joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5a98
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051ec
mov eax, dword [ebp - 8]
call fcn.004051ec
xor eax, eax
push ebp
push 0x4a5bb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.004051fc
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 3
mov eax, 0x4a5bc8
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004051fc
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4a5b9a
xor eax, eax
push ebp
push 0x4a5b93
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4a5b73
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x4a5b77
xor eax, eax
jmp 0x4a5b79
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5b9a
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5bbc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d90
ret
Function at 0x4a5bd0
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004051ec
mov eax, dword [ebp - 8]
call fcn.004051ec
mov eax, dword [ebp - 0xc]
call fcn.004051ec
mov eax, dword [ebp + 0xc]
call fcn.004051ec
xor eax, eax
push ebp
push 0x4a5d3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.004051fc
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, 0x4a5d54
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004051fc
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4a5d1c
xor edx, edx
push ebp
push 0x4a5d15
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.004051fc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004051fc
push eax
movzx eax, word [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.004051fc
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
test eax, eax
je 0x4a5cfe
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4a5cf5
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x4a5cf9
xor eax, eax
jmp 0x4a5cfb
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5d1c
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5d46
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404d90
lea eax, [ebp + 0xc]
call fcn.00404d6c
ret
Function at 0x4a5d5c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x4a5e24
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x4a5e28
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x4a5e24
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a5e1b
xor eax, eax
push ebp
push 0x4a5e14
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5e1b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a61b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a63c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x105
mov eax, dword [ebp - 0x20]
call fcn.00402f64
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a622e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x4a6218
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00404f64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6235
mov eax, dword [ebp - 0x10]
call fcn.00402f80
ret

Function at 0x4a776c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.004036dc
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x4a77a6
cmp byte [ebp - 0xa], 0x31
jne 0x4a77a4
mov bl, 1
jmp 0x4a77a6
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a8ed4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0044d294
test al, al
je 0x4a8f8d
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x4a8f6b
cmp word [esi + 0x65a], 0
je 0x4a8f25
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x65c]
call dword [esi + 0x658]
cmp byte [ebp - 9], 0
jne 0x4a8f42
cmp dword [ebp - 4], 0
jbe 0x4a8f3e
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x4a8f42
xor ebx, ebx
jmp 0x4a8f44
mov bl, 1
test bl, bl
jne 0x4a8f8d
mov eax, dword [0x123d438]
mov eax, dword [eax]
cmp byte [eax + 0xa4], 0
jne 0x4a8f8d
mov eax, dword [0x123d438]
mov eax, dword [eax]
call fcn.004626cc
push 1
call sub.kernel32.dll_Sleep_2
test esi, esi
je 0x4a8f8d
cmp byte [esi + 0x5f0], 0
jne 0x4a8f8d
mov edx, 0xfffffdf3
mov eax, esi
call fcn.0046adb8
cmp eax, 4
jne 0x4a8f02
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4abd6c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4abdaa
push 0x18e
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x123d438]
mov eax, dword [eax]
call fcn.004626cc
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0xc738
jbe 0x4abdaa
call fcn.0040dff8
call fcn.0048ac88
test al, al
jne 0x4abd81
call fcn.0048ab14
test al, al
jne 0x4abd81
call fcn.004abd68
test al, al
jne 0x4abd81
xor eax, eax
push ebp
push 0x4abe01
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [0x123d638]
mov eax, dword [eax]
call fcn.00451f68
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x39d], edx
mov edx, dword [ebp - 8]
mov dword [eax + 0x3a1], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4abe0b
or edx, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.004452b8
call sub.user32.dll_GetForegroundWindow
mov edx, dword [ebp - 4]
mov dword [edx + 0x380], eax
mov eax, dword [0x123d438]
mov eax, dword [eax]
call fcn.00461474
call fcn.004aaa2c
mov eax, dword [ebp - 4]
call fcn.0044cee4
call fcn.004abccc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
test eax, eax
jbe 0x4abe54
call fcn.004abccc
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.0044cee4
push eax
call sub.user32.dll_SetWindowPos
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3cc], 0
je 0x4abe84
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004ab9b8
mov eax, 9
call fcn.0048a994
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af894
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4af943
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
xor ecx, ecx
mov edx, 0x105
call fcn.004036dc
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
cmp byte [ebp - 0x104], 0x3a
jne 0x4af91e
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404fdc
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.00409a20
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.0040ed58
jmp 0x4af925
mov eax, ebx
call fcn.00404d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af94a
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00404d90
ret

Function at 0x4b8db4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b8e63
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
xor ecx, ecx
mov edx, 0x105
call fcn.004036dc
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
cmp byte [ebp - 0x104], 0x3a
jne 0x4b8e3e
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404fdc
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.00409a20
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.0040ed58
jmp 0x4b8e45
mov eax, ebx
call fcn.00404d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8e6a
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00404d90
ret
Function at 0x1235aa4
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x1235b2a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [0x12407f8]
call fcn.0040f70c
lea eax, [ebp - 8]
mov ecx, 0x1235b40
mov edx, dword [ebp - 4]
call fcn.00405084
mov eax, dword [ebp - 8]
call fcn.004051fc
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
push 5
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 0xc]
mov ecx, 0x1235b40
mov edx, dword [ebp - 4]
call fcn.00405084
push ebx
mov eax, dword [ebp - 4]
call fcn.004051fc
push eax
call sub.kernel32.dll_MoveFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1235b31
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404d90
ret
Function at 0x401060
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x45000c]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [esp + 0x18], esi
cmp word [eax], si
je 0x401099
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, dword [esp + 0x18]
mov edi, eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push esi
mov edx, edi
mov ecx, 0x443b68
call section..text
add esp, 8
test al, al
je 0x4010c7
mov eax, dword [esp + 0x10]
inc eax
cmp eax, esi
ja 0x4010c7
mov bl, 1
jmp 0x4010c9
xor bl, bl
lea eax, [esp + 0x10]
mov edx, edi
push eax
push esi
mov ecx, 0x443b70
call section..text
mov ecx, dword [esp + 0x18]
add esp, 8
test al, al
je 0x40110d
lea eax, [ecx + 1]
cmp eax, esi
ja 0x40110d
mov bh, 1
mov eax, dword [edi + ecx*4 + 4]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x401140
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
jmp 0x401145
xor bh, bh
test bl, bl
jne 0x4010ef
push str.Usage:_DaemonRegistrator.exe__i_.dll_or_DaemonRegistrator.exe__u_.dll
push str.A_Volute
push 3
call fcn.00401310
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004217c8
mov esp, ebp
pop ebp
ret 0x10
mov edi, 1
xor edx, edx
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x10]
call fcn.004031e0
test eax, eax
je 0x40116e
mov edx, 0x2000
lea ecx, [esp + 0x10]
call fcn.004031e0
test eax, eax
jne 0x401127
mov esi, dword [esp + 0x10]
test bl, bl
je 0x401184
mov edx, dword [esp + 0x14]
mov ecx, esi
push edi
call fcn.004036c0
jmp 0x401194
test bh, bh
je 0x401197
mov edx, dword [esp + 0x14]
mov ecx, esi
push edi
call fcn.00403910
add esp, 4
test esi, esi
je 0x4011af
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
cmp eax, 0x405060
jne 0x4011c5
lea ecx, [esi + 0x18]
call fcn.00411dc0
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004217c8
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
call eax
jmp 0x4011af

Function at 0x401330
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov eax, dword [0x45000c]
xor eax, esp
mov dword [esp + 4], eax
lea ecx, [esp]
mov dword [esp], 0
call fcn.004016e0
call fcn.00401230
test eax, eax
je 0x401385
push 0x452b38
push 0x443c5c
push 0x800
push 0x454b40
call fcn.004015b0
add esp, 0x10
xor eax, eax
mov word [0x455b3e], ax
push 0x454b40
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x451628], 0
je 0x401397
push dword [esp]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004217c8
add esp, 8
ret
Function at 0x401880
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b5b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x45000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], 0
call fcn.004016e0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40190f
lea ecx, [ebp + 0x14]
push ecx
push 0
push eax
push 0xffffffffffffffff
push 0x100
push 0x455b68
call fcn.004011d0
push dword [eax + 4]
push dword [eax]
call fcn.00426c36
push 0x455b68
push edi
push esi
push str.Error__d_in_function__S:__s
push 0x200
push 0x455d68
call fcn.004015d0
add esp, 0x38
jmp 0x401966
cmp esi, 2
jne 0x401945
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov edx, eax
mov ecx, edi
call fcn.00401ac0
add esp, 4
mov esi, eax
cmp byte [0x451628], 0
je 0x401a96
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x401a96
mov ecx, esi
call fcn.00401bd0
push edi
push eax
push esi
push str.Error__d___s__in_function__S
push 0x200
push 0x455d68
call fcn.004015d0
add esp, 0x18
mov ecx, 0x455d68
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401970
sub ecx, edx
mov dword [ebp - 0x1c], 1
sar ecx, 1
lea eax, [ebp - 0x14]
cmp ecx, 1
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x1c]
cmovbe eax, edx
mov ecx, dword [eax]
sub ecx, 1
je 0x4019cd
lea eax, [ecx + ecx]
nop
movzx edx, word [eax + 0x455d68]
cmp edx, 0xd
je 0x4019b1
cmp edx, 0xa
jne 0x4019cd
cmp eax, 0x400
jae 0x401ab3
xor edx, edx
mov word [eax + 0x455d68], dx
sub eax, 2
sub ecx, 1
jne 0x4019a0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x454b38]
cmp eax, dword [ecx + 4]
jle 0x401a14
push 0x454b38
call fcn.00421b3d
add esp, 4
cmp dword [0x454b38], 0xffffffff
jne 0x401a14
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
push 0x454b38
setne byte [0x455b40]
call fcn.00421afe
add esp, 4
cmp byte [0x455b40], 0
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jne 0x401a6f
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.004016e0
push 0x455d68
push 0x443c5c
push 0x800
push 0x454b40
call fcn.004015b0
add esp, 0x10
xor eax, eax
mov word [0x455b3e], ax
push 0x454b40
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x451628], 0
je 0x401a6f
push dword [ebp - 0x14]
call edi
push 0x455d68
push 0x443dd0
push str.A_Volute
push 1
call fcn.00401310
add esp, 0x10
cmp byte [0x451628], 0
je 0x401a96
push dword [ebp - 0x18]
call edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004217c8
mov esp, ebp
pop ebp
ret
call fcn.00421d64
int3
Function at 0x402550
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b680
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x45000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407490
mov dword [ebp - 4], 0
lea esi, [ebx + 0xb0]
push ebx
push 0x4445e8
mov ecx, ebx
mov dword [ebx], 0x444c54
mov dword [ebx + 0xc], 0x445270
mov dword [ebx + 0x10], 0x4448ec
mov dword [esi], 0x444ae4
call fcn.0040a090
push esi
push 0x44497c
mov ecx, ebx
call fcn.0040a090
mov dword [ebp - 4], 1
lea edi, [ebx + 0xb8]
mov dword [esi], 0x444b0c
mov ecx, ebx
lea esi, [ebx + 0xb4]
mov dword [ebx], 0x445000
push esi
push 0x444b38
mov dword [ebx + 0xc], 0x444fb4
mov dword [ebx + 0x10], 0x4451f4
mov dword [esi], 0x444f4c
mov dword [edi], 0x444a44
call fcn.0040a090
push esi
push 0x4451b4
mov ecx, ebx
call fcn.0040a090
push edi
push 0x4455d4
mov ecx, ebx
call fcn.0040a090
mov eax, dword [ebx + 0x30]
lea ecx, [ebx + 0x30]
call dword [eax + 0x20]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402650
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b6a0
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x45000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x30]
lea ecx, [esi + 0x30]
mov dword [esi], 0x445000
mov dword [esi + 0xc], 0x444fb4
mov dword [esi + 0x10], 0x4451f4
mov dword [esi + 0xb0], 0x444b0c
mov dword [esi + 0xb4], 0x444f4c
mov dword [esi + 0xb8], 0x444a44
call dword [eax + 0x24]
mov ecx, esi
mov dword [esi], 0x444c54
mov dword [esi + 0xc], 0x445270
mov dword [esi + 0x10], 0x4448ec
mov dword [esi + 0xb0], 0x444ae4
call fcn.00405850
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4034d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
mov eax, dword [0x45000c]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x54]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x14], eax
push edi
mov ebx, edx
mov dword [esp + 0x10], esi
xor ebp, ebp
call fcn.00402e40
mov edx, dword [eax]
cmp edx, 0x4443e8
jne 0x40369f
lea edx, [eax + 0xc]
mov eax, dword [edx]
xor ecx, ecx
mov dword [esp + 0x3c], eax
movzx eax, word [edx + 4]
mov word [esp + 0x40], ax
movzx eax, word [edx + 6]
mov word [esp + 0x42], ax
mov al, byte [edx + ecx + 8]
mov byte [esp + ecx + 0x44], al
inc ecx
cmp ecx, 8
jne 0x403524
call fcn.00403030
mov ecx, eax
xor edx, edx
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x4c], eax
movzx eax, word [ecx + 0x10]
mov word [esp + 0x50], ax
movzx eax, word [ecx + 0x12]
mov word [esp + 0x52], ax
mov al, byte [ecx + edx + 0x14]
mov byte [esp + edx + 0x54], al
inc edx
cmp edx, 8
jne 0x403554
mov eax, dword [esi]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, esi
call dword [eax + 0x40]
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x40366b
nop dword [eax]
lea eax, [esp + 0x3c]
mov dword [esp + 0x34], 0
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], edi
push ecx
mov ecx, esi
mov dword [esp + 0x2c], 0
call dword [eax + 0x44]
mov ebp, eax
test ebp, ebp
jne 0x403660
mov ecx, dword [esp + 0x34]
push 0x4445e8
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x38]
push ecx
mov edx, dword [eax]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, eax
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x38], ebp
call dword [edx + 0x44]
mov ebp, eax
test ebp, ebp
jne 0x403660
mov ecx, dword [esp + 0x38]
push 0x4448f8
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 0x44]
cmp eax, 0x406b20
jne 0x4036ab
mov eax, dword [esi + 0x64]
test al, 2
jne 0x403625
cmp byte [esi + 0x78], 0
jne 0x40363b
test al, 1
je 0x40363b
mov ecx, dword [esi + 0x60]
lea eax, [esi + 0x68]
push 0x10
push eax
mov edx, dword [ecx]
call dword [edx + 0x34]
test eax, eax
jne 0x40363b
mov byte [esi + 0x78], 1
add esi, 0x68
mov ecx, dword [ebx]
cmp ecx, dword [esi]
jne 0x40365c
mov ecx, dword [ebx + 4]
cmp ecx, dword [esi + 4]
jne 0x40365c
mov eax, dword [ebx + 8]
cmp eax, dword [esi + 8]
jne 0x40365c
mov eax, dword [ebx + 0xc]
cmp eax, dword [esi + 0xc]
je 0x403680
mov esi, dword [esp + 0x10]
inc edi
cmp edi, dword [esp + 0x14]
jb 0x403580
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.004217c8
add esp, 0x50
ret
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [esp + 0x54]
pop ebp
pop ebx
xor ecx, esp
call fcn.004217c8
add esp, 0x50
ret
mov ecx, eax
call dword [edx + 8]
mov edx, eax
jmp 0x40350a
mov ecx, esi
call eax
mov esi, eax
jmp 0x40363e