcn.0045b162
mov edi, eax
cmp edi, ebx
pop ecx
je 0x4010d4
push dword [ebp - 4]
push ebx
push edi
call fcn.0045bc20
add esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push edi
call sub.iphlpapi.dll_GetIpForwardTable
test eax, eax
je 0x401079
cmp dword [0x4b0b70], 2
jne 0x401071
push str.GetIpForwardTable_fail_n
call fcn.00461482
add eax, 0x40
push eax
call fcn.0045ed3d
pop ecx
pop ecx
push edi
call fcn.0045b225
jmp 0x4010f1
cmp dword [edi], ebx
mov dword [ebp - 8], ebx
jbe 0x4010bd
lea esi, [edi + 4]
cmp dword [0x4b0b70], 2
jne 0x4010a7
push dword [esi + 4]
push dword [esi]
push str.MIB_IPFORWARDROW__lu__lu_n
call fcn.00461482
add eax, 0x40
push eax
call fcn.0045ed3d
add esp, 0x10
cmp dword [esi], ebx
jne 0x4010b0
cmp dword [esi + 4], ebx
je 0x4010c8
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add esi, 0x38
cmp eax, dword [edi]
jb 0x401083
push edi
call fcn.0045b225
pop ecx
xor eax, eax
jmp 0x4010f4
push edi
call fcn.0045b225
xor eax, eax
pop ecx
inc eax
jmp 0x4010f4
cmp dword [0x4b0b70], 2
jne 0x4010f2
push str.size__0__malloc_fail_n
call fcn.00461482
add eax, 0x40
push eax
call fcn.0045ed3d
pop ecx
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4010f9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x4ab13c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push 0x7fe
lea eax, [ebp - 0x802]
push edi
push eax
mov word [ebp - 0x804], di
call fcn.0045bc20
push 0xffffffffffffffff
push str.SOFTWARETencent_bugReport_
mov esi, 0x400
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.0045b3bd
push 0x4b0b98
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.0045d391
add esp, 0x28
lea eax, [ebp - 0x810]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x804]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4011d8
push 4
pop esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x80c]
push eax
push edi
push str.lcdbg
push dword [ebp - 0x810]
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x814], esi
mov dword [ebp - 0x80c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x80c], esi
je 0x4011d0
mov dword [ebp - 0x808], edi
mov eax, dword [ebp - 0x808]
jmp 0x4011da
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045b0da
leave
ret
Function at 0x4017e1
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x4ab13c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp byte [0x4b0be0], bl
push esi
jne 0x4018c5
cmp eax, ebx
mov byte [0x4b0be0], 1
je 0x4018c5
cmp word [eax], bx
je 0x4018c5
push 0xffffffffffffffff
push eax
push 0x21
mov esi, 0x4b0b98
push esi
call fcn.0045b3bd
push 0x63
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call fcn.0045bc20
add esp, 0x1c
push ebx
push ebx
push 0x63
lea eax, [ebp - 0x68]
push eax
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
push eax
push 0x21
push 0x4b0b74
call fcn.0045c854
add esp, 0x10
cmp byte [0x4b0b74], bl
je 0x4018c5
movzx eax, word [ebp + 0xc]
movzx ecx, word [ebp + 0x10]
imul eax, eax, 0x64
add eax, ecx
imul eax, eax, 0x2710
add eax, dword [ebp + 0x14]
mov dword [ebp - 0x6c], ebx
mov dword [0x4b0bdc], eax
lea eax, [ebp - 0x6c]
push eax
push 4
push ebx
push 0x4011e8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x4018c5
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4018c8
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045b0da
leave
ret

Function at 0x401b52
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4ab13c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push esi
push str..PhysicalDrive0
mov dword [ebp - 0x414], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401c2c
push edi
push 0xc
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.0045bc20
mov edi, 0x400
push edi
lea eax, [ebp - 0x404]
push esi
push eax
mov dword [ebp - 0x410], esi
mov dword [ebp - 0x40c], esi
mov dword [ebp - 0x418], esi
call fcn.0045bc20
add esp, 0x18
push esi
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x404]
push eax
push 0xc
lea eax, [ebp - 0x410]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
pop edi
je 0x401c25
mov esi, dword [ebp - 0x3f4]
lea esi, [ebp + esi - 0x404]
movsx eax, byte [esi]
push eax
call fcn.0045db0f
test eax, eax
pop ecx
je 0x401c25
mov ecx, dword [ebp - 0x414]
push esi
call fcn.004020df
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x401c2e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0045b0da
leave
ret 4
Function at 0x40287d
Capabilities:
Hash data with md5

Disassembly:
push 0x5c
push 0
push esi
call fcn.0045bc20
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
ret
Function at 0x403692
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push esi
xor esi, esi
and dword [ebp - 4], esi
push edi
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
mov edi, eax
cmp edi, 0x6f
jne 0x4036dd
test esi, esi
je 0x4036c5
push esi
call fcn.00451909
pop ecx
push dword [ebp - 8]
call fcn.0045190e
mov esi, eax
test esi, esi
pop ecx
je 0x403715
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jl 0x4036a3
test edi, edi
jne 0x40370a
test esi, esi
je 0x403715
push dword [ebp + 8]
mov ecx, esi
call fcn.0040371d
mov edi, eax
test edi, edi
je 0x4036ff
push dword [ebp + 8]
call fcn.0040403b
mov edi, eax
push esi
call fcn.00451909
pop ecx
mov eax, edi
jmp 0x403717
test esi, esi
je 0x403715
push esi
call fcn.00451909
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x404bd0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x404bf0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
mov edi, ecx
jne 0x404c06
push 0x80004005
call fcn.00404930
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [edi]
push esi
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 0xc

Function at 0x404c30
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
mov dword [esp + 4], ecx
jne 0x404c48
push 0x80004005
call fcn.00404930
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x404c55
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8

Function at 0x405510
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, dword [esp + 0x19c]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x40555f
xor ecx, ecx
mov ch, byte [esp + 0x1a4]
lea eax, [esp + 4]
push eax
mov cl, byte [esp + 0x1a4]
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x194]
pop esi
xor ecx, esp
call fcn.0045b0da
add esp, 0x194
ret
Function at 0x4061f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x218], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x22c]
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push 0
push edi
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0xc]
mov esi, eax
test esi, esi
jne 0x40625e
test ecx, ecx
je 0x406250
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x14]
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x40626c
test ecx, ecx
je 0x406311
push ecx
jmp 0x40630b
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push 0
push ecx
mov dword [esp + 0x30], pe_nt_image_headers32
call esi
test eax, eax
jne 0x4062de
jmp 0x4062a0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.004061f0
mov edi, eax
test edi, edi
jne 0x40632d
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push eax
push edi
push ecx
mov dword [esp + 0x30], pe_nt_image_headers32
call esi
test eax, eax
je 0x4062a0
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4062f5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
mov edx, dword [ebp]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x406311
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0045b0da
add esp, 0x21c
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40633c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x406313

Function at 0x406e50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x486c9b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
lea esi, [edi + 0xc]
mov dword [edi + 4], 0
mov ecx, esi
mov dword [edi], 0x491b28
call fcn.00426490
mov eax, dword [esp + 0x20]
mov dword [esi], 0x491a48
mov dword [esi + 4], 0x491a34
mov dword [esi + 8], 0x491a14
mov dword [esi + 0x30], 0x4919a0
mov dword [esi + 0x34], 0x491978
mov dword [esi + 0x38], 0x491958
mov dword [esi + 0x3c], 0x491928
mov dword [esi + 0x40], 0x491908
mov dword [esi + 0x44], eax
mov ecx, dword [0x4ad7ac]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
mov dword [esp + 0x18], 0
call eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x40b3b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x487220
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4ab13c]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov eax, dword [ebp + 0x418]
mov edi, dword [ebp + 0x410]
mov ebx, dword [ebp + 0x414]
mov dword [ebp - 0x14], eax
call dword [0x4ac514]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], eax
mov dword [ebp], eax
push 2
push eax
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
mov dword [ebp - 0x18], edi
jne 0x40b43d
call fcn.00404ac0
mov esi, eax
jmp 0x40b525
mov ecx, dword [ebp - 0x14]
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40b459
call fcn.00404ac0
jmp 0x40b51c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x20], eax
jne 0x40b472
call fcn.00404ac0
jmp 0x40b51c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x14], esi
jae 0x40b4a8
lea edx, [ebp + 4]
cmp dword [ebp], edx
je 0x40b496
lea ecx, [ebp]
call fcn.004056f0
lea ecx, [ebp - 0x1c]
call fcn.00405630
mov eax, 0x8007000e
jmp 0x40b542
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.004078b0
mov dword [ebp - 4], 1
jmp 0x40b4d1
mov ebx, dword [ebp]
test ebx, ebx
jne 0x40b4df
mov esi, 0x8007000e
jmp 0x40b51e
call dword [0x4ac514]
mov ecx, dword [ebp - 0x20]
push esi
push ebx
push esi
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x40b500
call fcn.00404ac0
jmp 0x40b51c
mov edx, dword [ebp]
mov word [edx + eax*2], 0
mov eax, dword [ebp + 0x41c]
mov ecx, dword [ebp]
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00409f30
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp + 4]
cmp dword [ebp], edx
je 0x40b540
lea ecx, [ebp]
call fcn.004056f0
jmp 0x40b540
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.0045b0da
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40bd30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x489a48
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0040b9e0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
xor edx, edx
mov dword [esi + 0x2c], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
lea eax, [edi + 0x30]
push edx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edx
push eax
mov dword [esp + 0x24], edx
mov byte [ecx + 4], dl
call fcn.0040204d
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x40d0d0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40d116
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0xc], esi
call fcn.00484f60
neg esi
sbb esi, esi
test esi, fcn.004318e0
mov dword [esp + 0x10], eax
pop esi
je 0x40d116
push 0x491ea0
lea eax, [esp + 0xc]
push eax
call fcn.0040cc50
mov dword [edi], ebx
mov eax, edi
pop edi
pop ebx
add esp, 8
ret

Function at 0x40d120
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x48759b
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
push ebx
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov edi, ecx
push 1
push 2
lea ecx, [esp + 0x34]
call fcn.0040cff0
push 0x491ec0
lea eax, [esp + 0x30]
push str.CBtHelper::StopBt
xor ebx, ebx
push eax
mov dword [esp + 0xc0], ebx
call fcn.0040ccb0
add esp, 8
push eax
call fcn.0040ccb0
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.0040cec0
mov ecx, esi
call fcn.0040cb30
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x30]
call fcn.0040c680
mov esi, 0x10
cmp dword [eax + 0x18], esi
jb 0x40d1b3
mov eax, dword [eax + 4]
jmp 0x40d1b6
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [esp + 0x28], esi
jb 0x40d1d0
mov edx, dword [esp + 0x14]
push edx
call fcn.00451909
add esp, 4
lea ecx, [esp + 0x78]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
mov dword [esp + 0xb4], 0xffffffff
call fcn.00407ad0
lea eax, [esp + 0x78]
push eax
mov dword [esp + 0x7c], 0x491650
call fcn.0047623c
add esp, 4
cmp byte [edi + 0xd], bl
je 0x40d220
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40d220
mov ecx, dword [eax]
mov edx, dword [ecx + 0x7c]
push eax
call edx
mov byte [edi + 0xd], bl
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xa8
ret
Function at 0x40fc70
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x487876
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.004153e0
mov eax, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esi], 0x492424
mov dword [esi + 4], 0x4923fc
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esp + 0x24], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov ecx, dword [esp + 0x30]
push 0x14
mov byte [esp + 0x28], 1
mov dword [esi + 0x88], ecx
call fcn.004518de
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, ebx
mov byte [esp + 0x24], 2
je 0x40fcfd
push esi
mov ecx, eax
call fcn.004066e0
jmp 0x40fcff
xor eax, eax
mov byte [esp + 0x24], 1
mov dword [esi + 0x6c], eax
call fcn.00447c80
mov ecx, esi
mov dword [esi + 0x70], eax
call fcn.00412760
cmp al, bl
jne 0x40fd75
lea edx, [esp + 0x14]
push edx
call fcn.004358e0
add esp, 4
mov ecx, dword [eax]
mov byte [esp + 0x24], 3
call fcn.00427180
mov edi, dword [esp + 0x18]
cmp edi, ebx
mov byte [esp + 0x24], 1
je 0x40fd6a
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x40fd6a
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x40fd6a
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
push str.CDownloadClient::CDownloadClient__ForceExit__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8

Function at 0x4114b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4114d2
cmp word [eax], 0
je 0x4114d2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4114d2
and al, 0x10
cmp al, 0x10
setne al
ret
xor al, al
ret

Function at 0x412680
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x487a98
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.00402157
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4126e0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00411d20
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], di
call fcn.00402157
cmp dword [esp + 0x28], 8
jb 0x41272b
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00451909
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret