joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bfb3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c050
push ebx
push esi
call fcn.0040bf7c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040bf10
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40bffd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c04f
push edi
push eax
call fcn.0040cbd0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40c01d
call fcn.0040aa71
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c04e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040bf10
add esp, 0x20
test eax, eax
jne 0x40c03c
push edi
call fcn.0040aa71
jmp 0x40c044
push ebx
call fcn.0040aa71
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d34d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44a608
push 0x44a600
push str.FlsAlloc
push 0x1f
call fcn.0040d20c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d381
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
jmp 0x40d387
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d3cb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44a618
push 0x44a610
push str.FlsGetValue
push 0x21
call fcn.0040d20c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d402
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d40a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x44a620
push 0x44a618
push str.FlsSetValue
push 0x22
call fcn.0040d20c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d444
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4128a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4128cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4128cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100056f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x10005726
push esi
call fcn.10009f4b
cmp dword [esi + 0x40], 0
pop ecx
je 0x10005721
xor eax, eax
mov dword [esi + 0x14], 0xcf
inc eax
jmp 0x100057b7
mov dword [esi + 0x14], edi
mov eax, edi
cmp eax, edi
jne 0x10005792
mov eax, dword [esi + 0x1b4]
cmp dword [eax + 0x10], 0
je 0x10005784
mov eax, dword [esi + 8]
test eax, eax
je 0x10005741
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1b4]
push esi
call dword [eax]
pop ecx
test eax, eax
je 0x10005780
cmp eax, 2
je 0x10005784
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10005736
cmp eax, 3
je 0x10005765
cmp eax, 1
jne 0x10005736
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x10005736
mov eax, dword [esi + 0x140]
add eax, edi
mov dword [edx + 8], eax
jmp 0x10005736
xor eax, eax
jmp 0x100057b7
mov eax, dword [esi + 0x90]
mov dword [esi + 0x98], eax
jmp 0x100057b0
cmp eax, 0xcc
je 0x100057b0
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
call dword [eax]
pop ecx
push esi
call fcn.100057ba
pop ecx
pop edi
pop esi
ret

Function at 0x1000d9e9
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
push edi
mov dword [edi + 4], ebp
call fcn.1000640e
push 0x54
push edi
mov ebx, eax
call fcn.1000ddb5
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1000da2b
push edi
call fcn.100069a7
mov ecx, dword [edi]
push edi
mov dword [ecx + 0x14], 0x36
mov ecx, dword [edi]
mov dword [ecx + 0x18], ebp
mov eax, dword [edi]
call dword [eax]
pop ecx
pop ecx
xor ecx, ecx
mov dword [esi], fcn.1000d6f4
mov dword [esi + 4], fcn.1000d5ac
lea eax, [esi + 0x40]
mov dword [esi + 8], fcn.1000d640
inc ecx
mov dword [esi + 0xc], fcn.1000d4ed
mov dword [esi + 0x10], 0x1000dcf7
mov dword [esi + 0x14], 0x1000dc8f
mov dword [esi + 0x18], 0x1000db1d
mov dword [esi + 0x1c], 0x1000d3bd
mov dword [esi + 0x20], 0x1000d28a
mov dword [esi + 0x24], fcn.1000d908
mov dword [esi + 0x28], 0x1000dd5f
mov dword [esi + 0x30], 0x3b9aca00
mov dword [esi + 0x2c], ebx
sub ecx, 1
mov dword [eax - 8], ebp
mov dword [eax], ebp
lea eax, [eax - 4]
jns 0x1000da87
mov dword [esi + 0x44], ebp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
pop ecx
test eax, eax
je 0x1000dafa
lea ecx, [esp + 0x18]
mov byte [esp + 0x18], 0x78
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push str._u_c
push eax
call fcn.1000dd91
add esp, 0x10
test eax, eax
jle 0x1000dafa
mov cl, byte [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp cl, 0x6d
je 0x1000daeb
cmp cl, 0x4d
jne 0x1000daf1
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1000df9d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
xor eax, eax
mov edx, 0x100
mov ebp, dword [edi + 0x58]
cmp ebp, 1
mov ebx, dword [edi + 0x1cc]
sete al
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebp
mov dword [ebx + 0x1c], eax
mov eax, 0x2fe
push dword [edi + 0x78]
mov ecx, dword [edi + 4]
cmovne eax, edx
push eax
push 1
push edi
call dword [ecx + 8]
xor esi, esi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0x14], esi
cmp dword [edi + 0x78], esi
jle 0x1000e0ce
mov ecx, dword [ebx + esi*4 + 0x20]
cdq
idiv ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
cmp ebp, 1
jne 0x1000e014
mov eax, dword [ebx + 0x18]
add dword [eax + esi*4], 0xff
mov eax, dword [ebx + 0x18]
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov ebp, dword [eax + esi*4]
mov esi, dword [esp + 0x20]
lea ebx, [esi*2 - 2]
lea eax, [esi + 0xfe]
mov dword [esp + 0x20], ebx
cdq
idiv ebx
xor ebx, ebx
mov edx, eax
cmp ebx, edx
jle 0x1000e066
imul eax, ecx, 0x1fe
lea edi, [esi + 0xfe]
add edi, eax
add edi, 0x1fe
inc ecx
mov eax, edi
cdq
idiv dword [esp + 0x20]
mov edx, eax
cmp ebx, edx
jg 0x1000e04e
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x1c]
movzx ecx, cl
movzx eax, al
imul ecx, eax
mov byte [ebx + ebp], cl
inc ebx
mov ecx, dword [esp + 0x10]
cmp ebx, 0xff
jle 0x1000e03c
cmp dword [esp + 0x18], 1
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x2c]
jne 0x1000e0b4
xor ecx, ecx
lea edx, [ebp - 1]
inc ecx
mov al, byte [ebp]
mov byte [edx], al
mov al, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
dec edx
cmp ecx, 0xff
jle 0x1000e098
mov ebx, dword [esp + 0x24]
inc esi
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], esi
cmp esi, dword [edi + 0x78]
jl 0x1000dff6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x1000e0d6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
push edi
mov ebx, dword [esi + 0x1cc]
mov dword [esp + 0x3c], ebx
lea ebp, [ebx + 0x20]
push ebp
push esi
mov dword [esp + 0x2c], ebp
call fcn.1000e7c0
cmp dword [esi + 0x78], 3
mov edi, eax
mov edx, dword [esi]
pop ecx
pop ecx
push 1
mov dword [esp + 0x3c], edi
push esi
jne 0x1000e12c
mov dword [edx + 0x18], edi
mov ecx, dword [ebp]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebx + 0x24]
mov dword [edx + 0x20], eax
mov eax, dword [ebx + 0x28]
mov dword [edx + 0x24], eax
mov eax, dword [esi]
mov dword [eax + 0x14], 0x5e
jmp 0x1000e138
mov dword [edx + 0x14], 0x5f
mov eax, dword [esi]
mov dword [eax + 0x18], edi
mov eax, dword [esi]
call dword [eax + 4]
mov eax, dword [esi + 4]
pop ecx
pop ecx
push dword [esi + 0x78]
push edi
push 1
push esi
call dword [eax + 8]
xor ecx, ecx
mov dword [esp + 0x38], eax
add esp, 0x10
mov edx, edi
mov dword [esp + 0x18], edx
cmp dword [esi + 0x78], ecx
jle 0x1000e23d
mov eax, dword [ebp]
mov dword [esp + 0x10], eax
mov eax, edx
cdq
idiv dword [esp + 0x10]
cmp dword [esp + 0x10], 0
mov edx, eax
mov dword [esp + 0x14], edx
jle 0x1000e220
mov esi, dword [esp + 0x10]
xor ebx, ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x20], ebx
lea eax, [esi - 1]
mov dword [esp + 0x30], eax
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x1c], eax
add eax, dword [esp + 0x2c]
cdq
idiv dword [esp + 0x30]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x34], eax
mov eax, ebx
mov dword [esp + 0x10], ebx
cmp ebx, edi
jge 0x1000e200
xor ebx, ebx
test edx, edx
jle 0x1000e1f2
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp + ecx*4]
mov edx, dword [esp + 0x34]
add eax, ebx
inc ebx
mov byte [eax + edi], dl
mov edx, dword [esp + 0x14]
cmp ebx, edx
jl 0x1000e1d0
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
add eax, ebp
mov dword [esp + 0x10], eax
cmp eax, edi
jl 0x1000e1c2
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
add ebx, edx
add eax, 0xff
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], eax
sub esi, 1
jne 0x1000e1a7
mov esi, dword [esp + 0x44]
mov ebp, dword [esp + 0x24]
inc ecx
mov dword [esp + 0x18], edx
add ebp, 4
mov dword [esp + 0x24], ebp
cmp ecx, dword [esi + 0x78]
jl 0x1000e164
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x14], edi
pop edi
pop esi
pop ebp
mov dword [ebx + 0x10], eax
pop ebx
add esp, 0x30
ret
Function at 0x100183b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x100183c4
pop dword [ebp - 8]
mov eax, 0xe35969aa
add eax, 0x2ca81a1a
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x8d78a600
sub dword [ebp - 0x18], 0x3f2660b5
mov dword [ebp - 0x14], 0x2063c5a3
sub dword [ebp - 0x14], 0xee30795e
mov dword [ebp - 0x10], 0x2841072a
sub dword [ebp - 0x10], 0xdbf4c2fc
mov dword [ebp - 0xc], 0xf776a0e4
sub dword [ebp - 0xc], 0xf776a0e4
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xe5058358
add dword [ebp - 0x18], 0x8f6ce5fe
mov dword [ebp - 0x14], 0xda6f2566
add dword [ebp - 0x14], 0x66fd3c0f
mov dword [ebp - 0x10], 0x9a811c4
add dword [ebp - 0x10], 0x59c75aa8
mov dword [ebp - 0xc], 0x67d580c7
sub dword [ebp - 0xc], 0x67d580c7
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xd712726a
sub eax, 0xc710522a
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x37fa7
push 0
call eax
mov ecx, 0x6a49c7b1
sub ecx, 0x6a498028
xor ebx, ebx
add ebx, eax
mov edx, 0x10031c00
add edx, dword [ebp - 8]
mov edi, 0x10af7846
sub edi, 0xd7a47db2
mov dword [ebp - 4], 0xe09f93db
mov esi, dword [edx]
xor dword [ebp - 4], 0x3218402e
add esi, edi
sub dword [ebp - 4], edx
mov dword [ebx], esi
xor dword [ebp - 4], 0x60889c60
add ebx, 4
add edx, 0xa26c21aa
add edx, 0x5d93de5a
loop 0x100184dd
add eax, 0x110f7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x1001da89
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x18
mov eax, dword [0x1002c00c]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x14], edi
lea eax, [edi + 0x2d58]
push eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
xor esi, esi
push esi
mov dword [edi + 0x2d4c], esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 0x26
push ebx
mov dword [esp + 0x18], ebx
call ebp
xor ecx, ecx
shr eax, 8
inc ecx
and eax, ecx
cmp dword [sym.imp.USER32.dll_UpdateLayeredWindow], esi
je 0x1001daea
test eax, eax
jne 0x1001daea
mov dword [edi + 0x2d4c], ecx
mov dword [edi + 0x2894], 4
cmp dword [edi + 0x2d4c], esi
je 0x1001db28
push 0xff000000
push 0xff
push 0xff00
push 0xff0000
push edi
call fcn.100183b5
mov dword [edi + 0x34], 1
mov dword [edi + 0x2898], esi
jmp 0x1001dbd6
mov dword [edi + 0x2898], ecx
test eax, eax
je 0x1001dbbc
push 0x6a
push ebx
call ebp
push 0x68
push ebx
mov esi, eax
call ebp
mov ebx, eax
sub ebx, esi
xor esi, esi
push esi
push esi
push esi
push esi
push edi
call fcn.100183b5
add esp, 0x14
mov eax, esi
test ebx, ebx
jle 0x1001db6b
lea ecx, [edi + 0x2934]
mov dword [ecx], eax
inc eax
lea ecx, [ecx + 4]
cmp eax, ebx
jl 0x1001db61
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.1001bf02
lea esi, [edi + 0x2934]
mov ebp, eax
push esi
lea ebx, [edi + 0x44]
add edi, 0x2494
push ebx
lea eax, [esp + 0x28]
push edi
push eax
call fcn.1001ba6e
mov eax, dword [esp + 0x2c]
add esp, 0x18
mov dword [eax + 0x40], esi
xor esi, esi
mov dword [eax + 0x38], ebx
mov ebx, dword [esp + 0x10]
mov dword [eax + 0x20], 1
mov dword [eax + 0x2c], edi
mov dword [eax + 0x3c], ebp
mov dword [eax + 0x2d54], esi
jmp 0x1001dbd9
push 0xff000000
push 0xff
push 0xff00
push 0xff0000
push edi
call fcn.100183b5
add esp, 0x14
push ebx
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
push str.JAVA2D_DPIAWARE
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
pop ecx
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
jne 0x1001dc0d
call fcn.100183b5
movss xmm0, dword [0x10027834]
fstp dword [esp]
comiss xmm0, dword [esp]
ja 0x1001dc1f
jmp 0x1001dc40
push eax
push str.true
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x1001dc40
push str.user32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x1001dc40
push str.SetProcessDPIAware
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x1001dc40
call eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10020582
add esp, 0x18
ret
Function at 0x1001deb6
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, dword [esp + 8]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [edi + 0x289c]
cdq
sub eax, edx
sar eax, 1
push 1
mov dword [edi + 0x292c], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [edi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [edi + 0x2930], eax
mov eax, dword [edi + 0x2d50]
test eax, eax
je 0x1001df26
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x28a0]
push dword [edi + 0x289c]
push dword [edi + 0x2930]
push dword [edi + 0x292c]
push dword [edi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push edi
call fcn.1001df2f
pop ecx
pop edi
ret
Function at 0x10014820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1001482f
pop dword [ebp - 0x40]
mov eax, 0xeaa3adcf
add eax, 0x255d9a60
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x7ddee9d5
add dword [ebp - 0x50], 0xd0735b76
mov dword [ebp - 0x4c], 0x9c26cfde
sub dword [ebp - 0x4c], 0x69f38399
mov dword [ebp - 0x48], 0x13929c65
add dword [ebp - 0x48], 0x38b9a7c9
mov dword [ebp - 0x44], 0x87f5d706
sub dword [ebp - 0x44], 0x87f5d706
lea eax, [ebp - 0x50]
push eax
mov eax, 0x507d948c
sub eax, 0x407be47c
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x94b5d187
sub dword [ebp - 0x50], 0x20436831
mov dword [ebp - 0x4c], 0x43728bd2
add dword [ebp - 0x4c], 0xfdf9d5a3
mov dword [ebp - 0x48], 0xbefae3c6
sub dword [ebp - 0x48], 0x5b8b775a
mov dword [ebp - 0x44], 0xb19b4615
add dword [ebp - 0x44], 0x4e64b9eb
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x40560
push 0
call eax
mov ecx, 0x5059
mov edi, eax
mov esi, 0x2fd541bf
sub esi, 0x1fd291bf
add esi, dword [ebp - 0x40]
mov ebx, 0xa82682ba
xor dword [ebp - 0x3c], 0x4b3f58c2
mov edx, dword [esi]
sub dword [ebp - 0x24], 0x109f563b
add edx, ebx
xor dword [ebp - 4], 0x45f5e609
mov dword [edi], edx
xor dword [ebp - 0x20], 0x899e79dc
add edi, 0x4231a2e8
sub edi, 0x4231a2e4
add esi, 0x3af39a21
add esi, 0xc50c65e3
loop 0x10014940
add eax, 0x9041d28b
add eax, 0x6fbf61ac
mov ebx, eax
add eax, 5
mov ecx, 0x104792b0
sub ecx, 0x4792b0
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x404ac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44b449
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
mov eax, dword [0x4650f0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov dword [esp + 0x10], 0
call fcn.00412ee0
mov ebp, eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x30], 1
call fcn.00412dd0
push ebp
push esi
mov ecx, eax
mov byte [esp + 0x34], 2
call fcn.004011f0
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x2c], 1
call fcn.00411520
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 0
call fcn.00411520
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x24
ret 4
Function at 0x40a940
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x44b0bb
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4650f0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 8]
mov dword [esp + 0x20], 0
mov ecx, edi
mov dword [esi], vtable.CPBasePath.0
call fcn.004114f0
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x28]
push ecx
mov byte [esp + 0x24], 1
lea ecx, [esp + 0x14]
mov dword [esi + 4], eax
call fcn.00401050
lea edx, [esp + 0x14]
lea ecx, [edi + 4]
push edx
mov byte [esp + 0x24], 2
call fcn.00401d00
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call fcn.00411520
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.00411520
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0xc
Function at 0x40c6f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44ac40
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4650f0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push str.CCZipperHeaderData::DoSerialProperty
lea ecx, [esp + 0x28]
call fcn.004010e0
lea edi, [eax + 4]
mov dword [esp + 0x38], 0
mov eax, dword [edi]
sub eax, 0x10
mov ebx, 1
cmp dword [eax + 0xc], ebx
jle 0x40c751
mov eax, dword [eax + 4]
push eax
mov ecx, edi
call fcn.00401df0
mov edi, dword [edi]
push edi
push 7
call fcn.00411380
add esp, 8
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.00411520
cmp dword [ebp + 8], 0
je 0x40c78f
mov eax, 0x68
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [ebp + 0x10], 0
je 0x40c86c
mov edi, dword [ebp + 0xc]
mov edx, dword [edi]
mov edx, dword [edx + 8]
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call edx
test eax, eax
jne 0x40c7bd
cmp dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
jg 0x40c7da
mov eax, 0xc8
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [ebp + 0xc]
mov ebx, 1
mov eax, dword [0x469d00]
mov ecx, dword [ebp + 0x14]
push eax
push ecx
push 0x7a666474
push edi
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x2c], 0
call fcn.00414760
add esp, 0x18
test eax, eax
jne 0x40c7bd
mov edi, dword [esp + 0x14]
test edi, edi
je 0x40c852
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], ebx
mov eax, dword [esi + 0x18]
lea ebx, [esi + 0x10]
call fcn.0040cee0
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.0040c5d0
mov eax, dword [esp + 0x18]
add eax, 1
cmp eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
jl 0x40c7d2
jmp 0x40c7b8
mov eax, 0x66
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x50]
call eax
test eax, eax
jne 0x40c7bd
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jle 0x40c7b8
xor edi, edi
test edi, edi
jl 0x40c8c1
cmp ebx, dword [esi + 0x18]
jge 0x40c8c1
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx + edi]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx + 0xc]
add ecx, edi
push eax
call edx
test eax, eax
jne 0x40c7bd
add ebx, 1
add edi, 0x30
cmp ebx, dword [esi + 0x18]
jl 0x40c88f
jmp 0x40c7b8
call fcn.0042a314
int3
Function at 0x40ec30
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x44aece
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x4650f0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, dword [esp + 0x34]
push edi
lea ecx, [esp + 0x20]
call fcn.0040eb40
mov esi, eax
push str.CCZipperObjectFactory::MakeObject
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0
call fcn.004010e0
push esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
mov byte [esp + 0x34], 1
call fcn.004011f0
lea esi, [eax + 4]
mov byte [esp + 0x2c], 2
mov eax, dword [esi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x40ecab
mov edx, dword [eax + 4]
push edx
mov ecx, esi
call fcn.00401df0
mov esi, dword [esi]
push esi
push 7
call fcn.00411380
add esp, 8
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call fcn.00411520
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call fcn.00411520
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00411520
xor eax, eax
cmp edi, 0x7a666474
je 0x40ed2b
cmp edi, 0x7a666864
jne 0x40ed61
push 0x24
call fcn.0042a205
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov dword [esp + 0x2c], 4
je 0x40ed5f
push eax
call fcn.0040c610
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 4
push 0x30
call fcn.0042a205
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
mov dword [esp + 0x2c], 3
je 0x40ed5f
push eax
call fcn.0040cf60
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 4
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 4