joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412082
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x418680], 0
push ebx
push esi
mov esi, 0x418688
jne 0x4120ae
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x4186a0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x418680], 1
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x41214b
push 0x14
push 8
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412175
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x418684]
test eax, eax
je 0x4120f0
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x418684], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41217a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412175
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x4029bf
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4093f4], 0
push esi
jne 0x4029f6
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4029d0
mov dword [ecx*4 + 0x4093f0], eax
inc ecx
cmp ecx, 0x100
jl 0x4029cb
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x402a27
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4093f0]
xor eax, esi
inc ecx
dec edx
jne 0x402a09
pop edi
not eax
pop esi
ret 0xc
Function at 0x401150
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
xor ecx, ecx
test bl, 1
je 0x401163
mov ecx, 0x80
mov eax, ebx
shr eax, 1
test al, 1
je 0x40116e
or ecx, 0x40
shr eax, 1
test al, 1
je 0x401177
or ecx, 0x20
shr eax, 1
test al, 1
je 0x401180
or ecx, 0x10
shr eax, 1
test al, 1
je 0x401189
or ecx, 8
shr eax, 1
test al, 1
je 0x401192
or ecx, 4
shr eax, 1
test al, 1
je 0x40119b
or ecx, 2
test al, 2
je 0x4011a2
or ecx, 1
shl ecx, 0x18
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov dword [esi + ebx*4], ecx
mov eax, ecx
xor edx, edx
mov ecx, 0x1f
lea ecx, [ecx]
test al, 1
je 0x40126d
mov edi, 1
shl edi, cl
or edx, edi
shr eax, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x401260
mov dword [esi + ebx*4], edx
inc ebx
cmp ebx, 0xff
jle 0x401157
pop edi
pop esi
pop ebx
ret

Function at 0x401290
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov edx, dword [edx]
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
test esi, esi
je 0x4012bf
push ebx
push edi
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ecx + edi*4]
shr eax, 8
xor eax, ebx
inc edx
dec esi
jne 0x4012a4
pop edi
pop ebx
not eax
pop esi
ret 8
Function at 0x401490
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x437928
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
push ebx
push ebp
push edi
push 0
push 0x8000000
push 3
push 0
push 3
push SysReAllocString
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
or ebp, 0xffffffff
cmp edi, ebp
jne 0x4014fd
push 0
push 0x439690
push str.Failed_to_open_the_file
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
push 0x20
lea ecx, [esp + 0x2c]
call fcn.004013d0
mov edx, dword [esp + 0x24]
mov eax, dword [edx - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [edx - 8]
sub eax, esi
or eax, ecx
mov dword [esp + 0x1c], 0
jge 0x401542
push esi
lea ecx, [esp + 0x28]
call fcn.00401350
mov edx, dword [esp + 0x24]
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x401565
xor eax, eax
jmp 0x40157f
mov eax, edx
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401570
sub eax, edi
js 0x401628
cmp eax, dword [edx - 8]
jg 0x401628
mov dword [edx - 0xc], eax
mov edx, dword [esp + 0x24]
mov byte [eax + edx], 0
cmp esi, dword [esp + 0x10]
je 0x4015e3
push 0
push 0x439690
push str.Failed_to_read_the_file
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esp + 0x1c], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x4015cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
push esi
lea eax, [esp + 0x28]
push eax
mov ecx, ebx
call fcn.00401290
mov esi, eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esp + 0x1c], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x401611
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
push 0x80070057
call fcn.00401000
int3

Function at 0x4025a0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
neg eax
push 4
sbb eax, eax
lea edx, [esp + 8]
push edx
add eax, 0x1006
push eax
mov eax, dword [ecx + 0x91c]
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x4025e4
push 0
push 0x439948
push str.setsockopt__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
ret 8
mov eax, 1
ret 8
Function at 0x4025f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x928]
test eax, eax
jne 0x4026a5
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_recv]
push edi
mov byte [esp + 0x13], 0
xor edi, edi
mov dword [esi + 0x92c], 0xffffffff
mov bl, 0xa
mov edi, edi
cmp edi, 0x400
jge 0x40268d
mov ecx, dword [esi + 0x91c]
push 0
push 1
lea eax, [esp + 0x1b]
push eax
push ecx
call ebp
mov dl, byte [esp + 0x13]
mov byte [esi + edi + 0x14], dl
inc edi
cmp edi, 4
jl 0x402620
cmp byte [esi + 0x14], 0x48
je 0x402660
cmp byte [esi + 0x15], 0x54
je 0x402660
cmp byte [esi + 0x16], 0x54
je 0x402660
cmp byte [esi + 0x17], 0x50
jne 0x40267c
cmp byte [edi + esi + 0x10], 0xd
jne 0x402620
cmp byte [edi + esi + 0x11], bl
jne 0x402620
cmp byte [edi + esi + 0x12], 0xd
jne 0x402620
cmp byte [edi + esi + 0x13], bl
jne 0x402620
jmp 0x40268d
mov eax, dword [esp + 0x18]
mov ecx, esi
mov dword [eax], 0xffffffff
call fcn.00402550
mov dword [esi + 0x92c], edi
mov byte [edi + esi + 0x14], 0
pop edi
pop ebp
mov dword [esi + 0x928], 1
pop ebx
mov ecx, dword [esi + 0x92c]
mov edx, dword [esp + 0xc]
lea eax, [esi + 0x14]
mov dword [edx], ecx
pop esi
pop ecx
ret 4

Function at 0x4027d0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x918]
test eax, eax
je 0x402834
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x4027ec
lea edi, [esi + 0x414]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x402809
lea eax, [esi + 0x414]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402800
sub eax, edx
push 0
push eax
mov eax, dword [esi + 0x91c]
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
pop edi
jne 0x40283a
push 0
push 0x439948
push str.send__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
ret 8
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004025f0
mov ecx, dword [esp + 8]
xor eax, eax
cmp ecx, 0xffffffff
setne al
pop esi
ret 8

Function at 0x402860
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x918]
test eax, eax
jne 0x402873
xor eax, eax
pop esi
ret 8
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esi + 0x91c]
push edi
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jg 0x40289a
mov ecx, esi
call fcn.00402550
mov eax, edi
pop edi
pop esi
ret 8
Function at 0x4039f0
Capabilities:
Send data
Send data on socket

Disassembly:
push 0xffffffffffffffff
push 0x437ab0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x930]
lea edx, [esp + 0xc]
xor ebx, ebx
push edx
mov dword [esp + 0x10], ebx
mov eax, dword [ecx]
push ebx
call dword [eax + 0xc]
mov eax, dword [esp + 0x4c]
cmp eax, 1
jne 0x403ae4
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x4c]
push eax
push ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x54], bl
call fcn.00403950
mov eax, dword [esp + 0xc]
push eax
push eax
mov dword [esp + 0x48], ebx
call fcn.0041c93a
mov ecx, dword [edi + 0x930]
mov edx, dword [ecx]
mov esi, eax
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
call dword [edx + 0xc]
test eax, eax
jge 0x403aa0
lea ecx, [esp + 0x24]
call fcn.00402ab0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x48]
push ebx
push ecx
push esi
push edx
call dword [sym.imp.WS2_32.dll_send]
push esi
mov edi, eax
call fcn.0041c8c9
add esp, 4
lea ecx, [esp + 0x24]
call fcn.00402ab0
cmp edi, ebx
jge 0x403bb7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 8
cmp eax, 2
jne 0x403bb7
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x4c]
push eax
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x54], bl
call fcn.00403950
mov ecx, dword [esp + 0x1c]
mov eax, ecx
shr eax, 4
mov edx, eax
shl edx, 4
sub ecx, edx
mov edx, dword [esp + 0x18]
cmp edx, eax
mov dword [esp + 0x40], 1
ja 0x403b36
sub eax, edx
mov edi, dword [edi + 0x930]
mov edx, dword [edi]
lea esi, [esp + 0xc]
push esi
mov esi, dword [esp + 0x18]
mov eax, dword [esi + eax*4]
add eax, ecx
push eax
mov ecx, edi
call dword [edx + 0xc]
test eax, eax
jge 0x403b75
lea ecx, [esp + 0x10]
call fcn.00402ab0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret 8
mov ecx, dword [esp + 0x1c]
mov eax, ecx
shr eax, 4
mov edx, eax
shl edx, 4
sub ecx, edx
mov edx, dword [esp + 0x18]
cmp edx, eax
ja 0x403b8f
sub eax, edx
mov edx, dword [esp + 0xc]
push ebx
push edx
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + eax*4]
add eax, ecx
mov ecx, dword [esp + 0x50]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
lea ecx, [esp + 0x10]
jl 0x403b5a
call fcn.00402ab0
mov ecx, dword [esp + 0x38]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x404940
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404959
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40496d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40498e
cmp esi, eax
jae 0x404967
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404980
cmp esi, eax
jae 0x404967
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x405290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x437bf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [esp + 0x14], ebx
call fcn.00429b49
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebp, [eax + 0x10]
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 4]
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 4]
mov ecx, edi
sub ecx, esi
mov edx, 1
sub edx, eax
mov eax, dword [ebp - 8]
inc ecx
sub eax, ecx
or eax, edx
mov dword [esp + 0x20], ebx
jge 0x405300
push ecx
lea ecx, [esp + 0x14]
call fcn.00401350
mov ebp, dword [esp + 0x10]
cmp esi, edi
jg 0x405375
mov ecx, dword [esp + 0x14]
mov al, byte [esi + ecx]
cmp al, 0x26
jne 0x40536a
xor edi, edi
mov eax, dword [edi*4 + 0x448168]
mov edx, dword [esp + 0x30]
sub edx, eax
cmp esi, edx
jg 0x405340
mov ecx, dword [edi*4 + 0x448154]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esi + eax + 1]
push edx
push ecx
call fcn.0041cc2d
add esp, 0xc
test eax, eax
je 0x405348
inc edi
cmp edi, 5
jl 0x405311
jmp 0x40535f
mov eax, dword [0x448150]
mov cl, byte [eax + edi]
mov byte [ebx + ebp], cl
mov edx, dword [edi*4 + 0x448168]
inc ebx
lea esi, [esi + edx + 1]
cmp edi, 5
jne 0x40536f
mov byte [ebx + ebp], 0x26
jmp 0x40536d
mov byte [ebx + ebp], al
inc ebx
inc esi
cmp esi, dword [esp + 0x30]
jle 0x405304
cmp ebx, 0xffffffff
mov eax, ebx
jne 0x405399
test ebp, ebp
jne 0x405384
xor eax, eax
jmp 0x4053a1
mov eax, ebp
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405390
sub eax, edx
test eax, eax
jl 0x40544b
cmp eax, dword [ebp - 8]
jg 0x40544b
mov dword [ebp - 0xc], eax
mov byte [eax + ebp], 0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
add ebp, 0xfffffff0
call dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
test edx, edx
lea ecx, [ebp + 0xc]
jl 0x4053d8
cmp eax, dword [ebp]
jne 0x4053d8
mov eax, ebp
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40540b
mov ecx, dword [ebp + 4]
mov edx, dword [eax]
push 1
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x4053ed
call fcn.00401090
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 4]
inc ecx
mov edx, ecx
shr ecx, 2
lea esi, [ebp + 0x10]
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x28]
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x20], 0xffffffff
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x405434
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
push 0x80070057
call fcn.00401000
int3
Function at 0x406370
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x437cb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
call fcn.00429b49
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 8], esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0
call fcn.0042ea96
mov eax, dword [esp + 0x2c]
push 0
push 0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0042ed2e
test eax, eax
lea ecx, [esp + 0xc]
jne 0x40640f
mov byte [esp + 0x24], al
call fcn.0042ead5
lea eax, [esi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4063fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
push edi
call fcn.0042e98e
mov edi, eax
mov eax, dword [esi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, edi
or eax, ecx
jge 0x406438
push edi
lea ecx, [esp + 0x10]
call fcn.00401350
mov esi, dword [esp + 0xc]
push edi
push esi
lea ecx, [esp + 0x18]
call fcn.0042e7a9
cmp eax, 0xffffffff
pop edi
jne 0x40645f
test esi, esi
jne 0x406451
xor eax, eax
jmp 0x406463
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406456
sub eax, edx
test eax, eax
jl 0x4064c7
cmp eax, dword [esi - 8]
jg 0x4064c7
mov dword [esi - 0xc], eax
lea ecx, [esp + 0xc]
mov byte [eax + esi], 0
call fcn.0042ea34
push esi
mov ecx, ebx
call fcn.00406180
lea ecx, [esp + 0xc]
mov bl, al
mov byte [esp + 0x24], 0
call fcn.0042ead5
lea eax, [esi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4064b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x1c]
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
push 0x80070057
call fcn.00401000
int3

Function at 0x406d50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret
Function at 0x4070c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x437ce8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00401b00
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.004018a0
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x407152
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x407360
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x437d66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
mov eax, dword [0x449320]
push ebx
push esi
push edi
mov dword [esp + 0x234], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
xor eax, eax
mov byte [esp + 0x20], bl
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
push 5
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x439c83
lea ecx, [esp + 0x14]
call fcn.004057f0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x14]
push str._sECPDataConfig.ini
push edx
mov dword [esp + 0x250], ebx
call fcn.004047d0
xor eax, eax
mov byte [esp + 0x134], bl
mov ecx, 0x40
lea edi, [esp + 0x135]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0xc
stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
push eax
push 0x104
lea ecx, [esp + 0x130]
push ecx
push 0x439c83
push str.UsersPath
push str.CONFIG
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x128]
push edx
lea ecx, [esp + 0x18]
call fcn.004057f0
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], ebx
mov byte [esp + 0x244], 1
je 0x40750a
push str.Setup
push eax
call fcn.0041cd02
add esp, 8
test eax, eax
je 0x40750a
mov eax, dword [esp + 0x14]
push str.Public
push eax
call fcn.0041cd02
add esp, 8
test eax, eax
jne 0x4074a0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x14]
push str._sECP_
push edx
call fcn.004047d0
mov esi, dword [ebp + 8]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00401980
jmp 0x407519
push 1
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
call fcn.00407060
mov eax, dword [eax]
push 0x439e2c
push eax
call fcn.0041cd02
add esp, 8
test eax, eax
mov eax, dword [esp + 0x1c]
setne byte [esp + 0x1b]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4074e5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
cmp byte [esp + 0x1b], bl
je 0x4074f9
push 0x439e2c
lea ecx, [esp + 0x18]
call fcn.00405700
mov esi, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.00401980
jmp 0x407519
mov esi, dword [ebp + 8]
push 0x439c83
mov ecx, esi
call fcn.004057f0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x244], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40753e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x244], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407567
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x23c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x234]
mov eax, esi
call fcn.0041c22b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4076a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x437d83
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00430b91
xor ecx, ecx
lea ebp, [esi + 0x10]
mov dword [esi], method.CDC.virtual_0
mov dword [esp + 0x24], ecx
mov dword [ebp + 4], ecx
mov dword [ebp], 0x43dae0
mov ebx, dword [esp + 0x2c]
xor eax, eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ecx
cmp dword [ebx + 0xc], ecx
sete al
mov byte [esp + 0x24], 1
cmp eax, ecx
mov dword [esi + 0x30], eax
je 0x407767
mov eax, dword [ebx]
lea edi, [esi + 0x20]
push edi
mov ecx, ebx
call dword [eax + 0x50]
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, esi
call fcn.00430ff1
mov ecx, dword [edi + 4]
mov eax, dword [edi + 0xc]
mov edx, dword [edi]
sub eax, ecx
mov ecx, dword [edi + 8]
sub ecx, edx
push eax
push ecx
mov ecx, dword [ebx + 4]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, ebp
call fcn.004312d8
test ebp, ebp
je 0x407745
mov ebp, dword [ebp + 4]
mov edx, dword [esi + 4]
push ebp
push edx
call fcn.00431361
mov ecx, dword [edi]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x24]
push eax
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.00430ce1
jmp 0x407779
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [ebx + 4]
mov dword [esi + 4], ecx
mov edx, dword [ebx + 8]
mov dword [esi + 8], edx
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4