joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40670e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
je 0x40673a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
jmp 0x40681f
cmp dword [ebp + 8], 0
je 0x406786
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push 0x100000
push 2
mov ebx, 0xc8
call fcn.004490f0
add esp, 0x1c
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.004068ea
mov dword [ebp - 4], eax
jmp 0x40681f
push 0x4862fb
mov ebx, dword [ebp + 0x18]
push dword [ebx]
call fcn.00403aca
add esp, 8
cmp eax, 0
je 0x40680e
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
push dword [ebp + 0x18]
call fcn.00406956
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
jne 0x4067cc
mov eax, 0
jmp 0x4068e4
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push 0x100000
push 2
mov ebx, 0xc8
call fcn.004490f0
add esp, 0x1c
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.004068ea
mov dword [ebp - 4], eax
jmp 0x40681f
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
call fcn.00402e31
cmp dword [ebp - 4], 0
je 0x4068d3
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40685a
push 0x2a0
push 0x4094f33
push 6
call fcn.00448671
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp + 0x24], 0
jne 0x40686e
mov dword [ebp + 0x20], 0xffffffff
mov dword [ebp - 0xc], esp
push dword [ebp + 0x20]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40689d
push 0x316
push 0x4094f33
push 6
call fcn.00448671
add esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x4068d3
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4068d3
push 0x36d
push 0x4094f33
push 6
call fcn.00448671
add esp, 0xc
cmp dword [ebp - 8], 1
mov eax, 0
sete al
jmp 0x4068e4
mov esp, ebp
pop ebp
ret 0x20
Function at 0x40d4cd
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
nop
cmp dword [ebp - 4], esp
je 0x40d504
push 0x12
push 0x409b9ee
push 6
call fcn.00448671
add esp, 0xc
jmp 0x40d509
mov esp, ebp
pop ebp
ret 4
Function at 0x411a4b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
cmp dword [0x58b439], 0
jle 0x411b95
mov dword [ebp - 8], esp
push dword [0x58b439]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x411a97
push 0x6d
push 0x409516e
push 6
call fcn.00448671
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x411ae7
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
nop
nop
cmp dword [ebp - 8], esp
je 0x411ad3
push 0xb6
push 0x409516e
push 6
call fcn.00448671
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
sete al
jmp 0x411bde
mov dword [ebp - 8], esp
push 1
push dword [0x58b439]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x411b1b
push 0xe4
push 0x409516e
push 6
call fcn.00448671
add esp, 0xc
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
nop
nop
cmp dword [ebp - 8], esp
je 0x411b4a
push 0x132
push 0x409516e
push 6
call fcn.00448671
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
sete al
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0
push dword [0x58b439]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x411b90
push 0x15e
push 0x409516e
push 6
call fcn.00448671
add esp, 0xc
jmp 0x411bd6
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
nop
nop
cmp dword [ebp - 8], esp
je 0x411bc4
push 0x1ad
push 0x409516e
push 6
call fcn.00448671
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
sete al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x411bde
mov esp, ebp
pop ebp
ret 8

Function at 0x411dea
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop
nop
cmp dword [ebp - 4], esp
je 0x411e1f
push 0x24
push 0x4095575
push 6
call fcn.00448671
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x411e33
mov esp, ebp
pop ebp
ret 4

Function at 0x411e88
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
call fcn.00401cc9
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
call fcn.00401b5d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x411ee9
push 0x33
push 0x409522c
push 6
call fcn.00448671
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x411ef1
mov esp, ebp
pop ebp
ret 8
Function at 0x411ef7
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x411f3e
push 0
push 0x4095228
push 6
call fcn.00448671
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x411f49
mov esp, ebp
pop ebp
ret 4

Function at 0x412a3e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.00401b80
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x412a80
push ebx
call fcn.00448677
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
call fcn.00401cc9
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x412ad2
push 0x70
push 0x409522d
push 6
call fcn.00448671
add esp, 0xc
push 0x80000301
push 0
push dword [ebp - 8]
push VariantCopy
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x412aef
mov eax, 0x482235
push eax
push 2
mov ebx, 0x1a0
call fcn.00449f10
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x412b19
push ebx
call fcn.00448677
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x412b37
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0044866b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x412b3c
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x412b4d
push ebx
call fcn.00448677
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8

Function at 0x412b54
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.00412bdd
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x412b8f
mov eax, 0
jmp 0x412bd7
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
nop
nop
cmp dword [ebp - 8], esp
je 0x412bc2
push 0xe1
push 0x409b9dc
push 6
call fcn.00448671
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x412bcf
mov eax, dword [ebp - 4]
jmp 0x412bd7
mov esp, ebp
pop ebp
ret 8

Function at 0x41341e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 1
push 0x4862fb
push 0x4862fb
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
cmp dword [ebp - 4], esp
je 0x41346e
push 0
push 0x4094e28
push 6
call fcn.00448671
add esp, 0xc
mov esp, ebp
pop ebp
ret 4
Function at 0x413520
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.00449480
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x413565
push ebx
call fcn.00448677
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00404359
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4135a5
push 0x73
push 0x4094f9f
push 6
call fcn.00448671
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4135d3
mov eax, dword [ebp - 4]
test eax, eax
je 0x4135ce
push eax
mov ebx, eax
call fcn.00403b67
inc eax
push eax
call fcn.0044866b
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4135dd
mov eax, 0x4862fb
jmp 0x4135dd
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4135ee
push ebx
call fcn.00448677
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4138de
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x413992
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0041386e
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x41396b
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41399e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x4139b9
test ebp, ebp
je 0x4139b9
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4139c1
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x413a01
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x413a5d
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x413a58
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x413a43
test dl, dl
je 0x413a3f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x413a43
add ecx, 2
add eax, 2
test dl, dl
jne 0x413a23
xor eax, eax
jmp 0x413a48
sbb eax, eax
or eax, 1
test eax, eax
je 0x413a67
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x413a10
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x413a7e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.004138de
test eax, eax
jne 0x413a96
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0041399e
mov esi, eax
test esi, esi
jne 0x413acc
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x413ae6
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x413bde
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.004138de
mov esi, eax
test esi, esi
jne 0x413bfc
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0041399e
mov dword [esp + 0x18], eax
test eax, eax
je 0x413bf4
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0041399e
mov dword [esp + 0x34], eax
test eax, eax
je 0x413bf4
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0041399e
mov dword [esp + 0x28], eax
test eax, eax
je 0x413bf4
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0041399e
mov dword [esp + 0x30], eax
test eax, eax
je 0x413bf4
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x413dc3
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x413dc3
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x413d26
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x413da7
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x413d49
movzx esi, ax
jmp 0x413d4e
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x413d6d
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x413d7c
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x413dd0
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x413d3e
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x413d03
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x413df9
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x413df9
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x413dde
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x413e0e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.004138de
mov esi, eax
test esi, esi
je 0x413eca
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0041399e
mov ebp, eax
test ebp, ebp
je 0x413ec9
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0041399e
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x413ec9
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x413ec9
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x413ec8
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x413eae
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x4141c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x414274
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00414150
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x41424d
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x41429b
test ebp, ebp
je 0x41429b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4142a3
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x4142e3
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x41433f
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x41433a
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414325
test dl, dl
je 0x414321
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414325
add ecx, 2
add eax, 2
test dl, dl
jne 0x414305
xor eax, eax
jmp 0x41432a
sbb eax, eax
or eax, 1
test eax, eax
je 0x414349
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x4142f2
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret

Function at 0x414360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.004141c0
mov esi, eax
test esi, esi
je 0x41441c
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.00414280
mov ebp, eax
test ebp, ebp
je 0x41441b
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.00414280
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x41441b
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x41441b
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x41441a
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x414400
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret
Function at 0x414dbf
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop
nop
cmp dword [ebp - 8], esp
je 0x414dfd
push 0x19
push 0x4094e29
push 6
call fcn.00448671
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x414e14
mov eax, 0
jmp 0x414e35
push 0x10
push dword [ebp - 4]
call fcn.00414e3b
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
sete al
jmp 0x414e35
mov esp, ebp
pop ebp
ret 4

Function at 0x414eb5
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
nop
cmp dword [ebp - 4], esp
je 0x414eef
push 0x24
push 0x40951ee
push 6
call fcn.00448671
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x414f03
mov esp, ebp
pop ebp
ret 8
Function at 0x418510
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 4
push 1
mov ebx, 0x184
call fcn.00449480
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x418555
push ebx
call fcn.00448677
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 4
push dword [ebp - 4]
push 0x23
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
nop
nop
cmp dword [ebp - 8], esp
je 0x418594
push 0x36
push 0x409c170
push 6
call fcn.00448671
add esp, 0xc
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4185a7
mov eax, 0x4862fb
push eax
push 1
mov ebx, 0x9dc
call fcn.00449010
add esp, 0x10
jmp 0x4185bf
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4185d0
push ebx
call fcn.00448677
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x41b667
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 2
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
nop
nop
cmp dword [ebp - 8], esp
je 0x41b6a8
push 0x19
push 0x4094e54
push 6
call fcn.00448671
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x41
jl 0x41b6c6
cmp dword [ebp - 4], 0x5a
jg 0x41b6c6
mov eax, 1
jmp 0x41b6cb
mov eax, 0
test eax, eax
je 0x41b6d7
add dword [ebp - 4], 0x20
mov eax, dword [ebp - 4]
jmp 0x41b6df
mov esp, ebp
pop ebp
ret 4