joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [0x403010], 0x400000
push 0x7f02
push 0
call dword [sym.imp.user32.dll_LoadIconA]
sub esp, 8
mov dword [0x403014], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
sub esp, 8
mov dword [0x403018], eax
mov eax, section..data_1
mov dword [esp], eax
call dword [sym.imp.user32.dll_RegisterClassA]
sub esp, 4
test eax, eax
je 0x402111
mov dword [esp], 0
mov dword [esp + 4], 0x403059
mov dword [esp + 8], 0x40305e
mov dword [esp + 0xc], 0x10080000
mov dword [esp + 0x10], pe_nt_image_headers32
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x18], 0x100
mov dword [esp + 0x1c], 0xc0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov eax, dword [0x403010]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.user32.dll_CreateWindowExA]
sub esp, 0x30
test eax, eax
je 0x402111
mov dword [esp], 0x403028
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.user32.dll_GetMessageA]
sub esp, 0x10
cmp eax, 1
jb 0x402111
jne 0x4020c0
mov dword [esp], 0x403028
call dword [sym.imp.user32.dll_TranslateMessage]
sub esp, 4
mov dword [esp], 0x403028
call dword [sym.imp.user32.dll_DispatchMessageA]
sub esp, 4
jmp 0x4020c0
leave
mov eax, dword [0x403030]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x40215d
Capabilities:
Query environment variable
Set environment variable
Terminate process

Disassembly:
mov byte [0x403063], al
push 0x403063
push 0x40305e
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
call fcn.004026a6
push 0
push 2
push 0x403080
push 0x403044
call dword [0x40568e]
cmp eax, 0x122
jne 0x4021b8
call fcn.00402120
pop eax
xor ebx, ebx
push edx
push 2
push 0x403065
push 0x40305e
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
mov bl, byte [0x403065]
pop edx
add edx, ebx
call edx
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x402689
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
push 0x40
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x4c054a62
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x17583758
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x56ef15cb
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..rsrc
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x1b8e25b1
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x411357
Capabilities:
Encode data using xor

Disassembly:
inc eax
adc ebx, dword [edi - 0x71a8e07e]
sbb byte [edi], 0x57
mov cs, word [ebx - 0x40570fb7]
sbb byte [edi], 0x57
mov cs, word [ebx - 0x40570fb7]
xchg ebp, eax
je 0x411353
mov al, byte [0x4e12459a]
loopne 0x411397
cwde
sbb eax, 0x9a68ff8b
cli
fidiv word [ebx + 0x32]
jae 0x4113ad
aaa
lcall 0x3388, 0x518633b0
xor byte [esi - 0x60], cl
mov cl, 0x5b
loop 0x411375
les ebx, [ecx]
rcl dword [0x207ed84a]
adc ah, byte [eax - 0xd20e0c8]
imul esp, dword [0x9b830213], 0x8e704e0f
wait
cmovle esi, dword [eax - 0x72]
test byte [esi - 0xf], dh
test bh, ch
lodsd eax, dword [esi]
add byte [eax + 0x44], bl
push 0xffffffffffffffaf
adc byte [edx], dh
adc eax, edi
iretd
xor esp, dword [ebp + 0x39957938]
and eax, 0xc1ac5ce2
mov fs, word [bx + si]
fsubr qword [ecx + 0x4c]
mov byte [esi - 0x63], bl
xor dword [edx - 2], 0x6d
lea ecx, [edi]
and dword [eax - 0x56], eax
stosb byte es:[edi], al
clc
outsd dx, dword [esi]
in al, dx
mov al, byte [ecx + 0x40]
jb 0x4113c9
mov al, byte [0x9a6f5b9e]
bound esp, qword [ecx]
shl dword [ecx - 0x57], 0x9f
outsd dx, dword [esi]
sbb ebp, dword [eax + 0x79]
xor al, 0x12
jns 0x411427
xor byte [ecx - 0x8fe18a7], dl
mov bl, byte [ecx]
popal
cmpsb byte [esi], byte es:[edi]
invalid
xchg ebp, eax
pop es
adc ebp, 0xec3df8eb
add esp, ebx
push ecx
aad 0xeb
clc
cmp eax, 0x51dc01ec
nop
cmp eax, 0x4eefa6ae
add al, 0x46
or al, 0xe0
lahf
shr dword [ecx], 0xa3
wait
xlatb
xor byte [edx - 0x49], dl
aam 5
mov edi, dword [edi]
cmp dword fs:[ebp - 0x389cfb6c], ebx
add eax, 0x10328085
xor dh, byte [ebp + eax - 0xf69427c]
nop
jo 0x411424
or dword [edi], ecx
xchg ebx, eax
push edi
mov eax, ecx
push esp
inc ecx
xchg edx, eax
lea edi, [esi + 0x2f8132c0]
invalid
Function at 0x4136d4
Capabilities:
Encode data using xor

Disassembly:
and dword [eax], eax
jbe 0x4136df
jmp dword [edx + 0x57bd3636]
mov eax, dword [0xb0412d49]
mov bl, 0x51
loope 0x41372a
inc esi
fdiv dword [edi + 0x30]
pop esi
loopne 0x413740
push cs
sbb eax, 0xd8caf018
imul edx, dword [eax + 0x21b9bc32], 0x4146a729
imul dword [esp + ecx*8 - 0x6b8cc167]
pop edi
mov edi, 0xb216759a
or eax, esi
cmp esi, ecx
mov es, edx
invalid
xor al, 0x4c
int1
ja 0x413749
rcr byte [ebx + 0x46b2ffbf], cl
cdq
push edx
lahf
wait
jbe 0x413712
xchg byte [edi], bl
fsubr qword [edx - 0xf]
int1
lodsb al, byte [esi]
loop 0x413772
xor dword [eax - 0x41], eax
add dword [ebx], esi
adc byte [ebx + esi], 0x8e
in eax, 0x21
dec ebp
je 0x4136f2
fsub qword [eax - 0x6e5a799c]
movsd dword es:[edi], dword [esi]
xchg ecx, eax
mov bl, 0x51
ret 0xd3a7
jg 0x41373e
sub eax, 0x28d068e1
sub dword [edx + esi*8 + 0x21], edi
adc dword [eax + 0x74], 0xffffff87
push eax
loop 0x413728
pop edx
dec eax
lea esi, [ebx - 0x178f8a60]
jbe 0x41376a
xchg ebp, eax
push ecx
adc al, 0xf7
and eax, 0xc2df0464
jecxz 0x4137c6
add al, 0xdf
ret 0x56e3
sub dword [edx], eax
mov eax, dword [0x9ae99adf]
add eax, 0xb1a1cd15
inc eax
mov cl, 0x40
nop
dec ecx
xchg esp, eax
mov bl, 0xd9
push 0x985557b0
mov al, 0x57
push ebp
cwde
dec eax
push esi
aas
pop es
and eax, 0x70d0a1b0
xor dword cs:[eax + 0x21c7f014], 0x4fe0d19c
test byte [esi - 0x43fff15f], bh
jo 0x41377b
and dword [ecx + edx*8 - 0x417bb020], ebx
mov eax, dword [0x70bc000e]
fcom dword [esi + 0x60]
push esi
pushal
push edi
daa
inc eax
xor ecx, 0xe161c120
cmc
je 0x4137ff
add byte [eax], dl
outsd dx, dword [esi]
xchg esp, eax
push eax
sbb edi, dword [ebp + 0x18]
mov al, byte [0x851a80bc]
dec edx
xchg dword [esi + ebx*8], esp
popal
test eax, 0xf4d820a5
xlatb
jae 0x413796
jo 0x413783
int 0x2e

Function at 0x452519
Capabilities:
Encode data using xor

Disassembly:
add esi, dword [edi + 0x589c2e6e]
lahf
jb 0x452578
cmp ebx, dword [ecx + 0x24]
pop eax
pop edx
mov bl, 0x91
mov byte [0x1ac9e9e8], al
call 0xb75fef07
or dword [ebx + ecx*8 + 0x2f2a863a], ecx
daa
mov cl, 0x6a
sbb esi, dword [edx]
outsd dx, dword [esi]
rcl dword [ebx]
pop es
call 0xb75fef07
or dword [ebx + ecx*8 + 0x2f2a863a], ecx
daa
mov cl, 0x6a
sbb esi, dword [edx]
outsd dx, dword [esi]
rcl dword [ebx]
pop es
dec edx
arpl word [eax - 0x7b], sp
out 0x91, al
pop esp
loop 0x452507
nop
pushfd
mov byte [ebx + 0x59], bh
jg 0x45252f
xor ch, byte [edi - 0x30e4cc0b]
sar al, 0x32
push dx
cmp ebx, dword [edi + ebp]
scasd eax, dword es:[edi]
sbb eax, edx
outsb dx, byte [esi]
wait
test dh, ch
sub al, 0x43
xor al, byte [edi + 0x33e703f6]
dec eax
sbb al, 0x77
mul dword [eax + 0x2ef4215]
int1
fdiv qword [ebp + 0x5695d63c]
xchg esi, eax
jne 0x452516
dec esp
mov al, 0x9d
invalid
fstp qword [ecx]
scasd eax, dword es:[edi]
invalid
Function at 0x4a8bc4
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
daa
adc bl, byte [ecx - 0x20]
mov al, 0xe1
pop esi
test esp, ecx
add al, 0x68
stosd dword es:[edi], eax
test al, 3
dec ecx
or ah, byte [eax - 0x41438eb3]
add ecx, dword [ecx + 0xa]
mov al, byte [0xbebc714d]
and al, 0x3d
in eax, 0x54
xor byte [esi - 0x26], al
mov dl, byte [ecx]
add bh, ah
dec eax
jno 0x4a8bd2
xor eax, 0xc2572aa0
pop edx
push eax
jnp 0x4a8c29
invalid
movsb byte es:[edi], byte [esi]
pop edx
and byte [esi + 0x45], cl
mov es, word [esi + 0x10]
je 0x4a8c5c
lahf
sub eax, 0xee001233
mov edx, 0x73ea0ff9
test al, 0x81
cmpsd dword [esi], dword es:[edi]
mov esi, 0xbb64bf68
push cs
dec edx
cmp eax, 0x513e3f6c
cmc
cmc
pop ebx
push es
mov edx, 0x639191d4
mov dl, 0xd1
invalid
dec ebx
pop ebx
mov dword [ebx + 0x89599c7], ebx
salc
stosd dword es:[edi], eax
pop es
mov al, byte [0xfa660174]
add byte [edx + 0x5a], 0xcb
mov al, 0xea
fsub st(6), st(0)
invalid

Function at 0x5fb073
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x4c052c64
and eax, 0x39c8835a
pop ebx
loope 0x5fafd7
inc ebp
adc eax, dword [ecx + 0x7e]
fsubr qword [ecx + 5]
pop edx
lodsb al, byte [esi]
test dword [eax], esp
idiv ch
leave
add esi, dword [ebp - 0x6f]
xor eax, 0x9a6a0a7f
push es
ficomp dword [edi + 0x6f97cd60]
and bl, dh
mov bl, 0x77
mov esi, 0x7eed47c4
dec ecx
fidiv word [ebx + 0x47c4be77]
in eax, dx
jle 0x5fb029
xchg ecx, eax
sub byte [edi - 0x4f], dl
jmp 0x5fafab
test dword [eax + edx*2 + 0x78749c7b], esp
rol dword [esi - 0x13cd15d0], 0xb5
xchg edx, eax
xor dl, ch
xor ch, ah
mov ch, 0x92
add edi, ebp
or dh, bh
jae 0x5fafdd
fmul qword [edi + 0x16]
pushfd
test dword [0x53701cca], ebp
dec ecx
loopne 0x5fb04d
popfd
ljmp 0x1543
int3
pop esi
sbb al, 0x67
mov dword [ecx + ebx*8], edx
je 0x5fb09d
xchg ebp, eax
out 0xb1, eax
mov ss, word [edi - 0x284c7981]
push esi
xchg esp, eax
imul eax, dword [edx], 0xe27d3a6b
xor al, 0x84
insb byte es:[edi], dx
stosd dword es:[edi], eax
push cs
pop esp
jbe 0x5fb07c
cdq
insb byte es:[edi], dx
mov gs, word [ebx + 0x6a]
push eax
mov esi, cs
imul eax, dword [0x35bbb947], 0xffffffe4
and eax, 0x554c645c
jns 0x5fb032
and bl, byte [0x5497c963]
sbb esi, dword [ebx]
push edx
jmp 0xd00d9541

Function at 0x61f52c
Capabilities:
Encode data using xor

Disassembly:
dec esi
push ds
xchg ebp, eax
cmp eax, dword [edx - 0x36922115]
mov dword [edi], edx
invalid
jle 0x61f568
sti
lodsd eax, dword [esi]
mov esp, 0x98086c24
lahf
dec edx
mov esp, 0xf6e77db7
push 0x39d4dd43
loopne 0x61f4f9
adc al, 0x18
popfd
push ds
sar byte [ebx + 0x7d], cl
sub byte [ebx - 0x5c77f217], bl
sub ebp, esi
or al, 0xdc
popfd
retf
lea edx, [eax + 0x74dacc9d]
and dword [eax], esp
bound ebx, qword [ebx - 0xdadcddd]
call 0xe7105d07
invalid
Function at 0x64fdae
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6542f0
cmp edx, dword [eax]
je 0x64fdd0
add eax, 8
inc ecx
cmp eax, 0x654380
jl 0x64fdc1
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6542f0]
jne 0x64fefe
mov eax, dword [0xa57934]
cmp eax, 1
je 0x64fed8
test eax, eax
jne 0x64fe01
cmp dword [0x654234], 1
je 0x64fed8
cmp edx, 0xfc
je 0x64fefe
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64fe38
invalid
invalid
pop esp
Function at 0x40fa79
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x40fb4e
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x40fb4e
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x40fb4e
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x40fad4
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x40fb4e
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40fb19
test dl, dl
je 0x40fb15
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40fb19
add ecx, 2
add eax, 2
test dl, dl
jne 0x40faf9
xor eax, eax
jmp 0x40fb1e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40fb30
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x40fb3b
inc esi
cmp esi, ebp
jae 0x40fb4e
mov edx, dword [esp + 0x10]
jmp 0x40faef
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x40fdb2
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x40fdbd
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x40fdd1
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x40fdd5
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x40fe0e
cmp dword [edi + ecx], 0x4550
jne 0x40fe0e
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x40fe0e
test byte [edi + ecx + 0x16], 2
je 0x40fe0e
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x40fe13
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x40fe4f
xor eax, eax
jmp 0x40fe32
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x40fe58
inc edx
movzx eax, dx
cmp eax, edi
jl 0x40fe32
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x40fe5e
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x40fe96
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x40fea4
add edx, 0x20
cmp eax, edx
jne 0x40feb5
test bx, bx
je 0x40feea
add esi, 2
add edi, 2
jmp 0x40fe86
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x40fec3
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x40fed1
add edx, 0x20
sub ecx, edx
je 0x40feea
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x40fe7f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40ff03
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x40ffdc
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x40ffdc
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x40ffdc
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x40ff62
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x40ffdc
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40ffa7
test dl, dl
je 0x40ffa3
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40ffa7
add ecx, 2
add eax, 2
test dl, dl
jne 0x40ff87
xor eax, eax
jmp 0x40ffac
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40ffbe
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x40ffc9
inc esi
cmp esi, ebp
jae 0x40ffdc
mov edx, dword [esp + 0x10]
jmp 0x40ff7d
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
Function at 0x40fff8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x48
push ebx
push ebp
push esi
mov esi, dword [esp + 0x58]
push edi
test esi, esi
je 0x410120
xor eax, eax
mov word [esp + 0x54], ax
mov byte [esp + 0x38], al
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0x65006b
mov dword [esp + 0x44], 0x6e0072
mov dword [esp + 0x48], 0x6c0065
mov dword [esp + 0x4c], 0x320033
mov dword [esp + 0x50], 0x64002e
mov dword [esp + 0x54], 0x6c006c
mov dword [esp + 0x2c], 0x4d746547
mov dword [esp + 0x30], 0x6c75646f
mov dword [esp + 0x34], 0x6e614865
mov dword [esp + 0x38], 0x41656c64
mov dword [esp + 0x14], 0x65657246
mov dword [esp + 0x18], 0x7262694c
mov dword [esp + 0x1c], 0x797261
mov dword [esp + 0x20], 0x74726956
mov dword [esp + 0x24], 0x466c6175
mov dword [esp + 0x28], 0x656572
call fcn.0041025a
add esp, 4
mov ebx, eax
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.0041012c
mov ebp, eax
test ebp, ebp
je 0x410120
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.0041012c
mov edi, eax
test edi, edi
je 0x410120
lea eax, [esp + 0x1c]
push eax
push ebx
call fcn.0041012c
mov ebx, eax
test ebx, ebx
je 0x410120
mov ecx, dword [esi + 0x3c]
mov eax, 0x2000
test word [ecx + esi + 0x16], ax
je 0x4100fc
mov eax, dword [ecx + esi + 0x28]
test eax, eax
je 0x4100fc
push 0
push 0
push esi
add eax, esi
call eax
push edi
push ebp
push esi
call fcn.0041020d
add esp, 0xc
push 0x8000
push 0
push esi
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x48
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48
ret 4

Function at 0x41012c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x410201
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x410201
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x410201
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x410187
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x410201
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4101cc
test dl, dl
je 0x4101c8
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4101cc
add ecx, 2
add eax, 2
test dl, dl
jne 0x4101ac
xor eax, eax
jmp 0x4101d1
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4101e3
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x4101ee
inc esi
cmp esi, ebp
jae 0x410201
mov edx, dword [esp + 0x10]
jmp 0x4101a2
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
Function at 0x41025a
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x410292
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x4102a0
add edx, 0x20
cmp eax, edx
jne 0x4102b1
test bx, bx
je 0x4102e6
add esi, 2
add edi, 2
jmp 0x410282
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x4102bf
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x4102cd
add edx, 0x20
sub ecx, edx
je 0x4102e6
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x41027b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret