joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4049a8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.00401a50
cmp dword [ebp - 0xc], 0
je 0x404a4e
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push ebp
call fcn.0040496c
pop ecx
test al, al
je 0x404a4e
cmp dword [ebp - 4], 1
je 0x4049eb
cmp dword [ebp - 4], 2
jne 0x404a4e
mov eax, dword [ebp - 8]
call fcn.00401154
mov dword [ebp - 0x14], eax
push ebp
call fcn.0040496c
pop ecx
test al, al
je 0x404a46
cmp dword [ebp - 4], 2
jne 0x404a3c
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edi, eax
mov eax, edi
call fcn.00401154
mov esi, eax
push edi
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, ebx
mov edx, esi
call fcn.00401b94
mov eax, esi
call fcn.0040116c
jmp 0x404a46
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00401b94
mov eax, dword [ebp - 0x14]
call fcn.0040116c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404adc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x404b09
lea eax, [esp + 4]
push eax
push 0
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00401dd4
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b0d
xor eax, eax
jmp 0x404b0f
mov al, 1
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x404b4c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x404c0c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0040b37c
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push edi
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x404bf6
cmp dword [ebp - 8], 0
jbe 0x404bf4
mov eax, dword [ebp - 8]
inc eax
call fcn.00401154
mov ebx, eax
xor esi, esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
jmp 0x404bd2
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00401b94
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040b36c
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push edi
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
jne 0x404bb5
mov eax, ebx
call fcn.0040116c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404c13
lea eax, [ebp - 0x10]
call fcn.00401a50
ret
Function at 0x405448
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
cmp byte [ebx + 0x18], 0
jne 0x4054c4
mov byte [ebp - 0x1004], 0
mov eax, dword [ebx + 0x19]
call fcn.00401dd4
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov eax, esi
call fcn.00401dd4
push eax
mov eax, dword [ebp - 4]
call fcn.00401dd4
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00401dd4
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
test eax, eax
je 0x4054bb
mov eax, edi
lea edx, [ebp - 0x1004]
mov ecx, 0x1000
call fcn.00401bc4
jmp 0x4054f5
mov eax, edi
call fcn.00401a50
jmp 0x4054f5
mov eax, edi
mov edx, esi
call fcn.00401aa4
mov eax, dword [ebx + 0x19]
call fcn.00401dd4
push eax
mov eax, esi
call fcn.00401dd4
push eax
mov eax, dword [ebp - 4]
call fcn.00401dd4
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00401dd4
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40915c
Capabilities:
Get file attributes

Disassembly:
call fcn.004031fc
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x409170
dec eax
and al, 0x10
sete al
ret

Function at 0x4091e0
Capabilities:
Get file attributes

Disassembly:
push ebx
push eax
push 0x8001
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x4091fb
dec eax
and al, 0x10
setne al
xchg ebx, eax
push eax
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
pop ebx
ret

Function at 0x40a740
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x37], 0xef
test dl, dl
je 0x40a74c
or byte [eax + 0x37], 0x10
mov byte [eax + 0x52], dl
mov ecx, dword [eax + 0x28]
jecxz 0x40a768
push eax
je 0x40a769
call dword [0x418110]
pop eax
push 5
push dword [eax + 0x28]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x177], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x418110]
ret

Function at 0x40bc30
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.0040bb2c
je 0x40bc62
mov eax, ebx
push edx
call fcn.00407844
pop edx
cmp eax, edx
je 0x40bc62
test edx, edx
mov eax, ebx
jne 0x40bc54
pop ebx
inc edx
jmp fcn.00407834
mov byte [ebx + 0x49], dl
xor edx, edx
call fcn.00407834
xchg ebx, eax
cmp eax, 0
pop ebx
jne fcn.0040bc80
ret
Function at 0x40cae0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40cb14
xor eax, eax
jmp 0x40cb65
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x40cb48
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x40cb48
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
mov ax, word [ebp + 8]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40de14
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40df1e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x418684]
mov eax, dword [eax]
call fcn.00405e68
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
call fcn.0040a6e4
mov dword [ebp - 8], 0xff
mov eax, 0x1a
call fcn.00414a58
mov esi, eax
dec esi
test esi, esi
jl 0x40deaa
inc esi
xor ebx, ebx
mov edi, ebx
shl edi, 2
mov eax, dword [0x418634]
mov eax, dword [eax]
mov edx, dword [eax + edi*4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
call fcn.0040afd4
mov eax, dword [0x418634]
mov eax, dword [eax]
mov eax, dword [eax + edi*4 + 4]
call fcn.00408f58
push eax
call sub.kernel32.dll_GetUserDefaultLangID
movzx eax, ax
pop edx
cmp edx, eax
jne 0x40dea6
mov dword [ebp - 8], ebx
inc ebx
dec esi
jne 0x40de6b
cmp dword [ebp - 8], 0xff
jne 0x40deec
mov eax, 0x1a
call fcn.00414a58
mov esi, eax
dec esi
test esi, esi
jl 0x40deec
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 2
mov edx, dword [0x418634]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
mov edx, 0x40df34
call fcn.00401d20
jne 0x40dee8
mov dword [ebp - 8], ebx
jmp 0x40deec
inc ebx
dec esi
jne 0x40dec7
cmp dword [ebp - 8], 0xff
jne 0x40defa
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov edx, dword [ebp - 8]
call fcn.0040b278
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40df25
lea eax, [ebp - 0xc]
call fcn.00401a50
ret

Function at 0x40fbd8
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
mov dword [esp], pe_nt_image_headers32
test al, al
je 0x40fbf9
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
jmp 0x40fc04
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00401bc4
add esp, 0x104
pop ebx
ret

Function at 0x40fc1c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc10
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [esp]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x3e9
call fcn.00401bc4
add esp, 0x3f0
pop ebx
ret
Function at 0x411694
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x41182e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0xe4]
mov eax, dword [0x4197b8]
mov eax, dword [eax + 0x5c]
call fcn.0040a6e4
mov eax, dword [0x418684]
mov eax, dword [eax]
call fcn.0040ac4c
mov eax, 0x28
call fcn.00414a58
mov edi, eax
dec edi
test edi, edi
jl 0x41180b
inc edi
xor ebx, ebx
mov esi, ebx
add esi, esi
lea esi, [esi + esi*2]
mov eax, dword [0x418640]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x10]
call fcn.00408f58
xor edx, edx
mov dl, byte [ebp - 1]
cmp eax, edx
jne 0x411803
mov eax, dword [0x418640]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 4]
lea ecx, [ebp - 8]
xor edx, edx
call fcn.00410128
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00401338
mov dword [ebp - 0x44], 0x3c
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00401dd4
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 8]
call fcn.00403fdc
mov eax, dword [ebp - 0x48]
call fcn.00401dd4
mov dword [ebp - 0x2c], eax
mov eax, dword [0x418640]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 8]
lea ecx, [ebp - 0x4c]
xor edx, edx
call fcn.00410128
mov eax, dword [ebp - 0x4c]
call fcn.00401dd4
mov dword [ebp - 0x30], eax
mov eax, dword [0x418640]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0xc]
call fcn.00408f58
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0x400
mov eax, dword [0x418640]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x14]
call fcn.00408f58
dec eax
jne 0x4117c7
mov eax, dword [ebp - 0x40]
or eax, 0x40
or eax, 0x200
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
jmp 0x4117de
mov eax, dword [0x418684]
mov eax, dword [eax]
call fcn.0040ac4c
push 0x32
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x4117d2
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4197b8]
call fcn.00410338
inc ebx
dec edi
jne 0x4116f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411835
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00401a74
lea eax, [ebp - 8]
call fcn.00401a50
ret
Function at 0x414b2c
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x414bfe
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea ecx, [ebp - 4]
xor edx, edx
mov eax, ebx
call fcn.00414a68
mov eax, dword [ebp - 4]
call fcn.00401dd4
push eax
call sub.kernel32.dll_DeleteFileA
inc ebx
cmp ebx, 0x12
jne 0x414b48
mov eax, 0x1a
call fcn.00414a58
mov esi, eax
add esi, 0x14
sub esi, 0x14
jl 0x414bbb
inc esi
mov ebx, 0x14
lea ecx, [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00414a68
mov eax, dword [ebp - 8]
call fcn.00401dd4
push eax
call sub.kernel32.dll_DeleteFileA
lea ecx, [ebp - 0xc]
lea eax, [ebx + 0x1e]
xor edx, edx
call fcn.00414a68
mov eax, dword [ebp - 0xc]
call fcn.00401dd4
push eax
call sub.kernel32.dll_DeleteFileA
inc ebx
dec esi
jne 0x414b82
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, 1
call fcn.00414a68
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00403fdc
mov eax, dword [ebp - 0x10]
call fcn.00401dd4
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414c05
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00401a74
ret

Function at 0x414f0c
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x414f50
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x414f50
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x414fe7
mov eax, 0x400
call fcn.00401154
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x414fe0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x418624
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x414fd6
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x414fd2
mov byte [esp], 1
jmp 0x414fd6
inc edi
dec ebx
jne 0x414fb9
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.0040116c
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4152e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00401dc4
xor eax, eax
push ebp
push 0x415351
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00408f8c
mov edx, dword [ebp - 8]
mov eax, 0x419874
call fcn.00401aa4
xor eax, eax
mov dword [0x419870], eax
push 0
push 0x4151f4
call sub.user32.dll_EnumWindows
mov ebx, dword [0x419870]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415358
lea eax, [ebp - 8]
mov edx, 2
call fcn.00401a74
ret

Function at 0x415360
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, eax
xor ebx, ebx
test esi, esi
jns 0x415371
call fcn.004013f4
push esi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
jns 0x415389
call fcn.004013f4
push esp
mov esi, edi
test esi, esi
jns 0x415395
call fcn.004013f4
push esi
call sub.kernel32.dll_GetExitCodeProcess
test edi, edi
je 0x4153b8
mov eax, dword [esp]
push eax
test edi, edi
jns 0x4153ac
call fcn.004013f4
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
test edi, edi
jns 0x4153c1
call fcn.004013f4
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40288e
pop dword [ebp - 0x14]
mov eax, 0x40288e
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xd4bb77f0
add dword [ebp - 0x24], 0x7996cd5b
mov dword [ebp - 0x20], 0xa5245dca
sub dword [ebp - 0x20], 0x72f11185
mov dword [ebp - 0x1c], 0xbc234ce7
sub dword [ebp - 0x1c], 0x6fd708b9
mov dword [ebp - 0x18], 0xf25e1c70
sub dword [ebp - 0x18], 0xf25e1c70
lea eax, [ebp - 0x24]
push eax
mov eax, 0x9943cee
sub eax, 0x953bc62
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x6d56e320
add dword [ebp - 0x24], 0x71b8636
mov dword [ebp - 0x20], 0x9678faf0
sub dword [ebp - 0x20], 0x550c997b
mov dword [ebp - 0x1c], 0xe9b49902
sub dword [ebp - 0x1c], 0x86452c96
mov dword [ebp - 0x18], 0xab7649d1
sub dword [ebp - 0x18], 0xab7649d1
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x4837b919
add eax, 0xb808c7bb
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x33c5a
push 0
call eax
mov ecx, 0x1454cfd9
add ecx, 0xebab6cdb
xor edx, edx
add edx, eax
mov esi, 0x411000
add esi, dword [ebp - 0x14]
mov ebx, 0xe5189af7
sub ebx, 0xc21a4964
mov edi, dword [esi]
xor dword [ebp - 0xc], ebx
xor edi, ebx
add dword [ebp - 0xc], 0xcdbbcc3b
mov dword [edx], edi
sub dword [ebp - 4], ecx
add edx, 0x94ddae23
add edx, 0x6b2251e1
add esi, 0x4421db4b
add esi, 0xbbde24b9
loop 0x4029a7
add eax, 0x63e444f2
add eax, 0x9c1ca0b1
xor ebx, ebx
add ebx, eax
add eax, 0x6481617f
add eax, 0x9b7e9e86
mov ecx, 0x246b73b6
add ecx, 0xdbd48c4a
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x403c25
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00403dd5
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x403d23
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x403cc6
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x403d09
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x403cdd
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x403cf8
test al, 0x40
je 0x403cef
mov ecx, dword [edi + 0x20]
jmp 0x403cf6
test al, 0x80
je 0x403d09
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x403d09
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x403c95
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x405037
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x4050eb
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00404fc7
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x4050c4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4050f7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x405112
test ebp, ebp
je 0x405112
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40511a
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40515a
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x4051b6
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4051b1
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40519c
test dl, dl
je 0x405198
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40519c
add ecx, 2
add eax, 2
test dl, dl
jne 0x40517c
xor eax, eax
jmp 0x4051a1
sbb eax, eax
or eax, 1
test eax, eax
je 0x4051c0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x405169
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x4051d7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.00405037
test eax, eax
jne 0x4051ef
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.004050f7
mov esi, eax
test esi, esi
jne 0x405225
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40523f
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret