joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404c67
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
and byte [ebp - 1], 0
and dword [ebp - 8], 0
cmp dword [ecx + 0x634], 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
jle 0x404d8d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ebx, [ecx + 0x128]
mov al, byte [0x454040]
push 0x40
mov byte [ebp - 0x118], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebx - 0x100]
push eax
lea eax, [ebp - 0x118]
push eax
call esi
lea eax, [ebp - 0x118]
push 0x44e1c8
push eax
call esi
lea eax, [ebp - 0x118]
push ebx
push eax
call esi
lea eax, [ebp - 0x118]
push str..src
push eax
call esi
xor edi, edi
lea eax, [ebp - 0x118]
push edi
push 0x80
push 3
push edi
push edi
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x404d5b
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jbe 0x404d5b
mov al, byte [ebp - 1]
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x14], esp
push 0
mov ecx, edi
mov byte [edi], al
call fcn.00402b70
push ebx
call fcn.0041d7c0
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.00402d52
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
call fcn.004011a3
test al, al
jne 0x404d69
mov dword [ebx + 0x100], 2
jmp 0x404d65
mov dword [ebx + 0x100], 1
mov byte [ebp - 1], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
add ebx, 0x204
cmp ecx, dword [eax + 0x634]
jl 0x404c97
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404e6a
Capabilities:
Get file size

Disassembly:
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x14], eax
jne 0x404e97
mov dword [esi + 0x14], edi
jmp 0x404ec5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
push edi
push edi
push 2
push edi
mov dword [esi + 0x1c], eax
push dword [esi + 0x14]
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esi + 0x18], eax
je 0x404ec2
mov al, 1
jmp 0x404ec7
mov dword [esi + 0x28], edi
xor al, al
pop edi
pop esi
ret 4
Function at 0x4053a9
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
je 0x4054c1
cmp dword [ebp + 0x10], ebx
je 0x4054c1
cmp dword [esi + 4], 0xffffffff
je 0x4053e0
call fcn.0040538f
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [edi]
cmp al, 0x30
jl 0x40540a
cmp al, 0x39
jg 0x40540a
push 0x10
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0041d9b0
add esp, 0xc
mov word [ebp - 0x14], 2
push edi
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0x10], eax
jmp 0x405444
push edi
call sub.WSOCK32.dll_gethostbyname
mov edi, eax
cmp edi, ebx
je 0x4054c1
push 0x10
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0041d9b0
movsx eax, word [edi + 0xa]
push eax
mov eax, dword [edi + 0xc]
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.0041dc60
mov ax, word [edi + 8]
add esp, 0x18
mov word [ebp - 0x14], ax
push dword [ebp + 0x10]
call sub.WSOCK32.dll_htons
push ebx
push 1
pop ebx
mov word [ebp - 0x12], ax
push ebx
push 2
call sub.WSOCK32.dll_socket
cmp eax, ebx
mov dword [esi + 4], eax
jb 0x4054c1
lea ecx, [ebp - 4]
push 4
push ecx
mov edi, 0xffff
push 0x1002
push edi
push eax
mov dword [ebp - 4], 0x2800
call sub.WSOCK32.dll_setsockopt
and word [ebp + 0xe], 0
lea eax, [ebp + 0xc]
push 4
push eax
push 0x80
push edi
push dword [esi + 4]
mov word [ebp + 0xc], bx
call sub.WSOCK32.dll_setsockopt
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [esi + 4]
call sub.WSOCK32.dll_connect
test eax, eax
je 0x4054ca
call sub.WSOCK32.dll_WSAGetLastError
push dword [esi + 4]
call sub.WSOCK32.dll_closesocket
or dword [esi + 4], 0xffffffff
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
mov edi, dword [ebp + 8]
push 0x31
push 0x401
push edi
push dword [esi + 4]
call sub.WSOCK32.dll_WSAAsyncSelect
mov dword [esi + 8], edi
mov eax, ebx
jmp 0x4054c3

Function at 0x4054e4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x405551
push ebx
lea ecx, [ebp - 4]
push edi
push ecx
push 0x4004667f
push eax
xor ebx, ebx
call sub.WSOCK32.dll_ioctlsocket
cmp dword [ebp - 4], ebx
jbe 0x40553b
lea edi, [esi + 0xc]
push 0
push 0x2800
push edi
push dword [esi + 4]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x40553b
test eax, eax
je 0x405536
push eax
push edi
lea ecx, [esi + 0x280c]
add ebx, eax
call fcn.00405554
cmp ebx, dword [ebp - 4]
jb 0x40550e
mov ecx, esi
call fcn.00405630
pop edi
pop ebx
test eax, eax
je 0x405551
mov ecx, esi
call fcn.00405630
jmp 0x405544
pop esi
leave
ret
Function at 0x4057a7
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
cmp dword [ebx + 4], 0xffffffff
je 0x40581f
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0xaa55
lea esi, [ebx + 0xc]
lea eax, [edi + 6]
mov dword [ebp + 0xc], eax
call sub.WSOCK32.dll_htons
mov word [esi], ax
inc esi
inc esi
push edi
push dword [ebp + 8]
mov word [esi], di
inc esi
inc esi
push esi
call fcn.0041dc60
add esp, 0xc
push 0x55aa
call sub.WSOCK32.dll_htons
mov word [esi + edi], ax
mov esi, dword [ebp + 0xc]
xor edi, edi
test esi, esi
jle 0x405817
push 0
lea eax, [ebx + 0xc]
push esi
push eax
push dword [ebx + 4]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x405817
test eax, eax
je 0x405813
add edi, eax
cmp edi, esi
jl 0x4057f9
add dword [ebx + 0x2820], esi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x406679
Capabilities:
Connect to http server
Create http request

Disassembly:
mov eax, 0x43d0cc
call fcn.0041d79c
push ecx
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
push str.3DOnline
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x4066cf
mov eax, dword [0x45000c]
mov dword [ebp + 8], eax
push 0x77
lea ecx, [ebp + 8]
mov dword [ebp - 4], edi
call fcn.00434d6c
push 0x10
add esi, 0xc
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
jmp 0x406734
cmp dword [ebp + 8], 1
lea ebx, [esi + 0xc]
push edi
jne 0x4066f2
push 0x8000000
lea ecx, [esi + 0x130]
push 1
push ecx
lea ecx, [esi + 0x110]
push ecx
push 0x15
jmp 0x4066f8
push edi
push 3
push edi
push edi
push edi
push ebx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
cmp eax, edi
mov dword [esi + 8], eax
jne 0x40673d
mov eax, dword [0x45000c]
mov dword [ebp - 0x10], eax
push 0x78
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.00434d6c
push 0x10
push dword [ebp - 0x10]
push ebx
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0043488f
xor al, al
jmp 0x40673f
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40ab80
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esi + 8]
xor ecx, ecx
push eax
push ecx
push esi
push 0x40ab61
push ecx
push ecx
mov dword [esi], 0x440e48
mov dword [esi + 4], ecx
mov dword [eax], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
cmp edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov dword [esi + 0x10], edi
mov eax, esi
pop edi
pop esi
ret 4

Function at 0x40abed
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x40ac03
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
and dword [esi + 0x10], 0
pop esi
ret

Function at 0x40b570
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d810
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
cmp byte [esi + 0xe4], 0xff
je 0x40b5b4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov al, byte [ebp + 0xc]
xor ebx, ebx
cmp al, bl
mov dword [ebp - 0x14], 1
jne 0x40b679
cmp dword [esi + 0x60], ebx
jne 0x40b5e9
mov ecx, esi
call fcn.0040b2b0
mov ecx, dword [esi + 0x68]
mov edx, dword [eax + 0x14]
cmp ecx, edx
je 0x40b5f0
push 0xffffffffffffff9a
mov ecx, esi
call fcn.0040af00
jmp 0x40b5f0
mov dword [ebp - 0x14], 0xffffffff
mov ecx, esi
call fcn.0040b2b0
cmp word [eax + 0xe], 8
jne 0x40b607
lea edx, [esi + 0x28]
push edx
call fcn.0040fc00
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x40b679
lea eax, [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call fcn.00430138
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
mov ecx, esi
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x11c], bl
call fcn.0040b2b0
mov ecx, eax
call fcn.0040f720
mov edx, dword [eax]
lea eax, [ebp - 0x12c]
push eax
push edi
mov dword [ebp - 0x128], edx
call fcn.00436254
mov ecx, esi
call fcn.0040b2b0
mov ecx, dword [eax + 0x24]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x40b672
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xe8]
call fcn.0040e560
lea ecx, [esi + 0x6c]
mov byte [esi + 0xe4], bl
call fcn.0040dcf0
mov ecx, esi
call fcn.0040c930
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b9b0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x43d8f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push eax
lea ecx, [esp + 0x20]
call fcn.004348b9
push 0x44e1c8
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call fcn.0042ff30
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 8]
push ecx
push edx
call fcn.0040b6d0
mov ecx, dword [esp + 0x24]
mov eax, dword [eax]
push ecx
push eax
mov byte [esp + 0x24], 1
call fcn.0041ecaf
add esp, 0x10
or esi, 0xffffffff
test eax, eax
je 0x40ba31
mov edx, dword [esp + 0x1c]
push edx
call fcn.0040bad0
add esp, 4
cmp eax, esi
sete al
test al, al
jne 0x40ba31
xor bl, bl
jmp 0x40ba33
mov bl, 1
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call fcn.0043488f
test bl, bl
jne 0x40baac
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.0040b6d0
mov eax, dword [eax]
mov byte [esp + 0x1c], 2
push eax
call fcn.0040b9b0
add esp, 0xc
lea ecx, [esp + 8]
test al, al
sete bl
mov byte [esp + 0x14], 0
call fcn.0043488f
test bl, bl
jne 0x40ba8c
mov edx, dword [esp + 0x1c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40baac
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call fcn.0043488f
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call fcn.0043488f
mov ecx, dword [esp + 0xc]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40bad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43d918
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 4]
call fcn.004157d9
mov esi, dword [esp + 0x30]
push 0
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call fcn.0041589c
test eax, eax
jne 0x40bb56
push esi
call fcn.0040bba0
add esp, 4
mov dword [esp + 0x28], 0xffffffff
test al, al
lea ecx, [esp + 4]
je 0x40bb3f
call fcn.00415816
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
call fcn.00415816
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
lea ecx, [esp + 4]
call fcn.00415abc
mov eax, dword [esp + 4]
push 0x10
lea ecx, [esp + 8]
call dword [eax + 0x38]
neg eax
sbb eax, eax
lea ecx, [esp + 4]
and al, 0xfe
mov dword [esp + 0x28], 0xffffffff
inc eax
mov esi, eax
call fcn.00415816
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x40c580
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
push ebx
lea ecx, [esp + 8]
push eax
push ecx
call fcn.0040c5b0
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
lea ecx, [esp + 8]
sete bl
call fcn.0043488f
mov al, bl
pop ebx
ret

Function at 0x40c6b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
mov ecx, dword [esi + 0x14]
push ecx
mov ecx, esi
call fcn.0040c810
mov edx, dword [esi + 0x18]
mov dword [esi + 0x14], eax
and eax, 0xff
mov ecx, esi
add eax, edx
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x18], eax
shr eax, 0x18
mov byte [esp + 8], al
mov eax, dword [esi + 0x1c]
mov edx, dword [esp + 8]
push edx
push eax
call fcn.0040c810
mov dword [esi + 0x1c], eax
pop esi
ret 4

Function at 0x40d440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43dc5e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebx
xor ebx, ebx
push esi
test eax, eax
mov esi, ecx
mov dword [esp + 8], ebx
jne 0x40d486
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0x18]
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ebx, 1
mov dword [esp + 8], ebx
mov eax, dword [eax]
mov dword [esp + 0x28], ebx
push eax
lea ecx, [esp + 0x10]
call fcn.004348b9
test bl, 1
mov dword [esp + 0x28], 3
je 0x40d4ad
and ebx, 0xfffffffe
lea ecx, [esp + 0x18]
mov dword [esp + 8], ebx
call fcn.0043488f
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.0040b6d0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
mov byte [esp + 0x38], 4
call fcn.0040b7a0
add esp, 0x10
mov ecx, dword [0x45000c]
mov dword [esp + 0x38], ecx
mov al, byte [esp + 0x34]
mov byte [esp + 0x28], 6
test al, al
je 0x40d4fa
push 0x44e7e0
lea ecx, [esp + 0x3c]
call fcn.004349d4
jmp 0x40d510
mov edx, dword [esi + 0x4c]
lea eax, [esp + 0x38]
push edx
push str._.3d
push eax
call fcn.0042ff1d
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
call fcn.00434a7a
push 0x44e194
lea ecx, [esp + 0x38]
push eax
push ecx
mov byte [esp + 0x34], 7
call fcn.00434ae0
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x38]
push edx
push eax
push esi
mov byte [esp + 0x34], 8
call fcn.00434a7a
or ebx, 2
mov dword [esp + 8], ebx
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 7
call fcn.0043488f
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 6
call fcn.0043488f
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 5
call fcn.0043488f
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.0043488f
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 3
call fcn.0043488f
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.0043488f
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x40d870
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x43dcd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov ecx, dword [ecx + 0x1c]
lea edx, [esp + 4]
push ebx
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x24], 0
push eax
lea eax, [esp + 8]
push eax
call fcn.0040c5b0
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
lea ecx, [esp + 4]
sete bl
call fcn.0043488f
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.0043488f
test bl, bl
pop ebx
je 0x40d900
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x40e010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43dd78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.0040e1b0
mov ecx, dword [esi + 0x2c]
mov dword [esi + 0x30], eax
push 0
push eax
mov ecx, dword [ecx + 0x1c]
mov edx, dword [ecx]
call dword [edx + 0x28]
push 0
push 0x16
lea ecx, [esp + 0xc]
call fcn.0040dcb0
mov eax, dword [esi + 0x2c]
push 0x16
mov dword [esp + 0x1c], 0
mov ecx, dword [eax + 0x1c]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [ecx]
call dword [edx + 0x34]
cmp eax, 0x16
je 0x40e076
push 0xffffffffffffff9b
mov ecx, esi
call fcn.0040e2f0
mov eax, dword [esp + 8]
push edi
mov ecx, dword [eax]
mov dword [esi + 4], ecx
mov dx, word [eax + 4]
mov word [esi + 8], dx
mov cx, word [eax + 6]
mov word [esi + 0xa], cx
mov dx, word [eax + 8]
mov word [esi + 0xc], dx
mov cx, word [eax + 0xa]
mov word [esi + 0xe], cx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x10], edx
mov ecx, dword [eax + 0x10]
mov dword [esi + 0x14], ecx
mov di, word [eax + 0x14]
lea ecx, [esp + 8]
call fcn.0040dcf0
mov dx, word [esi + 8]
mov ecx, dword [esi + 0x2c]
push edx
call fcn.0040d920
mov ecx, dword [esi + 0x2c]
call fcn.0040cff0
test eax, eax
jne 0x40e0ea
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x30]
add eax, edx
cmp ecx, eax
jae 0x40e0ea
push 0xffffffffffffff9b
mov ecx, esi
call fcn.0040e2f0
test di, di
je 0x40e11d
and edi, 0xffff
push 0
push edi
lea ecx, [esi + 0x18]
call fcn.0040dd20
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x1c]
push edi
push eax
mov ecx, dword [ecx + 0x1c]
mov edx, dword [ecx]
call dword [edx + 0x34]
cmp eax, edi
je 0x40e11d
push 0xffffffffffffff9b
mov ecx, esi
call fcn.0040e2f0
mov ecx, dword [esi + 0x2c]
call fcn.0040cff0
test eax, eax
pop edi
je 0x40e12e
xor eax, eax
jmp 0x40e13b
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
sub eax, edx
sub eax, ecx
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x40e14b
cmp word [esi + 0xe], ax
jne 0x40e156
cmp word [esi + 0xe], 0
jne 0x40e15f
test eax, eax
je 0x40e15f
push 0xffffffffffffff9b
mov ecx, esi
call fcn.0040e2f0
mov ecx, dword [esi + 0x2c]
xor eax, eax
mov ax, word [esi + 0xa]
mov byte [esi + 0x3c], 1
push eax
call fcn.0040d010
mov eax, dword [esi + 0x10]
test eax, eax
je 0x40e180
mov ecx, esi
call fcn.0040e350
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.0040dce0
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x40f580
Capabilities:
Access peb ldr_data
Enumerate pe sections
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x43dee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
push 0x2e
lea ecx, [esp + 0x1c]
call fcn.0040dcb0
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x30]
push 1
push 0x2e
push eax
mov ecx, edi
mov dword [esp + 0x34], 0
call fcn.0040ce40
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov dword [esi + 4], ecx
mov dx, word [eax + 4]
mov word [esi + 8], dx
mov cx, word [eax + 6]
mov word [esi + 0xa], cx
mov dx, word [eax + 8]
mov word [esi + 0xc], dx
mov cx, word [eax + 0xa]
mov word [esi + 0xe], cx
mov dx, word [eax + 0xc]
mov word [esi + 0x10], dx
mov cx, word [eax + 0xe]
mov word [esi + 0x12], cx
mov edx, dword [eax + 0x10]
mov dword [esi + 0x14], edx
mov ecx, dword [eax + 0x14]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [esi + 0x1c], edx
mov cx, word [eax + 0x20]
mov dx, word [eax + 0x22]
mov bx, word [eax + 0x1c]
mov bp, word [eax + 0x1e]
mov word [esp + 0x30], cx
mov word [esi + 0x20], dx
mov cx, word [eax + 0x24]
mov word [esi + 0x22], cx
mov edx, dword [eax + 0x26]
mov dword [esi + 0x24], edx
mov eax, dword [eax + 0x2a]
lea ecx, [esp + 0x14]
mov dword [esi + 0x28], eax
call fcn.0040dcf0
mov edx, dword [esi + 4]
mov ecx, 0x44e810
cmp edx, dword [ecx]
je 0x40f66c
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.0040dce0
xor al, al
jmp 0x40f704
mov ecx, edi
call fcn.0040d210
and ebx, 0xffff
push 0
push ebx
lea ecx, [esi + 0x38]
mov dword [esp + 0x18], eax
call fcn.0040dd20
mov ecx, dword [edi + 0x1c]
mov eax, dword [esi + 0x3c]
push ebx
push eax
mov edx, dword [ecx]
call dword [edx + 0x34]
test bp, bp
je 0x40f6ba
mov ebx, ebp
push 0
and ebx, 0xffff
lea ecx, [esi + 0x2c]
push ebx
call fcn.0040dd20
mov ecx, dword [edi + 0x1c]
mov eax, dword [esi + 0x30]
push ebx
push eax
mov edx, dword [ecx]
call dword [edx + 0x34]
mov ebx, dword [esp + 0x30]
test bx, bx
je 0x40f6e1
and ebx, 0xffff
push 0
push ebx
lea ecx, [esi + 0x44]
call fcn.0040dd20
mov ecx, dword [edi + 0x1c]
mov esi, dword [esi + 0x48]
push ebx
push esi
mov eax, dword [ecx]
call dword [eax + 0x34]
mov ecx, edi
call fcn.0040d210
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
cmp eax, ecx
lea ecx, [esp + 0x14]
sete bl
call fcn.0040dce0
mov al, bl
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x410230
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x41023f
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x44e888]
test eax, eax
je 0x41024d
call fcn.004101d0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
cmp edx, 8
push ebx
not eax
jb 0x41034f
push edi
mov edi, edx
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x4544ec]
sub edx, 8
xor eax, ebx
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x4544ec]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x4544ec]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x4544ec]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x4544ec]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x4544ec]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x4544ec]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x4544ec]
xor eax, ecx
inc esi
dec edi
jne 0x410267
pop edi
test edx, edx
je 0x410371
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x4544ec]
xor eax, ecx
inc esi
dec edx
jne 0x410353
pop ebx
pop esi
not eax
ret 0xc