joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010d4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, str._ccav_
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00401224
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401108
push ebx
call fcn.0040fae3
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [0x41bef1]
test ebx, ebx
je 0x40111f
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [0x41bef1], eax
push 0x41b216
push dword [0x41bef1]
call fcn.00401037
add esp, 8
cmp eax, 0
jne 0x401165
mov dword [ebp - 8], esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401448
call fcn.00403124
call main
call fcn.004033f7
call fcn.0040d441
mov eax, str._9eb1c02da7f39221_
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401194
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x40119d
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4011ad
push ebx
call fcn.0040fae3
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40288e
pop dword [ebp - 0x34]
mov eax, 0x39bce7be
add eax, 0xc68340d0
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x55961602
add dword [ebp - 0x44], 0xf8bc2f49
mov dword [ebp - 0x40], 0x4295ab5d
add dword [ebp - 0x40], 0xef9da0e8
mov dword [ebp - 0x3c], 0x3db5b035
add dword [ebp - 0x3c], 0xe9693f9
mov dword [ebp - 0x38], 0xc76ec90c
add dword [ebp - 0x38], 0x389136f4
lea eax, [ebp - 0x44]
push eax
mov eax, 0xae522769
add eax, 0x51ee48fb
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xdfce280f
add dword [ebp - 0x44], 0x94a44147
mov dword [ebp - 0x40], 0x2e3d0fdd
add dword [ebp - 0x40], 0x132f5198
mov dword [ebp - 0x3c], 0x142f83ab
add dword [ebp - 0x3c], 0x4f3fe8c1
mov dword [ebp - 0x38], 0x1beed094
sub dword [ebp - 0x38], 0x1beed094
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x45ae30ce
sub eax, 0x456dc026
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x35db6
push 0
call eax
mov ecx, 0x25942f6
sub ecx, 0x258fdeb
xor edi, edi
add edi, eax
mov ebx, 0x2fac98ac
sub ebx, 0x2f6b98ac
add ebx, dword [ebp - 0x34]
mov edx, 0x868218bc
add edx, 0x3bf0ebf2
sub dword [ebp - 0xc], 0x5edbe16a
mov esi, dword [ebx]
add dword [ebp - 0xc], edi
sub esi, edx
sub dword [ebp - 0x28], 0x344368bc
mov dword [edi], esi
xor dword [ebp - 0x2c], 0x15c113a
add edi, 0x70ffeb54
add edi, 0x8f0014b0
add ebx, 0x84b936a0
add ebx, 0x7b46c964
loop 0x4029b2
add eax, 0xb7d8e0a1
sub eax, 0xb7d7d9a2
xor ebx, ebx
add ebx, eax
add eax, 0xb34c04ac
add eax, 0x4cb3fb59
mov ecx, 0x2a8ab565
add ecx, 0xd5b54a9b
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x424580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x42458f
pop dword [ebp - 0x10]
mov eax, 0x24069cab
sub eax, 0x23c4571c
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xe79813d0
add dword [ebp - 0x20], 0x66ba317b
mov dword [ebp - 0x1c], 0xf7c2023f
add dword [ebp - 0x1c], 0x3a714a06
mov dword [ebp - 0x18], 0x256d2def
add dword [ebp - 0x18], 0x26df163f
mov dword [ebp - 0x14], 0x4bf5051e
sub dword [ebp - 0x14], 0x4bf5051e
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x7f0d01e4
add dword [ebp - 0x20], 0xf5656772
mov dword [ebp - 0x1c], 0x6499396f
add dword [ebp - 0x1c], 0xdcd32806
mov dword [ebp - 0x18], 0x9585aae0
add dword [ebp - 0x18], 0xcde9c18c
mov dword [ebp - 0x14], 0xadf318
add dword [ebp - 0x14], 0xff520ce8
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x6e5d6
push 0
call eax
mov ecx, 0x45de
mov esi, eax
mov edx, 0xfc2e55e3
sub edx, 0xfbdda9e3
add edx, dword [ebp - 0x10]
mov edi, 0x15f14179
add dword [ebp - 4], esi
mov ebx, dword [edx]
add dword [ebp - 8], ebx
add ebx, edi
xor dword [ebp - 8], 0xce4a2f2c
mov dword [esi], ebx
add dword [ebp - 8], eax
add esi, 0xd54291f2
add esi, 0x2abd6e12
add edx, 0xc9ce446d
add edx, 0x3631bb97
loop 0x42469b
add eax, 0x45837bf0
add eax, 0xba7d8e5b
xor ebx, ebx
add ebx, eax
add eax, 0x5a7794e
sub eax, 0x5a77949
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x449ce0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x449cf0
xor al, al
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x449ced
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x449ced
mov edx, 0x10b
cmp word [eax + 0x18], dx
sete al
ret
Function at 0x466db0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
push edi
jne 0x466dd0
push 0xa2
push str.F:CB11X_MainQImportsOpen_boost_boost_smart_ptr_intrusive_ptr.hpp
push 0x4d8134
call main
add esp, 0xc
mov eax, dword [esi]
lea ecx, [eax + 0x20]
push ecx
push 4
push eax
push 0x466d30
push 0
push 0
call main
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x466df5
pop edi
xor al, al
pop esi
ret
mov edx, dword [esi]
add edx, 4
mov eax, 1
lock xadd dword [edx], eax
cmp dword [esi], 0
jne 0x466e1f
push 0xa2
push str.F:CB11X_MainQImportsOpen_boost_boost_smart_ptr_intrusive_ptr.hpp
push 0x4d8134
call main
add esp, 0xc
mov ecx, dword [esi]
push edi
add ecx, 8
call main
cmp dword [esi], 0
jne 0x466e46
push 0xa2
push str.F:CB11X_MainQImportsOpen_boost_boost_smart_ptr_intrusive_ptr.hpp
push 0x4d8134
call main
add esp, 0xc
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.kernel32.dll_ResumeThread]
pop edi
mov al, 1
pop esi
ret

Function at 0x49269f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f2d80]
jne 0x4926a9
repz ret
jmp fcn.0049db2c
Function at 0x40959f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x4095e3
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x4095b2
jmp 0x4095e3
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x4095d3
pop esi
pop ebp
ret

Function at 0x40a2e5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40a31a
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40a344
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40a344
test edi, edi
je 0x40a311
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40a311
test edi, edi
je 0x40a34c
mov eax, edi
jmp 0x40a313
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40a313
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040d65b
add esp, 0xc
int3
Function at 0x40d68f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestArguments.exe_gMozillaPoisonSize], eax
call fcn.0040a2e5
pop ecx
mov ecx, dword [sym.TestArguments.exe_gMozillaPoisonSize]
mov dword [sym.TestArguments.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40d6c7
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestArguments.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x749740
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x214000]
lea eax, [edi + 0x31968c]
push dword [eax]
mov dword [eax], 0x2f120ada
push eax
push edi
jmp 0x74976a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x749771
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x749760
mov eax, 1
add ebx, ebx
jne 0x749783
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x749794
jne 0x7497b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7497b3
dec eax
add ebx, ebx
jne 0x7497a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x749778
add ebx, ebx
jne 0x7497af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x749805
xor ecx, ecx
sub eax, 3
jb 0x7497cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x74983a
sar eax, 1
mov ebp, eax
jmp 0x7497d6
add ebx, ebx
jne 0x7497d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7497a4
inc ecx
add ebx, ebx
jne 0x7497e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7497a4
add ebx, ebx
jne 0x7497f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7497e6
jne 0x749802
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7497e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x749824
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x749816
jmp 0x749766
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x749824
add edi, ecx
jmp 0x749766
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0xfb6b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x749846
cmp byte [edi], 0x71
jne 0x749846
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x74984b
lea edi, [esi + 0x346000]
mov eax, dword [edi]
or eax, eax
je 0x7498c3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x349858]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3499d8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x749878
mov ecx, edi
jns 0x7498a7
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3499e0]
or eax, eax
je 0x7498bd
mov dword [ebx], eax
add ebx, 4
jmp 0x749895
call dword [esi + 0x3499dc]
mov ebp, dword [esi + 0x3499e4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x277]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7498f7
sub esp, 0xffffff80
jmp 0x4bfb30
Function at 0x4706c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4c000]
lea eax, [edi + 0x609f0]
push dword [eax]
mov dword [eax], 0xba0b10e1
push eax
push edi
jmp 0x4706ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4706f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4706e0
mov eax, 1
add ebx, ebx
jne 0x470703
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x470714
jne 0x470733
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x470733
dec eax
add ebx, ebx
jne 0x470720
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4706f8
add ebx, ebx
jne 0x47072f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x470785
xor ecx, ecx
sub eax, 3
jb 0x47074b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4707ba
sar eax, 1
mov ebp, eax
jmp 0x470756
add ebx, ebx
jne 0x470756
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x470724
inc ecx
add ebx, ebx
jne 0x470764
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x470724
add ebx, ebx
jne 0x470771
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x470766
jne 0x470782
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x470766
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4707a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x470796
jmp 0x4706e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4707a4
add edi, ecx
jmp 0x4706e6
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x1b62
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4707c6
cmp byte [edi], 6
jne 0x4707c6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4707cb
lea edi, [esi + 0x69000]
mov eax, dword [edi]
or eax, eax
je 0x470843
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x70bb4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x70e18]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4707f8
mov ecx, edi
jns 0x470827
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x70e20]
or eax, eax
je 0x47083d
mov dword [ebx], eax
add ebx, 4
jmp 0x470815
call dword [esi + 0x70e1c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x470874
cmp al, 0xef
ja 0x470867
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x470849
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x470856
mov ebp, dword [esi + 0x70e24]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4708a8
sub esp, 0xffffff80
jmp 0x435150
Function at 0x40ea8e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestCasting.exe_gMozillaPoisonSize], eax
call fcn.0040aeb5
pop ecx
mov ecx, dword [sym.TestCasting.exe_gMozillaPoisonSize]
mov dword [sym.TestCasting.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40eac6
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestCasting.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x4020e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x407d37
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov ecx, 0x409248
xor eax, eax
push edi
mov dword [esp + 8], esi
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
lea ecx, [esi + 0x2c]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString_2
lea edi, [esi + 0x34]
mov byte [esp + 0x14], 3
mov ecx, edi
call sub.MFC42.DLL_CString::CString_2
push 0x40b160
mov ecx, edi
mov byte [esp + 0x18], 4
mov dword [esi], 0x409244
call fcn.00407494
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4021c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x407d87
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x409244
lea ebx, [esi + 4]
mov dword [esp + 0x18], 4
push ebx
call fcn.00402ac0
lea edi, [esi + 0x18]
mov ecx, esi
push edi
call fcn.00402ac0
lea ecx, [esi + 0x34]
mov byte [esp + 0x18], 3
call fcn.0040747c
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 2
call fcn.0040747c
lea ecx, [esi + 0x2c]
mov byte [esp + 0x18], 1
call fcn.0040747c
mov eax, dword [edi + 4]
mov dword [edi], 0x409248
test eax, eax
je 0x40223e
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [edi], 0x40925c
mov eax, dword [ebx + 4]
test eax, eax
mov dword [ebx], 0x409248
je 0x40225a
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ebx], 0x40925c
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x402e30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x407eab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, ecx
push ebp
push esi
lea eax, [ebx + 0x18]
mov dword [esp + 0xc], ebx
push eax
call fcn.00402ac0
mov ecx, dword [ebx + 0x30]
lea ebp, [ebx + 0x30]
xor esi, esi
cmp dword [ecx - 8], esi
jne 0x402e7d
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4
push edi
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x24]
mov dword [esp + 0x30], esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x30], 1
jmp 0x402ea2
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0x34]
push esi
push eax
mov ecx, ebp
call sub.MFC42.DLL_CString::Find_3
mov edi, eax
test edi, edi
jle 0x402fb9
mov edx, edi
lea eax, [esp + 0x14]
sub edx, esi
mov ecx, ebp
push edx
push esi
push eax
call sub.MFC42.DLL_CString::Mid
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], 2
call fcn.004074d0
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.0040747c
mov eax, dword [ebx + 0x34]
lea esi, [edi + 1]
push esi
push eax
mov ecx, ebp
call sub.MFC42.DLL_CString::Find_3
mov edi, eax
test edi, edi
jge 0x402f02
mov ecx, dword [ebp]
mov edi, dword [ecx - 8]
mov edx, edi
lea eax, [esp + 0x18]
sub edx, esi
mov ecx, ebp
push edx
push esi
push eax
call sub.MFC42.DLL_CString::Mid
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x34], 3
call fcn.004074d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0040747c
push 8
lea esi, [edi + 1]
call sub.MFC42.DLL_operatornew
mov ebx, eax
add esp, 4
mov dword [esp + 0x1c], ebx
test ebx, ebx
mov byte [esp + 0x30], 4
je 0x402f63
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_2
lea ecx, [ebx + 4]
mov byte [esp + 0x30], 5
call sub.MFC42.DLL_CString::CString_2
jmp 0x402f65
xor ebx, ebx
test ebx, ebx
mov byte [esp + 0x30], 1
je 0x402fa9
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebx
call fcn.004074d0
lea edx, [esp + 0x24]
lea ecx, [ebx + 4]
push edx
call fcn.004074d0
mov ecx, dword [esp + 0x38]
push 0xffffffffffffffff
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
inc eax
push eax
call fcn.00403330
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax + 4]
mov dword [ecx + edx*4], ebx
test edi, edi
jle 0x402fb9
mov eax, dword [ebp]
cmp esi, dword [eax - 8]
jl 0x402e9e
lea ecx, [esp + 0x24]
mov dword [esp + 0x30], 6
call fcn.0040747c
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0xffffffff
call fcn.0040747c
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x406040
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x408430
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x1c], 0
push eax
call fcn.00406140
add esp, 4
push str._netmsg.txt
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 8]
push 0
push 0
push 4
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
mov esi, eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0xc], 0
lea edx, [esp + 0xc]
mov ecx, dword [eax - 8]
push 0
push edx
push ecx
push eax
push esi
call edi
push 0x40b904
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push 0
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
call fcn.0040747c
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 0
call fcn.0040747c
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0040747c
mov ecx, dword [esp + 0x14]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40757e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409270
push 0x407914
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x40f124], 0xffffffff
or dword [0x40f128], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x40f108]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x40f104]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40f120], eax
call fcn.00407913
cmp dword [0x40ba10], 0
jne 0x407601
push 0x407910
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.004078fe
push 0x40b054
push 0x40b050
call sub.MSVCRT.dll__initterm
mov eax, dword [0x40f100]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40f0fc]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x40b04c
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00403850
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret