joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402568
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402576
call dword [0x40b004]
or eax, eax
je 0x402577
ret
mov al, 1
jmp fcn.004025e8

Function at 0x402580
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40258e
call dword [0x40b008]
or eax, eax
jne 0x40258f
ret
mov al, 2
jmp fcn.004025e8

Function at 0x402598
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4025d0
test edx, edx
je 0x4025ba
push eax
mov eax, ecx
call dword [0x40b00c]
pop ecx
or eax, eax
je 0x4025c9
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.004025e8
mov dword [eax], edx
mov eax, ecx
call dword [0x40b008]
or eax, eax
jne 0x4025b3
ret
mov al, 1
jmp fcn.004025e8
test edx, edx
je 0x4025e4
push eax
mov eax, edx
call dword [0x40b004]
pop ecx
or eax, eax
je 0x4025c9
mov dword [ecx], eax
ret

Function at 0x402770
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x403754
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.004025e8
cmp eax, edx
je 0x4037c4
cmp word [eax], 8
jb 0x403779
push eax
push edx
cmp word [eax], 0x100
je 0x40376f
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x403777
add eax, 8
call fcn.0040316c
pop edx
pop eax
cmp word [edx], 8
jae 0x403790
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
jne 0x4037b0
mov edx, dword [edx + 8]
or edx, edx
je 0x4037a7
mov ecx, dword [edx - 8]
inc ecx
jle 0x4037a7
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x403718
ret

Function at 0x4051d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405209
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040324c
jmp 0x405212
mov eax, ebx
mov edx, esi
call fcn.00403200
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40521c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x40523d
mov al, byte [esp]
jmp 0x40523f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069b0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4069f8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040694c
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4069ff
lea eax, [ebp - 4]
call fcn.0040316c
ret
Function at 0x407864
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c55c
mov eax, esi
mov edx, 8
test al, 1
je 0x407880
shr eax, 1
xor eax, 0xedb88320
jmp 0x407882
shr eax, 1
dec edx
jne 0x407873
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40786c
pop esi
ret

Function at 0x4078af
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c558], 0
jne 0x4078bb
call fcn.00407864
push 1
push 0x40c558
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x4078e6
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4078c1
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x408f90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f44
test al, al
jne 0x408fb1
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408ffd
xor eax, eax
push ebp
push 0x408fed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004033e8
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408ff4
lea eax, [ebp - 0xc]
call fcn.00408f80
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409304
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4093f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406cc8
mov edx, dword [ebp - 8]
mov ecx, 0x40940c
xor eax, eax
call fcn.004091f8
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093c1
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409324
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x35
call fcn.00408dac
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c58
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407258
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x67
call fcn.00408d7c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404624
call fcn.00405854
call fcn.00402e88
jmp 0x409324
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4093fa
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040318c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040318c
ret
Function at 0x4147d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x4147f5
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x414868
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x41482a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x41485d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x41485b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x414821
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4147ec
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x40249e
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7c0
mov ebx, eax
mov al, byte [0x412524]
test al, al
mov byte [esp], dl
lea esi, [esp + 4]
je 0x4024da
xor edx, edx
mov dl, al
cmp edx, 0x20
je 0x4024ce
mov edx, 0x411125
mov eax, ebx
call fcn.0040c530
mov edx, 0x412524
mov eax, ebx
call fcn.0040c530
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.0040c35c
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x5c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x402503
lea edx, [ebx + 1]
jmp 0x402505
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x402556
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x40252e
jmp 0x402527
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x402527
mov byte [ebx + eax], 0x20
jmp 0x40252e
inc eax
cmp byte [ebx + eax], 0
jne 0x402517
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x402543
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x402555
cmp edx, 0x20
jne 0x40254c
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x40255d
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x40250c
mov dword [esi + 0x1c], 1
mov eax, dword [esi + 0x10]
call fcn.00405e14
mov edi, eax
test edi, edi
je 0x402589
mov edx, str..inf
mov eax, edi
call fcn.0040c4e4
test eax, eax
jne 0x402589
mov dword [esi + 0xc], 0x4111f6
xor edx, edx
mov eax, dword [esi + 0x10]
call fcn.0040679c
mov byte [esp + 1], al
cmp byte [esp + 1], 0
je 0x4025b1
lea edx, [esp + 0x40]
mov eax, dword [esi + 0x10]
call fcn.00406868
lea ecx, [esp + 0x40]
mov dword [esi + 0x10], ecx
cmp byte [esp], 0
je 0x4025f4
cmp byte [esp + 1], 0
jne 0x4025f4
lea eax, [esp + 0x440]
mov edx, dword [esi + 0x10]
call fcn.0040c45c
mov edx, str..exe
lea eax, [esp + 0x440]
call fcn.0040c530
lea eax, [esp + 0x440]
xor edx, edx
call fcn.0040679c
test al, al
je 0x4026dc
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x40261e
and dword [esi + 4], 0xfffffbff
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x4026dc
cmp byte [0x411044], 0
jne 0x402635
cmp byte [esp], 0
je 0x40268d
mov ebx, dword [0x411870]
test ebx, ebx
je 0x402649
push ebx
call sub.USER32.DLL_IsWindowVisible
test eax, eax
jne 0x40264d
xor eax, eax
jmp 0x402652
mov eax, 1
mov ebx, eax
test ebx, ebx
je 0x402665
push 0
push dword [0x411870]
call sub.USER32.DLL_ShowWindow
push 0x7d0
push dword [esi + 0x38]
call sub.USER32.DLL_WaitForInputIdle
push 0xffffffffffffffff
push dword [esi + 0x38]
call sub.KERNEL32.DLL_WaitForSingleObject
test ebx, ebx
je 0x40268d
push 1
push dword [0x411870]
call sub.USER32.DLL_ShowWindow
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x4026a9
mov edx, str..exe
mov eax, edi
call fcn.0040c4e4
test eax, eax
je 0x4026dc
cmp byte [0x411044], 0
je 0x4026c4
cmp byte [esp], 0
jne 0x4026c4
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x4026dc
cmp byte [esp], 0
je 0x4026d1
mov edx, 0xc8
jmp 0x4026d6
mov edx, 0x3e8
push edx
call sub.KERNEL32.DLL_Sleep
add esp, 0x840
pop edi
pop esi
pop ebx
ret
Function at 0x10001460
Capabilities:
Copy file
Set current directory

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x104
push 0x100175b8
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
push str.C:ProgramDataUnZipCAMUnZipCAM.exe
push 0x100175b8
call edi
push 0x104
push 0x100173b0
push 0
call esi
push 0x5c
push 0x100173b0
call fcn.1000235b
add esp, 8
xor ecx, ecx
push 0x100173b0
mov word [eax + 2], cx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 1
push str.C:ProgramDataUnZipCAMZipDLL.dll
push 0x1000d508
call edi
pop edi
pop esi
ret

Function at 0x10001900
Capabilities:
Create directory
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x10001982
push str.ChrisSanders
push eax
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
test eax, eax
je 0x10001925
push 0
call fcn.100028e7
push str.ChrisSanders
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push str.C:ProgramDataUnZipCAM
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x24
push 0x1000d40c
push 1
push str.UnZipCAM
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
call fcn.10001460
push str.Start...Code_techspence_n
call fcn.10002389
call fcn.100011b0
push str.Start......techspence_Up_Code_Ok_n
call fcn.10002389
add esp, 8
mov eax, 1
pop ebp
ret 0xc

Function at 0x10001e74
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000f078]
jne 0x10001e7e
repz ret
jmp fcn.10002c89
Function at 0x10007e50
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000f078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10004f64
and dword [ebp - 0x14], 0
cmp dword [0x10017384], 0
mov dword [ebp - 0x18], eax
jne 0x10007f03
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10007fab
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10007fab
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10017384], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10017388], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1001738c], eax
call edi
push eax
call esi
mov dword [0x10017394], eax
test eax, eax
je 0x10007f03
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10017390], eax
mov eax, dword [0x10017390]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10007f5c
cmp dword [0x10017394], ecx
je 0x10007f5c
push eax
call esi
push dword [0x10017394]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10007f5c
test ebx, ebx
je 0x10007f5c
call edi
test eax, eax
je 0x10007f53
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10007f53
test byte [ebp - 8], 1
jne 0x10007f5c
or dword [ebp + 0x10], 0x200000
jmp 0x10007f8f
mov eax, dword [0x10017388]
cmp eax, dword [ebp - 0x18]
je 0x10007f8f
push eax
call esi
test eax, eax
je 0x10007f8f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10007f8f
mov eax, dword [0x1001738c]
cmp eax, dword [ebp - 0x18]
je 0x10007f8f
push eax
call esi
test eax, eax
je 0x10007f8f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10017384]
call esi
test eax, eax
je 0x10007fab
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10007fad
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001e74
leave
ret
Function at 0x407e87
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x477638]
jne 0x407e91
repz ret
jmp fcn.00409fab

Function at 0x40b0ff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407f08
and dword [ebp - 4], 0
cmp dword [0x479aa8], 0
mov ebx, eax
jne 0x40b1b0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b261
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b261
push eax
call fcn.00407e96
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x479aa8], eax
call esi
push eax
call fcn.00407e96
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x479aac], eax
call esi
push eax
call fcn.00407e96
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x479ab0], eax
call esi
push eax
call fcn.00407e96
pop ecx
mov dword [0x479ab8], eax
test eax, eax
je 0x40b1b0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407e96
pop ecx
mov dword [0x479ab4], eax
mov eax, dword [0x479ab4]
cmp eax, ebx
je 0x40b208
cmp dword [0x479ab8], ebx
je 0x40b208
push eax
call fcn.00407f11
push dword [0x479ab8]
mov esi, eax
call fcn.00407f11
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b208
test edi, edi
je 0x40b208
call esi
test eax, eax
je 0x40b1ff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b1ff
test byte [ebp - 0xc], 1
jne 0x40b208
or dword [ebp + 0x10], 0x200000
jmp 0x40b241
mov eax, dword [0x479aac]
cmp eax, ebx
je 0x40b241
push eax
call fcn.00407f11
pop ecx
test eax, eax
je 0x40b241
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b241
mov eax, dword [0x479ab0]
cmp eax, ebx
je 0x40b241
push eax
call fcn.00407f11
pop ecx
test eax, eax
je 0x40b241
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x479aa8]
call fcn.00407f11
pop ecx
test eax, eax
je 0x40b261
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b263
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40caf7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x46f3f3]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x4770b4], 0x2b6c
mov dword [0x4770b8], 0xf24
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.0040d99a
mov dword [0x4770b4], 0xfffffff5
call fcn.0040cff9
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.0040c9a2
xor ecx, ecx
mov edx, dword [0x4770b4]
add edx, 0x3cb
mov dword [0x4770b8], edx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x40cc2e
mov eax, dword [ebp - 0x3c]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.0040d209
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x44], ecx
mov ecx, dword [0x4770b8]
mov esi, ecx
add esi, 0xffffea83
mov dword [0x4770b4], esi
mov esi, dword [ebp - 0x44]
mov dword [edx + 0x14], esi
add ecx, 0xffffc381
mov dword [0x4770b8], ecx
cmp esi, 0
mov dword [ebp - 0x40], eax
je 0x40cc2e
mov dword [0x4770b4], 0xc0c
mov eax, dword [ebp - 0x44]
add eax, 0x15fa
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x4c
pop esi
pop edi
pop ebp
ret
Function at 0x40cde0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
cmp eax, 0
sete bl
mov dword [0x4770b4], 0x1477
cmp ecx, 0
sete bh
mov dword [0x4770b8], 0x8a9
and bh, bl
test bh, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x40ce40
jmp 0x40ce4b
mov dword [0x4770b4], 0xfffff84b
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [0x4770b8], 0x19eb
mov dword [0x4770b4], 0xfc1
mov ecx, dword fs:[0x18]
mov dword [0x4770b4], 0xd4b
mov dword [0x4770b8], 0xe95
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0xc]
mov ecx, eax
add ecx, 0x14
mov eax, dword [eax + 0x14]
mov dword [0x4770b4], 0xd87
cmp eax, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
je 0x40cfe5
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov edx, dword [ebp - 0x24]
mov byte [ebp - 0x25], cl
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, eax
add ecx, 0x24
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x25]
and bh, bl
test bh, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], esi
jne 0x40ce2b
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov dx, word [ecx]
mov dword [0x4770b8], 0x2d
shr dx, 1
movzx esi, dx
cmp dx, 0
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], eax
je 0x40cfc8
mov eax, dword [ebp - 0x40]
mov ecx, 0xfffffbb5
mov edx, dword [ebp - 0x34]
mov si, word [edx + eax*2]
mov di, si
add di, 0xffbf
mov bx, si
add bx, 0x20
cmp di, 0x1a
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov word [ebp - 0x4a], si
mov word [ebp - 0x4c], bx
jb 0x40cf50
mov ax, word [ebp - 0x4a]
mov word [ebp - 0x4c], ax
mov ax, word [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x44]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
sete bh
mov al, bl
xor al, 1
or bh, al
test bh, 1
mov esi, dword [ebp - 0x48]
mov byte [ebp - 0x4d], bl
mov dword [ebp - 0x54], esi
jne 0x40cf9b
mov eax, 0xffffee9d
mov ecx, dword [ebp - 0x44]
add ecx, 1
mov edx, dword [ebp - 0x3c]
cmp ecx, edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x54], eax
jb 0x40cf14
mov eax, dword [ebp - 0x54]
mov dword [0x4770b8], 0x534
mov cl, byte [ebp - 0x4d]
test cl, 1
mov dword [ebp - 0x58], eax
jne 0x40cfb5
jmp 0x40cfc8
mov eax, dword [ebp - 0x58]
mov dword [0x4770b4], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x18], ecx
jmp 0x40ce40
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
cmp ecx, edx
mov dword [ebp - 0x2c], ecx
jne 0x40ceb7
mov dword [0x4770b4], 0x164d
xor eax, eax
mov dword [0x4770b4], 0xca4
mov dword [ebp - 0x18], eax
jmp 0x40ce40
Function at 0x40d34e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ecx, dword [0x4770b8]
add ecx, 0xfffff1e3
mov dword [0x4770b4], ecx
mov dword [0x4770b8], 0x15c
mov dword [ebp - 0x10], eax
call fcn.0040ddd8
xor ecx, ecx
mov edx, eax
mov dword [0x4770b4], 0xfffff6ff
mov esi, dword [eax + 0x3c]
mov dword [0x4770b4], 0x3a7
mov esi, dword [eax + esi + 0x78]
mov dword [0x4770b8], 0xffffea02
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x4770b4], 0x114d
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x40d4d7
jmp 0x40d467
mov eax, dword [ebp - 0x2c]
mov ecx, eax
mov edx, dword [ebp - 0x30]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x35], bh
mov byte [ebp - 0x36], cl
je 0x40d4a6
jmp 0x40d479
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + ecx*4]
mov dword [0x4770b8], 0x15c
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edx
jmp 0x40d3e1
mov eax, dword [ebp - 0x44]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x4770b8], 0x1344
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [0x4770b4], 0xcf8
mov dword [ebp - 0x28], edx
jmp 0x40d4d7
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
jmp 0x40d410
mov al, byte [ebp - 0x35]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x34]
add edx, 1
mov ah, byte [ebp - 0x36]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x2c], edx
jne 0x40d3e1
mov al, byte [ebp - 0x36]
test al, 1
jne 0x40d436
jmp 0x40d4af
xor eax, eax
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov edx, dword [ebp - 0x44]
add edx, 2
mov esi, dword [ebp - 0x18]
cmp ecx, esi
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x28], eax
jb 0x40d410
mov eax, dword [ebp - 0x28]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret