joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4730b0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5908ac]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4730c3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x473104
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x590954]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x473136
mov bl, byte [esp + ecx + 0x4c]
jmp 0x47313a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x47312b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x473158
mov bl, byte [esp + ecx + 0x4c]
jmp 0x47315c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x47314d
xor ecx, ecx
mov eax, 0x5908bc
xor ebx, ebx
mov bl, byte [ecx + 0x590964]
cmp byte [esp + ebx + 0x14], 0
je 0x473187
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x59097c]
cmp byte [esp + ebx + 0x14], 0
je 0x47319e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x47316e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4730f7
lea edx, [esp + 0x84]
push edx
call fcn.004731e0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x475c50
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x475c99
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x476110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a27a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00475cc0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00475d40
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00475d40
lea ecx, [esi + 0xc]
call fcn.00494577
lea ecx, [esi + 0x10]
call fcn.00494577
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004772d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004772d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004772d0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004945ec
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004945ec
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4774c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x477526
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x477526
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x477507
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x496990
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4969c8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00494a47
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00494a1f
jmp 0x4969d4
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x498082
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4980c4
call fcn.0049dbf5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4980c4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4980bb
xor eax, eax
jmp 0x4980cc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004980d2
pop edi
pop esi
pop ebx
ret 4

Function at 0x49e125
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49e153
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49e171
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049e08b
jmp 0x49e171
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49e171
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049e08b
test edi, edi
mov eax, edi
jne 0x49e15b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40b172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x40b1a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x40b1a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x40bdff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.0040bf04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.0040bf20
push edx
push dword [ebp + 0x10]
push eax
call fcn.0040beec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0040bf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0040becb
push ecx
push dword [ebp + 8]
call fcn.0040bf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0040bf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0040becb
push ecx
push dword [ebp + 8]
call fcn.0040bf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0040bf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0040becb
push ecx
push dword [ebp + 8]
call fcn.0040bf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0040bf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0040becb
cmp ecx, 0x2b
jne 0x40be0f
leave
ret 0xc

Function at 0x40d4b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x40d544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x2210
push 0
call dword [eax + 0x20]
test eax, eax
je 0x40d5d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x2210
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x2210
call fcn.0040d3fa
push 0x2210
push dword [ebp + 0xc]
call fcn.0040b1a8
test eax, eax
jne 0x40d5b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x2210
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.0040d5dd
test eax, eax
je 0x40d5d6
jmp 0x40d574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x40d5d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x40d60b
Capabilities:
Terminate process

Disassembly:
call fcn.0040d618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x40c000
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
call 0x40c007
pop eax
sub eax, 0x3007
mov edi, eax
mov esi, 0x1000
mov ecx, 0
cmp ecx, esi
jge 0x40c02c
mov al, 0
xor byte [edi], al
inc edi
inc ecx
jmp 0x40c019
call 0x40c031
pop eax
sub eax, 0xb031
mov edi, eax
mov esi, 0x8000
mov ecx, 0
cmp ecx, esi
jge 0x40c056
mov al, 0
xor byte [edi], al
inc edi
inc ecx
jmp 0x40c043
popal
popfd
jmp 0x401948
Function at 0x405b40
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405bf1
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword fs:[0x2c]
mov edi, eax
mov edx, dword [ecx]
mov ecx, dword [0x65b810]
cmp ecx, dword [edx + 4]
jle 0x405b9f
push 0x65b810
call fcn.00571a96
add esp, 4
cmp dword [0x65b810], esi
jne 0x405b9f
call fcn.00404c90
push 0x65b810
call fcn.00571a57
add esp, 4
mov ecx, dword [0x65b838]
mov eax, dword [0x65b83c]
mov dword [ebp - 0xc], edi
cmp ecx, 0x25c5e09b
jne 0x405bbc
cmp eax, 0x8fafd21e
je 0x405bcb
cmp ecx, 0x257edf0d
jne 0x405bd2
cmp eax, 0xb2ab117a
jne 0x405bd2
test edi, edi
setne al
jmp 0x405be2
mov eax, dword [0x65b830]
mov ecx, 0x65b830
push edi
mov eax, dword [eax + 0x18]
call eax
mov byte [ebp - 8], al
mov dword [ebp - 4], 0x65b830
pop edi
test al, al
jne 0x405bf8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x61e2b4
lea ecx, [ebp - 0xc]
call fcn.004059e0
int3

Function at 0x405c10
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x649fe8]
xor eax, esp
mov dword [esp + 0x194], eax
push 0x65b808
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x405c52
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
push 0x65b80c
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00571951
mov esp, ebp
pop ebp
ret

Function at 0x405fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
push 0
push 0xff
call fcn.00405df0
mov byte [esi + edi], al
add esp, 8
inc esi
cmp esi, 8
jb 0x405fc1
xor esi, esi
nop dword [eax + eax]
xor byte [esi + ebx], 0x40
mov eax, esi
and eax, 7
mov ecx, esi
and ecx, 0x1ff
mov dl, byte [eax + edi]
xor dl, byte [esi + ebx]
mov byte [esi + ebx], dl
mov al, byte [eax + edi]
add al, dl
xor al, byte [ecx + 0x61dee0]
sub al, byte [ecx + 0x61dae0]
add al, byte [ecx + 0x61d2e0]
xor al, byte [ecx + 0x61d8e0]
add al, byte [ecx + 0x61d6e0]
xor al, byte [ecx + 0x61d0d8]
sub al, byte [ecx + 0x61d4e0]
sub al, byte [ecx + 0x61dce0]
mov byte [esi + ebx], al
inc esi
cmp esi, 0x40
jl 0x405fe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
xor esi, esi
push edi
mov edi, ecx
test ebx, ebx
jle 0x4060cf
mov eax, 0x81020409
imul ebx
add edx, ebx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 4], eax
nop word [eax + eax]
mov ecx, dword [ebp + 8]
mov eax, esi
and eax, 0x1ff
mov dl, byte [eax + 0x61dce0]
add dl, byte [eax + 0x61d4e0]
add dl, byte [esi + edi]
xor dl, byte [eax + 0x61d0d8]
sub dl, byte [eax + 0x61d6e0]
xor dl, byte [eax + 0x61d8e0]
sub dl, byte [eax + 0x61d2e0]
add dl, byte [eax + 0x61dae0]
xor dl, byte [eax + 0x61dee0]
mov eax, esi
and eax, 7
mov byte [esi + edi], dl
add ecx, eax
mov al, byte [ebp - 4]
add al, al
add al, bl
sub dl, byte [ecx]
mov byte [esi + edi], dl
xor al, dl
xor al, byte [ecx]
mov byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x406070
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 1
mov dword [0x65b8c8], edi
mov dword [0x65b8cc], ecx
nop dword [eax]
push 0x5851f42d
mov edx, ecx
xor eax, eax
push 0x4c957f2d
shr edx, 0x1e
xor eax, ecx
xor edx, edi
push eax
push edx
call fcn.00572570
mov edi, eax
mov ecx, edx
mov eax, esi
cdq
add edi, eax
mov dword [esi*8 + 0x65b8c8], edi
adc ecx, edx
mov dword [esi*8 + 0x65b8cc], ecx
inc esi
cmp esi, 0x138
jl 0x406ac0
pop edi
mov dword [0x65b8c0], 0x138
pop esi
pop ebp
ret 0x10
Function at 0x408370
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
mov eax, 0x40
push edi
mov edi, ecx
mov edx, dword [esi]
and edx, 0x3f
mov byte [edx + esi + 0x18], 0x80
inc edx
sub eax, edx
cmp eax, 8
jae 0x4083b1
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.0058db90
push 0x40
lea edx, [esi + 0x18]
mov ecx, esi
call fcn.004078f0
add esp, 0x10
mov eax, 0x40
xor edx, edx
add eax, 0xfffffff8
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.0058db90
shl dword [esi], 3
lea edx, [esi + 0x18]
movzx eax, byte [esi]
mov ecx, esi
mov byte [esi + 0x50], al
mov eax, dword [esi]
shr eax, 8
mov byte [esi + 0x51], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x52], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x53], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x54], al
mov eax, dword [esi + 4]
shr eax, 8
mov byte [esi + 0x55], al
movzx eax, byte [esi + 6]
mov byte [esi + 0x56], al
movzx eax, byte [esi + 7]
push 0x40
mov byte [esi + 0x57], al
call fcn.004078f0
movzx eax, byte [esi + 8]
mov byte [edi], al
mov eax, dword [esi + 8]
shr eax, 8
mov byte [edi + 1], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 2], al
movzx eax, byte [esi + 0xb]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 4], al
mov eax, dword [esi + 0xc]
shr eax, 8
mov byte [edi + 5], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 8], al
mov eax, dword [esi + 0x10]
shr eax, 8
mov byte [edi + 9], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xc], al
mov eax, dword [esi + 0x14]
shr eax, 8
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x16]
push 0x98
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x17]
push 0
push esi
mov byte [edi + 0xf], al
call fcn.0058db90
add esp, 0x1c
pop edi
pop esi
ret

Function at 0x4084a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [0x649fe8]
xor eax, esp
mov dword [esp + 0xa0], eax
push esi
mov esi, dword [ebp + 8]
push edx
mov edx, ecx
mov dword [esp + 0x14], 0x67452301
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.004082c0
add esp, 4
lea edx, [esp + 8]
mov ecx, esi
call fcn.00408370
mov ecx, dword [esp + 0xa4]
pop esi
xor ecx, esp
call fcn.00571951
mov esp, ebp
pop ebp
ret
Function at 0x408560
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cc982
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x649fe8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x2c0], esi
push edi
mov dword [ebp - 0x2bc], 0
lea eax, [ebp - 0x220]
push 0x200
push 1
push eax
mov dword [ebp - 0x2c4], esi
mov dword [ebp - 0x2b0], 0x67452301
mov dword [ebp - 0x2ac], 0xefcdab89
mov dword [ebp - 0x2a8], 0x98badcfe
mov dword [ebp - 0x2a4], 0x10325476
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0
call fcn.005947e3
add esp, 0x10
test eax, eax
je 0x40862d
nop
push eax
lea edx, [ebp - 0x220]
lea ecx, [ebp - 0x2b8]
call fcn.004082c0
push edi
push 0x200
lea eax, [ebp - 0x220]
push 1
push eax
call fcn.005947e3
add esp, 0x14
test eax, eax
jne 0x408600
lea edx, [ebp - 0x2b8]
lea ecx, [ebp - 0x20]
call fcn.00408370
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x408661
mov eax, dword [esi]
jmp 0x408663
mov eax, esi
mov byte [eax], 0
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x2bc], 1
nop dword [eax]
mov bh, byte [ebp + edi - 0x20]
mov ecx, dword [esi + 0x14]
mov al, bh
shr al, 4
cmp al, 0xa
sbb bl, bl
add al, 0x57
and bl, 0xd9
add bl, al
mov eax, dword [esi + 0x10]
cmp eax, ecx
jne 0x4086ce
inc eax
cmp eax, 0xfffffffe
ja 0x408774
cmp ecx, eax
jae 0x4086b9
push dword [esi + 0x10]
mov ecx, esi
push eax
call fcn.00406e70
jmp 0x4086ce
test eax, eax
jne 0x4086ce
mov dword [esi + 0x10], eax
cmp ecx, 0x10
jb 0x4086c9
mov eax, dword [esi]
jmp 0x4086cb
mov eax, esi
mov byte [eax], 0
cmp dword [esi + 0x14], 0x10
jb 0x4086d8
mov ecx, dword [esi]
jmp 0x4086da
mov ecx, esi
mov eax, dword [esi + 0x10]
and bh, 0xf
mov byte [ecx + eax], bl
inc dword [esi + 0x10]
cmp bh, 0xa
mov eax, dword [esi + 0x10]
sbb bl, bl
and bl, 0xd9
add bl, 0x57
mov byte [eax + ecx], 0
add bl, bh
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
cmp eax, ecx
jne 0x408730
inc eax
cmp eax, 0xfffffffe
ja 0x408774
cmp ecx, eax
jae 0x40871b
push dword [esi + 0x10]
mov ecx, esi
push eax
call fcn.00406e70
jmp 0x408730
test eax, eax
jne 0x408730
mov dword [esi + 0x10], eax
cmp ecx, 0x10
jb 0x40872b
mov eax, dword [esi]
jmp 0x40872d
mov eax, esi
mov byte [eax], 0
cmp dword [esi + 0x14], 0x10
jb 0x40873a
mov ecx, dword [esi]
jmp 0x40873c
mov ecx, esi
mov eax, dword [esi + 0x10]
inc edi
mov byte [ecx + eax], bl
inc dword [esi + 0x10]
mov eax, dword [esi + 0x10]
mov byte [eax + ecx], 0
cmp edi, 0x10
jb 0x408680
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00571951
mov esp, ebp
pop ebp
ret
push 0x61d094
call fcn.00572dc7
int3
Function at 0x409390
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
mov eax, 0x40
push edi
mov edi, ecx
mov edx, dword [esi]
and edx, 0x3f
mov byte [edx + esi + 0x18], 0x80
inc edx
sub eax, edx
cmp eax, 8
jae 0x4093d1
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.0058db90
push 0x40
lea edx, [esi + 0x18]
mov ecx, esi
call fcn.00408910
add esp, 0x10
mov eax, 0x40
xor edx, edx
add eax, 0xfffffff8
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.0058db90
shl dword [esi], 3
lea edx, [esi + 0x18]
movzx eax, byte [esi]
mov ecx, esi
mov byte [esi + 0x50], al
mov eax, dword [esi]
shr eax, 8
mov byte [esi + 0x51], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x52], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x53], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x54], al
mov eax, dword [esi + 4]
shr eax, 8
mov byte [esi + 0x55], al
movzx eax, byte [esi + 6]
mov byte [esi + 0x56], al
movzx eax, byte [esi + 7]
push 0x40
mov byte [esi + 0x57], al
call fcn.00408910
movzx eax, byte [esi + 8]
mov byte [edi], al
mov eax, dword [esi + 8]
shr eax, 8
mov byte [edi + 1], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 2], al
movzx eax, byte [esi + 0xb]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 4], al
mov eax, dword [esi + 0xc]
shr eax, 8
mov byte [edi + 5], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 8], al
mov eax, dword [esi + 0x10]
shr eax, 8
mov byte [edi + 9], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xc], al
mov eax, dword [esi + 0x14]
shr eax, 8
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x16]
push 0x98
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x17]
push 0
push esi
mov byte [edi + 0xf], al
call fcn.0058db90
add esp, 0x1c
pop edi
pop esi
ret
Function at 0x412d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cd578
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x649fe8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x412e3e
cmp byte [ebx + 0x3d], 0
je 0x412e3e
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x412d69
xor al, al
jmp 0x412e40
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00406500
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x412dcf
sub eax, 1
je 0x412dd3
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x412e26
xor bl, bl
jmp 0x412e28
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x412e08
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.005953de
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x412dcb
cmp byte [ebx + 0x3d], 0
je 0x412e26
test esi, esi
jne 0x412d91
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00406db0
jmp 0x412d8e
mov bl, 1
cmp ecx, 0x10
jb 0x412e3a
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00406b10
mov al, bl
jmp 0x412e40
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00571951
mov esp, ebp
pop ebp
ret

Function at 0x414bb0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x65b88c
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0
push dword [esi + 4]
test eax, eax
je 0x414bff
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
mov esp, ebp
pop ebp
ret
push fcn.004046d0
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov esp, ebp
pop ebp
ret