joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466c72
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
and eax, 0x3f
push ebx
mov ebx, dword [ebp + 0xc]
sar edx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [edx*4 + 0x480978]
mov dword [ebp - 8], edx
mov edx, dword [eax + edi + 0x18]
mov dword [ebp - 0x18], edx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x466cb6
push 0xa
pop esi
cmp word [ebx], si
jne 0x466cb6
or byte [eax + edi + 0x28], 4
jmp 0x466cbb
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + edx*2]
mov eax, ebx
mov dword [ebp - 0x10], edx
mov esi, ebx
cmp ebx, edx
jae 0x466e26
movzx edx, word [eax]
mov ecx, edx
mov dword [ebp - 0xc], ecx
movzx ecx, cx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
cmp edx, 0x1a
je 0x466dfe
lea ebx, [eax + 2]
mov dword [ebp - 4], ebx
push 0xd
pop ebx
cmp dx, bx
mov ebx, dword [ebp + 0xc]
je 0x466d08
mov ebx, dword [ebp - 0x14]
mov edx, esi
mov eax, dword [ebp - 4]
movzx ebx, bx
mov dword [ebp - 4], ebx
jmp 0x466d32
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x466d51
push 0xa
pop ebx
cmp word [edx], bx
jne 0x466d1f
push ebx
add eax, 4
pop edx
jmp 0x466d27
mov eax, edx
mov edx, dword [ebp - 0xc]
movzx edx, dx
movzx edx, dx
mov dword [ebp - 4], edx
mov edx, esi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], 2
mov word [esi], cx
mov esi, dword [ebp - 0xc]
add esi, edx
cmp eax, dword [ebp - 0x10]
jb 0x466ccd
jmp 0x466e26
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x466df9
cmp dword [ebp - 0x14], 0
je 0x466df9
mov eax, dword [ebp - 8]
push 0xa
mov eax, dword [eax*4 + 0x480978]
test byte [eax + edi + 0x28], 0x48
pop eax
je 0x466dd5
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x466d9d
mov word [esi], ax
jmp 0x466e23
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebp - 8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov eax, dword [eax*4 + 0x480978]
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x480978]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x480978]
pop ecx
mov byte [eax + edi + 0x2c], cl
jmp 0x466e23
cmp word [ebp - 4], ax
jne 0x466ddf
cmp esi, ebx
je 0x466d95
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00466971
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x466e26
push 0xd
pop eax
jmp 0x466d95
mov eax, ecx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
mov edi, dword [eax*4 + 0x480978]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x466e20
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x466e26
mov word [esi], dx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x469f90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x469fbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x469fbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402e60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
call fcn.00402ee0
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp + 8]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 8], esp
je 0x402ea7
push 0x2d
push 0x40aa5aa
push 6
call fcn.00441898
add esp, 0xc
mov dword [ebp - 8], esp
push 0xffffffff
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
cmp dword [ebp - 8], esp
je 0x402ed8
push 0x67
push 0x40aa5aa
push 6
call fcn.00441898
add esp, 0xc
mov esp, ebp
pop ebp
ret 8
Function at 0x406704
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
je 0x406730
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
jmp 0x406815
cmp dword [ebp + 8], 0
je 0x40677c
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push 0x100000
push 2
mov ebx, 0xc8
call fcn.00442430
add esp, 0x1c
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.004068e0
mov dword [ebp - 4], eax
jmp 0x406815
push 0x47b2ec
mov ebx, dword [ebp + 0x18]
push dword [ebx]
call fcn.00403b0c
add esp, 8
cmp eax, 0
je 0x406804
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
push dword [ebp + 0x18]
call fcn.0040694c
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
jne 0x4067c2
mov eax, 0
jmp 0x4068da
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push 0x100000
push 2
mov ebx, 0xc8
call fcn.00442430
add esp, 0x1c
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.004068e0
mov dword [ebp - 4], eax
jmp 0x406815
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
call fcn.00402e60
cmp dword [ebp - 4], 0
je 0x4068c9
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x406850
push 0x2a0
push 0x40aa39e
push 6
call fcn.00441898
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp + 0x24], 0
jne 0x406864
mov dword [ebp + 0x20], 0xffffffff
mov dword [ebp - 0xc], esp
push dword [ebp + 0x20]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x406893
push 0x316
push 0x40aa39e
push 6
call fcn.00441898
add esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x4068c9
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4068c9
push 0x36d
push 0x40aa39e
push 6
call fcn.00441898
add esp, 0xc
cmp dword [ebp - 8], 1
mov eax, 0
sete al
jmp 0x4068da
mov esp, ebp
pop ebp
ret 0x20
Function at 0x408e20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
nop
cmp dword [ebp - 4], esp
je 0x408e57
push 0x12
push 0x409df11
push 6
call fcn.00441898
add esp, 0xc
jmp 0x408e5c
mov esp, ebp
pop ebp
ret 4

Function at 0x40b510
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
cmp dword [0x5a3b90], 0
jle 0x40b65a
mov dword [ebp - 8], esp
push dword [0x5a3b90]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x40b55c
push 0x6d
push 0x40aa5d9
push 6
call fcn.00441898
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x40b5ac
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
nop
nop
cmp dword [ebp - 8], esp
je 0x40b598
push 0xb6
push 0x40aa5d9
push 6
call fcn.00441898
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
sete al
jmp 0x40b6a3
mov dword [ebp - 8], esp
push 1
push dword [0x5a3b90]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x40b5e0
push 0xe4
push 0x40aa5d9
push 6
call fcn.00441898
add esp, 0xc
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
nop
nop
cmp dword [ebp - 8], esp
je 0x40b60f
push 0x132
push 0x40aa5d9
push 6
call fcn.00441898
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
sete al
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0
push dword [0x5a3b90]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
nop
cmp dword [ebp - 8], esp
je 0x40b655
push 0x15e
push 0x40aa5d9
push 6
call fcn.00441898
add esp, 0xc
jmp 0x40b69b
mov dword [ebp - 8], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
nop
nop
cmp dword [ebp - 8], esp
je 0x40b689
push 0x1ad
push 0x40aa5d9
push 6
call fcn.00441898
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
sete al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x40b6a3
mov esp, ebp
pop ebp
ret 8

Function at 0x40b8b8
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop
nop
cmp dword [ebp - 4], esp
je 0x40b8ed
push 0x24
push 0x40aa9df
push 6
call fcn.00441898
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x40b901
mov esp, ebp
pop ebp
ret 4
Function at 0x40b958
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
call fcn.00401e78
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
call fcn.00401d08
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40b9b9
push 0x33
push 0x40aa697
push 6
call fcn.00441898
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x40b9c1
mov esp, ebp
pop ebp
ret 8

Function at 0x40b9c8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40ba0f
push 0
push 0x40aa693
push 6
call fcn.00441898
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x40ba1a
mov esp, ebp
pop ebp
ret 4

Function at 0x40c514
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.00401d2c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40c556
push ebx
call fcn.0044189e
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
call fcn.00401e78
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40c5a8
push 0x70
push 0x40aa698
push 6
call fcn.00441898
add esp, 0xc
push 0x80000301
push 0
push dword [ebp - 8]
push VariantCopy
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40c5c5
mov eax, 0x47b2f0
push eax
push 2
mov ebx, 0x1a0
call fcn.00443000
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40c5ef
push ebx
call fcn.0044189e
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x40c60d
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00441892
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40c612
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40c623
push ebx
call fcn.0044189e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40c62c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.0040c6b8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40c667
mov eax, 0
jmp 0x40c6af
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
nop
nop
cmp dword [ebp - 8], esp
je 0x40c69a
push 0xe1
push 0x409deff
push 6
call fcn.00441898
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40c6a7
mov eax, dword [ebp - 4]
jmp 0x40c6af
mov esp, ebp
pop ebp
ret 8

Function at 0x40cf00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 1
push 0x47b2ec
push 0x47b2ec
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
cmp dword [ebp - 4], esp
je 0x40cf50
push 0
push 0x40aa293
push 6
call fcn.00441898
add esp, 0xc
mov esp, ebp
pop ebp
ret 4

Function at 0x40d084
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.004427c0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40d0c9
push ebx
call fcn.0044189e
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.004043a8
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40d109
push 0x73
push 0x40aa40a
push 6
call fcn.00441898
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40d137
mov eax, dword [ebp - 4]
test eax, eax
je 0x40d132
push eax
mov ebx, eax
call fcn.00403bac
inc eax
push eax
call fcn.00441892
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40d141
mov eax, 0x47b2ec
jmp 0x40d141
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40d152
push ebx
call fcn.0044189e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40d449
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40d4fd
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040d3d9
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40d4d6
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d509
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40d524
test ebp, ebp
je 0x40d524
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40d52c
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40d56c
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40d5c8
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40d5c3
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40d5ae
test dl, dl
je 0x40d5aa
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40d5ae
add ecx, 2
add eax, 2
test dl, dl
jne 0x40d58e
xor eax, eax
jmp 0x40d5b3
sbb eax, eax
or eax, 1
test eax, eax
je 0x40d5d2
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40d57b
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40d5e9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040d449
test eax, eax
jne 0x40d601
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040d509
mov esi, eax
test esi, esi
jne 0x40d637
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40d651
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x40d749
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0040d449
mov esi, eax
test esi, esi
jne 0x40d767
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0040d509
mov dword [esp + 0x18], eax
test eax, eax
je 0x40d75f
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0040d509
mov dword [esp + 0x34], eax
test eax, eax
je 0x40d75f
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0040d509
mov dword [esp + 0x28], eax
test eax, eax
je 0x40d75f
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0040d509
mov dword [esp + 0x30], eax
test eax, eax
je 0x40d75f
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x40d92e
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x40d92e
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x40d891
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x40d912
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x40d8b4
movzx esi, ax
jmp 0x40d8b9
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x40d8d8
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x40d8e7
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x40d93b
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x40d8a9
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x40d86e
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x40d964
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x40d964
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x40d949
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x40d979
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0040d449
mov esi, eax
test esi, esi
je 0x40da35
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0040d509
mov ebp, eax
test ebp, ebp
je 0x40da34
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0040d509
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x40da34
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x40da34
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40da33
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x40da19
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x40dd2d
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40dde1
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040dcbd
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40ddba
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret