joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2fc86d6b
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5e8e6942
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x45e3ec], 1
mov dword [0x45e3f0], 1
mov dword [0x45e3f4], 1
mov dword [0x45e3e0], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x401415
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x401438
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x40145a
cmp eax, 0x20b
je 0x40147f
jmp 0x4014aa
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x40146c
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014af
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x401497
mov eax, 0
jmp 0x4014af
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014af
mov eax, 0
leave
ret

Function at 0x404050
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, eax
xor eax, eax
push ebx
mov ebx, edx
sub esp, 0x14
test edx, edx
je 0x404067
mov dword [esp], edx
call sym._strlen
mov dword [esp + 0xc], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
call sym._fwrite
mov dword [esp], esi
call sym._fflush
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40d660
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov dword [esp + 0x1c], edx
mov dword [esp], 0x45e040
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
test edi, edi
jle 0x40d6e0
mov dword [esp], 0x446178
xor esi, esi
call sym.___emutls_get_address
mov ebp, dword [sym.___acrt_iob_func]
mov edi, eax
jmp 0x40d6ac
add esi, 1
add ebx, 8
cmp dword [esp + 0x1c], esi
je 0x40d6e6
mov dword [esp], 1
call ebp
mov dword [esp + 8], 0
mov edx, dword [ebx + 4]
mov ecx, eax
mov eax, dword [ebx]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._writeWindows__system_u9034_16
sub esp, 0xc
cmp byte [edi], 0
je 0x40d6a0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [sym.___acrt_iob_func]
mov dword [esp], 1
call ebp
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x447371
call sym._fwrite
mov dword [esp], 1
call ebp
mov dword [esp], eax
call sym._fflush
mov dword [esp], 0x45e040
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x433eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, ecx
sub esp, 8
call sym._chckNilDisp_4
test ebx, ebx
je 0x433ee9
mov eax, dword [ebx]
movzx edx, word [eax + 0xa]
cmp dx, 4
jle 0x433f00
mov eax, dword [eax + 0xc]
cmp dword [eax + 0x14], 0xd2b0e000
je 0x433ef0
cmp dword [eax + 0xc], 0x40e58f00
je 0x433f20
cmp dword [eax + 4], 0xf9c48000
je 0x433f10
add esp, 8
pop ebx
ret
add esp, 8
mov ecx, ebx
pop ebx
jmp fcn.00422650
cmp dx, 2
jg 0x433f2b
test dx, dx
jle 0x433ee9
mov eax, dword [eax + 0xc]
jmp 0x433ee0
add esp, 8
mov ecx, ebx
pop ebx
jmp fcn.00420170
add esp, 8
mov ecx, ebx
pop ebx
jmp fcn.004210c0
mov eax, dword [eax + 0xc]
jmp 0x433ed7

Function at 0x434624
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x435174
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x435193
mov eax, 0
jmp 0x4351d7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x4351b6
mov eax, 0
jmp 0x4351d7
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x4351d2
mov eax, 0
jmp 0x4351d7
mov eax, 1
leave
ret

Function at 0x4351d9
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x435238
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x435230
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x435230
mov eax, dword [ebp - 4]
jmp 0x43524c
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x43520d
mov eax, 0
leave
ret
Function at 0x43c12d
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
je 0x43c246
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._pthread_spin_destroy
cmp eax, 1
jne 0x43c23c
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea eax, [ebp - 0x4f]
mov ecx, 0x43
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x43c1f2
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x43c209
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x43c1ee
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x43c227
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sym._abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x43c247
nop
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x43d04e
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call eax
mov dword [0x446460], eax
mov eax, dword [0x446460]
cmp eax, 0xffffffff
jne 0x43d06f
call sym._abort
nop
leave
ret

Function at 0x43d1e1
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], sym._pthread_tls_init
mov dword [esp], 0x45ee20
call sym.__pthread_once_raw
mov eax, dword [0x446460]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x43d228
mov eax, dword [ebp - 0x20]
jmp 0x43d373
call sym._pop_pthread_mem
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x43d23f
cmp dword [ebp - 0x20], 0
jne 0x43d249
mov eax, 0
jmp 0x43d373
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._replace_spin_keys
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x43d31b
call sym._abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x446460]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x43d370
call sym._abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x43d437
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call sym.___pthread_self_lite
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call sym.__pthread_cleanup_dest
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x43d492
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_longjmp]
call eax
mov eax, dword [0x446460]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43d5bc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x43d524
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x43d4e1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._push_pthread_mem
mov dword [ebp - 0x10], 0
mov eax, dword [0x446460]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x43d5bc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x43d554
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x43d5bc
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._push_pthread_mem
mov dword [ebp - 0x10], 0
mov eax, dword [0x446460]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__endthreadex]
call eax
Function at 0x402810
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40281e
call dword [0x700024]
or eax, eax
je 0x40281f
ret
mov al, 1
jmp fcn.0040289c

Function at 0x402828
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402836
call dword [0x700028]
or eax, eax
jne 0x402837
ret
mov al, 2
jmp fcn.0040289c

Function at 0x402840
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402878
test edx, edx
je 0x402862
push eax
mov eax, ecx
call dword [0x70002c]
pop ecx
or eax, eax
je 0x402871
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.0040289c
mov dword [eax], edx
mov eax, ecx
call dword [0x700028]
or eax, eax
jne 0x40285b
ret
mov al, 1
jmp fcn.0040289c
test edx, edx
je 0x40288c
push eax
mov eax, edx
call dword [0x700024]
pop ecx
or eax, eax
je 0x402871
mov dword [ecx], eax
ret

Function at 0x40289c
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x732004]
test ecx, ecx
je 0x4028ac
pop edx
call ecx
dec eax
mov al, byte [eax + 0x4028c5]
jns 0x4028c0
call fcn.00407c38
mov eax, dword [eax + 4]
jmp fcn.00403e18

Function at 0x4028e0
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push ecx
call fcn.00407c38
cmp dword [eax + 4], 0
pop ecx
pop edx
pop eax
jne 0x4028f5
ret
xor eax, eax
jmp fcn.0040289c

Function at 0x402a24
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402a53
push 0x105
lea eax, [esp + 4]
push eax
push 0
call fcn.00401384
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403fac
jmp 0x402a71
call fcn.0040136c
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004029ac
mov edi, eax
test ebx, ebx
je 0x402a71
cmp dword [esi], 0
je 0x402a71
dec ebx
jmp 0x402a5a
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402cf8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x732044], 0x8088405
inc edx
mov dword [0x732044], edx
mul edx
mov eax, edx
ret

Function at 0x402f88
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403020
push 0x80000002
call fcn.004013e4
test eax, eax
jne 0x403000
xor eax, eax
push ebp
push 0x402ff9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40303c
mov eax, dword [ebp - 4]
push eax
call fcn.004013ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403000
mov eax, dword [ebp - 4]
push eax
call fcn.004013dc
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x4032b4
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4032ce
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x4032ce
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x4032ba
mov al, 0xa
jmp fcn.0040289c
ret
Function at 0x403300
Capabilities:
Terminate process

Disassembly:
cmp dword [0x73201c], 0
je 0x402b5b
call dword [0x73201c]
mov eax, 0xd2
jmp fcn.00403e18
push eax
push ecx
mov eax, dword [eax]
call fcn.004032d0
pop ecx
pop eax
je 0x40330f
jmp ebx
pop ecx
jmp 0x402b4c

Function at 0x403318
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.004032d0
mov eax, ebx
pop ebx
jne 0x40332d
pop ecx
jmp 0x402b4c
ret

Function at 0x403cec
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x7324a4
mov esi, 0x732038
mov edi, 0x73203c
cmp byte [ebx + 0x24], 0
jne 0x403d1b
cmp dword [edi], 0
je 0x403d1b
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403d0a
cmp dword [0x732040], 0
je 0x403d6b
call fcn.00403c68
cmp byte [0x732048], 0
je 0x403d48
mov edx, 0x700034
mov eax, 0x73221c
call fcn.0040712c
call fcn.004070af
jmp 0x403d64
cmp byte [0x700010], 0
jne 0x403d64
push 0
push 0x700054
push 0x700034
push 0
call fcn.0040134c
xor eax, eax
mov dword [0x732040], eax
cmp byte [ebx + 0x24], 2
jne 0x403d7b
cmp dword [esi], 0
jne 0x403d7b
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403b04
cmp byte [ebx + 0x24], 1
jbe 0x403d8b
cmp dword [esi], 0
je 0x403da8
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403da8
call fcn.00406964
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403da8
push edx
call fcn.00401364
call fcn.00403adc
cmp byte [ebx + 0x24], 1
jne 0x403db6
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403dc1
call fcn.00403cb8
cmp dword [ebx], 0
jne 0x403dce
mov eax, dword [esi]
push eax
call fcn.00401344
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403d6b

Function at 0x403e18
Capabilities:
Terminate process

Disassembly:
pop dword [0x732040]
jmp fcn.00403e0c

Function at 0x403e24
Capabilities:
Terminate process

Disassembly:
cmp dword [0x732018], 0
je 0x403e37
push dword [esp]
call dword [0x732018]
ret
mov al, 0x15
jmp fcn.0040289c

Function at 0x403e78
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402810
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x732049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403e40
push eax
push esi
push ebx
call fcn.00401334
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4045f0
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.0040289c
test edx, edx
je fcn.004045b4
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.004045b4
push ecx
push edx
push eax
call fcn.0040140c
test eax, eax
je 0x40459c
ret

Function at 0x404698
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
je fcn.004045b4
push eax
push ecx
push edx
call fcn.00401404
test eax, eax
je 0x40459c
pop edx
push dword [edx]
mov dword [edx], eax
call fcn.00401414
ret
Function at 0x4046fc
Capabilities:
Terminate process

Disassembly:
xor ecx, ecx
test edx, edx
je 0x40472f
push edx
cmp cx, word [edx]
je 0x404728
cmp cx, word [edx + 2]
je 0x404725
cmp cx, word [edx + 4]
je 0x404722
cmp cx, word [edx + 6]
je 0x40471f
add edx, 8
jmp 0x404703
add edx, 2
add edx, 2
add edx, 2
mov ecx, edx
pop edx
sub ecx, edx
shr ecx, 1
jmp fcn.00404698

Function at 0x4048a8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4048bc
push eax
push 0
call fcn.00401404
test eax, eax
je 0x40459c
ret

Function at 0x4049a0
Capabilities:
Terminate process

Disassembly:
mov edx, dword [eax]
test edx, edx
je 0x4049be
push eax
mov ecx, dword [edx - 4]
shr ecx, 1
push ecx
push edx
call fcn.00401404
pop edx
test eax, eax
je 0x40459c
mov dword [edx], eax
ret

Function at 0x4049ec
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x404a2b
cmp al, 0xb
je 0x404a2b
cmp al, 0xc
je 0x404a35
cmp al, 0xd
je 0x404a48
cmp al, 0xe
je 0x404a66
cmp al, 0xf
je 0x404a2b
cmp al, 0x11
je 0x404a2b
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.0040289c
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x404a2b
jmp 0x404a7a
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404a35
jmp 0x404a7a
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004049ec
dec edi
jg 0x404a4b
pop ebp
jmp 0x404a7a
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004049c0
dec edi
jg 0x404a69
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x404a80
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004049ec

Function at 0x404ab8
Capabilities:
Terminate process

Disassembly:
cmp ecx, 0
je 0x404b9e
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404b08
cmp al, 0xb
je 0x404b22
cmp al, 0xc
je 0x404b39
cmp al, 0xd
je 0x404b48
cmp al, 0xe
je 0x404b66
cmp al, 0xf
je 0x404b7c
cmp al, 0x11
je 0x404b8b
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.0040289c
cmp ecx, 1
mov eax, ebx
jg 0x404b19
call fcn.00403ec4
jmp 0x404b9a
mov edx, ecx
call fcn.00403ee8
jmp 0x404b9a
cmp ecx, 1
mov eax, ebx
jg 0x404b30
call fcn.004045b4
jmp 0x404b9a
mov edx, ecx
call fcn.004045cc
jmp 0x404b9a
mov eax, ebx
add ebx, 0x10
call fcn.00405b0c
dec edi
jg 0x404b39
jmp 0x404b9a
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404ab8
dec edi
jg 0x404b4b
pop ebp
jmp 0x404b9a
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404a8c
dec edi
jg 0x404b69
pop ebp
jmp 0x404b9a
mov eax, ebx
add ebx, 4
call fcn.00406a2c
dec edi
jg 0x404b7c
jmp 0x404b9a
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.004063bc
dec edi
jg 0x404b8b
pop edi
pop esi
pop ebx
pop eax
ret