joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d83f0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
push dword [0x10120e84]
mov edi, dword [esp + 0x1c]
mov ebp, ecx
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100d841c
cmp dword [eax], esi
je 0x100d8459
mov eax, dword [eax + 8]
test eax, eax
jne 0x100d8411
mov eax, dword [ebx]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx]
cmp byte [eax + 0x38], 0
je 0x100d84a8
mov dword [edi + 0x14], 0
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x100d848d
mov dword [ecx + 0x14], edi
mov dword [eax + 0x40], edi
mov eax, dword [ebx]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
mov esi, dword [eax + 4]
mov eax, dword [ebx]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test esi, esi
je 0x100d8428
mov eax, dword [ebx]
cmp byte [eax + 0x38], 0
jne 0x100d8428
mov byte [eax + 0x38], 1
mov eax, dword [ebx]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
mov dword [eax + 0x3c], edi
mov dword [eax + 0x40], edi
mov eax, dword [ebx]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
mov byte [eax + 0x38], 1
mov eax, dword [ebx]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx]
add eax, 0x44
mov dword [edi + 0x14], 0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x100d84d0
mov dword [ecx + 0x14], edi
jmp 0x100d84d2
mov dword [eax], edi
mov dword [eax + 4], edi
mov ecx, dword [ebp + 0x14]
push 0
push dword [ebx]
call fcn.100da1c0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
Function at 0x100da2c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x24]
push 0
push 0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call fcn.100d1380
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, dword [esp + 0x28]
mov dword [edi], eax
mov dword [edi + 4], esi
cmp eax, 0x40
jne 0x100da328
call fcn.100d1380
mov dword [edi], 0x2746
jmp 0x100da33a
cmp eax, 0x4d2
jne 0x100da33d
call fcn.100d1380
mov dword [edi], 0x274d
mov dword [edi + 4], eax
test ebx, ebx
je 0x100da34b
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0xc]
mov dword [edi], 0
mov dword [edi + 4], 0x10117038
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x100dbe40
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0
push 0
push 1
push 0
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 4], edi
test edi, edi
jne 0x100dbe91
call esi
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [esp + 0x14], esi
call fcn.100d1380
mov dword [esp + 0x18], eax
test esi, esi
jne 0x100dbf4e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp + 8], eax
mov dword [ebx + 8], eax
cmp dword [ebp + 8], 0
jne 0x100dbecc
call esi
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [esp + 0x14], esi
call fcn.100d1380
mov dword [esp + 0x18], eax
test esi, esi
jne 0x100dbf5d
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0
push ebx
push 0x100dc550
push dword [esp + 0x34]
push 0
call fcn.10091e83
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x18
mov dword [ebp + 4], eax
test eax, eax
jne 0x100dbf34
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov dword [esp + 0x24], eax
call dword [edx]
test edi, edi
je 0x100dbf15
push edi
call esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x100dbf1f
push eax
call esi
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
call fcn.100d1380
mov dword [esp + 0x18], eax
test ebx, ebx
jne 0x100dbf6c
test edi, edi
je 0x100dbf44
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
push str.thread.entry_event
lea eax, [esp + 0x18]
push eax
call fcn.100d0ff0
push str.thread.exit_event
lea eax, [esp + 0x18]
push eax
call fcn.100d0ff0
push str.thread
lea eax, [esp + 0x18]
push eax
call fcn.100d0ff0
int3
Function at 0x100e13d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x20], eax
mov edi, ecx
add eax, 8
push eax
push 0x4c
mov dword [esp + 0x18], eax
call fcn.100cfef0
mov ebx, dword [esp + 0x38]
mov esi, eax
add esp, 8
xor ecx, ecx
xor edx, edx
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x100e140d
mov ecx, dword [ebx + 8]
mov edx, eax
lock inc dword [eax + 8]
mov al, byte [ebx + 4]
lea ebp, [edx + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x100e3460
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x20], al
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
test edx, edx
je 0x100e1469
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], edx
lock inc dword [ebp]
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x2c], eax
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esi + 0x38], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x34], eax
mov eax, dword [ecx]
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x3c], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x40], eax
mov eax, dword [ecx + 8]
mov dword [esi + 0x44], eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ecx + 0xc]
mov dword [esi + 0x48], eax
test edx, edx
je 0x100e14d3
or eax, 0xffffffff
lock xadd dword [ebp], eax
jne 0x100e14d3
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 4]
test byte [ebx + 4], 0x10
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], ecx
je 0x100e150b
test ecx, ecx
jne 0x100e150b
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
push ecx
push ecx
mov ecx, dword [edi + 4]
push esi
call fcn.100d1aa0
jmp 0x100e159b
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
mov ecx, dword [ebx]
push 0
cmp ecx, 0xffffffff
jne 0x100e152d
mov ecx, dword [edi + 4]
push 0x2719
push esi
call fcn.100d1aa0
jmp 0x100e159b
mov eax, dword [esp + 0x3c]
push esi
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0
push eax
push 1
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x100e156a
mov eax, 0x2746
jmp 0x100e1577
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x100e1592
cmp eax, 0x3e5
je 0x100e1592
push dword [esp + 0x3c]
mov ecx, dword [edi + 4]
push eax
push esi
call fcn.100d1aa0
jmp 0x100e159b
mov ecx, dword [edi + 4]
push esi
call fcn.100d1b20
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
call fcn.100e3860
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x100e1600
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
mov esi, dword [eax + 8]
cmp esi, 0xffffffff
jne 0x100e1621
call fcn.100d1380
mov ecx, dword [edi]
pop edi
add ecx, 8
pop esi
jmp fcn.100e29c0
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 2
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
call fcn.100d1380
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [edi]
pop edi
add ecx, 8
pop esi
jmp fcn.100e29c0
Function at 0x100e1a40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100efe0d
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push esi
push edi
mov eax, dword [0x101170e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 8]
push dword [0x10120e98]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100e1a8f
cmp dword [eax], esi
je 0x100e1bf3
mov eax, dword [eax + 8]
test eax, eax
jne 0x100e1a80
mov esi, dword [ebp + 0xc]
push esi
push 0x54
mov dword [ebp - 0x38], esi
call fcn.100cfef0
add esp, 8
mov edi, eax
lea ecx, [edi + 0x20]
mov dword [ebp - 4], 1
push esi
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0x100e3390
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x1c], 0
call fcn.100e1d90
mov esi, dword [ebp - 0x10]
mov ecx, esi
push edi
push ebx
call fcn.100d83f0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
test al, al
je 0x100e1bdf
mov eax, dword [ebx]
push dword [0x10120e98]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x10120e98]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
lea ebx, [edi + 0x20]
push ebx
lea ecx, [ebp - 0x6c]
call fcn.100e1d90
mov byte [ebp - 4], 5
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x2c], eax
mov esi, edi
test edi, edi
je 0x100e1b87
mov ecx, ebx
call fcn.100e2210
xor esi, esi
mov dword [ebp - 0x24], 0
test edi, edi
je 0x100e1b87
lea eax, [ebp - 0x6c]
push eax
push 0x54
push edi
call fcn.100cff50
add esp, 0xc
xor edi, edi
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x14], 0
je 0x100e1ba1
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 6
push eax
push eax
call fcn.100e1770
add esp, 8
xchg dword [ebp + 0xc], eax
lea ecx, [ebp - 0x6c]
call fcn.100e2210
test esi, esi
je 0x100e1bb5
lea ecx, [esi + 0x20]
call fcn.100e2210
test edi, edi
je 0x100e1bc8
lea eax, [ebp - 0x6c]
push eax
push 0x54
push edi
call fcn.100cff50
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.100d5d00
push dword [ebp - 0x18]
push dword [0x10120e98]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [eax + 4], 0
je 0x100e1a8f
push 0
lea ecx, [ebp + 0xb]
call fcn.100d5480
mov eax, dword [ebp + 0xc]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.100e1770
add esp, 8
xchg dword [ebp + 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100e44b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100e44dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100e44dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x105efd44
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret
Function at 0x40e604
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40e6b8
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040e594
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40e691
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e6c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40e6df
test ebp, ebp
je 0x40e6df
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40e6e7
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40e727
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40e783
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40e77e
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40e769
test dl, dl
je 0x40e765
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40e769
add ecx, 2
add eax, 2
test dl, dl
jne 0x40e749
xor eax, eax
jmp 0x40e76e
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e78d
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40e736
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40e7a4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040e604
test eax, eax
jne 0x40e7bc
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040e6c4
mov esi, eax
test esi, esi
jne 0x40e7f2
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40e80c
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x40e904
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0040e604
mov esi, eax
test esi, esi
jne 0x40e922
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0040e6c4
mov dword [esp + 0x18], eax
test eax, eax
je 0x40e91a
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0040e6c4
mov dword [esp + 0x34], eax
test eax, eax
je 0x40e91a
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0040e6c4
mov dword [esp + 0x28], eax
test eax, eax
je 0x40e91a
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0040e6c4
mov dword [esp + 0x30], eax
test eax, eax
je 0x40e91a
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x40eae9
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x40eae9
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x40ea4c
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x40eacd
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x40ea6f
movzx esi, ax
jmp 0x40ea74
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x40ea93
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x40eaa2
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x40eaf6
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x40ea64
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x40ea29
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x40eb1f
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x40eb1f
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x40eb04
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x40eb34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0040e604
mov esi, eax
test esi, esi
je 0x40ebf0
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0040e6c4
mov ebp, eax
test ebp, ebp
je 0x40ebef
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0040e6c4
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x40ebef
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x40ebef
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40ebee
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x40ebd4
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x40ee6d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40ee90
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x40ee90
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40ee9a
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x40eedc
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40ef3e
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40ef39
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40ef24
test dl, dl
je 0x40ef20
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40ef24
add ecx, 2
add eax, 2
test dl, dl
jne 0x40ef04
xor eax, eax
jmp 0x40ef29
sbb eax, eax
or eax, 1
test eax, eax
je 0x40ef4a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x40eef1
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4480d0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x51031b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00503ac9
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x448152
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.005008f1
mov eax, dword [eax]
push 0x6682c8
push eax
call fcn.004d53f4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00503d54
test bl, bl
je 0x448152
push 0x6682c8
lea ecx, [esp + 0xc]
call fcn.005040e4
push 0x66be44
lea ecx, [esp + 0xc]
call fcn.005040e4
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x44818e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00503d54
jmp 0x448259
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x448212
lea edx, [esp + 0x7c]
push 0x66be40
push edx
call fcn.004d53f4
add esp, 8
test eax, eax
je 0x448212
lea eax, [esp + 0x7c]
push 0x66be3c
push eax
call fcn.004d53f4
add esp, 8
test eax, eax
je 0x448212
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4481a2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00503d54
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4494d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x449532
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc