joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b370
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x40b3d1
mov ecx, 2
imul edx, ecx, 0
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx]
test ecx, ecx
je 0x40b3d1
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40b3cb
mov eax, dword [ebp - 8]
jmp 0x40b40b
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x40b408
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 8]
je 0x40b408
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40d960
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d31d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x43b0e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x30], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.0040e3a0
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0x40d8a0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x40da09
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], edx
jmp 0x40da1a
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040ec90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4112d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x24
ja 0x411310
cmp dword [ebp - 4], 0x24
je 0x41144d
mov ecx, dword [ebp - 4]
sub ecx, 3
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x11
ja case.0x411309.1
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x4114ac]
jmp dword [eax*4 + 0x411498]
cmp dword [ebp - 4], 0x112
je 0x411379
cmp dword [ebp - 4], 0x218
je 0x41133e
cmp dword [ebp - 4], 0x232
je 0x411425
jmp case.0x411309.1
mov eax, 1
jmp 0x41148f
cmp dword [ebp + 0x10], 0
jne 0x411350
mov eax, 0x424d5144
jmp 0x41148f
cmp dword [ebp + 0x10], 9
jne 0x41136a
push 0
push str.Warning_
push str.Battery_power_is_low
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x41148f
mov ecx, dword [ebp + 0x10]
and ecx, 0xfffffff0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xf020
je 0x41139f
cmp dword [ebp - 8], 0xf030
je 0x41139f
cmp dword [ebp - 8], 0xf120
je 0x41139f
jmp 0x4113e9
mov ecx, dword [sym.imp.Engine.dll_class_cWeb_g_web]
call dword [sym.imp.Engine.dll_public:_int___thiscall_cWeb::IsWebHandle_void_]
test eax, eax
je 0x4113e9
mov ecx, dword [sym.imp.Engine.dll_class_cWeb_g_web]
call dword [sym.imp.Engine.dll_public:_struct_HWND______thiscall_cWeb::GetWebHandle_void_]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [sym.imp.Engine.dll_class_cWeb_g_web]
call dword [sym.imp.Engine.dll_public:_int___thiscall_cWeb::CloseWebPage_struct_HWND____]
cmp eax, 1
jne 0x4113df
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp case.0x411309.1
call fcn.00411160
jmp case.0x411309.1
mov ecx, dword [sym.imp.Engine.dll_class_cWeb_g_web]
call dword [sym.imp.Engine.dll_public:_struct_HWND______thiscall_cWeb::GetWebHandle_void_]
test eax, eax
je 0x411421
mov ecx, dword [sym.imp.Engine.dll_class_cWeb_g_web]
call dword [sym.imp.Engine.dll_public:_void___thiscall_cWeb::UpdatePos_void_]
mov ecx, dword [sym.imp.Engine.dll_class_cWeb_g_web]
call dword [sym.imp.Engine.dll_public:_struct_HWND______thiscall_cWeb::GetWebHandle_void_]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x411309.1
mov edx, dword [sym.imp.Engine.dll_long_int_sam_bFullScreenActive]
cmp dword [edx], 1
je 0x411442
movzx eax, byte [0x461fd4]
test eax, eax
je 0x411442
mov byte [0x461fd4], 0
jmp case.0x411309.1
mov byte [0x461fd4], 1
jmp case.0x411309.1
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 0x20], 0x898
mov edx, dword [ebp + 0x14]
mov dword [edx + 0x24], 0x5dc
cmp dword [0x461fd8], 0
je 0x411473
mov dword [ebp - 0x10], 0
jmp 0x41148c
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x418370
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x122c
call fcn.0042b410
mov eax, dword [0x43b0e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1214], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ecx, dword [ebp - 0x1214]
call fcn.00418620
mov eax, dword [ebp - 0x1214]
mov ecx, dword [eax]
mov dword [ebp - 0x121c], ecx
lea edx, [ebp - 0x1220]
push edx
push 0x1000
lea eax, [ebp - 0x120c]
push eax
mov ecx, dword [ebp - 0x121c]
push ecx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x418478
mov dword [ebp - 0x1210], 0
jmp 0x4183ef
mov edx, dword [ebp - 0x1210]
add edx, 1
mov dword [ebp - 0x1210], edx
mov eax, dword [ebp - 0x1220]
shr eax, 2
cmp dword [ebp - 0x1210], eax
jae 0x418478
mov ecx, dword [ebp - 0x1210]
mov edx, dword [ebp + ecx*4 - 0x120c]
mov dword [ebp - 0x1224], edx
mov eax, dword [ebp - 0x122c]
mov dword [ebp - 0x1218], eax
mov ecx, dword [ebp - 0x1214]
mov edx, dword [ecx]
mov dword [ebp - 0x1218], edx
push 0x208
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x1224]
push ecx
mov edx, dword [ebp - 0x1218]
push edx
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x418473
mov eax, dword [ebp - 0x1214]
add eax, 0x210
mov dword [ebp - 0x1228], eax
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0x1228]
call fcn.00417e60
jmp 0x4183e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b23a
mov esp, ebp
pop ebp
ret
Function at 0x418490
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call fcn.0042b410
mov eax, dword [0x43b0e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1008], ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 0x1008]
mov byte [edx + ecx + 8], 0
mov eax, dword [ebp - 0x1008]
mov ecx, dword [eax]
mov dword [ebp - 0x1018], ecx
lea edx, [ebp - 0x1028]
push edx
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp - 0x1018]
push ecx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x4185f0
mov dword [ebp - 0x100c], 0
jmp 0x418510
mov edx, dword [ebp - 0x100c]
add edx, 1
mov dword [ebp - 0x100c], edx
cmp dword [ebp - 0x100c], 1
jae 0x4185f0
push 0x472648
push 0x43b16c
call sub.VCRUNTIME140.dll___std_type_info_name
add esp, 8
mov dword [ebp - 0x101c], eax
push str.char__260_
mov eax, dword [ebp - 0x101c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x41859c
mov ecx, dword [ebp - 0x100c]
mov edx, dword [ebp + ecx*4 - 0x1004]
mov dword [ebp - 0x1020], edx
mov eax, dword [ebp - 0x102c]
mov dword [ebp - 0x1010], eax
mov ecx, dword [ebp - 0x1008]
mov edx, dword [ecx]
mov dword [ebp - 0x1010], edx
push 0x104
mov eax, dword [ebp - 0x1008]
add eax, 8
push eax
mov ecx, dword [ebp - 0x1020]
push ecx
mov edx, dword [ebp - 0x1010]
push edx
call sub.KERNEL32.dll_K32GetModuleBaseNameA
jmp 0x4185eb
mov eax, dword [ebp - 0x100c]
mov ecx, dword [ebp + eax*4 - 0x1004]
mov dword [ebp - 0x1024], ecx
mov edx, dword [ebp - 0x1030]
mov dword [ebp - 0x1014], edx
mov eax, dword [ebp - 0x1008]
mov ecx, dword [eax]
mov dword [ebp - 0x1014], ecx
push 0x104
mov edx, dword [ebp - 0x1008]
add edx, 8
push edx
mov eax, dword [ebp - 0x1024]
push eax
mov ecx, dword [ebp - 0x1014]
push ecx
call sub.KERNEL32.dll_K32GetModuleBaseNameW
jmp 0x418501
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b23a
mov esp, ebp
pop ebp
ret

Function at 0x42c83e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42c87d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42c87d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42c87d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42c87d
cmp dword [ecx + 0x74], 0xe
jbe 0x42c87d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6d9002f6
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x54354ce4
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..00cfg
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x53392d4b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x633037b1
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4046f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x42b080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x404717
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x40471e
mov al, 1
jmp 0x4047ed
call fcn.00405ed0
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
push eax
call fcn.00405ed0
push eax
call fcn.00405f00
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40474e
xor al, al
jmp 0x4047ed
mov dword [ebp - 0x40], 0x20
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x38]
call fcn.00407900
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40478a
cmp dword [ebp - 0x30], 1
je 0x404791
cmp dword [ebp - 0x30], 3
je 0x4047e0
jmp 0x4047eb
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x4047c0
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x34]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.0040e82a
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x4047c0
xor al, al
jmp 0x4047ed
mov edx, dword [ebp - 0x2c]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x4047d4
mov dword [ebp - 0x38], 1
jmp 0x4047db
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x4047ed
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 0
mov al, 1
jmp 0x4047ed
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d3b
mov esp, ebp
pop ebp
ret
Function at 0x406640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x42b080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00405ed0
push eax
call fcn.00405f00
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40667f
mov edx, dword [ebp + 8]
push edx
call fcn.00406540
add esp, 4
jmp 0x4067fc
mov ecx, dword [ebp - 0x2c]
call fcn.004069b0
test eax, eax
je 0x4066c1
mov ecx, dword [ebp - 0x2c]
call fcn.004069b0
mov esi, eax
mov ecx, dword [ebp - 0x2c]
call fcn.00405ee0
cmp esi, eax
jae 0x4066c1
mov eax, dword [ebp + 8]
push eax
call fcn.004075c0
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x2c]
call fcn.004052b0
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x4067fc
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx + 0x4c], 0
jne 0x4066d4
call fcn.00405ed0
jmp 0x4067fc
mov ecx, dword [ebp - 0x2c]
call fcn.00405320
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x38], 0
jne 0x406723
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004075c0
add esp, 4
movzx eax, al
push eax
call fcn.00401db0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x406713
mov edx, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
jmp 0x40671b
call fcn.00405ed0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
jmp 0x4067fc
mov dword [ebp - 0x4c], 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.004075c0
add esp, 4
mov byte [ebp - 0x2e], al
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x2d]
push edx
lea eax, [ebp - 0x2e]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.00406600
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x40677a
cmp dword [ebp - 0x34], 1
je 0x40677a
cmp dword [ebp - 0x34], 3
je 0x4067c7
jmp 0x4067f7
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x38], eax
je 0x4067ac
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
push 1
lea edx, [ebp - 0x28]
push edx
call fcn.0040e82a
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x4067ac
call fcn.00405ed0
jmp 0x4067fc
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 1
lea ecx, [ebp - 0x2e]
cmp dword [ebp - 0x48], ecx
je 0x4067c0
mov eax, dword [ebp + 8]
jmp 0x4067fc
call fcn.00405ed0
jmp 0x4067fc
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x4c]
push eax
movzx ecx, byte [ebp - 0x2e]
push ecx
call fcn.00401db0
add esp, 8
movzx edx, al
test edx, edx
je 0x4067ea
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
jmp 0x4067f2
call fcn.00405ed0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
jmp 0x4067fc
call fcn.00405ed0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d3b
mov esp, ebp
pop ebp
ret 4
Function at 0x407a30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x407a50
jl 0x407a47
cmp dword [ebp + 0xc], 0
ja 0x407a50
xor eax, eax
xor edx, edx
jmp 0x407b87
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x407a72
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.00407b90
jmp 0x407b87
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call fcn.00404ab0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x407ae1
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004027b0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00406260
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00405b30
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.004061b0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x407b78
mov ecx, dword [ebp - 8]
call fcn.00405320
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x407b51
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0040e1a3
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x407b4f
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x407b87
jmp 0x407afd
cmp dword [ebp - 4], 0
jbe 0x407b78
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.0040e1a3
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x409946
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409985
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409985
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409985
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409985
cmp dword [ecx + 0x74], 0xe
jbe 0x409985
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x414d6a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00414be0
Function at 0x41fdb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41fddd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41fddd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404255
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
salc
dec ebx
xchg ecx, eax
stc
inc eax
salc
inc ecx
xchg edx, eax
aaa
dec ecx
nop
cdq
std
cwde
cmc
aas
cmc
dec ecx
wait
xchg ebx, eax
aaa
lahf
inc ebx
dec eax
aas
cdq
dec eax
inc eax
nop
dec edx
cmc
aas
cdq
das
stc
nop
xchg ebx, eax
daa
xchg ebx, eax
aaa
aas
lahf
cwde
std
dec ecx
lahf
lahf
cmc
stc
lahf
aaa
cdq
aas
xchg ecx, eax
cld
clc
cld
aas
inc edx
clc
lahf
clc
xchg ecx, eax
inc edx
inc eax
cdq
xchg edx, eax
aas
inc eax
salc
inc edx
inc edx
inc ebx
aaa
inc edx
das
xchg ecx, eax
clc
cdq
inc eax
aas
salc
xchg ecx, eax
lahf
clc
cwde
inc edx
das
lahf
xchg edx, eax
xchg ecx, eax
cdq
cmc
salc
inc edx
cdq
das
xchg edx, eax
std
dec eax
cwde
dec ebx
das
das
wait
salc
dec ecx
aas
cdq
daa
aas
clc
salc
stc
clc
inc ecx
xchg edx, eax
dec ecx
std
wait
clc
xchg ebx, eax
cmc
dec eax
inc ebx
wait
inc edx
dec ebx
wait
nop
cwde
inc eax
aaa
xchg ecx, eax
lahf
cld
daa
inc ebx
dec edx
daa
das
inc edx
aaa
cld
nop
salc
cmc
aas
xchg ecx, eax
lahf
clc
xchg ecx, eax
dec eax
nop
inc ebx
dec ecx
wait
dec eax
inc ecx
cmc
salc
clc
cld
cmc
aas
dec edx
lahf
cld
lahf
dec edx
std
jmp 0x408fde
nop
cld
nop
call 0x409347
nop
nop
jmp 0x408ff8
nop
jmp 0x409003
pushal
jmp 0x409014
xor edx, edx
mov ebp, esp
mov edx, dword fs:[edx + 0x30]
nop
mov edx, dword [edx + 0xc]
jmp 0x40902c
mov edx, dword [edx + 0x14]
nop
jmp 0x40903c
mov esi, dword [edx + 0x28]
jmp 0x409050
movzx ecx, word [edx + 0x26]
xor edi, edi
jmp 0x409062
xor eax, eax
lodsb al, byte [esi]
jmp 0x409071
cmp al, 0x61
jl 0x409095
nop
jmp 0x409085
nop
sub al, 0x20
nop
jmp 0x409095
nop
ror edi, 0xd
nop
add edi, eax
jmp 0x4090a7
dec ecx
nop
jmp 0x4090b9
jne 0x409056
jmp 0x4090ca
jmp 0x4090d5
push edx
push edi
nop
jmp 0x4090e4
mov edx, dword [edx + 0x10]
nop
jmp 0x4090f2
mov eax, dword [edx + 0x3c]
jmp 0x409103
add eax, edx
nop
jmp 0x409113
mov eax, dword [eax + 0x78]
nop
jmp 0x409125
test eax, eax
jmp 0x409134
je 0x409304
add eax, edx
nop
jmp 0x40914d
push eax
nop
jmp 0x40915b
mov ecx, dword [eax + 0x18]
mov ebx, dword [eax + 0x20]
add ebx, edx
jmp 0x409170
nop
test ecx, ecx
nop
jmp 0x409180
je 0x4092f3
nop
xor edi, edi
jmp 0x409199
dec ecx
nop
jmp 0x4091ac
mov esi, dword [ebx + ecx*4]
nop
add esi, edx
nop
jmp 0x4091c1
xor eax, eax
nop
jmp 0x4091d4
lodsb al, byte [esi]
nop
ror edi, 0xd
add edi, eax
nop
jmp 0x4091ec
cmp al, ah
jmp 0x4091f8
jne 0x4091c1
jmp 0x40920b
nop
jmp 0x409220
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
jne 0x409170
nop
pop eax
nop
mov ebx, dword [eax + 0x24]
add ebx, edx
nop
jmp 0x409247
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
jmp 0x40925e
add ebx, edx
nop
jmp 0x409275
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
jmp 0x409292
pop ebx
nop
jmp 0x4092a7
pop ebx
jmp 0x4092ba
popal
nop
jmp 0x4092cf
pop ecx
jmp 0x4092e1
pop edx
push ecx
nop
jmp 0x4092f1
jmp eax
nop
jmp 0x409302
pop eax
nop
pop edi
jmp 0x409315
pop edx
nop
jmp 0x40932a
mov edx, dword [edx]
nop
jmp 0x409341
jmp 0x409030