joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aa77
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
mov edi, eax
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp dword [ebx + 0x240], 0
mov esi, eax
je 0x40ab4a
cmp edi, 0x14
je 0x40ab4a
cmp edi, 0x90
je 0x40ab4a
cmp edi, 0x91
je 0x40ab4a
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
or byte [ebp + edi - 0x104], 0x80
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor edx, edx
shl esi, 0x10
inc edx
or esi, edx
cmp byte [ebp + 8], dl
je 0x40ab00
cmp edi, 0x2d
je 0x40aafa
mov eax, edi
call fcn.0040a514
jmp 0x40aafc
mov al, dl
cmp al, dl
jne 0x40ab06
or esi, 0x1000000
mov ecx, dword [ebx + 0x23c]
test dl, cl
mov eax, pe_nt_image_headers32
jne 0x40ab1e
test eax, ecx
jne 0x40ab1e
cmp edi, 0x12
jne 0x40ab39
test cl, 8
jne 0x40ab39
test cx, 0x800
jne 0x40ab39
or esi, 0x20000000
push esi
push edi
push 0x104
jmp 0x40ab3c
push esi
push edi
push eax
push dword [ebx + 0x240]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40ab72
xor edx, edx
inc edx
cmp byte [ebp + 8], dl
je 0x40ab6a
cmp edi, 0x2d
je 0x40ab60
mov eax, edi
call fcn.0040a514
jmp 0x40ab62
mov al, dl
cmp al, dl
je 0x40ab6a
push 0
jmp 0x40ab6b
push edx
push esi
push edi
call fcn.00409fc3
mov edi, dword [ebx + 4]
push ebx
call fcn.0040b11d
pop edi
pop esi
leave
ret 4

Function at 0x40ab81
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp dword [edi + 0x240], 0
mov esi, eax
je 0x40ac57
cmp ebx, 0x14
je 0x40ac57
cmp ebx, 0x90
je 0x40ac57
cmp ebx, 0x91
je 0x40ac57
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
shl esi, 0x10
or esi, 0xc0000001
cmp byte [ebp + 8], 1
je 0x40abf7
cmp ebx, 0x2d
je 0x40abf1
mov eax, ebx
call fcn.0040a514
jmp 0x40abf3
mov al, 1
cmp al, 1
jne 0x40abfd
or esi, 0x1000000
mov eax, dword [edi + 0x23c]
test al, 1
jne 0x40ac12
test ax, 0x100
jne 0x40ac12
cmp ebx, 0x12
jne 0x40ac2b
test al, 8
jne 0x40ac2b
test ax, 0x800
jne 0x40ac2b
or esi, 0x20000000
push esi
push ebx
push 0x105
jmp 0x40ac32
push esi
push ebx
push 0x101
push dword [edi + 0x240]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp + ebx - 0x104]
xor byte [eax], 0x80
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x40ac7e
cmp byte [ebp + 8], 1
je 0x40ac75
cmp ebx, 0x2d
je 0x40ac6b
mov eax, ebx
call fcn.0040a514
jmp 0x40ac6d
mov al, 1
cmp al, 1
je 0x40ac75
push 2
jmp 0x40ac77
push 3
push esi
push ebx
call fcn.00409fc3
push edi
mov edi, dword [edi]
call fcn.0040b11d
pop edi
pop esi
leave
ret 4
Function at 0x40ecfe
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push dword [ebp + 8]
lea eax, [ebp - 0x22c]
call fcn.0040e1fc
pop ecx
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ed2c
test al, 0x10
jne 0x40ed30
xor al, al
leave
ret
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
lea eax, [ebp - 0x22c]
push eax
jne 0x40ed4c
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x40ed8f
call fcn.0045179a
mov word [ebp + eax*2 - 0x22a], bx
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb al, al
inc al
pop ebx
leave
ret

Function at 0x40ee5d
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
push esi
mov esi, eax
lea eax, [ebp - 0x29c]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x40ef1d
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
call sub.WSOCK32.dll_gethostname
lea eax, [ebp - 0x10c]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x40ef1d
mov eax, dword [eax + 0xc]
xor edx, edx
cmp dword [eax], edx
je 0x40eeb7
mov ecx, eax
add ecx, 4
inc edx
cmp dword [ecx], 0
jne 0x40eeae
cmp esi, edx
jle 0x40eecc
push str.0.0.0.0
push dword [ebp + 8]
call fcn.0044f88d
pop ecx
pop ecx
jmp 0x40ef16
push 4
push dword [eax + esi*4 - 4]
lea eax, [ebp - 8]
push eax
call fcn.0044fd30
add esp, 0xc
push dword [ebp - 8]
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00451f90
lea eax, [ebp - 0x10c]
push eax
or eax, 0xffffffff
call fcn.0040fc0d
mov esi, eax
push esi
push dword [ebp + 8]
call fcn.0044f88d
push esi
call fcn.0044f971
add esp, 0x18
call sub.WSOCK32.dll_WSACleanup
jmp 0x40ef2c
push 0x46bf80
push dword [ebp + 8]
call fcn.0044f88d
pop ecx
pop ecx
pop esi
leave
ret
Function at 0x435d69
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push edi
xor ebx, ebx
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push ebx
push dword [ebp + 8]
mov dword [esp + 0x30], 0xff
call esi
mov edi, 0x103
jmp 0x435e24
xor eax, eax
cmp byte [0x48a300], bl
je 0x435db6
mov eax, pe_nt_image_headers32
lea ecx, [esp + 0x14]
push ecx
or eax, 0x20019
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x435e30
push dword [esp + 0x14]
call fcn.00435d69
pop ecx
push dword [esp + 0x14]
mov byte [esp + 0x13], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0xf], bl
je 0x435e30
lea eax, [esp + 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x435e30
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push ebx
push dword [ebp + 8]
mov dword [esp + 0x30], 0xff
call esi
cmp eax, edi
jne 0x435da7
mov al, 1
jmp 0x435e32
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43bbf4
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
push ebx
mov edi, 0x48b8d8
push edi
call fcn.00451720
push 0x10
push ebx
mov esi, 0x48b8c8
push esi
call fcn.00451720
add esp, 0x18
push esi
push edi
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [esp + 0x30]
xor eax, eax
inc eax
push ebx
mov dword [0x48b8d8], 0x44
mov dword [0x48b904], eax
mov word [0x48b908], ax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
pop edi
pop esi
pop ebx
je 0x43bc57
push dword [0x48b8c8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
ret 4
Function at 0xa13240
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x57b000]
lea eax, [edi + 0x60a324]
push dword [eax]
mov dword [eax], 0xe01417d0
push eax
push edi
or ebp, 0xffffffff
jmp 0xa13272
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa13279
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa13268
mov eax, 1
add ebx, ebx
jne 0xa1328b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa1329c
jne 0xa132bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa132bb
dec eax
add ebx, ebx
jne 0xa132a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa13280
add ebx, ebx
jne 0xa132b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa1330d
xor ecx, ecx
sub eax, 3
jb 0xa132d3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa13342
sar eax, 1
mov ebp, eax
jmp 0xa132de
add ebx, ebx
jne 0xa132de
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa132ac
inc ecx
add ebx, ebx
jne 0xa132ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa132ac
add ebx, ebx
jne 0xa132f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa132ee
jne 0xa1330a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa132ee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa1332c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa1331e
jmp 0xa1326e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa1332c
add edi, ecx
jmp 0xa1326e
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x7629
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa1334e
cmp byte [edi], 0x2e
jne 0xa1334e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa13353
lea edi, [esi + 0x610000]
mov eax, dword [edi]
or eax, eax
je 0xa133cb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x613ee0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x614050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa13380
mov ecx, edi
jns 0xa133af
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x614058]
or eax, eax
je 0xa133c5
mov dword [ebx], eax
add ebx, 4
jmp 0xa1339d
call dword [esi + 0x614054]
mov ebp, dword [esi + 0x61405c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa133ff
sub esp, 0xffffff80
jmp 0x512c6f
Function at 0x401e90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x401ea9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov esi, eax
test esi, esi
jne 0x401ebd
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401ede
cmp esi, eax
jae 0x401eb7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401ed0
cmp esi, eax
jae 0x401eb7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402b60
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x458788
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00401d30
mov dword [esp + 0x14], 0
mov dword [esi], 0x45d6bc
call fcn.0043e6d2
cdq
mov ecx, 5
idiv ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x28]
mov byte [esi + 0x98], 1
mov dword [esi + 0x14], ecx
mov dword [esi + 0x1c], eax
push 0
add edx, 2
mov dword [esp + 8], edx
mov dl, byte [esp + 0x30]
fild dword [esp + 8]
mov byte [esi + 0xa8], dl
mov edx, dword [esp + 0x28]
fstp qword [esi + 0xa0]
mov dword [esi + 0x18], edx
mov ecx, dword [0x47c158]
mov ecx, dword [ecx + 0x934]
call fcn.0042cda0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x20], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
Function at 0x403270
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x458846
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0040ef10
mov dword [esi], 0x45d728
mov dword [esi + 0x98], 0x45d714
mov dword [esi + 0x140], 0x45d708
mov eax, dword [0x47c158]
mov ecx, dword [eax + 0x850]
mov edx, dword [ecx + 0x10]
lea edi, [esi + 0x140]
push 0
push 0xffffffffffffffff
dec edx
push edx
push 0
lea ecx, [esi + 0x1a0]
mov dword [esp + 0x2c], 0
call fcn.004263b0
fld qword [esp + 0x38]
mov edx, dword [esp + 0x24]
fadd qword [0x45d700]
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
mov dword [esi + 0x1b8], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x1c0], edx
mov dword [esi + 0x1b0], eax
mov dword [esi + 0x1bc], ebp
mov ebp, dword [esp + 0x30]
mov dword [esi + 0x1c4], ebp
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0x40240000
mov edx, dword [0x47c158]
mov edx, dword [edx + 0x834]
mov edx, dword [edx + 0xa0]
inc edx
imul edx, edx, 0x64
mov dword [esi + 0x160], edx
mov edx, dword [0x47c158]
mov edx, dword [edx + 0x834]
mov edx, dword [edx + 0xa0]
lea eax, [edx + eax + 0xa]
imul eax, eax, 0x64
mov dword [esi + 0x168], eax
mov edx, dword [0x47c158]
mov eax, dword [edx + 0x834]
mov ebx, dword [eax + 0xa0]
mov edx, 0x1e
sub edx, ebx
shl edx, 1
mov dword [esi + 0x16c], edx
mov eax, dword [0x47c158]
mov edx, dword [eax + 0x834]
mov ebp, dword [edx + 0xa0]
mov eax, 0x1e
sub eax, ebp
mov dword [esi + 0x170], eax
mov edx, dword [0x47c158]
mov eax, dword [edx + 0x834]
mov ebx, dword [eax + 0xa0]
push 0
mov ecx, 1
sub esp, 8
mov edx, 0x1e
mov byte [esp + 0x28], cl
fstp qword [esp]
sub edx, ebx
mov dword [esi + 0x17c], ecx
push ecx
mov ecx, edi
mov dword [esi + 0x174], edx
mov dword [esi + 0x178], 0x1e
mov dword [esi + 0x18c], 0xc
call fcn.0042b1f0
mov eax, esi
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x403288
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x458846
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0040ef10
mov dword [esi], 0x45d728
mov dword [esi + 0x98], 0x45d714
mov dword [esi + 0x140], 0x45d708
mov eax, dword [0x47c158]
mov ecx, dword [eax + 0x850]
mov edx, dword [ecx + 0x10]
lea edi, [esi + 0x140]
push 0
push 0xffffffffffffffff
dec edx
push edx
push 0
lea ecx, [esi + 0x1a0]
mov dword [esp + 0x2c], 0
call fcn.004263b0
fld qword [esp + 0x38]
mov edx, dword [esp + 0x24]
fadd qword [0x45d700]
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
mov dword [esi + 0x1b8], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x1c0], edx
mov dword [esi + 0x1b0], eax
mov dword [esi + 0x1bc], ebp
mov ebp, dword [esp + 0x30]
mov dword [esi + 0x1c4], ebp
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0x40240000
mov edx, dword [0x47c158]
mov edx, dword [edx + 0x834]
mov edx, dword [edx + 0xa0]
inc edx
imul edx, edx, 0x64
mov dword [esi + 0x160], edx
mov edx, dword [0x47c158]
mov edx, dword [edx + 0x834]
mov edx, dword [edx + 0xa0]
lea eax, [edx + eax + 0xa]
imul eax, eax, 0x64
mov dword [esi + 0x168], eax
mov edx, dword [0x47c158]
mov eax, dword [edx + 0x834]
mov ebx, dword [eax + 0xa0]
mov edx, 0x1e
sub edx, ebx
shl edx, 1
mov dword [esi + 0x16c], edx
mov eax, dword [0x47c158]
mov edx, dword [eax + 0x834]
mov ebp, dword [edx + 0xa0]
mov eax, 0x1e
sub eax, ebp
mov dword [esi + 0x170], eax
mov edx, dword [0x47c158]
mov eax, dword [edx + 0x834]
mov ebx, dword [eax + 0xa0]
push 0
mov ecx, 1
sub esp, 8
mov edx, 0x1e
mov byte [esp + 0x28], cl
fstp qword [esp]
sub edx, ebx
mov dword [esi + 0x17c], ecx
push ecx
mov ecx, edi
mov dword [esi + 0x174], edx
mov dword [esi + 0x178], 0x1e
mov dword [esi + 0x18c], 0xc
call fcn.0042b1f0
mov eax, esi
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x4045b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x458976
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0040ef10
mov dword [esi], 0x45d820
mov dword [esi + 0x98], 0x45d80c
mov dword [esi + 0x140], 0x45d800
mov eax, dword [0x47c158]
mov ecx, dword [eax + 0x850]
mov edx, dword [ecx + 0x10]
lea edi, [esi + 0x98]
push 0
push 0xffffffffffffffff
dec edx
push edx
push 0
lea ecx, [esi + 0x1a0]
mov dword [esp + 0x24], 0
call fcn.004263b0
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x1b0], ecx
mov byte [esi + 0x118], 1
mov eax, dword [0x47c158]
mov edx, dword [eax + 0x834]
mov eax, dword [edx + 0xa0]
cdq
sub eax, edx
sar eax, 1
add eax, 5
mov dword [esp + 0x2c], eax
mov byte [esp + 0x14], 1
fild dword [esp + 0x2c]
fstp qword [esi + 0x100]
mov eax, dword [0x47c158]
mov edx, dword [eax + 0x834]
mov eax, dword [edx + 0xa0]
inc eax
imul eax, eax, 0x64
mov dword [esi + 0x160], eax
mov edx, dword [0x47c158]
mov eax, dword [edx + 0x834]
mov edx, dword [eax + 0xa0]
lea eax, [edx + ecx + 0xa]
mov ecx, dword [esp + 0x28]
imul eax, eax, 0x64
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x168], eax
mov eax, dword [esp + 0x24]
push edx
push eax
push ecx
mov ecx, esi
call fcn.0040f440
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push eax
mov ecx, edi
call fcn.004261a0
mov ecx, dword [0x47c158]
mov edx, dword [ecx + 0x834]
mov edi, dword [edx + 0xa0]
mov eax, 0x1e
sub eax, edi
shl eax, 1
mov dword [esi + 0x16c], eax
mov ecx, dword [0x47c158]
mov edx, dword [ecx + 0x834]
mov edi, dword [edx + 0xa0]
mov eax, 0x1e
sub eax, edi
mov dword [esi + 0x170], eax
mov ecx, dword [0x47c158]
mov edx, dword [ecx + 0x834]
mov ecx, dword [edx + 0xa0]
mov eax, 0x1e
sub eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x174], eax
mov dword [esi + 0x178], 0x1e
mov dword [esi + 0x18c], 0xc
mov dword [esi + 0x17c], 1
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x40c160
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x459543
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edi
call fcn.0040b950
mov eax, dword [edi + 0x1a8]
push 0x40813000
push 0
lea esi, [edi + 0x1a8]
push 0x406f4000
push 0
mov ecx, esi
mov dword [esp + 0x4c], 0
mov dword [edi], 0x45e270
call dword [eax + 8]
push 0x40100000
push 0
mov ecx, esi
call fcn.004261a0
push 0
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [esp + 0x28], 0
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], ecx
mov dword [esp + 0x2c], 0
mov ecx, dword [esp + 0x2c]
mov dword [eax + 8], ecx
sub esp, 0x10
mov dword [esp + 0x40], 0
mov ecx, dword [esp + 0x40]
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x44]
mov dword [eax], ecx
mov dword [esp + 0x48], 0xc0e00000
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], ecx
push 0x40704000
mov dword [esp + 0x50], 0
mov ecx, dword [esp + 0x50]
mov dword [eax + 8], ecx
push 0
mov dword [esp + 0x58], 0xc0e00000
mov ecx, dword [esp + 0x58]
push 0x406f4000
mov dword [eax + 0xc], ecx
push 0
mov ecx, esi
call dword [edx + 0xc]
push 0x40000000
push 0
mov ecx, esi
call fcn.004261a0
mov edx, dword [esi]
push 0
sub esp, 0x10
mov dword [esp + 0x34], 0
mov ecx, dword [esp + 0x34]
mov eax, esp
mov dword [eax], ecx
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x38]
mov dword [eax + 4], ecx
mov dword [esp + 0x3c], 0
mov ecx, dword [esp + 0x3c]
mov dword [eax + 8], ecx
mov dword [esp + 0x40], 0
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xc0e00000
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0xc0e00000
mov dword [eax + 0xc], ecx
sub esp, 0x10
mov ecx, dword [esp + 0x34]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x3c]
push 0xc0490000
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x44]
push 0
push 0x406f4000
mov dword [eax + 0xc], ecx
push 0
mov ecx, esi
call dword [edx + 0xc]
push 0x40000000
push 0
mov ecx, esi
call fcn.004261a0
push 0x98
call fcn.0044b938
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov byte [esp + 0x3c], 1
je 0x40c34e
mov edx, dword [0x47c158]
mov ecx, dword [edx + 0xa5c]
push ecx
push 0x406e0000
push 0
push 0x40740000
push 0
mov ecx, eax
call fcn.0042a6e0
jmp 0x40c350
xor eax, eax
push eax
lea ecx, [edi + 0x10]
call fcn.00401210
mov ecx, dword [esp + 0x34]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4596d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edi
call fcn.0040b950
mov eax, dword [edi + 0x1a8]
push 0x40813000
push 0
lea esi, [edi + 0x1a8]
push 0x40704000
push 0
mov ecx, esi
mov dword [esp + 0x4c], 0
mov dword [edi], 0x45e318
call dword [eax + 8]
push 0x40100000
push 0
mov ecx, esi
call fcn.004261a0
push 0
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [esp + 0x28], 0
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], ecx
mov dword [esp + 0x2c], 0
mov ecx, dword [esp + 0x2c]
mov dword [eax + 8], ecx
sub esp, 0x10
mov dword [esp + 0x40], 0
mov ecx, dword [esp + 0x40]
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [esp + 0x44], 0
mov ecx, dword [esp + 0x44]
mov dword [eax], ecx
mov dword [esp + 0x48], 0xc0e00000
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], ecx
push 0x406e0000
mov dword [esp + 0x50], 0
mov ecx, dword [esp + 0x50]
mov dword [eax + 8], ecx
push 0
mov dword [esp + 0x58], 0xc0e00000
mov ecx, dword [esp + 0x58]
push 0x40704000
mov dword [eax + 0xc], ecx
push 0
mov ecx, esi
call dword [edx + 0xc]
push 0x40180000
push 0
mov ecx, esi
call fcn.004261a0
mov edx, dword [esi]
push 0
sub esp, 0x10
mov dword [esp + 0x34], 0
mov ecx, dword [esp + 0x34]
mov eax, esp
mov dword [eax], ecx
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x38]
mov dword [eax + 4], ecx
mov dword [esp + 0x3c], 0
mov ecx, dword [esp + 0x3c]
mov dword [eax + 8], ecx
mov dword [esp + 0x40], 0
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xc0e00000
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0xc0e00000
mov dword [eax + 0xc], ecx
sub esp, 0x10
mov ecx, dword [esp + 0x34]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x3c]
push 0xc0490000
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x44]
push 0
push 0x40704000
mov dword [eax + 0xc], ecx
push 0
mov ecx, esi
call dword [edx + 0xc]
push 0x3ff00000
push 0
mov ecx, esi
call fcn.004261a0
push 0x98
call fcn.0044b938
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov byte [esp + 0x3c], 1
je 0x40d52e
mov edx, dword [0x47c158]
mov ecx, dword [edx + 0xa30]
push ecx
push 0x406e0000
push 0
push 0x40740000
push 0
mov ecx, eax
call fcn.0042a6e0
jmp 0x40d530
xor eax, eax
push eax
lea ecx, [edi + 0x10]
call fcn.00401210
mov ecx, dword [esp + 0x34]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret