joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51c201
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5c1334]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x20], 0
je 0x51c26e
cmp dword [esi + 0x18], 0
je 0x51c26e
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00528930
mov ebx, esp
test ebx, ebx
je 0x51c26e
push edi
push ebx
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x18]
push ebx
add ecx, 0x1d4
call fcn.004d9dcd
mov ecx, dword [esi + 0x18]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x20]
mov ecx, eax
call fcn.004dfca7
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00528802
leave
ret 0x10

Function at 0x51ea93
Capabilities:
Hide graphical window

Disassembly:
push 0xa0
mov eax, 0x574ca3
call fcn.0052887e
mov edi, ecx
mov dword [ebp - 0x9c], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x18], eax
mov dword [eax + 0x78c], ebx
cmp dword [edi + 0xc], ebx
jne 0x51eb25
lea eax, [ebp - 0xac]
push eax
call fcn.0051e78b
mov ecx, dword [edi + 0x18]
lea esi, [ebp - 0xac]
push ebx
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
push ebx
movsd dword es:[edi], dword [esi]
push 0x40000000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x20]
mov ecx, eax
call fcn.004dd4ce
mov edi, dword [ebp - 0x9c]
mov ecx, edi
push eax
call fcn.004e185b
mov esi, dword [edi + 0x18]
mov ecx, esi
call fcn.0050875c
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
mov ecx, eax
call fcn.004dd05b
push 1
push dword [eax]
push 0x30
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x18]
lea edx, [ebp - 0x98]
push edx
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.004da644
lea ecx, [ebp - 0x98]
mov bl, al
call fcn.004d9ca5
mov esi, 0x77c
test bl, bl
je 0x51eb60
mov eax, dword [edi + 0x18]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x18]
add eax, esi
push eax
push 0
push 0x1002
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x20], 1
call fcn.00528828
ret 4
Function at 0x524985
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5c1334]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
and dword [eax + 0x350], 0
mov dword [ebp - 0x50], eax
mov dword [eax + 0x34c], ebx
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.00524449
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x38]
mov esi, eax
lea edi, [ebp - 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x5c]
lea esi, [ebp - 0x68]
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x58]
mov dword [ebp - 0x10], eax
add eax, dword [ebp - 0x54]
mov dword [ebp - 8], eax
test esi, esi
jle 0x5249ed
mov eax, dword [ebp - 0x14]
add eax, esi
mov dword [ebp - 0xc], eax
push 2
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
mov eax, dword [ebx]
push 0
call dword [eax + 0x20]
mov ecx, eax
call fcn.004dd4ce
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x4c]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
push eax
push 1
mov dword [ebp - 0x4c], 0x28
call fcn.004e148c
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x24]
call fcn.004d9a91
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jle 0x524a98
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
test esi, esi
jle 0x524a61
lea eax, [ecx + esi]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x54]
sub eax, ecx
cmp eax, edx
mov dword [ebp - 8], ecx
push 2
cmovl edx, eax
mov eax, ecx
sub eax, edx
mov ecx, ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx]
push 0
call dword [eax + 0x20]
mov ecx, eax
call fcn.004dd4ce
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebx]
lea esi, [ebp - 0x14]
push 0
sub esp, 0x10
mov ecx, ebx
mov edi, esp
push 0x80
movsd dword es:[edi], dword [esi]
push closesocket
push 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x20]
mov ecx, eax
call fcn.004dd4ce
mov ebx, dword [ebp - 0x50]
mov ecx, ebx
push eax
call fcn.004e185b
mov esi, dword [ebx + 0xc]
mov edi, dword [sym.imp.USER32.dll_GetParent]
jmp 0x524adb
push esi
call edi
mov esi, eax
push esi
call edi
test eax, eax
jne 0x524ad6
push 5
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00528802
leave
ret 4
Function at 0x5256ff
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5c1334]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x210], edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov esi, eax
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
shl esi, 0x10
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, esi
or ecx, 0x1000000
cmp dword [ebp + 0x10], 0
push 0x103
push eax
cmove ecx, esi
push ecx
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004d9b56
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00528802
leave
ret 0xc

Function at 0x525799
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5c1334]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
pop esi
jne 0x525835
cmp dword [ebp - 0x114], 5
jne 0x5257fd
mov ecx, dword [ebp - 0x110]
test ecx, ecx
jne 0x5257f9
push 2
pop eax
jmp 0x525851
push 3
jmp 0x5257f6
cmp dword [ebp - 0x114], 6
mov eax, dword [ebp - 0x110]
jne 0x525814
test eax, eax
jne 0x525816
push 4
jmp 0x5257f6
jb 0x525851
cmp eax, 1
jne 0x52581f
push 5
jmp 0x5257f6
cmp eax, 2
jne 0x525851
call fcn.00525c06
xor ecx, ecx
test al, al
setne cl
lea eax, [ecx + 6]
jmp 0x525851
cmp dword [ebp - 0x108], 1
jne 0x525851
cmp dword [ebp - 0x114], 4
jne 0x525851
cmp dword [ebp - 0x110], 0x5a
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00528802
leave
ret
Function at 0x525aee
Capabilities:
Hide graphical window

Disassembly:
push 0x9c
mov eax, 0x575344
call fcn.0052887e
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x18], eax
test eax, eax
je 0x525bfe
lea eax, [ebp - 0xa8]
push eax
call fcn.005251fe
mov ecx, dword [ebx + 0x18]
lea esi, [ebp - 0xa8]
xor eax, eax
push eax
sub esp, 0x10
mov edi, esp
push eax
movsd dword es:[edi], dword [esi]
push 0x40000080
push eax
mov eax, dword [ecx]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x20]
mov ecx, eax
call fcn.004dd4ce
push eax
mov ecx, ebx
call fcn.004e185b
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x525bfe
mov esi, dword [ebx + 0x18]
mov ecx, esi
call fcn.0050875c
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
mov ecx, eax
call fcn.004dd05b
push 1
push dword [eax]
push 0x30
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x18]
movzx eax, word [ecx + 0x9aa]
push eax
movzx eax, word [ecx + 0x9a8]
mov ecx, ebx
push eax
call fcn.0052611e
lea eax, [ebp - 0x98]
mov ecx, ebx
push eax
call fcn.005254e8
mov ecx, dword [ebx + 0x18]
and dword [ebp - 4], 0
add ecx, 0x1d4
push eax
call fcn.004d9d3f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.004d9ca5
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx]
call dword [eax + 0xe4]
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push 4
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [ebx + 0x20], 1
call fcn.00528828
ret 4
Function at 0x52733c
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x1c8
mov eax, 0x57556f
call fcn.0052887e
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1cc], ebx
call fcn.004dd4f9
push eax
lea ecx, [ebp - 0x98]
call fcn.004d9b31
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004dd4ff
mov ecx, eax
call fcn.004da644
test al, al
je 0x527424
push ebx
lea ecx, [ebp - 0x98]
call fcn.004d9fdd
push esi
push 0x80
push 3
push esi
push 1
push closesocket
lea ecx, [ebp - 0x98]
call fcn.004da4c6
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5273c7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.004d9ca5
jmp 0x527505
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x5273b3
push edi
mov dword [ebp - 0x1c8], esi
call fcn.00528a7d
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 0x1c8]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c8], edi
je 0x5274f0
push esi
call fcn.00528a86
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.004d9ca5
jmp 0x527503
call fcn.004dd4ff
push eax
lea ecx, [ebp - 0x98]
call fcn.004d9f5a
call fcn.004dd618
test al, al
je 0x527445
call fcn.004dd505
jmp 0x52745c
push 2
push esi
lea ecx, [ebp - 0x98]
call fcn.004da4c6
push eax
call fcn.004e9b7e
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x5273b3
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x1d4]
push eax
push 1
push dword [ebp - 0x1cc]
push ebx
call fcn.004e920b
add esp, 0x14
test eax, eax
jne 0x5273b3
mov edi, dword [ebp - 0x9c]
test edi, edi
je 0x5273b3
push edi
call fcn.00528a7d
push 3
push edi
mov esi, eax
push esi
push dword [ebp - 0x1d4]
push ebx
call fcn.004e9fdb
add esp, 0x18
test eax, eax
je 0x5274e0
cmp eax, 0x600
je 0x5274e0
push esi
call fcn.00528a86
pop ecx
call fcn.004dd618
test al, al
jne 0x527410
push ebx
call fcn.004e905b
jmp 0x52740f
call fcn.004dd618
test al, al
jne 0x5274f0
push ebx
call fcn.004e905b
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.004d9ca5
test esi, esi
jne 0x527577
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push closesocket
push dword [ebp - 0x1cc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x527573
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
je 0x527573
push edi
mov dword [ebp - 0x1d0], esi
call fcn.00528a7d
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1d0], edi
je 0x52756f
push esi
call fcn.00528a86
pop ecx
xor esi, esi
test esi, esi
jne 0x527577
xor eax, eax
jmp 0x527580
push edi
push esi
call fcn.005272d3
pop ecx
pop ecx
call fcn.00528828
ret
Function at 0x52c460
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x52c46c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.0052c9b0

Function at 0x52c7a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5c1334]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x108], edx
test edi, edi
jg 0x52c7dc
jl 0x52c7ca
test edx, edx
jne 0x52c7dc
mov eax, dword [ebp + 8]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00528802
mov esp, ebp
pop ebp
ret
mov ecx, 1
mov dword [ebp - 0x84], 0xedb88320
mov eax, ecx
nop dword [eax]
mov dword [ebp + eax*4 - 0x84], ecx
inc eax
add ecx, ecx
cmp eax, 0x20
jl 0x52c7f0
push ebx
push esi
xor esi, esi
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp + esi - 0x84]
lea ecx, [ebp - 0x84]
xor edx, edx
test eax, eax
je 0x52c830
test al, 1
je 0x52c829
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x52c823
mov dword [ebp + esi - 0x104], edx
add esi, 4
cmp esi, 0x80
jl 0x52c810
xor esi, esi
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [ebp + esi - 0x104]
lea ecx, [ebp - 0x104]
xor edx, edx
test eax, eax
je 0x52c870
test al, 1
je 0x52c869
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x52c863
mov dword [ebp + esi - 0x84], edx
add esi, 4
cmp esi, 0x80
jl 0x52c850
mov ebx, dword [ebp + 8]
nop word [eax + eax]
xor esi, esi
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp + esi - 0x84]
lea ecx, [ebp - 0x84]
xor edx, edx
test eax, eax
je 0x52c8c0
test al, 1
je 0x52c8b9
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x52c8b3
mov dword [ebp + esi - 0x104], edx
add esi, 4
cmp esi, 0x80
jl 0x52c8a0
mov edx, dword [ebp - 0x108]
mov eax, edx
and eax, 1
or eax, 0
je 0x52c900
xor ecx, ecx
lea eax, [ebp - 0x104]
test ebx, ebx
je 0x52c8fe
nop
test bl, 1
je 0x52c8f7
xor ecx, dword [eax]
add eax, 4
shr ebx, 1
jne 0x52c8f0
mov ebx, ecx
shrd edx, edi, 1
sar edi, 1
mov eax, edx
or eax, edi
mov dword [ebp - 0x108], edx
je 0x52c996
xor esi, esi
nop dword [eax + eax]
mov eax, dword [ebp + esi - 0x104]
lea ecx, [ebp - 0x104]
xor edx, edx
test eax, eax
je 0x52c940
test al, 1
je 0x52c939
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x52c933
mov dword [ebp + esi - 0x84], edx
add esi, 4
cmp esi, 0x80
jl 0x52c920
mov edx, dword [ebp - 0x108]
mov eax, edx
and eax, 1
or eax, 0
je 0x52c980
xor ecx, ecx
lea eax, [ebp - 0x84]
test ebx, ebx
je 0x52c97e
nop
test bl, 1
je 0x52c977
xor ecx, dword [eax]
add eax, 4
shr ebx, 1
jne 0x52c970
mov ebx, ecx
shrd edx, edi, 1
sar edi, 1
mov ecx, edx
or ecx, edi
mov dword [ebp - 0x108], edx
jne 0x52c890
xor ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.00528802
mov esp, ebp
pop ebp
ret

Function at 0x54a029
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x402ca0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00401f90
add esp, 4
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.00403160
add esp, 8
push eax
lea ecx, [ebp - 8]
call fcn.00401360
lea ecx, [ebp - 0xc]
call fcn.00404a70
mov dword [ebp - 0x10], 0x402710
mov edx, dword [ebp - 4]
add edx, 4
push edx
push 0
lea ecx, [ebp - 8]
call fcn.004097e0
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
call fcn.0041a21b
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x402d13
lea ecx, [ebp - 8]
call fcn.0040a7b0
jmp 0x402d24
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
push 6
call fcn.0040c009
lea ecx, [ebp - 8]
call fcn.00404a70
mov esp, ebp
pop ebp
ret 4
Function at 0x40b620
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x40b640
jl 0x40b637
cmp dword [ebp + 0xc], 0
ja 0x40b640
xor eax, eax
xor edx, edx
jmp 0x40b777
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x40b662
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.0040b780
jmp 0x40b777
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call fcn.00406830
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x40b6d1
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00403230
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00409b00
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004080f0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.004097a0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x40b768
mov ecx, dword [ebp - 8]
call fcn.004077b0
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x40b741
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0041797f
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x40b73f
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x40b777
jmp 0x40b6ed
cmp dword [ebp - 4], 0
jbe 0x40b768
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.0041797f
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40eccb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40ed0a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40ed0a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40ed0a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40ed0a
cmp dword [ecx + 0x74], 0xe
jbe 0x40ed0a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x420104
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43464c
push 0x434644
push str.FlsAlloc
push 0x1e
call fcn.0041ff2e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x420138
push dword [ebp + 8]
mov ecx, esi
call dword [0x430174]
call esi
jmp 0x42013e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x420182
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43465c
push 0x434654
push str.FlsGetValue
push 0x20
call fcn.0041ff2e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4201b9
push dword [ebp + 8]
mov ecx, esi
call dword [0x430174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x421a9b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042173d

Function at 0x421aa6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004218cc

Function at 0x421ea0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040f050
mov eax, dword [0x46eec0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004207a0
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x421ee2
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x42203e
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0042eae0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x470d08]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00423070
mov ecx, dword [esi*4 + 0x470d08]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x422037
cmp eax, dword [edi + ecx + 0x24]
jne 0x422037
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422037
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00423070
add esp, 0x14
test edx, edx
jl 0x422037
jg 0x421fad
test eax, eax
jb 0x422037
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x422037
jl 0x421fc7
cmp dword [ebp - 0x1008], eax
ja 0x422037
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x421fe5
test ebx, ebx
je 0x42201e
cmp ecx, edi
jae 0x42201e
mov al, byte [ecx]
cmp al, 0xd
jne 0x421fff
lea eax, [edi - 1]
cmp ecx, eax
jae 0x42200b
cmp byte [ecx + 1], 0xa
jne 0x42200b
inc ecx
jmp 0x42200b
movzx eax, al
movsx eax, byte [eax + 0x46f180]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x421fe5
cmp edx, ebx
jne 0x421fe5
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x42203c
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040e527
leave
ret