joyce8/EMBER2024-capa huggingface dataset:
Function at 0x693d0e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x693d0ed8
cmp byte [esi + ebx - 1], 0xa
je 0x693d0eac
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x693e10a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x693d1530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xfc
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x693d1708
mov edi, dword [0x693e10a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x693d1617
test byte [0x693d2054], 8
jne 0x693d16b0
lea ebx, [ebp - 0xe0]
mov edi, ebx
test byte [0x693d2064], 8
jne 0x693d1670
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x693d15b9
cmp esi, 3
jbe 0x693d1628
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x693d15ca
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xfc
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x693db348]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x693d15b9
mov dword [esp], 0x693d2064
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x693d1590
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x693d1590
mov dword [esp], 0x693d2054
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x693d157b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xe0]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x693d1583
mov eax, 0xffffffff
jmp 0x693d1617
Function at 0x7a40e0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7a40ea
pushal
call 0x7a40f0
pop ebp
sub ebp, 0x10
sub ebp, 0x3a40e0
cmp al, byte [eax]
jmp 0x7a4106
mov eax, 0x3a40e0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f7
mov edx, 0xd552625d
xor byte [eax], dl
inc eax
dec ecx
jne 0x7a411d
jmp 0x7a4130
salc
nop
salc
aam 0x61
pop ebp
pop ebp
pop ebp
fcomp qword [ebp + 0x5e5d5d5d]
nop
in eax, 0x4d
pop ebp
pop ebp
pop ebp
out 0x75, eax
pop ebp
pop ebp
pop ebp
stosb byte es:[edi], al
mov edi, 0xdcd6955e
push ecx
pop ebp
pop ebp
pop ebp
pop esi
cwde
sar byte [ecx], 1
jns 0x7a40fb
aam 0x59
jns 0x7a416b
xor eax, 0x5d53e421
xor eax, 0x5d76da39
pop esp
jno 0x7a41e4
xor eax, 0xe6b47050
mov ch, 0x58
pop ebp
pop ebp
pop ebp
mov ah, 0x73
pop ebp
pop ebp
pop ebp
or dh, dl
mov cl, 0xd6
fcom dword [ebp + 0x5d]
pop ebp
pop ebp
salc
enter 0x5d51, 0x5d
pop ebp
salc
ror byte [ebp + 0x5d], 1
pop ebp
pop ebp
pushfd
mov ah, 0x5f
insb byte es:[edi], dx
pop edi
ficomp word [edi - 0x27adeba7]
test eax, 0xd6a2a2a2
jno 0x7a421a
sar byte [ecx], 1
jns 0x7a41fe
lahf
push ecx
pop ebp
salc
sar dword [ecx + 0x59], 1
pop ebp
pop ebp
pop ebp
xor eax, 0x5d53e421
xor eax, 0x5d76da39
pop esp
jno 0x7a4235
or al, 0xb5
pop eax
pop ebp
pop ebp
pop ebp
mov ah, 0x18
pop edi
pop ebp
pop ebp
or byte [ecx], cl
add byte [edx + 0x28a25128], ah
push ebp
mov ch, 0x25
pop ebp
pop ebp
pop ebp
salc
and eax, 0xd65d5d5d
loopne 0x7a422d
pop ebp
pop ebp
pop ebp
fsubr qword [esi + eax - 0x23e33a72]
lodsb al, byte [esi]
push es
mov es, ebp
sbb al, 0x6e
xchg esp, eax
outsb dx, byte [esi]
invalid
frstor dword fs:[esi + 0x47d952b5]
pop ebp
pop ebp
pop ebp
frstor dword [esi + 0x4cd952b4]
pop ebp
pop ebp
pop ebp
cmp ebx, esp
cmpsb byte [esi], byte es:[edi]
mov byte [0x48d95278], al
pop ebp
invalid
pop ebp
pop ebp
sbb al, 0xb4
xchg ecx, eax
mov byte [0x1174a2a2], al
pop esp
ficomp word [eax + ebx*2 - 0x4ba64a22]
loopne 0x7a41d1
mov byte [0x640974a2], al
pop edi
ficomp word [ebx + ebx*2 - 0x21a64822]
mov ch, 0x58
mov ah, 0xf6
mov byte [0x71d6a2a2], al
jns 0x7a4217
cmp dword [ecx + 0x59], edi
lahf
push ecx
pop ebp
or dh, dl
mov cl, 0xb
or cl, byte [eax]
salc
sub byte [ecx - 0x2a], dl
and byte [ebp - 0x5f], dl
out dx, eax
fst st(7)
pop ebx
fcomp qword [ebx + 0x5d5d5d5c]
aad 0x5a
fcomp qword [edx + 0x5d5d5d5c]
out 0x5f, al
pop ebp
pop ebp
pop ebp
pop edi
invalid
Function at 0x10005a7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10005a89
pop dword [ebp - 0x20]
mov eax, 0xbcba7e1c
add eax, 0x5345dc6d
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x140ace68
sub dword [ebp - 0x30], 0xc5b8891d
mov dword [ebp - 0x2c], 0x3ee66395
add dword [ebp - 0x2c], 0xf34ce8b0
mov dword [ebp - 0x28], 0xb461bf06
add dword [ebp - 0x28], 0x97ea8528
mov dword [ebp - 0x24], 0x65d39476
sub dword [ebp - 0x24], 0x65d39476
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xe2b37875
sub dword [ebp - 0x30], 0x6e410f1f
mov dword [ebp - 0x2c], 0x6297c3f7
sub dword [ebp - 0x2c], 0x212b6282
mov dword [ebp - 0x28], 0xf5c2679
add dword [ebp - 0x28], 0x541345f3
mov dword [ebp - 0x24], 0x253df3be
add dword [ebp - 0x24], 0xdac20c42
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x19f67ec4
add eax, 0xf60a4168
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x33c02
push 0
call eax
mov ecx, 0x36f4
mov edx, eax
mov esi, 0x47bd2a68
add esi, 0xc8474998
add esi, dword [ebp - 0x20]
mov ebx, 0x7ea26892
add ebx, 0x72ce0922
xor dword [ebp - 8], 0xc73edd5b
mov edi, dword [esi]
sub dword [ebp - 0x14], 0x38784695
add edi, ebx
sub dword [ebp - 8], edx
mov dword [edx], edi
add edx, 4
add esi, 0xd5806f21
add esi, 0x2a7f90e3
loop 0x10005ba0
add eax, 0x86ea9bc8
sub eax, 0x86e9cd25
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x480bc3
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0x20
push ebx
mov ebx, ecx
jne 0x480c14
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x18]
add eax, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
add eax, 0x17
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov ecx, ebx
call fcn.00480597
mov ecx, ebx
call fcn.00480b3b
push 2
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
jmp 0x480c6a
xor eax, eax
cmp dword [ebx + 0x2e4], eax
jne 0x480c2f
cmp dword [ebp + 0xc], 0x79
je 0x480c2a
cmp dword [ebp + 0xc], 0x12
jne 0x480c6a
xor eax, eax
inc eax
jmp 0x480c6a
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
call esi
movzx edi, ax
shr edi, 0xf
push 0x10
and edi, 1
call esi
mov esi, dword [ebp + 0xc]
shr eax, 0xf
and eax, 1
cmp esi, 0x12
je 0x480c6f
cmp esi, 0x79
je 0x480c6f
push 2
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x57e5ec], 0
jne 0x480c66
test byte [ebx + 0x2f4], 2
jne 0x480c66
cmp esi, 0x12
je 0x480c93
cmp esi, 0x79
jne 0x480c66
test edi, edi
jne 0x480c66
test eax, eax
jne 0x480c66
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call fcn.0041312d
cmp eax, ebx
jne 0x480cb6
test dword [ebp + 0x10], 0x40000000
jne 0x480cb6
cmp esi, 0x79
jne 0x480cc4
mov ecx, dword [ebp + 8]
jmp 0x480cbd
cmp esi, 0x79
jne 0x480cc4
mov ecx, ebx
call fcn.0041685a
jmp 0x480cdf
cmp dword [ebx + 0x2a0], 0
jge 0x480cdf
push 0
push 0xc8
push 2
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
inc eax
jmp 0x480c68

Function at 0x4849c2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
invalid
invalid

Function at 0x484fd4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x484fe9
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00482e25
stosd dword es:[edi], eax
wait
les esp, [ebp + 0x478bf88b]
cmp al, 0x8b
push esp
pop es
js 0x485003
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.00482e25
push ebx
rcr byte [ecx], 1
leave
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x485012
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x485012
call fcn.00482e25
add dword [esi], ecx
retf
Function at 0x4e2f85
Capabilities:
Get common file path

Disassembly:
push 0x120
mov eax, 0x52b6c1
call fcn.00509788
mov esi, ecx
mov dword [ebp - 0x128], esi
call fcn.004e89c4
push 0x15c
call fcn.0040a414
pop ecx
mov ecx, eax
mov dword [ebp - 0x124], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp ecx, ebx
je 0x4e2fc9
mov eax, dword [esi + 4]
push ebx
push eax
call fcn.004ea27c
jmp 0x4e2fcb
xor eax, eax
or dword [ebp - 4], 0xffffffff
push eax
mov ecx, esi
call fcn.004e8996
call fcn.00417af6
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x88]
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov byte [ebp + esi - 0x114], 0x5c
inc esi
mov dword [ebp - 0x124], esi
mov byte [ebp + esi - 0x114], bl
mov dword [ebp - 0x120], ebx
cmp edi, ebx
je 0x4e3165
cmp dword [edi + 4], ebx
jle 0x4e3165
lea ecx, [ebp - 0x118]
call fcn.00406fe0
mov edx, dword [edi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x114]
push eax
push ebx
lea eax, [ebp - 0x118]
push eax
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x4e3149
lea ecx, [ebp - 0x11c]
call fcn.00406fe0
mov eax, dword [ebp - 0x120]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x4e309a
push dword [ebp - 0x118]
lea eax, [ebp - 0x11c]
push 0x54b460
push eax
call fcn.00407270
add esp, 0xc
jmp 0x4e30cc
jge 0x4e30ba
push dword [ebp - 0x118]
inc eax
push eax
lea eax, [ebp - 0x11c]
push str._d__s
push eax
call fcn.00407270
add esp, 0x10
jmp 0x4e30cc
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x11c]
call fcn.00408b70
push 0x15c
call fcn.0040a414
pop ecx
mov dword [ebp - 0x12c], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x4e30f0
mov ecx, eax
call fcn.004bbd30
mov esi, eax
jmp 0x4e30f2
xor esi, esi
push dword [ebp - 0x11c]
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 2
call dword [eax + 0x10]
mov eax, dword [esi]
lea ecx, [ebx + 0xe110]
push ecx
mov ecx, esi
call dword [eax + 0xc]
push ebx
mov ecx, edi
call fcn.0040f4c5
mov eax, dword [eax]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x24]
mov ecx, dword [ebp - 0x128]
push esi
call fcn.004e8996
mov ecx, dword [ebp - 0x11c]
inc dword [ebp - 0x120]
add ecx, 0xfffffff0
call fcn.00407030
mov esi, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x118]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00407030
inc ebx
cmp ebx, dword [edi + 4]
jl 0x4e3033
call fcn.0050980b
ret
Function at 0x7002e77
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x701a85c]
jne 0x7002e81
repz ret
jmp fcn.0700f55f

Function at 0x70038fd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x700390c
pop dword [ebp - 0x50]
mov eax, 0x28d45baf
sub eax, 0x21d422a3
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xb8b802de
sub dword [ebp - 0x60], 0x6a65bd93
mov dword [ebp - 0x5c], 0x67792b0a
sub dword [ebp - 0x5c], 0x3545dec5
mov dword [ebp - 0x58], 0x7f0df9b0
add dword [ebp - 0x58], 0xcd3e4a7e
mov dword [ebp - 0x54], 0xfcc98395
add dword [ebp - 0x54], 0x3367c6b
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xb133e2b5
add dword [ebp - 0x60], 0xc33e86a1
mov dword [ebp - 0x5c], 0x54bff2c2
add dword [ebp - 0x5c], 0xecac6eb3
mov dword [ebp - 0x58], 0x61f7515b
sub dword [ebp - 0x58], 0xfe87e4ef
mov dword [ebp - 0x54], 0x5e047962
add dword [ebp - 0x54], 0xa1fb869e
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x7dd49680
add eax, 0x892c89a8
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3a490
push 0
call eax
mov ecx, 0x465f
mov edi, eax
mov ebx, 0xf505b5ad
sub ebx, 0xee03d5ad
add ebx, dword [ebp - 0x50]
mov esi, 0xa3f9c2cb
sub esi, 0x5fade9c3
xor dword [ebp - 0x38], esi
mov edx, dword [ebx]
sub dword [ebp - 0x20], 0x2abaa2fd
sub edx, esi
add dword [ebp - 0x4c], edx
mov dword [edi], edx
mov dword [ebp - 0x24], 0x17751ea9
add edi, 0x5519945c
add edi, 0xaae66ba8
add ebx, 0x627ef4be
sub ebx, 0x627ef4ba
loop 0x7003a23
add eax, 0x6a4af1a
sub eax, 0x6a3a2cb
xor ebx, ebx
add ebx, eax
add eax, 0x855e5c8c
sub eax, 0x855e5c87
mov ecx, 0xdea1c330
add ecx, 0x285e3cd0
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x700d408
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d476
cmp byte [esi + 0x10], 0
je 0x700d427
push eax
call dword [sym.imp.MSVCR100.dll_fflush]
pop ecx
mov byte [esi + 0x10], 0
push edi
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d464
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_feof]
pop ecx
test eax, eax
jne 0x700d464
push str.stream_read_error
push eax
call fcn.070038fd
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700d478
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x401070
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fbd5
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x44c060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.CActionSendHelper.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
lea ecx, [edi + 0x90]
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
call fcn.0040b6e0
lea ecx, [edi + 0x124]
mov byte [ebp - 4], 1
call dword [sym.imp.ouilibx.dll_public:_void___thiscall_OUI::COString::constructor_void_]
lea ecx, [edi + 0x128]
mov byte [ebp - 4], 2
call dword [sym.imp.ouilibx.dll_public:_void___thiscall_OUI::COString::constructor_void_]
mov dword [edi + 0x12c], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x403480
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403499
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4034d4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4034d0
lea ebx, [ebx]
cmp esi, edx
jae 0x4034d4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4034c0
cmp esi, edx
jb 0x4034db
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403e10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fdfa
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x44c060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ouilibx.dll_public:_void___thiscall_OUI::COVTreeItem::constructor_void_]
mov dword [ebp - 4], 0
mov edi, dword [sym.imp.ouilibx.dll_public:_void___thiscall_OUI::COString::constructor_void_]
lea esi, [ebx + 0x94]
mov ecx, esi
mov dword [ebx], vtable.CVirScanTreeItem.2.0
mov dword [ebx + 0xc], vtable.CVirScanTreeItem.1.0
mov dword [ebx + 0x24], vtable.CVirScanTreeItem.0
mov dword [ebp - 0x14], esi
call edi
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
call edi
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call edi
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 3
call edi
lea ecx, [ebx + 0xa4]
mov byte [ebp - 4], 4
call edi
lea esi, [ebx + 0xa8]
mov byte [ebp - 4], 5
mov ecx, esi
mov dword [ebp - 0x14], esi
call edi
lea ecx, [esi + 4]
mov byte [ebp - 4], 6
call edi
lea ecx, [esi + 8]
mov byte [ebp - 4], 7
call edi
mov byte [ebp - 4], 8
mov edi, dword [sym.imp.ouilibx.dll_public:_void___thiscall_OUI::CORect::constructor_void_]
lea ecx, [ebx + 0xb4]
call edi
lea ecx, [ebx + 0xc4]
call edi
lea ecx, [ebx + 0xd4]
call edi
lea esi, [ebx + 0xe4]
mov ecx, esi
call edi
lea ecx, [esi + 0x10]
call edi
lea ecx, [esi + 0x20]
call edi
lea ecx, [esi + 0x30]
call edi
lea ecx, [esi + 0x40]
call edi
lea ecx, [esi + 0x50]
call edi
lea ecx, [esi + 0x60]
call edi
lea ecx, [ebx + 0x154]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fdfa
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x44c060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ouilibx.dll_public:_void___thiscall_OUI::COVTreeItem::constructor_void_]
mov dword [ebp - 4], 0
mov edi, dword [sym.imp.ouilibx.dll_public:_void___thiscall_OUI::COString::constructor_void_]
lea esi, [ebx + 0x94]
mov ecx, esi
mov dword [ebx], vtable.CVirScanTreeItem.2.0
mov dword [ebx + 0xc], vtable.CVirScanTreeItem.1.0
mov dword [ebx + 0x24], vtable.CVirScanTreeItem.0
mov dword [ebp - 0x14], esi
call edi
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
call edi
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call edi
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 3
call edi
lea ecx, [ebx + 0xa4]
mov byte [ebp - 4], 4
call edi
lea esi, [ebx + 0xa8]
mov byte [ebp - 4], 5
mov ecx, esi
mov dword [ebp - 0x14], esi
call edi
lea ecx, [esi + 4]
mov byte [ebp - 4], 6
call edi
lea ecx, [esi + 8]
mov byte [ebp - 4], 7
call edi
mov byte [ebp - 4], 8
mov edi, dword [sym.imp.ouilibx.dll_public:_void___thiscall_OUI::CORect::constructor_void_]
lea ecx, [ebx + 0xb4]
call edi
lea ecx, [ebx + 0xc4]
call edi
lea ecx, [ebx + 0xd4]
call edi
lea esi, [ebx + 0xe4]
mov ecx, esi
call edi
lea ecx, [esi + 0x10]
call edi
lea ecx, [esi + 0x20]
call edi
lea ecx, [esi + 0x30]
call edi
lea ecx, [esi + 0x40]
call edi
lea ecx, [esi + 0x50]
call edi
lea ecx, [esi + 0x60]
call edi
lea ecx, [ebx + 0x154]
call edi
mov esi, dword [ebp + 0xc]
mov dword [ebx + 0x168], 0
mov dword [ebx + 0x16c], 1
mov dword [ebx + 0x174], 0
mov dword [ebx + 0x178], 0
mov dword [ebx + 0x17c], 0
test esi, esi
je 0x4041bf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4041bf
mov ecx, dword [ebp + 8]
mov eax, ecx
sub eax, 0
je 0x404196
dec eax
jne 0x4041a0
mov dword [ebx + 0x170], 1
jmp 0x4041a0
mov dword [ebx + 0x170], 0
push esi
mov dword [ebx + 0x90], ecx
push ecx
mov ecx, ebx
mov dword [ebx + 0x8c], edx
mov dword [ebx + 0x164], 0x636363
call fcn.00404610
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407500
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43041a
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x44c060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
xor eax, eax
mov dword [ebx + 0x30], 7
mov dword [ebx + 0x2c], 0
mov word [ebx + 0x1c], ax
mov dword [ebp - 4], eax
mov esi, dword [sym.imp.ouilibx.dll_public:_void___thiscall_OUI::COString::constructor_void_]
lea edi, [ebx + 0x3c]
mov ecx, edi
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], eax
mov dword [ebp - 0x14], edi
call esi
lea ecx, [edi + 4]
mov byte [ebp - 4], 1
call esi
lea ecx, [edi + 8]
mov byte [ebp - 4], 2
call esi
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 3
call esi
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 4
call esi
lea ecx, [ebx + 0x50]
mov byte [ebp - 4], 5
call fcn.00401070
mov dword [ebx + method.CVirScanCallBackModule.virtual_0], vtable.CVirScanCallBackModule.0
mov dword [ebx + 0x184], 0
mov byte [ebp - 4], 7
mov dword [ebx + 0x188], 0
mov dword [ebx + 0x18c], 0
mov dword [ebx + 0x190], 0
mov dword [ebx + 0x194], 0
mov dword [ebx + 0x198], 0
mov dword [ebx + 0x19c], 0
lea ecx, [ebx + 0x1c0]
mov dword [ebx + 0x1a0], 0
mov dword [ebx + 0x1a4], 0
mov dword [ebx + 0x1a8], 0
mov dword [ebx + 0x1ac], 0
call esi
lea ecx, [ebx + 0x1c4]
mov byte [ebp - 4], 8
call esi
mov byte [ebp - 4], 9
mov esi, dword [reloc.ouilibx.dll___4COString_OUI__QAEAAV01_PB_W_Z]
push 0x437668
lea ecx, [ebx + 0x48]
mov dword [ebx + 0x1c8], 0
mov dword [ebx + 0x1cc], 0
mov dword [ebx + 0x1d0], 0
call esi
push 0x437668
mov ecx, edi
call esi
push 0x437668
lea ecx, [ebx + 0x44]
call esi
push 0x43766c
lea ecx, [ebx + 0x40]
call esi
push 0x437668
lea ecx, [ebx + 0x4c]
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret