joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc71720
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0xc80008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.DumpIt
push str.RegistryMachineSystemCurrentControlSetServices_s
lea eax, [ebp - 0x218]
push 0x20a
xor esi, esi
push eax
mov dword [ebp - 0x21c], esi
call fcn.00c71dc5
add esp, 0x10
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x224]
push edx
call dword [0xc81b48]
lea eax, [ebp - 0x224]
push eax
call dword [0xc81b4c]
test eax, eax
jne 0xc717b9
lea ecx, [ebp - 0x21c]
push ecx
push 0xf003f
push eax
push str.SYSTEMCurrentControlSetServices
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xc717b9
mov edx, dword [ebp - 0x21c]
push str.DumpIt
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0xc717b9
lea esi, [eax + 1]
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0xc717ca
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00c71db6
mov esp, ebp
pop ebp
ret

Function at 0xc71870
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0xc80008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [ebp - 0x664]
push ecx
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x664], 0x20
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x20a
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.00c776b0
movzx ecx, word [ebp - 0x654]
movzx edx, word [ebp - 0x656]
movzx eax, word [ebp - 0x658]
add esp, 0xc
push ecx
movzx ecx, word [ebp - 0x65a]
push edx
movzx edx, word [ebp - 0x65e]
push eax
movzx eax, word [ebp - 0x660]
push ecx
push edx
push eax
lea ecx, [ebp - 0x24]
push ecx
push str._s__04d_02d_02d__02d_02d_02d.raw
lea edx, [ebp - 0x238]
push 0x20a
push edx
call fcn.00c71dc5
push 0x20a
lea eax, [ebp - 0x448]
push 0
push eax
call fcn.00c776b0
add esp, 0x34
lea ecx, [ebp - 0x670]
push ecx
lea edx, [ebp - 0x448]
push edx
push 0x105
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [ebp - 0x650]
push ecx
lea edx, [ebp - 0x66c]
push edx
call dword [0xc81b48]
push 0
push 0
lea eax, [ebp - 0x66c]
push eax
lea ecx, [ebp - 0x448]
push ecx
call dword [0xc81b44]
mov bl, al
test bl, bl
je 0xc719a1
movzx eax, word [ebp - 0x66c]
lea esi, [eax + 2]
shr esi, 1
cmp esi, 0x20a
ja 0xc719a1
mov edx, dword [ebp - 0x668]
push eax
push edx
push edi
call fcn.00c7ab20
add esp, 0xc
xor eax, eax
mov word [edi + esi*2 - 2], ax
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00c71db6
mov esp, ebp
pop ebp
ret
Function at 0xc71a70
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0xc80008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x38]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0xc71ab2
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00c71db6
mov esp, ebp
pop ebp
ret
push str.NtQuerySystemInformation
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0xc81b40], esi
test esi, esi
je 0xc71a9f
push 0x2c
lea ecx, [ebp - 0x30]
push 0
push ecx
call fcn.00c776b0
add esp, 0xc
push 0
push 0x2c
lea edx, [ebp - 0x30]
push edx
push 0
call esi
test eax, eax
js 0xc71a9f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
inc eax
mul dword [ebp - 0x28]
mov ebx, eax
mov eax, dword [ebp - 0x38]
mov esi, edx
mul dword [ebp - 0x3c]
push 0
push ecx
push edx
push eax
call fcn.00c7b2e0
mov dword [ebp - 0x48], eax
mov edi, edx
mov edx, ebx
mov eax, esi
shrd edx, eax, 0x14
shr eax, 0x14
push eax
push edx
push 7
push esi
push ebx
push 0xf
push str._n____Address_space_size:____I64d_bytes___I64d_Mb__n
call fcn.00c71e01
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, edi
shrd ecx, edx, 0x14
shr edx, 0x14
push edx
push ecx
push 7
push edi
push eax
push 0xf
push str.____Free_space_size:_______I64d_bytes___I64d_Mb__n_n
call fcn.00c71e01
add esp, 0x38
cmp edi, esi
ja 0xc71b6b
jb 0xc71a9f
cmp dword [ebp - 0x48], ebx
jb 0xc71a9f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00c71db6
mov esp, ebp
pop ebp
ret
Function at 0xc71b80
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3cc
mov eax, dword [0xc80008]
xor eax, esp
mov dword [esp + 0x3c8], eax
push ebx
push esi
push edi
push str.__DumpIt___v1.3.2.20110401___One_click_memory_memory_dumper_n
call fcn.00c71060
add esp, 4
push 0xc7e348
call fcn.00c71e01
add esp, 4
push str.__Copyright__c__2010___2011__MoonSols__http:__www.moonsols.com__n_n
call fcn.00c71e01
add esp, 4
call fcn.00c717e0
test al, al
jne 0xc71bf6
push str._______Error:_Cannot_import_functions._n
call fcn.00c71000
add esp, 4
call fcn.00c72140
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c8]
xor ecx, esp
call fcn.00c71db6
mov esp, ebp
pop ebp
ret
xor ebx, ebx
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x44], ebx
mov word [esp + 0x48], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0xc71c54
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0xc71c43
mov dword [esp + 0xc], ebx
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [esp + 0xc], ebx
jne 0xc71c7d
push str._______Error:_This_application_requires_Administrator_privileges._n
call fcn.00c71000
add esp, 4
call fcn.00c72140
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c8]
xor ecx, esp
call fcn.00c71db6
mov esp, ebp
pop ebp
ret
call fcn.00c71a70
test al, al
jne 0xc71caf
push str._______You_dont_have_enough_space_on_disk_to_dump_the_physical_memory._n
call fcn.00c71000
add esp, 4
call fcn.00c72140
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c8]
xor ecx, esp
call fcn.00c71db6
mov esp, ebp
pop ebp
ret
push 0x3b0
lea edx, [esp + 0x24]
push ebx
push edx
call fcn.00c776b0
add esp, 0xc
lea edi, [esp + 0x94]
mov dword [esp + 0x28], 0x300021
call fcn.00c71870
push str._____Destination_
call fcn.00c71060
add esp, 4
mov eax, edi
push eax
push 0xc7e5f8
call fcn.00c710c0
add esp, 8
call fcn.00c71120
test eax, eax
je 0xc71d9f
call fcn.00c719c0
mov esi, eax
cmp esi, 0xffffffff
je 0xc71d9f
push str._____Processing...
call fcn.00c71060
add esp, 4
push ebx
lea ecx, [esp + 0x18]
push ecx
push 0x3b0
lea edx, [esp + 0x2c]
push edx
push 0x3b0
mov eax, edx
push eax
push 0x22c000
push esi
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0xc71d65
push str.Failed._r_n_r_n
call fcn.00c71e01
add esp, 4
push str._______Error:_DeviceIoControl____Cannot_send_IOCTL._r_n_r_n
call fcn.00c71e01
add esp, 4
jmp 0xc71d93
cmp dword [esp + 0x24], ebx
jl 0xc71d81
cmp dword [esp + 0x20], 0x57333244
jne 0xc71d81
push str.Success._n
call fcn.00c710c0
jmp 0xc71d8b
push str.Failed._n
call fcn.00c71000
add esp, 4
call fcn.00c72140
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00c71720
mov ecx, dword [esp + 0x3d4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00c71db6
mov esp, ebp
pop ebp
ret
Function at 0xc71db6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0xc80008]
jne 0xc71dc0
repz ret
jmp fcn.00c722d9

Function at 0xc78f75
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xc80008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00c75809
and dword [ebp - 0x14], 0
cmp dword [0xc81b20], 0
mov dword [ebp - 0x18], eax
jne 0xc79028
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0xc790d0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0xc790d0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0xc81b20], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0xc81b24], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0xc81b28], eax
call edi
push eax
call esi
mov dword [0xc81b30], eax
test eax, eax
je 0xc79028
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0xc81b2c], eax
mov eax, dword [0xc81b2c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0xc79081
cmp dword [0xc81b30], ecx
je 0xc79081
push eax
call esi
push dword [0xc81b30]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0xc79081
test ebx, ebx
je 0xc79081
call edi
test eax, eax
je 0xc79078
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0xc79078
test byte [ebp - 8], 1
jne 0xc79081
or dword [ebp + 0x10], 0x200000
jmp 0xc790b4
mov eax, dword [0xc81b24]
cmp eax, dword [ebp - 0x18]
je 0xc790b4
push eax
call esi
test eax, eax
je 0xc790b4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0xc790b4
mov eax, dword [0xc81b28]
cmp eax, dword [ebp - 0x18]
je 0xc790b4
push eax
call esi
test eax, eax
je 0xc790b4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0xc81b20]
call esi
test eax, eax
je 0xc790d0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0xc790d2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00c71db6
leave
ret
Function at 0x405d70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x405da8
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x405d96
mov al, 1
jmp 0x405e07
cmp dword [ebx + 0x54], ecx
jne 0x405d9f
mov al, 2
jmp 0x405e07
cmp dword [ebx + 0x7c], ecx
jne 0x405e07
mov al, 3
jmp 0x405e07
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x405dbd
mov al, 4
jmp 0x405e07
cmp ecx, 5
jne 0x405ddd
cmp ebx, 0
jne 0x405dcb
mov al, 5
jmp 0x405e07
cmp ebx, 1
jne 0x405dd4
mov al, 6
jmp 0x405e07
cmp ebx, 2
jne 0x405ddd
mov al, 7
jmp 0x405e07
cmp ecx, 6
jne 0x405e05
cmp ebx, 0
jne 0x405deb
mov al, 8
jmp 0x405e07
cmp ebx, 1
jne 0x405df2
mov al, 9
cmp ebx, 2
jne 0x405df9
mov al, 0xa
cmp ebx, 3
jne 0x405e00
mov al, 0xb
cmp ebx, 4
jne 0x405e07
mov al, 0xc
pop ebx
leave
ret
Function at 0x40d7c9
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40d87d
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040d759
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40d856
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d889
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40d8a4
test ebp, ebp
je 0x40d8a4
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40d8ac
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40d8ec
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40d948
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40d943
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40d92e
test dl, dl
je 0x40d92a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40d92e
add ecx, 2
add eax, 2
test dl, dl
jne 0x40d90e
xor eax, eax
jmp 0x40d933
sbb eax, eax
or eax, 1
test eax, eax
je 0x40d952
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40d8fb
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40d969
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040d7c9
test eax, eax
jne 0x40d981
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040d889
mov esi, eax
test esi, esi
jne 0x40d9b7
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40d9d1
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x40dac9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0040d7c9
mov esi, eax
test esi, esi
jne 0x40dae7
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0040d889
mov dword [esp + 0x18], eax
test eax, eax
je 0x40dadf
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0040d889
mov dword [esp + 0x34], eax
test eax, eax
je 0x40dadf
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0040d889
mov dword [esp + 0x28], eax
test eax, eax
je 0x40dadf
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0040d889
mov dword [esp + 0x30], eax
test eax, eax
je 0x40dadf
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x40dcae
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x40dcae
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x40dc11
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x40dc92
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x40dc34
movzx esi, ax
jmp 0x40dc39
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x40dc58
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x40dc67
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x40dcbb
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x40dc29
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x40dbee
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x40dce4
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x40dce4
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x40dcc9
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x40dcf9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0040d7c9
mov esi, eax
test esi, esi
je 0x40ddb5
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0040d889
mov ebp, eax
test ebp, ebp
je 0x40ddb4
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0040d889
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x40ddb4
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x40ddb4
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40ddb3
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x40dd99
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x413abb
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x413b6e
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x41490a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
and eax, 1
leave
ret
Function at 0x414d8b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x414dae
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x414dae
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x414db8
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x414dfa
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x414e5c
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x414e57
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414e42
test dl, dl
je 0x414e3e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414e42
add ecx, 2
add eax, 2
test dl, dl
jne 0x414e22
xor eax, eax
jmp 0x414e47
sbb eax, eax
or eax, 1
test eax, eax
je 0x414e68
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x414e0f
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x414e8b
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x414ead
mov eax, 0xfffffffd
jmp 0x414f7f
cmp dword [0x908050], 0
je 0x414f58
cmp dword [0x908054], 5
jl 0x414edb
cmp dword [0x908054], 7
jg 0x414edb
mov eax, 1
jmp 0x414ee0
mov eax, 0
test eax, eax
jne 0x414ef9
cmp dword [0x908054], 0xfffffffb
je 0x414ef9
xor eax, eax
jmp 0x414efe
mov eax, 1
test eax, eax
je 0x414f2a
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x414f13
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
cmp dword [0x908050], 0
jne 0x414f75
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x414f7f
mov esp, ebp
pop ebp
ret 4
Function at 0x417a07
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x417abb
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00417997
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x417a94
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417ac7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x417ae2
test ebp, ebp
je 0x417ae2
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x417aea
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x417b2a
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x417b86
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x417b81
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x417b6c
test dl, dl
je 0x417b68
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x417b6c
add ecx, 2
add eax, 2
test dl, dl
jne 0x417b4c
xor eax, eax
jmp 0x417b71
sbb eax, eax
or eax, 1
test eax, eax
je 0x417b90
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x417b39
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret