joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ce90
Capabilities:
Get file size
Read file via mapping
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
mov byte [ebp - 0x11], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
push 0
push 0
push 3
push 0
push 0
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40cfe3
push 0
push 0
push 0
push 2
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40cfd9
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40cfcf
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jbe 0x40cfc5
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0040aea0
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40cfc5
mov edx, dword [ebp - 8]
sub edx, 0x100
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x18], edx
jne 0x40cfc5
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x100
push ecx
push 0x10
mov edx, dword [ebp - 0x10]
add edx, 8
push edx
call fcn.0040a840
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40cfc5
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004091e0
add esp, 0xc
mov ecx, 4
lea edi, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
add esi, 8
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x40cfc5
mov ecx, dword [ebp - 4]
push ecx
call fcn.00408990
add esp, 4
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x40d03d
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40d031
mov byte [ebp - 0x11], 1
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push edx
call fcn.00408990
add esp, 4
mov al, byte [ebp - 0x11]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d050
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov edx, 5
mov word [ebp - 0x30], dx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x60]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x40d0bf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x40d0f6
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x64], ecx
cmp dword [ebp - 0x64], 0x20
jle 0x40d0f4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x40d0f6
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x40d100
Capabilities:
Create http request
Get http content length
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 5], 0
push 0
push 0
push 0
push 1
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_105.0.0.0_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40d198
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40d18e
mov dword [ebp - 0x14], 4
push 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
push 0x20000005
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
cmp dword [ebp - 0x10], 0x1388
jbe 0x40d184
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx]
je 0x40d184
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x40d560
Capabilities:
Create tcp socket
Create thread
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
test si, si
je 0x40d651
test edi, edi
je 0x40d651
push ebx
push 0x24
call fcn.00408820
add esp, 4
push 0
push 0
mov ebx, eax
push 1
push 0
mov dword [ebx], 0x756470
mov dword [ebx + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x11
push 2
push 2
mov dword [ebx + 0x10], eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx + 8], eax
cmp eax, 0xffffffff
jne 0x40d5bc
call fcn.0040d9c0
xor ebx, ebx
test ebx, ebx
je 0x40d64e
xor eax, eax
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov dword [esp + 0x12], eax
mov word [esp + 0x16], ax
mov eax, dword [esp + 0x1c]
mov ecx, 2
push esi
mov dword [esp + 0x10], eax
mov word [esp + 0xc], cx
call dword [sym.imp.WS2_32.dll_htons]
push 1
lea edx, [esp + 0xb]
push edx
push 4
mov word [esp + 0x16], ax
mov byte [esp + 0x13], 1
mov eax, dword [ebx + 8]
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edx, dword [ebx + 8]
push 0x10
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x40d634
call fcn.0040d9c0
xor eax, eax
pop ebx
add esp, 0x14
ret
push 0
push 0
push ebx
push 0x40d790
push 0
push 0
mov dword [ebx + 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x14], eax
mov eax, ebx
pop ebx
add esp, 0x14
ret
Function at 0x40d890
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, eax
xor al, al
push edi
mov byte [esp + 0x13], al
test ecx, ecx
je 0x40d9aa
cmp dword [ecx], 0x756470
jne 0x40d9aa
cmp dword [ebp + 0xc], 0
je 0x40d9aa
test esi, esi
je 0x40d9aa
lea edi, [esi + 4]
push edi
call fcn.00408840
mov ebx, eax
mov eax, dword [ebp + 0xc]
push esi
push eax
lea ecx, [ebx + 4]
push ecx
mov dword [esp + 0x24], ebx
mov dword [ebx], esi
call sub.ntdll.dll_memcpy
xor eax, eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
mov eax, dword [ebp + 0x14]
add esp, 0x10
mov edx, 2
push eax
mov word [esp + 0x1c], dx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp + 0x10]
mov word [esp + 0x1a], ax
mov dword [esp + 0x1c], ecx
test edi, edi
je 0x40d980
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push 0x10
lea edx, [esp + 0x1c]
push edx
push 0
push edi
push ebx
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
cmp esi, 0xffffffff
je 0x40d978
mov edx, dword [ebp + 8]
push esi
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
sub edi, esi
add ebx, esi
test edi, edi
jne 0x40d926
mov ebx, dword [esp + 0x14]
push ebx
mov byte [esp + 0x17], 1
call fcn.00408990
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x40d999
mov ebx, dword [esp + 0x14]
push ebx
mov byte [esp + 0x17], 1
call fcn.00408990
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00408990
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40da30
Capabilities:
Create tcp socket
Create thread
Create udp socket

Disassembly:
sub esp, 0x10
push ebx
push 0x24
call fcn.00408820
add esp, 4
push 0
push 0
mov ebx, eax
push 1
push 0
mov dword [ebx], 0x756470
mov dword [ebx + 4], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x11
push 2
push 2
mov dword [ebx + 0x10], eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx + 8], eax
cmp eax, 0xffffffff
jne 0x40da79
call fcn.0040d9c0
xor ebx, ebx
test ebx, ebx
je 0x40dada
xor eax, eax
mov dword [esp + 6], eax
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov word [esp + 0x12], ax
mov eax, 2
push 0x10
lea ecx, [esp + 8]
mov word [esp + 8], ax
mov edx, dword [ebx + 8]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x40dabc
call fcn.0040d9c0
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
push 0
push 0
push ebx
push 0x40d790
push 0
push 0
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x14], eax
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x40e280
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSASend]
push ebp
mov ebp, dword [esp + 0xc]
mov ecx, dword [ebp + 0x260]
push edi
push 0
push esi
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea edi, [esi + 0x1c]
push edi
push ecx
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x40e2f0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x40e2f0
cmp eax, 0x2733
jne 0x40e2f6
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x260]
push 0
push esi
push 0
lea edx, [esp + 0x1c]
push edx
push 1
push edi
push eax
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
jne 0x40e2b2
pop edi
pop ebp
mov al, 1
pop ebx
ret
pop edi
pop ebp
xor al, al
pop ebx
ret

Function at 0x40e3f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
mov edx, dword [esi + 0x260]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSARecv]
push ebp
push edi
xor eax, eax
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea edi, [esi + 0x208]
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
lea ebp, [esi + 0x224]
push ebp
push edx
call ebx
test eax, eax
je 0x40e472
mov edi, edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x40e472
cmp eax, 0x2733
jne 0x40e47b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esi + 0x260]
xor eax, eax
push eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push ebp
push edx
call ebx
test eax, eax
jne 0x40e430
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
pop edi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
Function at 0x40e500
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x1c
cmp dword [esp + 0x20], 0
push esi
push edi
mov esi, eax
mov edi, ecx
jne 0x40e692
test ebx, ebx
je 0x40e692
call fcn.0040bb20
push eax
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esi + 0x18]
sub eax, 0
je 0x40e5ee
sub eax, 1
jne 0x40e6e9
cmp byte [edi + 0x275], al
je 0x40e55c
add edi, 0x21c
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop edi
pop esi
add esp, 0x1c
ret
lea ecx, [edi + 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov edx, dword [edi + 0x27c]
push ebx
add edx, 0x44
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [edi + 0x264]
mov ecx, dword [edi + 0x268]
mov edx, dword [edi + 0x26c]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x270]
mov dword [esp + 0xc], ecx
mov ecx, dword [edi + 0x278]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [edi + 0x27c]
lea eax, [esp + 8]
lea edx, [edi + 8]
push eax
mov dword [esp + 0x20], edx
push ecx
mov ecx, 3
mov edx, edi
mov dword [esp + 0x28], ebx
call fcn.0040dee0
add esp, 8
mov eax, edi
call fcn.0040e490
test al, al
jne 0x40e6e9
mov byte [edi + 0x275], 1
pop edi
pop esi
add esp, 0x1c
ret
cmp byte [edi + 0x275], 0
je 0x40e607
add esi, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop edi
pop esi
add esp, 0x1c
ret
add dword [esi + 0x28], ebx
mov eax, dword [esi + 0x28]
cmp eax, dword [esi + 0x24]
jae 0x40e627
add dword [esi + 0x20], ebx
sub dword [esi + 0x1c], ebx
push edi
call fcn.0040e280
add esp, 4
pop edi
pop esi
add esp, 0x1c
ret
lea edx, [esi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ecx, dword [edi + 0x268]
mov edx, dword [edi + 0x26c]
mov eax, dword [edi + 0x264]
mov dword [esp + 0xc], ecx
mov ecx, dword [edi + 0x278]
mov dword [esp + 0x10], edx
mov edx, dword [esi + 0x30]
mov dword [esp + 0x18], ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x270]
mov dword [esp + 0x1c], edx
mov edx, dword [edi + 0x27c]
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x28]
push edx
mov ecx, 2
mov edx, edi
mov dword [esp + 0x28], eax
call fcn.0040dee0
add esp, 8
pop edi
pop esi
add esp, 0x1c
ret
add esi, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 4
lea edx, [esp + 0x2c]
push edx
mov eax, 1
push 0x80
mov word [esp + 0x34], ax
mov eax, dword [edi + 0x260]
push 0xffff
xor ecx, ecx
push eax
mov byte [edi + 0x275], 1
mov word [esp + 0x3e], cx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [edi + 0x260]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi + 0x260], 0xffffffff
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x40e7c0
Capabilities:
Create tcp socket
Create udp socket
Get system information on windows
Set socket configuration

Disassembly:
sub esp, 0x38
push edi
push 0x4c
call fcn.00408820
mov edi, eax
add esp, 4
test edi, edi
je 0x40e946
lea eax, [esp + 0x18]
push eax
mov dword [edi], 0x494f4350
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x2c]
lea eax, [edi + 0x20]
lea edx, [ecx + ecx]
push eax
mov dword [edi + 4], edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x10], eax
test eax, eax
je 0x40e93f
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [edi + 8], eax
test eax, eax
je 0x40e93f
call fcn.0040b7b0
mov dword [edi + 0xc], eax
test eax, eax
je 0x40e93f
push 1
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [edi + 0x14], eax
cmp eax, 0xffffffff
je 0x40e93f
push 1
lea ecx, [esp + 0xb]
push ecx
push 4
push 0xffff
push eax
mov byte [esp + 0x1b], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [esp + 0x44]
xor eax, eax
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov dword [esp + 0x12], eax
mov word [esp + 0x16], ax
mov eax, dword [esp + 0x40]
mov edx, 2
push ecx
mov word [esp + 0xc], dx
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [esp + 0xc]
mov word [esp + 0xe], ax
mov eax, dword [edi + 0x14]
push edx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x40e93f
mov ecx, dword [edi + 0x14]
push bind
push ecx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x40e93f
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [edi + 0x18], eax
test eax, eax
je 0x40e93f
mov edx, dword [edi + 0x14]
push 8
push eax
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x40e93f
push esi
xor esi, esi
cmp dword [edi + 4], esi
jbe 0x40e91f
mov eax, dword [edi + 0xc]
push 0
push 0
push edi
push 0x40e6f0
push 0
push eax
call fcn.0040b860
inc esi
add esp, 0x18
cmp esi, dword [edi + 4]
jb 0x40e901
mov ecx, dword [edi + 0xc]
push 0
push 0
push edi
push 0x40e0c0
push 0
push ecx
call fcn.0040b860
add esp, 0x18
pop esi
mov eax, edi
pop edi
add esp, 0x38
ret
call fcn.0040dda0
xor eax, eax
pop edi
add esp, 0x38
ret
Function at 0x40ebed
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40ec1e
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0x40ec25
cmp ebx, dword [ebp + 8]
jae 0x40ec25
xor eax, eax
jmp 0x40ee0b
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x40ec36
xor eax, eax
inc eax
jmp 0x40ee0a
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40ec48
cmp ecx, edx
jae 0x40ecac
cmp dword [eax + 4], 0
je 0x40ec51
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40ec3d
cmp dword [ebp + 8], 0
je 0x40ec6b
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40ecac
cmp eax, esi
jae 0x40ecac
mov ecx, dword [0x413f70]
mov esi, ebx
and esi, 0xfffff000
xor eax, eax
test ecx, ecx
jle 0x40ec8d
cmp dword [eax*4 + 0x413f78], esi
je 0x40ecb3
inc eax
cmp eax, ecx
jl 0x40ec7f
lea eax, [ebp + 8]
push eax
push 0x1c
lea eax, [ebp - 0x20]
push eax
push 0
push ebx
or edi, 0xffffffff
push edi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
jl 0x40ed23
mov eax, dword [ebp + 8]
jmp 0x40ed25
xor eax, eax
jmp 0x40ee0a
test eax, eax
jle 0x40ec2e
xor edx, edx
mov ebx, 0x413fb8
inc edx
mov edi, ebx
xchg dword [edi], edx
test edx, edx
jne 0x40ec2e
cmp dword [eax*4 + 0x413f78], esi
je 0x40ed02
lea eax, [ecx - 1]
test eax, eax
jl 0x40ecef
cmp dword [eax*4 + 0x413f78], esi
je 0x40eceb
dec eax
jns 0x40ecdf
test eax, eax
jge 0x40ed00
cmp ecx, 0x10
jge 0x40ecfb
inc ecx
mov dword [0x413f70], ecx
lea eax, [ecx - 1]
jmp 0x40ed02
je 0x40ed1a
xor edx, edx
test eax, eax
jl 0x40ed1a
lea ecx, [edx*4 + 0x413f78]
mov edi, dword [ecx]
inc edx
cmp edx, eax
mov dword [ecx], esi
mov esi, edi
jle 0x40ed08
xor eax, eax
xchg dword [ebx], eax
jmp 0x40ec2e
xor eax, eax
test eax, eax
je 0x40ee08
cmp dword [ebp - 8], 0x1000000
jne 0x40ee08
test byte [ebp - 0xc], 0xcc
je 0x40ed9a
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40ee08
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40ee08
cmp word [eax + 0x18], 0x10b
jne 0x40ee08
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40ee08
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x40ed9a
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x40ed9a
test byte [ecx + 0x27], 0x80
jne 0x40ecac
xor eax, eax
inc eax
mov ecx, eax
mov edx, 0x413fb8
xchg dword [edx], ecx
test ecx, ecx
jne 0x40ee0a
mov ecx, dword [0x413f70]
test ecx, ecx
mov edx, ecx
jle 0x40edc9
lea eax, [ecx*4 + 0x413f74]
cmp dword [eax], esi
je 0x40edc9
dec edx
sub eax, 4
test edx, edx
jg 0x40edbd
test edx, edx
jne 0x40edfa
push 0xf
pop ebx
cmp ecx, ebx
jg 0x40edd6
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x40edee
lea eax, [edx*4 + 0x413f78]
mov edi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], esi
mov esi, edi
jle 0x40eddc
cmp ecx, 0x10
jge 0x40edfa
inc ecx
mov dword [0x413f70], ecx
xor eax, eax
mov ecx, 0x413fb8
xchg dword [ecx], eax
jmp 0x40ec2e
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41bc35
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x41bc56
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x41bc4d
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x41bc45
mov eax, ebx
leave
ret

Function at 0x41bc7c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x41bcdb
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x41bd08
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x41bcf7
xor ecx, eax
xor edx, ebx
dec edi
jne 0x41bce8
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x41bd2e
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x41bccf
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x41c56e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword ds:[ebp - 0x20], 0xff8bff8b
mov dword ds:[ebp - 0x14], 0xff8bff8b
mov dword ds:[ebp - 0x1c], 0xff8bff8b
push 0x7fc
push dword [ebp - 0x20]
call fcn.0041bbfb
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ebx, eax
pop ecx
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x41c74d
push dword [ebp - 4]
call fcn.0041bbdf
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41c63e
jmp 0x41c74d
push dword [ebp - 4]
call fcn.0041bbdf
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
jne 0x41c692
lea eax, [ebp - 4]
push eax
call fcn.0041c554
mov dword [ebp - 0x28], eax
push 0
push 4
push dword [ebp - 0x28]
push dword [ebp - 4]
push 0xffffffff
push dword [ebp - 0x14]
call fcn.0041be06
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x41c692
mov eax, 1
jmp 0x41c694
xor eax, eax
test eax, eax
je 0x41c742
push ebx
push esi
push edx
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov eax, dword [eax]
add eax, ebx
lea eax, [eax + 0x78]
mov eax, dword [eax]
lea esi, [eax + ebx]
mov dword [ebp - 0x10], esi
lea edx, [esi + 0x20]
mov edx, dword [edx]
add edx, ebx
mov edx, dword [edx]
add edx, ebx
mov dword [ebp - 0x18], edx
lea eax, [esi + 0x18]
mov eax, dword [eax]
dec eax
mov dword [ebp - 4], eax
pop ebx
pop esi
pop edx
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x41c73a
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [ebp - 0x1c]
call fcn.0041c371
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x41c729
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
lea eax, [eax + edi*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop edi
leave
ret 8
push dword [ebp - 0xc]
call fcn.0041c52d
add dword [ebp - 8], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x41c6dc
add esp, 0xc
jmp 0x41c74d
pop ebx
pop ecx
pop edx
add ecx, 4
jmp 0x41c617
add esp, 0xc
mov edi, edi
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0
jmp 0x41c76e
mov esp, ebp
pop ebp
ret 8