joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4097b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov ecx, 0x20
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 0xc]
mov dword [esp + 8], 4
call fcn.0040fc64
xor esi, esi
xor ecx, ecx
xor edx, edx
jmp 0x409817
xor eax, eax
mov edi, esi
mov ebp, dword [esp]
shl edi, 4
lea ebx, [esp + edx*4 + 0xc]
lea edi, [ebp + edi]
mov bl, byte [ebx + eax]
lea edi, [edi + ecx*4]
mov byte [edi + eax + 0x14], bl
inc eax
cmp eax, 4
jl 0x4097e2
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x40980f
cmp ecx, 4
jl 0x4097e0
cmp ecx, 4
jne 0x409817
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x409822
cmp esi, 0xa
jle 0x409804
cmp esi, 0xa
jg 0x4099b5
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov al, byte [edx + 0x417cf4]
xor byte [esp + 0xc], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 0xa]
mov dl, byte [eax + 0x417cf4]
xor byte [esp + 0xd], dl
mov eax, dword [esp + 8]
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov al, byte [edx + 0x417cf4]
xor byte [esp + 0xe], al
mov edx, dword [esp + 8]
xor eax, eax
mov al, byte [esp + edx*4 + 8]
mov dl, byte [eax + 0x417cf4]
xor byte [esp + 0xf], dl
mov eax, dword [esp + 4]
mov dl, byte [eax + 0x417ef4]
xor byte [esp + 0xc], dl
inc dword [esp + 4]
cmp dword [esp + 8], 8
je 0x4098c5
mov edx, 1
cmp edx, dword [esp + 8]
jge 0x409963
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x4098a5
inc edx
cmp edx, dword [esp + 8]
jl 0x4098a3
jmp 0x409963
mov edx, 1
jmp 0x4098e3
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x4098ce
inc edx
mov eax, dword [esp + 8]
sar eax, 1
jns 0x4098ee
adc eax, 0
cmp edx, eax
jl 0x4098cc
mov eax, dword [esp + 8]
sar eax, 1
jns 0x4098fd
adc eax, 0
xor edx, edx
mov dl, byte [esp + eax*4 + 8]
mov dl, byte [edx + 0x417cf4]
xor byte [esp + eax*4 + 0xc], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 9]
mov dl, byte [edx + 0x417cf4]
xor byte [esp + eax*4 + 0xd], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xa]
mov dl, byte [edx + 0x417cf4]
xor byte [esp + eax*4 + 0xe], dl
xor edx, edx
mov dl, byte [esp + eax*4 + 0xb]
mov dl, byte [edx + 0x417cf4]
xor byte [esp + eax*4 + 0xf], dl
mov edx, eax
inc edx
cmp edx, dword [esp + 8]
jge 0x409963
xor eax, eax
lea ebx, [esp + edx*4 + 8]
lea edi, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
xor byte [edi + eax], bl
inc eax
cmp eax, 4
jl 0x409948
inc edx
cmp edx, dword [esp + 8]
jl 0x409946
xor edx, edx
jmp 0x4099a1
xor eax, eax
mov ebx, esi
shl ebx, 4
mov edi, dword [esp]
lea ebx, [edi + ebx]
lea ebx, [ebx + ecx*4]
lea edi, [ebx + eax + 0x14]
lea ebx, [esp + edx*4 + 0xc]
mov bl, byte [ebx + eax]
mov byte [edi], bl
inc eax
cmp eax, 4
jl 0x40996b
inc edx
inc ecx
cmp edx, dword [esp + 8]
jge 0x409999
cmp ecx, 4
jl 0x409969
cmp ecx, 4
jne 0x4099a1
inc esi
xor ecx, ecx
cmp edx, dword [esp + 8]
jge 0x4099ac
cmp esi, 0xa
jle 0x40998e
cmp esi, 0xa
jle 0x40982b
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4099c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov dword [esp], eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
add edx, dword [esp]
shl ebx, 2
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx edi, byte [edx + 1]
mov bl, byte [edx]
lea edi, [edi*4 + 0x41a312]
lea ebx, [ebx*4 + 0x419f12]
mov bl, byte [ebx + eax]
xor bl, byte [edi + eax]
movzx edi, byte [edx + 2]
movzx edx, byte [edx + 3]
lea edi, [edi*4 + 0x41a712]
lea edx, [edx*4 + 0x41ab12]
xor bl, byte [edi + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4 + 4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x4099d2
inc eax
cmp eax, 4
jl 0x4099d0
mov eax, esi
lea edx, [esp + 4]
shl eax, 4
mov ecx, 0x10
add eax, dword [esp]
add eax, 0x14
call fcn.0040fc64
inc esi
cmp esi, 0xa
jl 0x4099ce
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x40acac
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret
Function at 0x40e5ac
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x40e5b5
mov eax, dword [esp + 0x2000]
add esp, 0xfffffb30
mov ebx, edx
mov esi, eax
lea edi, [esp + 0x10b4]
lea eax, [esp + 0xc14]
call fcn.00406884
lea eax, [esp + 0xc40]
call fcn.00406884
lea eax, [esp + 0xc6c]
call fcn.00406884
push 0
lea ecx, [esp + 4]
mov edx, ebx
mov eax, esi
call fcn.00405b9c
test al, al
jne 0x40e615
xor eax, eax
jmp 0x40e762
cmp byte [esp], 0
je 0x40e625
cmp byte [esp + 0xc98], 0
jne 0x40e62c
xor eax, eax
jmp 0x40e762
mov eax, esp
call fcn.00405fac
lea edx, [esp + 0xc98]
call fcn.00407008
test eax, eax
je 0x40e65a
mov eax, esi
call fcn.00405fac
lea edx, [esp + 0xc98]
call fcn.00407008
test eax, eax
je 0x40e661
xor eax, eax
jmp 0x40e762
xor ebx, ebx
mov eax, edi
mov ecx, 0x400
mov edx, esi
call fcn.004070b0
push ebx
push str.rtmp_d
mov eax, edi
call fcn.00405fac
push eax
call fcn.0040fe48
add esp, 0xc
mov eax, edi
xor edx, edx
call fcn.00406e8c
test al, al
je 0x40e69f
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x40e663
mov eax, edi
xor edx, edx
call fcn.00406e8c
test al, al
je 0x40e6b3
xor eax, eax
jmp 0x40e762
lea eax, [esp + 0x14b4]
mov ecx, 0x400
mov edx, esi
call fcn.004070b0
mov eax, esp
call fcn.00405fac
push eax
lea eax, [esp + 0x14b8]
call fcn.00405fac
pop edx
call fcn.0040fd50
push edi
lea ecx, [esp + 0x14b8]
push ecx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
jne 0x40e6f6
xor eax, eax
jmp 0x40e762
lea eax, [esp + 0x18b4]
call fcn.0040e76c
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.00406e8c
test al, al
jne 0x40e723
lea eax, [esp + 0x18b4]
xor ecx, ecx
mov edx, esi
call fcn.0040e94c
mov ebx, eax
lea eax, [esp + 0x14b4]
push eax
push edi
call sub.KERNEL32.DLL_MoveFileA
test bl, bl
je 0x40e74d
lea eax, [esp + 0x18b4]
call fcn.0040ea50
lea eax, [esp + 0x18b4]
call fcn.0040ead8
mov al, 1
push eax
lea eax, [esp + 0x18b8]
mov edx, 2
call fcn.0040e7bc
pop eax
add esp, 0x24d4
pop edi
pop esi
pop ebx
ret
Function at 0x40e800
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x40e823
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x40e834
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x40e843
or dword [ebp - 8], 2
xor eax, eax
cmp byte [ebx + 0x15], 0
jne 0x40e850
add eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.0040571c
test eax, eax
je 0x40e87d
test esi, esi
je 0x40e87d
cmp word [esi], 0
je 0x40e87d
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x40e894
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x40e8ad
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x40e8ad
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x40e917
mov dword [ebx + 4], edi
test esi, esi
je 0x40e8e2
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.00410528
jmp 0x40e8eb
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x40e8fe
lea eax, [ebx + 0x17]
mov edx, dword [ebp - 4]
call fcn.0040fd50
jmp 0x40e90d
lea edx, [ebx + 0x17]
mov ecx, 0x1000000
mov eax, esi
call fcn.00410308
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.0040e9fc
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40eb08
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, ecx
test esi, esi
mov edi, eax
mov dword [esp], edx
je 0x40ec2b
mov eax, dword [edi + 0xc]
test eax, eax
je 0x40eb43
dec eax
je 0x40eb2d
dec eax
je 0x40eb39
jmp 0x40eb43
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x40eb43
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x40eb95
xor ebp, ebp
cmp esi, ebp
jle 0x40ebb1
push 0
lea eax, [esp + 8]
push eax
mov edx, esi
sub edx, ebp
cmp edx, 0x4000
jge 0x40eb68
mov ecx, esi
sub ecx, ebp
jmp 0x40eb6d
mov ecx, 0x4000
push ecx
mov eax, dword [esp + 0xc]
add eax, ebp
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x40ebb1
add ebp, 0x4000
cmp esi, ebp
jg 0x40eb4f
jmp 0x40ebb1
push 0
lea eax, [esp + 8]
push eax
push esi
push dword [esp + 0xc]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
jne 0x40ec27
cmp byte [edi + 0x14], 0
je 0x40ec27
cmp dword [edi + 0xc], 0
jne 0x40ec27
lea edx, [edi + 0x17]
mov eax, 0x41b998
call fcn.0040cc8c
test al, al
je 0x40ec11
mov ecx, dword [esp + 4]
cmp ecx, esi
jae 0x40eb43
cmp dword [esp + 4], 0
jbe 0x40eb43
mov eax, edi
call fcn.0040ee50
push edx
push eax
mov eax, dword [esp + 0xc]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
xor edx, edx
mov eax, edi
call fcn.0040ed98
jmp 0x40eb43
lea ecx, [edi + 0x17]
mov eax, 0x41b998
xor edx, edx
call fcn.0040cc74
jmp 0x40ec27
mov byte [edi + 8], 1
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40ed18
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x40ed3f
cmp esi, 0x4e20
jle 0x40ed35
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40ed90
mov eax, ebx
call fcn.0040f058
test al, al
je 0x40ed77
cmp esi, 0x4e20
jle 0x40ed77
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.0040ed18
jmp 0x40ed93
cmp dword [ebx + 0xc], 1
jne 0x40ed8b
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x40ed8b
xor eax, eax
jmp 0x40ed93
or eax, 0xffffffff
jmp 0x40ed93
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x410298
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x41577c], 0
jne 0x4102b1
call fcn.0040feec
mov dword [0x415778], eax
inc byte [0x41577c]
call fcn.0040feec
sub eax, dword [0x415778]
cmp eax, 0x64
jle 0x4102ed
cmp dword [0x416188], 0
je 0x4102e8
mov eax, 0x41b998
mov edx, 0xff
call fcn.0040ce28
mov eax, 0x41b998
mov edx, 0xff
call fcn.0040ce20
call fcn.00402c70
ret
Function at 0x40a3c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x409015
lea edi, [esi - 0x8015]
push edi
jmp 0x40a3da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40a3e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40a3d0
mov eax, 1
add ebx, ebx
jne 0x40a3f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40a3e8
jne 0x40a404
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a3e8
xor ecx, ecx
sub eax, 3
jb 0x40a418
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40a48a
mov ebp, eax
add ebx, ebx
jne 0x40a423
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40a430
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40a454
inc ecx
add ebx, ebx
jne 0x40a440
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40a435
jne 0x40a451
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a435
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40a474
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40a465
jmp 0x40a3d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40a474
add edi, ecx
jmp 0x40a3d6
pop esi
mov edi, esi
mov ecx, 0xf0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40a492
cmp byte [edi], 0
jne 0x40a492
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40a497
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40a506
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa0ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa14c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40a4c4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa150]
or eax, eax
je 0x40a500
mov dword [ebx], eax
add ebx, 4
jmp 0x40a4e1
call dword [esi + 0xa160]
mov ebp, dword [esi + 0xa154]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40a53a
sub esp, 0xffffff80
jmp 0x4021d1
Function at 0x4055f0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5223c8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5750c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx]
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov ecx, dword [ebx + 4]
lea edx, [ebx + 8]
lea eax, [edi + 8]
push edx
push eax
mov dword [edi + 4], ecx
call fcn.004057d0
lea ecx, [ebx + 0x18]
lea eax, [edi + 0x18]
push ecx
push eax
mov dword [ebp - 4], 0
call fcn.004057d0
mov byte [ebp - 4], 1
mov edx, dword [ebx + 0x28]
mov dword [edi + 0x28], edx
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [ebp + 8]
add edi, 0x30
lea esi, [ebx + 0x30]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 0x70]
lea esi, [ebx + 0x70]
mov ecx, 0x10
add eax, 0xb0
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0xb0]
push eax
call fcn.00404070
mov byte [ebp - 4], 2
mov ecx, dword [ebx + 0xc0]
mov esi, dword [ebp + 8]
mov dword [esi + 0xc0], ecx
lea edi, [esi + 0xc4]
mov dword [edi], 0
mov ebx, dword [ebx + 0xc4]
test ebx, ebx
je 0x4056bf
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
je 0x4056db
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
call eax
mov ecx, eax
call fcn.004037e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x406a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
fld dword [ecx]
fstp dword [eax]
fld dword [ecx + 4]
fstp dword [eax + 4]
fld dword [ecx + 8]
fstp dword [eax + 8]
fld dword [ecx + 0xc]
fstp dword [eax + 0xc]
fld dword [ecx + 0x10]
fstp dword [eax + 0x10]
fld dword [ecx + 0x14]
fstp dword [eax + 0x14]
fld dword [ecx + 0x18]
fstp dword [eax + 0x18]
fld dword [ecx + 0x1c]
fstp dword [eax + 0x1c]
fld dword [ecx + 0x20]
fstp dword [eax + 0x20]
mov edx, dword [ecx + 0x24]
mov dword [eax + 0x24], edx
mov edx, dword [ecx + 0x28]
mov dword [eax + 0x28], edx
mov edx, dword [ecx + 0x2c]
mov dword [eax + 0x2c], edx
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x30], edx
mov edx, dword [ecx + 0x34]
mov dword [eax + 0x34], edx
fld dword [ecx + 0x38]
fstp dword [eax + 0x38]
fld dword [ecx + 0x3c]
fstp dword [eax + 0x3c]
mov edx, dword [ecx + 0x40]
mov dword [eax + 0x40], edx
movzx edx, word [ecx + 0x44]
mov word [eax + 0x44], dx
fld dword [ecx + 0x48]
fstp dword [eax + 0x48]
fld dword [ecx + 0x4c]
fstp dword [eax + 0x4c]
movzx edx, word [ecx + 0x50]
mov word [eax + 0x50], dx
fld dword [ecx + 0x54]
fstp dword [eax + 0x54]
fld dword [ecx + 0x58]
fstp dword [eax + 0x58]
movzx edx, word [ecx + 0x5c]
mov word [eax + 0x5c], dx
fld dword [ecx + 0x60]
fstp dword [eax + 0x60]
fld dword [ecx + 0x64]
fstp dword [eax + 0x64]
fld dword [ecx + 0x68]
fstp dword [eax + 0x68]
fld dword [ecx + 0x6c]
fstp dword [eax + 0x6c]
fld dword [ecx + 0x70]
fstp dword [eax + 0x70]
fld dword [ecx + 0x74]
fstp dword [eax + 0x74]
fld dword [ecx + 0x78]
fstp dword [eax + 0x78]
movzx edx, word [ecx + 0x7c]
mov word [eax + 0x7c], dx
movzx edx, word [ecx + 0x7e]
mov word [eax + 0x7e], dx
movzx edx, word [ecx + 0x80]
mov word [eax + 0x80], dx
fld dword [ecx + 0x84]
fstp dword [eax + 0x84]
fld dword [ecx + 0x88]
fstp dword [eax + 0x88]
fld dword [ecx + 0x8c]
fstp dword [eax + 0x8c]
fld dword [ecx + 0x90]
fstp dword [eax + 0x90]
fld dword [ecx + 0x94]
fstp dword [eax + 0x94]
fld dword [ecx + 0x98]
fstp dword [eax + 0x98]
mov dl, byte [ecx + 0x9c]
mov byte [eax + 0x9c], dl
mov ecx, dword [ecx + 0xa0]
mov dword [eax + 0xa0], ecx
ret
Function at 0x40b8b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
cmp eax, dword [ebp + 8]
je 0x40ba16
push esi
push edi
lea edi, [eax + 8]
mov esi, dword [edi - 8]
test esi, esi
je 0x40b8e1
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
je 0x40b93f
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
call eax
mov esi, eax
lea eax, [esi + 4]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40b93f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40b935
mov eax, dword [esi + 8]
push 1
push 0
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x40b92d
mov edx, dword [ebp - 4]
mov eax, dword [edx]
jmp 0x40b93f
mov ecx, dword [esi + 8]
call fcn.004037e0
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov ecx, dword [edi - 4]
mov dword [ebx + 4], ecx
mov edx, dword [edi]
mov dword [ebx + 8], edx
mov al, byte [edi + 4]
mov byte [ebx + 0xc], al
mov ecx, dword [edi + 8]
mov dword [ebx + 0x10], ecx
mov edx, dword [edi + 0xc]
mov dword [ebx + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x18], eax
mov ecx, dword [edi + 0x14]
mov dword [ebx + 0x1c], ecx
mov edx, dword [edi + 0x18]
mov dword [ebx + 0x20], edx
mov eax, dword [edi + 0x1c]
mov dword [ebx + 0x24], eax
mov ecx, dword [edi + 0x20]
mov dword [ebx + 0x28], ecx
mov edx, dword [edi + 0x24]
mov dword [ebx + 0x2c], edx
mov ax, word [edi + 0x28]
mov word [ebx + 0x30], ax
fld dword [edi + 0x2c]
fstp dword [ebx + 0x34]
lea esi, [edi + 0x6c]
fld dword [edi + 0x30]
fstp dword [ebx + 0x38]
fld dword [edi + 0x34]
fstp dword [ebx + 0x3c]
fld dword [edi + 0x38]
fstp dword [ebx + 0x40]
fld dword [edi + 0x3c]
fstp dword [ebx + 0x44]
mov ecx, dword [edi + 0x40]
mov dword [ebx + 0x48], ecx
mov edx, dword [edi + 0x44]
mov dword [ebx + 0x4c], edx
mov eax, dword [edi + 0x48]
mov dword [ebx + 0x50], eax
mov ecx, dword [edi + 0x4c]
mov dword [ebx + 0x54], ecx
mov edx, dword [edi + 0x50]
mov dword [ebx + 0x58], edx
mov eax, dword [edi + 0x54]
mov dword [ebx + 0x5c], eax
fld dword [edi + 0x58]
fstp dword [ebx + 0x60]
fld dword [edi + 0x5c]
fstp dword [ebx + 0x64]
mov ecx, dword [edi + 0x60]
mov dword [ebx + 0x68], ecx
mov edx, dword [edi + 0x64]
mov dword [ebx + 0x6c], edx
mov eax, dword [edi + 0x68]
mov dword [ebx + 0x70], eax
lea ecx, [ebx + 0x74]
lea eax, [ebp - 8]
call fcn.00403890
mov ecx, dword [edi + 0x70]
mov dword [ebx + 0x78], ecx
mov dl, byte [edi + 0x74]
sub edi, 0xffffff80
mov byte [ebx + 0x7c], dl
lea eax, [edi - 8]
sub ebx, 0xffffff80
cmp eax, dword [ebp + 8]
jne 0x40b8c7
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bc60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov ecx, edi
call fcn.004f7590
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
movzx ecx, byte [edi + 0xc]
mov byte [esi + 0xc], cl
mov edx, dword [edi + 0x10]
mov dword [esi + 0x10], edx
fld dword [edi + 0x14]
fstp dword [esi + 0x14]
fld dword [edi + 0x18]
fstp dword [esi + 0x18]
fld dword [edi + 0x1c]
fstp dword [esi + 0x1c]
fld dword [edi + 0x20]
fstp dword [esi + 0x20]
fld dword [edi + 0x24]
fstp dword [esi + 0x24]
fld dword [edi + 0x28]
fstp dword [esi + 0x28]
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov cx, word [edi + 0x30]
mov word [esi + 0x30], cx
fld dword [edi + 0x34]
fstp dword [esi + 0x34]
fld dword [edi + 0x38]
fstp dword [esi + 0x38]
fld dword [edi + 0x3c]
fstp dword [esi + 0x3c]
fld dword [edi + 0x40]
fstp dword [esi + 0x40]
fld dword [edi + 0x44]
fstp dword [esi + 0x44]
fld dword [edi + 0x48]
fstp dword [esi + 0x48]
fld dword [edi + 0x4c]
fstp dword [esi + 0x4c]
fld dword [edi + 0x50]
fstp dword [esi + 0x50]
fld dword [edi + 0x54]
fstp dword [esi + 0x54]
fld dword [edi + 0x58]
fstp dword [esi + 0x58]
fld dword [edi + 0x5c]
fstp dword [esi + 0x5c]
fld dword [edi + 0x60]
fstp dword [esi + 0x60]
fld dword [edi + 0x64]
fstp dword [esi + 0x64]
fld dword [edi + 0x68]
fstp dword [esi + 0x68]
fld dword [edi + 0x6c]
fstp dword [esi + 0x6c]
fld dword [edi + 0x70]
fstp dword [esi + 0x70]
movzx edx, byte [edi + 0x74]
mov byte [esi + 0x74], dl
mov al, byte [edi + 0x75]
mov byte [esi + 0x75], al
movzx ecx, byte [edi + 0x76]
mov byte [esi + 0x76], cl
movzx edx, byte [edi + 0x77]
mov byte [esi + 0x77], dl
mov eax, dword [edi + 0x78]
mov dword [esi + 0x78], eax
movzx ecx, byte [edi + 0x7c]
mov byte [esi + 0x7c], cl
mov eax, esi
ret
Function at 0x40bd70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523a8a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5750c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [ebp - 4], ebx
lea ecx, [edi + 0x74]
mov dword [ecx], 0xff000000
xor eax, eax
mov word [edi + 0x30], ax
mov esi, 0x576b6c
lea eax, [ebp - 0x10]
mov dword [edi + 0x10], ebx
mov dword [edi + 0x2c], ebx
call fcn.00403890
fldz
mov ecx, dword [0x57c388]
mov dword [edi + 0x68], ecx
mov edx, dword [0x57c38c]
mov dword [edi + 0x6c], edx
mov eax, dword [0x57c390]
fst dword [edi + 0x38]
fst dword [edi + 0x3c]
mov dword [edi + 0x70], eax
fst dword [edi + 0x34]
mov byte [edi + 0xc], 1
fld1
push ebx
fstp dword [edi + 0x60]
push edi
fst dword [edi + 0x64]
fst dword [edi + 0x40]
fstp dword [edi + 0x44]
mov ecx, dword [0x57c388]
mov dword [edi + 0x48], ecx
mov edx, dword [0x57c38c]
mov dword [edi + 0x4c], edx
mov eax, dword [0x57c390]
mov dword [edi + 0x50], eax
mov ecx, dword [edi + 0x48]
mov edx, dword [edi + 0x4c]
mov dword [edi + 0x54], ecx
mov dword [edi + 0x58], edx
mov dword [edi + 0x5c], eax
mov ecx, dword [0x57c388]
mov dword [edi + 0x14], ecx
mov edx, dword [0x57c38c]
mov dword [edi + 0x18], edx
mov eax, dword [0x57c390]
mov dword [edi + 0x1c], eax
mov ecx, dword [0x57c388]
mov dword [edi + 0x20], ecx
mov edx, dword [0x57c38c]
mov dword [edi + 0x24], edx
mov eax, dword [0x57c390]
mov dword [edi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp eax, ebx
je 0x40be75
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
call eax
mov ecx, eax
call fcn.004037e0
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40be89
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [edi + 0x7c], bl
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4