joyce8/EMBER2024-capa huggingface dataset:
Function at 0x667fec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x668159
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6bbf7c]
mov eax, dword [eax]
movzx eax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x6bbf7c]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.004d0cb4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2b4]
call fcn.00510530
xor edx, edx
push ebp
push 0x66813c
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x6680aa
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
call fcn.00407c7c
push eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x38c]
call fcn.0066612c
push eax
mov eax, dword [0x6bbab4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x6680a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00405384
jmp 0x668143
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6680e8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2b4]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.005100f8
mov ebx, eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00667e7c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x6680c2
push 0
mov edx, 0x667e14
xor ecx, ecx
mov eax, dword [ebp - 0xc]
call fcn.0050fac8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x668143
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2b4]
call fcn.0051057c
mov eax, dword [0x6bbf7c]
mov eax, dword [eax]
movzx edx, word [ebp - 0x16]
call fcn.004d0cb4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x668160
lea eax, [ebp - 4]
call fcn.00407c7c
ret
Function at 0x674c2c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x240], 0
je 0x674c48
cmp dword [esi + 4], 0
je 0x674c75
test byte [ebx + 0x55], 1
jne 0x674c67
mov eax, ebx
call fcn.004b8a20
test eax, eax
jne 0x674c67
mov edx, esi
mov eax, ebx
call fcn.004bea54
jmp 0x674d85
mov edx, esi
mov eax, ebx
call fcn.004ba0f4
jmp 0x674d85
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x674d7e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004bc99c
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004b5cf4
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00674c2c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004bc99c
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x674d85
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x67cb60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405e2c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x67cb79
test al, 0x10
jne 0x67cb7d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x67cb84
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.00405e1c
xor eax, eax
push ebp
push 0x67cd71
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.00404004
mov edi, eax
lea eax, [ebp - 0x178]
xor ecx, ecx
mov edx, 0x160
call fcn.00403da4
cmp dword [ebp + 0x20], 0
je 0x67cc3f
cmp dword [ebp - 0x10], 0
je 0x67cc3f
mov eax, dword [ebp + 0x20]
call fcn.0040be30
test al, al
jne 0x67cbf5
mov eax, dword [ebp + 0x20]
call fcn.0067cb60
test al, al
je 0x67cc18
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00405e2c
push eax
call sub.shell32.dll_SHGetFileInfoA
jmp 0x67cc39
push 0x4010
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00405e2c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, dword [ebp - 0x174]
cmp byte [ebp + 0x1c], 0
je 0x67cc66
push 0x4000
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x67cd84
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
jmp 0x67cc85
push 0x4001
push 0x160
lea eax, [ebp - 0x178]
push eax
push 0
push 0x67cd84
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0042134c
test bl, bl
je 0x67ccc5
cmp byte [ebp + 0x14], 0
jne 0x67ccc5
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0048e4f8
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
test byte [ebp + 0x14], bl
je 0x67cd5b
mov dl, 1
mov eax, dword [0x48be20]
call fcn.00492600
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0
push 0
push 0
mov eax, ebx
call fcn.00492bd4
call fcn.0048e4f8
push eax
push edi
push esi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x184], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.004036c0
add eax, dword [ebp - 8]
mov dword [ebp - 0x180], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.004036c0
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x17c], eax
mov ecx, ebx
lea edx, [ebp - 0x188]
mov eax, dword [ebp - 4]
call fcn.0067ca84
mov eax, ebx
call fcn.00404960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67cd78
lea eax, [ebp + 0x20]
call fcn.00405980
ret

Function at 0x682d6c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esp + 4], 5
ja 0x682d98
cmp dword [esp + 4], 5
jne 0x682d94
cmp dword [esp + 8], 1
jae 0x682d98
xor eax, eax
jmp 0x682d9a
mov al, 1
add esp, 0x94
ret
Function at 0x6834b4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x6834c6
add esp, 0xfffffff0
call fcn.00404cc4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004a3fc8
mov eax, dword [0x6836b8]
not eax
and eax, dword [ebx + 0x50]
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x6795a8]
call fcn.00679714
mov dword [ebx + 0x274], eax
mov dl, 1
mov eax, dword [0x67a098]
call fcn.0068b200
mov esi, eax
mov dword [ebx + 0x27c], esi
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], 0x68ac34
mov dword [esi + 0x64], ebx
mov dword [esi + 0x60], 0x68ac64
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], 0x68ac58
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x78], 0x688098
mov eax, dword [ebx + 0x274]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x6834a8
mov dword [ebx + 0x284], 0xff0000
mov dword [ebx + 0x2e4], 0x1fffffff
mov dword [ebx + 0x2e8], 0x1fffffff
mov dword [ebx + 0x2f0], 0x808080
mov dword [ebx + 0x2ec], 2
mov ecx, ebx
mov dl, 1
mov eax, dword [0x679d60]
call fcn.0068b5c0
mov dword [ebx + 0x318], eax
mov dl, 1
mov eax, dword [0x5a5b48]
call fcn.00404930
mov dword [ebx + 0x350], eax
mov byte [ebx + 0x240], 1
mov dl, 1
mov eax, dword [0x48be20]
call fcn.00492600
mov dword [ebx + 0x358], eax
mov byte [ebx + 0x35e], 0
mov dword [ebx + 0x368], 0x14
mov dword [ebx + 0x370], 0x808080
mov byte [ebx + 0x388], 1
mov dword [ebx + 0x3a8], 0xffffffff
mov dword [ebx + 0x3ac], 0xffffffff
mov byte [ebx + 0x3d8], 0
call sub.KERNEL32.DLL_GetVersion
movzx edx, al
movzx eax, ax
shr eax, 8
movzx eax, al
cmp edx, 5
ja 0x683611
cmp edx, 5
jne 0x68360d
cmp eax, 1
jae 0x683611
xor eax, eax
jmp 0x683613
mov al, 1
mov byte [ebx + 0x35c], al
mov ecx, ebx
mov dl, 1
mov eax, dword [0x67a83c]
call fcn.0068c43c
mov dword [ebx + 0x374], eax
mov byte [ebx + 0x378], 1
mov byte [ebx + 0x379], 1
mov eax, dword [ebx + 0x70]
mov dword [ebx + 0x288], eax
mov dword [ebx + 0x37c], 0x1fffffff
mov dword [ebx + 0x3d0], 0x1fffffff
mov dword [ebx + 0x3d4], 0x1fffffff
mov dl, 1
mov eax, dword [0x67a610]
call fcn.0068df3c
mov esi, eax
mov dword [ebx + 0x3cc], esi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], 0x68808c
mov dl, 1
mov eax, dword [0x41fe8c]
call fcn.00404930
mov dword [ebx + 0x3dc], eax
mov byte [ebx + 0x2f6], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x6836b0
call fcn.00404d1c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x68e848
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x68ea6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffea0
call fcn.0068e62c
mov ecx, dword [ebp + 8]
mov dword [ecx - 0x168], eax
mov dword [ecx - 0x164], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp eax, 0x68e83c
je 0x68e8f9
lea eax, [ebp - 8]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x14c]
call fcn.00406380
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax - 0x164]
push dword [eax - 0x168]
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x170]
call fcn.00406380
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x16c]
call fcn.00406380
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
lea esi, [eax + 8]
pop ecx
mov eax, dword [esi + 4]
call dword [esi]
mov edx, dword [ebp + 8]
mov byte [edx - 0x171], al
cmp byte [ebp - 1], 0
je 0x68ea45
mov eax, dword [ebp + 8]
cmp byte [eax + 0x1c], 0
jne 0x68e965
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x17c]
call fcn.00405e2c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x178]
call fcn.00405e2c
push eax
call sub.KERNEL32.DLL_CopyFileA
mov eax, dword [ebp + 8]
cmp byte [eax + 0x10], 0
je 0x68e965
mov eax, dword [ebp + 8]
test byte [eax - 0x150], 1
je 0x68e965
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x150]
and edx, 0xfffffffe
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x17c]
call fcn.0040be78
inc dword [0x6c9ec0]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x164]
mov eax, dword [eax - 0x168]
add dword [0x6c9ec4], eax
adc dword [0x6c9ec8], edx
mov eax, dword [0x6bb354]
mov eax, dword [eax]
mov eax, dword [eax + 0x4b8]
call fcn.0058fbec
test al, al
je 0x68ea4b
mov eax, dword [0x6bbcc0]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
je 0x68ea4b
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14c]
lea eax, [ebp - 0x14]
mov edx, 0x68ea84
call fcn.00405cb4
mov edx, dword [ebp - 0x14]
mov eax, dword [0x6bbcc0]
mov eax, dword [eax]
mov eax, dword [eax + 0x378]
call fcn.004b49b0
mov eax, dword [0x6bbcc0]
mov eax, dword [eax]
mov eax, dword [eax + 0x378]
mov edx, dword [eax]
call dword [edx + 0x80]
mov eax, dword [0x6bbcc0]
mov eax, dword [eax]
call fcn.004b4fb8
mov eax, dword [0x6c9ec4]
mov edx, dword [0x6c9ec8]
add eax, dword [0x6c9ecc]
adc edx, dword [0x6c9ed0]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
fild qword [ebp - 0x1c]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [0x6bbcc0]
mov eax, dword [eax]
mov eax, dword [eax + 0x380]
call fcn.00504d1c
mov eax, dword [0x6bbab4]
mov eax, dword [eax]
call fcn.004d31ac
jmp 0x68ea4b
inc dword [0x6c9edc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68ea75
lea eax, [ebp - 0x14]
call fcn.00405980
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004061c0
ret
Function at 0x690790
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.KERNEL32.DLL_GetTickCount_1
mov ebx, eax
jmp 0x6907a9
mov eax, dword [0x6bbab4]
mov eax, dword [eax]
call fcn.004d31ac
call sub.KERNEL32.DLL_GetTickCount_1
sub eax, ebx
xor edx, edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x6907c7
cmp eax, dword [esp]
pop edx
pop eax
ja 0x69079d
pop esi
pop ebx
ret
pop edx
pop eax
jg 0x69079d
pop esi
pop ebx
ret

Function at 0x6907d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x6907d8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x690914
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405980
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00403550
mov eax, dword [ebp - 0x14]
call fcn.00405e2c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x6908f9
mov eax, esi
call fcn.00402fc4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00403550
mov eax, dword [ebp - 0x18]
call fcn.00405e2c
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x690924
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040b8d4
push dword [ebx]
push 0x690930
mov eax, dword [edi + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b8d4
push dword [ebp - 0x1c]
mov eax, ebx
mov edx, 3
call fcn.00405d30
push dword [ebx]
push 0x690930
mov eax, dword [edi + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040b8d4
push dword [ebp - 0x20]
mov eax, ebx
mov edx, 3
call fcn.00405d30
push dword [ebx]
push 0x690930
mov eax, dword [edi + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.0040b8d4
push dword [ebp - 0x24]
mov eax, ebx
mov edx, 3
call fcn.00405d30
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00402fe0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69091b
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004059a4
ret
Function at 0x694e50
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x694ede
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
mov eax, dword [eax + 0x284]
mov edx, dword [eax]
call dword [edx + 0x44]
mov esi, 0x18
mov ebx, 0x6c9ef0
mov eax, dword [ebx]
call fcn.00405e2c
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
sub eax, 3
je 0x694e9c
dec eax
je 0x694eb4
jmp 0x694eca
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
mov eax, dword [eax + 0x284]
mov edx, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x694eca
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x380]
mov eax, dword [eax + 0x284]
mov edx, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0x38]
add ebx, 4
dec esi
jne 0x694e85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x694ee5
ret
Function at 0x4036da
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 4]
mov eax, dword [ebp - 4]
jmp 0x403711
mov esp, ebp
pop ebp
ret
Function at 0x40f1ec
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40f2a0
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040f17c
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40f279
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f2ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40f2c7
test ebp, ebp
je 0x40f2c7
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40f2cf
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40f30f
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40f36b
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40f366
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40f351
test dl, dl
je 0x40f34d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40f351
add ecx, 2
add eax, 2
test dl, dl
jne 0x40f331
xor eax, eax
jmp 0x40f356
sbb eax, eax
or eax, 1
test eax, eax
je 0x40f375
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40f31e
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40f38c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040f1ec
test eax, eax
jne 0x40f3a4
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040f2ac
mov esi, eax
test esi, esi
jne 0x40f3da
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40f3f4
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x40f4ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0040f1ec
mov esi, eax
test esi, esi
jne 0x40f50a
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0040f2ac
mov dword [esp + 0x18], eax
test eax, eax
je 0x40f502
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0040f2ac
mov dword [esp + 0x34], eax
test eax, eax
je 0x40f502
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0040f2ac
mov dword [esp + 0x28], eax
test eax, eax
je 0x40f502
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0040f2ac
mov dword [esp + 0x30], eax
test eax, eax
je 0x40f502
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x40f6d1
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x40f6d1
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x40f634
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x40f6b5
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x40f657
movzx esi, ax
jmp 0x40f65c
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x40f67b
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x40f68a
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x40f6de
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x40f64c
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x40f611
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x40f707
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x40f707
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x40f6ec
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret