joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a3c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x41a3fa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
or eax, 0xffffffff
jmp 0x41a3fd
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x41a460
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x434440]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], ecx
push 0x42f9e6
lea ecx, [ebp - 0x210]
call fcn.00408950
push 0x42f9e6
lea ecx, [ebp - 0x20c]
call fcn.00408950
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x214], 0
mov ecx, dword [ebp + 8]
call fcn.00402e50
mov ecx, dword [ebp + 0xc]
call fcn.00402e50
cmp dword [ebp - 0x214], 0
jne 0x41a56c
push 0
push 1
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x224]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jge 0x41a4fe
mov dword [ebp - 0x214], 1
mov al, byte [ebp - 0x208]
mov byte [ebp - 0x228], al
cmp byte [ebp - 0x228], 0xa
je 0x41a520
cmp byte [ebp - 0x228], 0xd
je 0x41a51e
jmp 0x41a53f
jmp 0x41a54e
cmp dword [ebp - 0x21c], 0
jne 0x41a533
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x21c], 0
jmp 0x41a54e
mov ecx, dword [ebp - 0x21c]
add ecx, 1
mov dword [ebp - 0x21c], ecx
mov byte [ebp - 0x207], 0
lea edx, [ebp - 0x208]
push edx
lea ecx, [ebp - 0x210]
call fcn.0041b520
jmp 0x41a4bd
push 0
push 0x1ff
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x224]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x274c
jne 0x41a5a6
mov dword [ebp - 0x220], 0
cmp dword [ebp - 0x218], 0
jge 0x41a5b1
jmp 0x41a5da
mov eax, dword [ebp - 0x218]
mov byte [ebp + eax - 0x208], 0
lea ecx, [ebp - 0x208]
push ecx
lea ecx, [ebp - 0x20c]
call fcn.0041b520
cmp dword [ebp - 0x218], 0
jg 0x41a56c
lea ecx, [ebp - 0x210]
call fcn.00407570
push eax
mov ecx, dword [ebp + 8]
call fcn.0040d700
lea ecx, [ebp - 0x20c]
call fcn.00407570
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040d700
lea ecx, [ebp - 0x20c]
call fcn.00408990
lea ecx, [ebp - 0x210]
call fcn.00408990
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c0df
mov esp, ebp
pop ebp
ret 8
Function at 0x41a920
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x434440]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.0041aa20
test eax, eax
jne 0x41a966
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 4], 0xffffffff
xor eax, eax
jmp 0x41a9bb
push 0x10
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41a9a9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], 0xffffffff
xor eax, eax
jmp 0x41a9bb
push 0x2710
mov ecx, dword [ebp - 0x1c]
call fcn.0041a9d0
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041c0df
mov esp, ebp
pop ebp
ret 8

Function at 0x41aa20
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x434440]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
call fcn.00403e50
mov dword [ebp - 0xc], eax
push 0x10
push 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041c040
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x41aa60
mov dword [ebp - 0x24], 0
jmp 0x41aaaf
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3fffffff
jle 0x41aa82
mov dword [ebp - 0x28], 0
jmp 0x41aaa9
mov eax, dword [ebp - 4]
shl eax, 1
call fcn.0041e0b0
mov dword [ebp - 0x2c], esp
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
shl ecx, 1
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0041ade0
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], edx
mov eax, 2
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx + 4], 0xffffffff
jne 0x41ab0d
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41aafe
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x10]
mov edx, dword [eax]
mov dword [ecx + 4], edx
jmp 0x41ab0d
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
jmp 0x41ab24
movzx eax, word [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp + 0x10]
mov word [ecx + 2], ax
mov eax, 1
lea esp, [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041c0df
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41ac20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0xffffffff
jne 0x41ac37
or eax, 0xffffffff
jmp 0x41ac75
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x41ac6c
mov dword [ebp - 0xc], 0xffffffff
jmp 0x41ac72
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x41aec0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x41aed4
xor eax, eax
jmp 0x41af33
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0xffffffff
je 0x41af1d
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0041af40
test eax, eax
je 0x41af1d
cmp dword [ebp + 8], 0
jne 0x41af16
push 0x2710
mov ecx, dword [ebp - 4]
call fcn.0041a9d0
mov eax, 1
jmp 0x41af33
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
call fcn.0041a270
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x41bc5a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4357cc], 0
push esi
jne 0x41bbcd
call fcn.0041baf3
test eax, eax
je 0x41bc10
mov eax, dword [0x4357cc]
cmp eax, 1
jne 0x41bbee
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41bc10
pop esi
ret
push eax
call dword [0x4357d4]
test eax, eax
jne 0x41bc58
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41bc14
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4357cc]
call dword [0x4357d4]
mov edi, eax
test edi, edi
je 0x41bc39
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41bc55
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4357cc]
call dword [0x4357d0]
add edi, 0x10
cmp edi, esi
jb 0x41bc41
mov eax, edi
pop edi
pop esi
ret
jmp 0x41bbba

Function at 0x41c0df
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434440]
jne 0x41c0e9
repz ret
jmp fcn.0041f6d6
Function at 0x425612
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041ef40
and dword [ebp - 4], 0
cmp dword [0x436290], 0
mov ebx, eax
jne 0x4256c3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x425774
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x425774
push eax
call fcn.0041eece
mov dword [esp], 0x4304d8
push edi
mov dword [0x436290], eax
call esi
push eax
call fcn.0041eece
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x436294], eax
call esi
push eax
call fcn.0041eece
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x436298], eax
call esi
push eax
call fcn.0041eece
pop ecx
mov dword [0x4362a0], eax
test eax, eax
je 0x4256c3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041eece
pop ecx
mov dword [0x43629c], eax
mov eax, dword [0x43629c]
cmp eax, ebx
je 0x42571b
cmp dword [0x4362a0], ebx
je 0x42571b
push eax
call fcn.0041ef49
push dword [0x4362a0]
mov esi, eax
call fcn.0041ef49
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42571b
test edi, edi
je 0x42571b
call esi
test eax, eax
je 0x425712
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425712
test byte [ebp - 0xc], 1
jne 0x42571b
or dword [ebp + 0x10], 0x200000
jmp 0x425754
mov eax, dword [0x436294]
cmp eax, ebx
je 0x425754
push eax
call fcn.0041ef49
pop ecx
test eax, eax
je 0x425754
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x425754
mov eax, dword [0x436298]
cmp eax, ebx
je 0x425754
push eax
call fcn.0041ef49
pop ecx
test eax, eax
je 0x425754
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x436290]
call fcn.0041ef49
pop ecx
test eax, eax
je 0x425774
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x425776
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4058f0
Capabilities:
Identify system language via api

Disassembly:
mov al, byte [0x438e3f]
test al, al
je 0x405939
mov ecx, 0x435778
call fcn.00416120
mov ecx, 0x436158
call fcn.00416120
mov ecx, 0x436c90
call fcn.00416120
mov ecx, 0x437778
call fcn.00416120
mov ecx, 0x4382a0
call fcn.00416120
mov byte [0x43e568], 1
mov byte [0x438e3f], 0
push 0
push 0x438e4c
call fcn.00401590
add esp, 8
test al, al
je 0x405953
mov eax, 9
jmp 0x40596c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0x3ff
push eax
push str.language
call fcn.00401550
add esp, 8
lea ecx, [eax - 7]
cmp ecx, 9
ja case.0x405974.8
jmp dword [ecx*4 + 0x4059b4]
mov dword [0x43e56c], 0x436c90
ret
mov dword [0x43e56c], 0x4382a0
ret
mov dword [0x43e56c], 0x436158
ret
mov dword [0x43e56c], 0x437778
ret
mov dword [0x43e56c], 0x435778
ret
Function at 0x4066a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x42d458
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebp
push esi
push edi
lea eax, [esp + 0xd]
xor edi, edi
push eax
lea ecx, [esp + 0x12]
push edi
push ecx
lea ecx, [esp + 0x44]
call fcn.0040b990
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x74], edi
mov eax, dword [ebp + 0x12c]
mov ecx, dword [eax]
cmp ecx, eax
mov dword [esp + 0x14], ecx
je 0x406836
push ebx
mov ebx, 1
mov eax, dword [ecx + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov edx, dword [ecx + 0x18]
cmp eax, edx
je 0x40681a
add eax, 0xc
lea edx, [esp + 0x24]
push eax
push edx
lea ecx, [esp + 0x44]
call fcn.0040b9c0
mov al, byte [esp + 0x28]
test al, al
je 0x4067fc
mov esi, str.GIKPMO
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
cmp eax, 0x15
jne 0x40673b
mov eax, 0x16
mov edi, dword [esi]
mov ecx, dword [esp + 0x84]
push edi
push eax
mov edx, dword [ecx]
push eax
mov eax, dword [ebp]
push ebx
push eax
push ecx
call dword [edx + 0x30]
test eax, eax
jne 0x4067ed
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x80]
push edx
push eax
lea eax, [esp + 0x1b]
lea edi, [ecx + 0xc]
push eax
lea ecx, [esp + 0x58]
call fcn.0040b990
mov ecx, dword [edi]
lea edx, [esp + 0x4c]
mov dword [esp + 0x5c], ecx
push edx
lea ecx, [esp + 0x64]
mov byte [esp + 0x7c], bl
call fcn.0040c040
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x1c]
push eax
push ecx
lea ecx, [ebp + 0x138]
mov byte [esp + 0x80], 2
call fcn.0040e640
lea edx, [esp + 0x20]
lea eax, [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x34]
call fcn.0040bea0
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x60]
mov byte [esp + 0x78], bl
call fcn.0040a1f0
lea ecx, [esp + 0x4c]
mov byte [esp + 0x78], 0
call fcn.0040a1f0
lea edx, [esp + 0x34]
push esi
lea ecx, [edi + 0x10]
push edx
call fcn.0040b9c0
add esi, 4
cmp esi, 0x438eb0
jl 0x40672a
lea ecx, [esp + 0x14]
call fcn.0040e5a0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, ecx
jne 0x406707
xor edi, edi
lea ecx, [esp + 0x18]
call fcn.0040e5f0
mov eax, dword [ebp + 0x12c]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jne 0x4066f3
pop ebx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x74], 0xffffffff
push eax
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x88]
push ecx
lea ecx, [esp + 0x44]
call fcn.0040bbe0
mov edx, dword [esp + 0x3c]
push edx
call fcn.00425648
add esp, 4
lea ecx, [esp + 0x7c]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x44], edi
xor esi, esi
call fcn.004214f0
mov eax, dword [0x43e128]
dec eax
mov dword [0x43e128], eax
jne 0x406890
mov esi, dword [0x43e124]
mov dword [0x43e124], edi
lea ecx, [esp + 0x7c]
call fcn.0042158c
cmp esi, edi
je 0x4068a6
push esi
call fcn.00425648
add esp, 4
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x6c
ret
Function at 0x407e90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov ecx, dword [eax]
mov esi, 6
lea edx, [ecx + ecx*2]
shl edx, 5
sub edx, ecx
mov ecx, dword [0x43e114]
mov edi, dword [ecx + edx*4 + 4]
lea ecx, [ecx + edx*4]
xor edx, edx
cmp edi, esi
setge dl
dec edx
and dl, 0x60
add edx, 0x320
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov edi, dword [ecx + 4]
xor edx, edx
cmp edi, esi
mov edi, 3
setge dl
dec edx
xor esi, esi
and edx, 0xffffff88
add edx, 0x258
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x30], esi
mov dword [eax + 0x34], esi
mov ebx, dword [ecx + 4]
xor edx, edx
cmp ebx, edi
setge dl
lea edx, [edx*8 + 0x10]
mov dword [eax + 0x38], edx
mov dword [eax + 0x3c], edx
mov ebx, dword [ecx + 4]
xor edx, edx
cmp ebx, edi
setl dl
dec edx
and edx, 8
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov ebx, dword [ecx + 4]
xor edx, edx
cmp ebx, edi
setge dl
lea edx, [edx*8 + 0x10]
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov ebx, dword [ecx + 4]
xor edx, edx
cmp ebx, edi
setl dl
dec edx
and edx, 8
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov edi, dword [ecx + 4]
xor edx, edx
cmp edi, 9
setl dl
dec edx
and edx, 0xffff
mov ecx, edx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov ecx, 1
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x74], ecx
mov dword [eax + 0x78], esi
mov dword [eax + 0x7c], esi
mov dword [eax + 0x80], esi
mov dword [eax + 0x84], esi
pop edi
pop esi
pop ebx
mov dword [esp + 4], eax
jmp fcn.004078d0
Function at 0x409be0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x42d5c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov al, byte [esp + 0x48]
push ebx
push esi
mov esi, ecx
mov cl, byte [esp + 0x50]
xor ebx, ebx
mov byte [esp + 0x19], cl
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], al
mov byte [esp + 0x20], bl
call fcn.00410960
mov eax, dword [esp + 0x50]
mov cl, byte [esp + 0x18]
mov byte [esp + 0x30], cl
lea ecx, [esp + 0x30]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x28], edx
mov dl, byte [esp + 0x19]
mov dword [esp + 0x2c], eax
mov al, byte [esp + 0x20]
mov dword [esp + 0x48], ebx
mov byte [esp + 0x31], dl
mov byte [esp + 0x38], al
call fcn.00410960
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x34]
call fcn.00410830
lea edx, [esp + 0x28]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x50], 1
call fcn.0040c970
lea ecx, [esp + 0x50]
mov byte [esp + 0x48], bl
push ecx
lea ecx, [esp + 0x34]
call fcn.0040bd90
mov edx, dword [esp + 0x34]
mov eax, dword [eax]
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x3c]
call fcn.0040d240
mov edx, dword [esp + 0x34]
push edx
call fcn.00425648
add esp, 4
lea ecx, [esp + 0x50]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
xor esi, esi
call fcn.004214f0
mov eax, dword [0x43e15c]
dec eax
mov dword [0x43e15c], eax
jne 0x409cd6
mov esi, dword [0x43e158]
mov dword [0x43e158], ebx
lea ecx, [esp + 0x50]
call fcn.0042158c
cmp esi, ebx
je 0x409cec
push esi
call fcn.00425648
add esp, 4
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
mov dword [esp + 0x4c], 0xffffffff
call fcn.0040bd90
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x24]
call fcn.0040d240
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00425648
add esp, 4
lea ecx, [esp + 0x50]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
xor esi, esi
call fcn.004214f0
mov eax, dword [0x43e15c]
dec eax
mov dword [0x43e15c], eax
jne 0x409d51
mov esi, dword [0x43e158]
mov dword [0x43e158], ebx
lea ecx, [esp + 0x50]
call fcn.0042158c
cmp esi, ebx
je 0x409d81
push esi
call fcn.00425648
mov edx, dword [esp + 0x14]
add esp, 4
pop esi
lea eax, [edx + 0x14]
pop ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
add esp, 0x44
ret 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x40]
pop esi
add eax, 0x14
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 4
Function at 0x409f40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x42d5e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov al, byte [esp + 0x48]
push ebx
push esi
mov esi, ecx
mov cl, byte [esp + 0x50]
xor ebx, ebx
mov byte [esp + 0x19], cl
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], al
mov byte [esp + 0x20], bl
call fcn.0040e280
mov eax, dword [esp + 0x50]
mov cl, byte [esp + 0x18]
mov byte [esp + 0x30], cl
lea ecx, [esp + 0x30]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x28], edx
mov dl, byte [esp + 0x19]
mov dword [esp + 0x2c], eax
mov al, byte [esp + 0x20]
mov dword [esp + 0x48], ebx
mov byte [esp + 0x31], dl
mov byte [esp + 0x38], al
call fcn.0040e280
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x34]
call fcn.00410ec0
lea edx, [esp + 0x28]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x50], 1
call fcn.0040d5d0
lea ecx, [esp + 0x50]
mov byte [esp + 0x48], bl
push ecx
lea ecx, [esp + 0x34]
call fcn.0040bd90
mov edx, dword [esp + 0x34]
mov eax, dword [eax]
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x3c]
call fcn.0040bbe0
mov edx, dword [esp + 0x34]
push edx
call fcn.00425648
add esp, 4
lea ecx, [esp + 0x50]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
xor esi, esi
call fcn.004214f0
mov eax, dword [0x43e128]
dec eax
mov dword [0x43e128], eax
jne 0x40a036
mov esi, dword [0x43e124]
mov dword [0x43e124], ebx
lea ecx, [esp + 0x50]
call fcn.0042158c
cmp esi, ebx
je 0x40a04c
push esi
call fcn.00425648
add esp, 4
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
mov dword [esp + 0x4c], 0xffffffff
call fcn.0040bd90
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x24]
call fcn.0040bbe0
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00425648
add esp, 4
lea ecx, [esp + 0x50]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
xor esi, esi
call fcn.004214f0
mov eax, dword [0x43e128]
dec eax
mov dword [0x43e128], eax
jne 0x40a0b1
mov esi, dword [0x43e124]
mov dword [0x43e124], ebx
lea ecx, [esp + 0x50]
call fcn.0042158c
cmp esi, ebx
je 0x40a0e1
push esi
call fcn.00425648
mov edx, dword [esp + 0x14]
add esp, 4
pop esi
lea eax, [edx + 0x14]
pop ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
add esp, 0x44
ret 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x40]
pop esi
add eax, 0x14
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 4
Function at 0x40a380
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x42d600
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov al, byte [esp + 0x44]
push ebx
push esi
mov esi, ecx
mov cl, byte [esp + 0x4c]
xor ebx, ebx
mov byte [esp + 0x19], cl
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], al
mov byte [esp + 0x20], bl
call fcn.0040e280
mov edx, dword [esp + 0x4c]
mov cl, byte [esp + 0x18]
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
mov eax, dword [edx]
mov dl, byte [esp + 0x19]
mov dword [esp + 0x28], eax
mov al, byte [esp + 0x20]
mov dword [esp + 0x44], ebx
mov byte [esp + 0x2d], dl
mov byte [esp + 0x34], al
call fcn.0040e280
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x30]
call fcn.00410ec0
lea edx, [esp + 0x28]
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x4c], 1
call fcn.0040e640
lea ecx, [esp + 0x4c]
mov byte [esp + 0x44], bl
push ecx
lea ecx, [esp + 0x30]
call fcn.0040bd90
mov edx, dword [esp + 0x30]
mov eax, dword [eax]
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x38]
call fcn.0040bbe0
mov edx, dword [esp + 0x30]
push edx
call fcn.00425648
add esp, 4
lea ecx, [esp + 0x4c]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], ebx
xor esi, esi
call fcn.004214f0
mov eax, dword [0x43e128]
dec eax
mov dword [0x43e128], eax
jne 0x40a46f
mov esi, dword [0x43e124]
mov dword [0x43e124], ebx
lea ecx, [esp + 0x4c]
call fcn.0042158c
cmp esi, ebx
je 0x40a485
push esi
call fcn.00425648
add esp, 4
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
mov dword [esp + 0x48], 0xffffffff
call fcn.0040bd90
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x24]
call fcn.0040bbe0
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00425648
add esp, 4
lea ecx, [esp + 0x4c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
xor esi, esi
call fcn.004214f0
mov eax, dword [0x43e128]
dec eax
mov dword [0x43e128], eax
jne 0x40a4ea
mov esi, dword [0x43e124]
mov dword [0x43e124], ebx
lea ecx, [esp + 0x4c]
call fcn.0042158c
cmp esi, ebx
je 0x40a51a
push esi
call fcn.00425648
mov edx, dword [esp + 0x14]
add esp, 4
pop esi
lea eax, [edx + 0x10]
pop ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
pop esi
add eax, 0x10
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4