joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50df70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + 0x124]
mov eax, dword [esp + 0x120]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x50dfa2
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], 0x100
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x50e002
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x50dfd9
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x50e0b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x50e14c
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x50e0db
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret
Function at 0x50fc00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowTextLengthW_1]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x50fc39
push 6
call fcn.00554b84
add esp, 4
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fmul qword [0x58a4be]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x58a4be]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.0050fbd9
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.00555600
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x50fc98
push ebx
call fcn.00554b7e
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
mov eax, dword [ebp - 8]
test eax, eax
je 0x50fcac
add eax, 8
push eax
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowTextW_1]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x50fccc
push 6
call fcn.00554b84
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x50fce3
mov eax, 0x58a4c6
jmp 0x50fd02
mov eax, dword [ebp - 8]
test eax, eax
je 0x50fcfd
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00554b78
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x50fd02
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x50fd13
push ebx
call fcn.00554b7e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x51174e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0x80000301
push 0
push 0x104
push 1
mov ebx, 0x1bc
call fcn.00555600
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5117a1
push ebx
call fcn.00554b7e
add esp, 4
pop eax
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x5117b6
mov dword [ebp + 8], 3
cmp dword [ebp + 8], 1
jl 0x5117d1
cmp dword [ebp + 8], 8
jg 0x5117d1
mov eax, 1
jmp 0x5117d6
mov eax, 0
test eax, eax
je 0x5118a1
mov eax, dword [ebp + 8]
cmp eax, 1
jl 0x5117eb
cmp eax, 9
jl 0x5117f8
push 9
call fcn.00554b84
add esp, 4
dec eax
call 0x5117fe
pop ebx
add ebx, dword [eax*4 + 0x58a508]
jmp ebx
cmp dword [ebp + 8], 9
jne 0x5118f1
mov dword [ebp - 0x10], esp
push 0x104
mov eax, dword [ebp - 4]
test eax, eax
je 0x5118bd
add eax, 8
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x5118da
push 6
call fcn.00554b84
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
mov eax, 0
setg al
mov dword [ebp - 0xc], eax
jmp 0x5119e3
cmp dword [ebp + 8], 0xa
jne 0x511941
mov dword [ebp - 0x10], esp
push 0x104
mov eax, dword [ebp - 4]
test eax, eax
je 0x51190d
add eax, 8
push eax
call dword [0x58ecb9]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x51192a
push 6
call fcn.00554b84
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
mov eax, 0
setg al
mov dword [ebp - 0xc], eax
jmp 0x5119e3
cmp dword [ebp + 8], 0xb
jne 0x511991
mov dword [ebp - 0x10], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x511958
add eax, 8
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x51197a
push 6
call fcn.00554b84
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
mov eax, 0
setg al
mov dword [ebp - 0xc], eax
jmp 0x5119e3
cmp dword [ebp + 8], 0xc
jne 0x5119e3
mov dword [ebp - 0x10], esp
push 0
push 0x20
mov eax, dword [ebp - 4]
test eax, eax
je 0x5119b2
add eax, 8
push eax
push 0
call dword [sym.imp.shell32.dll_SHGetSpecialFolderPathW]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x5119d4
push 6
call fcn.00554b84
add esp, 4
test eax, eax
je 0x5119e3
mov dword [ebp - 0xc], 1
mov eax, 0x58a4c6
jmp 0x5119ed
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5119fe
push ebx
call fcn.00554b7e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x531244
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jle 0x5312cb
push dword [ebp + 0xc]
call fcn.005166c7
mov dword [ebp - 4], eax
push SysStringLen
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jne 0x531277
mov eax, 0x58a4d0
push eax
push 1
mov ebx, 0x194
call fcn.005556e0
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
mov eax, 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_WriteFile_1]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x5312c6
push 6
call fcn.00554b84
add esp, 4
jmp 0x5312d5
mov eax, 0
jmp 0x5312d5
mov esp, ebp
pop ebp
ret 8

Function at 0x531385
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jg 0x5313a9
mov eax, 0x58a4d0
jmp 0x53146b
push 0x80000301
push 0
push dword [ebp + 0xc]
push 1
mov ebx, 0x1bc
call fcn.00555600
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5313dc
push ebx
call fcn.00554b7e
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
test eax, eax
je 0x531401
add eax, 8
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_ReadFile_1]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x531421
push 6
call fcn.00554b84
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x53144c
push 0
push 1
push 2
push dword [ebp + 8]
call fcn.00531483
mov eax, 0x58a4d0
jmp 0x53146b
mov eax, dword [ebp - 4]
test eax, eax
je 0x531466
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00554b78
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x53146b
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x53147c
push ebx
call fcn.00554b7e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x53894a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x538962
add eax, 8
push eax
call dword [sym.imp.shlwapi.dll_PathFileExistsW]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x53897f
push 6
call fcn.00554b84
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
mov eax, 0
sete al
jmp 0x538993
mov esp, ebp
pop ebp
ret 4

Function at 0x538b88
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x14], 1
jne 0x538ba7
mov dword [ebp + 0x14], 0
jmp 0x538bc4
cmp dword [ebp + 0x14], 2
jne 0x538bbd
mov dword [ebp + 0x14], 7
jmp 0x538bc4
mov dword [ebp + 0x14], 1
mov dword [ebp - 4], esp
push dword [ebp + 0x14]
mov eax, 0x58a4c6
test eax, eax
je 0x538bd6
add eax, 8
push eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x538be3
add eax, 8
push eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x538bf0
add eax, 8
push eax
mov eax, 0x58d418
test eax, eax
je 0x538bfd
add eax, 8
push eax
push 0
call dword [sym.imp.shell32.dll_ShellExecuteW_1]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x538c1f
push 6
call fcn.00554b84
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jne 0x538c3b
mov eax, 0
jmp 0x538c45
mov eax, 1
jmp 0x538c45
mov esp, ebp
pop ebp
ret 0x14
Function at 0x541eb6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.user32.dll_GetAsyncKeyState_1]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x541ef1
push 6
call fcn.00554b84
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00555360
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x541f54
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00555bd0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.user32.dll_GetAsyncKeyState_1]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x541f78
push 6
call fcn.00554b84
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00555360
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x541fdb
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00555bd0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.user32.dll_GetAsyncKeyState_1]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x541fff
push 6
call fcn.00554b84
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00555360
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x542062
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00555bd0
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x54206a
mov esp, ebp
pop ebp
ret
Function at 0x5452a9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.user32.dll_GetWindowTextLengthW_1]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x5452ef
push 6
call fcn.00554b84
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fmul qword [0x58a4be]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
fadd qword [0x58a4be]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
call fcn.0050fbd9
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x1bc
call fcn.00555600
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x54534e
push ebx
call fcn.00554b7e
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
mov eax, dword [ebp - 8]
test eax, eax
je 0x54536d
add eax, 8
push eax
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.user32.dll_GetWindowTextW_1]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x54538f
push 6
call fcn.00554b84
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x5453a6
mov eax, 0x58a4c6
jmp 0x5453c5
mov eax, dword [ebp - 8]
test eax, eax
je 0x5453c0
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00554b78
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x5453c5
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x5453d6
push ebx
call fcn.00554b7e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x568587
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5685c9
call fcn.0056b666
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
cmp eax, edi
je 0x5685c9
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource_1]
cmp eax, edi
jne 0x5685c0
xor eax, eax
jmp 0x5685d1
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005685d7
pop edi
pop esi
pop ebx
ret 4
Function at 0x5692de
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x56cf44
call fcn.0055b2e0
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.0056b666
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x56931d
call fcn.0056b666
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.kernel32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.kernel32.dll_LoadResource_1]
mov edi, eax
test edi, edi
je 0x56932b
push edi
call dword [sym.imp.kernel32.dll_LockResource_1]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x569339
or eax, 0xffffffff
jmp 0x569421
mov ecx, esi
call fcn.00569254
mov dword [ebp - 0x14], eax
call fcn.00566bd2
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x569370
push dword [ebp - 0x14]
call dword [sym.imp.user32.dll_IsWindowEnabled_1]
test eax, eax
je 0x569370
push edi
push dword [ebp - 0x14]
call dword [sym.imp.user32.dll_EnableWindow_1]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.00566b86
push dword [ebp - 0x14]
call fcn.005666b8
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00568fec
cmp eax, edi
je 0x5693e3
test byte [esi + 0x24], 0x10
je 0x5693b1
push 4
mov ecx, esi
pop ebx
call fcn.005660b8
test ah, 1
je 0x5693a9
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.005686d9
cmp dword [esi + 0x1c], edi
je 0x5693e3
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.005660ec
jmp 0x5693e3
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x5693f7
push 1
push dword [ebp - 0x14]
call dword [sym.imp.user32.dll_EnableWindow_1]
cmp dword [ebp - 0x14], edi
je 0x569410
call dword [sym.imp.user32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x569410
push dword [ebp - 0x14]
call dword [sym.imp.user32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0056928e
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4067b0
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x3c]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 4], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x406790
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov edx, eax
mov dword [ebx], eax
xor eax, eax
test edx, edx
je 0x406810
add esp, 0x28
pop ebx
ret
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
add esp, 0x28
pop ebx
ret
Function at 0x40e7c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, eax
sub esp, 0x34
mov edi, dword [eax + 0x2a4]
mov edx, dword [esi + 0x810]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 0x2a8]
mov dword [esp], eax
sub eax, edi
sar eax, 3
mov ecx, eax
mov dword [esp + 8], eax
mov eax, dword [esi + 0x2b0]
sub eax, dword [esi + 0x2ac]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x294]
mov dword [esp + 0x1c], eax
shl eax, 4
add eax, dword [esi + 0x290]
test ecx, ecx
mov ebx, eax
mov dword [esp + 0x20], eax
lea eax, [edx + 0x11e8]
mov edx, dword [edx + 0x11e8]
mov dword [esp + 0x28], edx
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
je 0x40ea0e
mov eax, dword [esi + 0x2cc]
mov edx, ebx
xor ebp, ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
jmp 0x40e884
mov eax, dword [esp]
mov dword [edx], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
mov eax, dword [esp]
mov dword [esp + 0x28], eax
add dword [esp + 0xc], ecx
add ebp, 1
add edx, 0x10
cmp dword [esp + 8], ebp
je 0x40e92e
mov eax, dword [edi + ebp*8]
movzx esi, word [edi + ebp*8 + 6]
cmp dword [esp + 0x10], ebp
lea ecx, [eax - 3]
lea ebx, [esi + 3]
mov dword [esp], ecx
movzx ecx, word [edi + ebp*8 + 4]
mov dword [edx + 8], ebx
mov dword [edx + 0xc], 0
mov word [esp + 6], cx
mov dword [edx + 4], ecx
je 0x40e980
cmp eax, 3
ja 0x40e854
test ecx, ecx
mov dword [edx + 0xc], eax
jne 0x40e9c5
cmp eax, 3
je 0x40e9f0
mov esi, dword [esp + eax*4 + 0x28]
sub eax, 1
cmp eax, 2
mov dword [edx], esi
ja 0x40e859
xor ebx, ebx
cmp word [esp + 6], 0
sete bl
add eax, ebx
je 0x40e870
cmp eax, 3
je 0x40e9d1
cmp eax, 1
mov esi, dword [esp + eax*4 + 0x28]
je 0x40e9e0
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
add dword [esp + 0xc], ecx
add ebp, 1
add edx, 0x10
cmp dword [esp + 8], ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], esi
jne 0x40e884
mov eax, dword [esp + 8]
mov edi, dword [esp + 8]
shl eax, 4
add eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
sub edx, dword [esp + 0xc]
mov dword [eax + 0xc], 0
mov dword [eax], 0
mov dword [eax + 4], edx
mov dword [eax + 8], 0
mov eax, dword [esp + 0x1c]
lea eax, [eax + edi + 1]
mov edi, dword [esp + 0x14]
mov dword [edi + 0x294], eax
add esp, 0x34
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [esp + 0x14]
mov ebx, dword [ebx + 0x2c8]
cmp ebx, 1
je 0x40e9b0
cmp ebx, 2
jne 0x40e8b6
add esi, 0x10003
mov dword [edx + 8], esi
jmp 0x40e8b6
add ecx, 0x10000
cmp eax, 3
mov dword [edx + 4], ecx
ja 0x40e854
mov dword [edx + 0xc], eax
sub eax, 1
mov esi, dword [esp + eax*4 + 0x28]
jmp 0x40e8d6
mov eax, dword [esp + 0x28]
lea esi, [eax - 1]
jmp 0x40e90a
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
jmp 0x40e90e
mov eax, dword [esp + 0x28]
xor ebx, ebx
sub eax, 1
cmp word [esp + 6], 0
mov dword [edx], eax
mov eax, 2
sete bl
jmp 0x40e8ec
xor eax, eax
mov dword [esp + 0xc], 0
mov edi, ecx
jmp 0x40e939
Function at 0x4132e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov eax, dword [ebx + 0x90c]
test eax, eax
je 0x413322
lea ecx, [edx - 0x64]
cmp ecx, 7
jbe 0x413310
mov eax, 0xffffffc4
pop ebx
pop esi
ret
mov eax, 1
shl eax, cl
test al, 0xfd
je 0x413300
mov dword [ebx + 4], 1
cmp edx, 0xca
jbe 0x413370
cmp edx, 0x192
ja 0x4133a0
cmp edx, 0x191
jae 0x413355
cmp edx, 0x190
jne 0x413387
test esi, esi
je 0x413355
mov ecx, dword [ebx + 0x288]
mov eax, 0xffffffd8
test ecx, ecx
jne 0x413305
add ebx, 0xc
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ebx
pop ebx
pop esi
jmp fcn.00412b80
cmp edx, 0xc8
jae 0x413355
cmp edx, 0x6b
ja 0x413390
cmp edx, 0x64
jae 0x413355
cmp edx, 0xa
je 0x413355
mov eax, 0xffffffd8
pop ebx
pop esi
ret
lea eax, [edx - 0xa0]
cmp eax, 4
ja 0x413387
jmp 0x413355
cmp edx, 0x1f4
je 0x413355
jb 0x413387
lea eax, [edx - 0x3e8]
cmp eax, 0xc
jbe 0x413355
jmp 0x413387

Function at 0x416080
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov eax, dword [esp + 0x18]
mov ebx, dword [eax]
mov edi, dword [eax + 0x10]
mov ebp, dword [eax + 0x18]
mov esi, dword [eax + 0x14]
mov eax, dword [eax + 4]
sub eax, ebx
sar eax, 3
mov ecx, eax
mov dword [esp], eax
xor eax, eax
test ecx, ecx
je 0x4160e6
lea esi, [esi]
movzx edx, word [ebx + eax*8 + 4]
movzx ecx, word [ebx + eax*8 + 6]
cmp edx, 0x3f
jbe 0x416131
bsr edx, edx
add edx, 0x13
mov byte [edi + eax], dl
bsr edx, dword [ebx + eax*8]
cmp ecx, 0x7f
mov byte [ebp + eax], dl
jbe 0x416110
bsr ecx, ecx
add ecx, 0x24
mov byte [esi + eax], cl
add eax, 1
cmp dword [esp], eax
jne 0x4160b0
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x24]
cmp eax, 1
je 0x416140
cmp eax, 2
jne 0x416102
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x28]
mov byte [esi + eax], 0x34
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, byte [ecx + 0x4f8820]
mov byte [esi + eax], dl
add eax, 1
cmp dword [esp], eax
je 0x4160e6
movzx edx, word [ebx + eax*8 + 4]
movzx ecx, word [ebx + eax*8 + 6]
cmp edx, 0x3f
ja 0x4160bf
movzx edx, byte [edx + 0x4f88a0]
jmp 0x4160c5
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x28]
mov byte [edi + eax], 0x23
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x24]
jmp 0x4160f2
Function at 0x419790
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], ebx
pop ebx
jmp fcn.004181c0

Function at 0x4197f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov ebp, 1
push esi
push ebx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov ecx, dword [eax + 0xa8]
shl ebp, cl
cmp ebp, 0x20000
mov ecx, ebp
mov ebp, 0x20000
cmova ecx, ebp
cmp ebx, ecx
jbe 0x419833
pop ebx
mov eax, 0xffffffb8
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov ecx, esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004181c0