joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404d60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x404d84
push eax
push esi
push str._GetDirORFile____s__INVALID_FILE_ATTRIBUTES_dwFileAttr__0x_08x
call fcn.00402650
add esp, 0xc
xor eax, eax
pop esi
ret
test al, 0x10
je 0x404d8f
mov eax, 1
pop esi
ret
and eax, 0x71a7
pop esi
neg eax
sbb eax, eax
and eax, 2
ret

Function at 0x405980
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x41380b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x514
push esi
push edi
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], 0
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x11]
mov byte [esp + 0x10], al
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
push ecx
push edx
call fcn.00402b50
add esp, 8
lea eax, [esp + 8]
push str.MoniManager.ini
lea ecx, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x530], 0
call sub.MFC42.DLL_operator
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x118]
push edx
push 0x401
push eax
push 0
push str.DownloadTempFolder
push str.DownUpload
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, 0x41bc78
lea eax, [esp + 0x118]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x405a5b
test cl, cl
je 0x405a57
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x405a5b
add eax, 2
add esi, 2
test cl, cl
jne 0x405a37
xor eax, eax
jmp 0x405a60
sbb eax, eax
sbb eax, 0xffffffff
pop edi
pop esi
test eax, eax
jne 0x405a7a
mov eax, dword [esp]
mov ecx, dword [esp + 0x524]
push eax
push str._sdownload
push ecx
jmp 0x405a8f
mov eax, dword [esp + 0x524]
lea edx, [esp + 0x110]
push edx
push 0x4193ac
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 4]
call fcn.00412bbc
lea ecx, [esp]
mov dword [esp + 0x51c], 0xffffffff
call fcn.00412bbc
mov ecx, dword [esp + 0x514]
mov dword fs:[0], ecx
add esp, 0x520
ret

Function at 0x407760
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x413a44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ecx, [esi + 8]
call fcn.0040a7a0
lea edi, [esi + 0x60]
mov dword [esp + 0x18], 0
mov ecx, edi
call fcn.004098b0
mov bl, 1
push 0xa
lea ecx, [esi + 0xac]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CPtrList::CPtrList
lea ecx, [esi + 0xcc]
mov byte [esp + 0x18], 2
call fcn.0040a800
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xf0], edi
mov dword [esi], 0x4158e8
mov byte [esi + 5], bl
mov byte [esi + 6], bl
mov byte [esi + 4], bl
mov dword [esi + 0x30], 0x407e70
mov dword [esi + 0x34], 0x407ea0
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4081d0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413b20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
cmp byte [esi + 0xc8], 0xff
je 0x408214
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x408235
mov ecx, esi
call fcn.00407ef0
mov ecx, dword [esi + 0x50]
mov edx, dword [eax + 0x14]
cmp ecx, edx
je 0x408235
push 0xffffffffffffff9a
mov ecx, esi
call fcn.00407950
mov ecx, esi
call fcn.00407ef0
cmp word [eax + 0xe], 8
jne 0x40824c
lea edx, [esi + 0x10]
push edx
call fcn.0040c840
mov edi, dword [ebp + 8]
mov bl, 1
test edi, edi
je 0x4082bf
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call sub.MFC42.DLL_CTime::GetTickCount
mov eax, dword [eax]
lea ecx, [ebp + 8]
push ecx
mov ecx, esi
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x11c], 0
call fcn.00407ef0
mov ecx, eax
call fcn.0040c080
mov edx, dword [eax]
lea eax, [ebp - 0x12c]
push eax
push edi
mov dword [ebp - 0x128], edx
call sub.MFC42.DLL_CFile::SetStatus
mov ecx, esi
call fcn.00407ef0
mov ecx, dword [eax + 0x2c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xcc]
call fcn.0040aed0
lea ecx, [esi + 0x54]
mov byte [esi + 0xc8], 0
call fcn.0040bbf0
mov ecx, dword [ebp - 0xc]
pop edi
mov al, bl
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x408310
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x11c
push ebx
push esi
mov esi, ecx
push 1
call fcn.00407920
test al, al
je 0x408332
pop esi
xor al, al
pop ebx
add esp, 0x11c
ret 0xc
mov al, byte [esi + 0xc8]
test al, al
je 0x408349
pop esi
xor al, al
pop ebx
add esp, 0x11c
ret 0xc
lea ebx, [esi + 0x60]
mov ecx, ebx
call fcn.00409b30
cmp eax, 0xffffffff
jne 0x408365
pop esi
xor al, al
pop ebx
add esp, 0x11c
ret 0xc
mov ecx, esi
call fcn.00407a90
cmp eax, 0xffff
jne 0x408380
pop esi
xor al, al
pop ebx
add esp, 0x11c
ret 0xc
push ebp
mov ebp, dword [esp + 0x134]
push edi
mov edi, dword [esp + 0x130]
test ebp, ebp
mov byte [esp + 0x13], 1
je 0x4083cf
lea eax, [esp + 0x14]
push eax
push ebp
call sub.MFC42.DLL_CFile::GetStatus
test eax, eax
je 0x4083ca
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call fcn.0040c390
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov dword [edi + 0x2c], eax
jne 0x4083cf
mov dword [edi + 0x2c], 0x20
mov byte [esp + 0x13], 0
lea ecx, [esi + 8]
call fcn.0040a7f0
push edi
lea ecx, [esi + 0xcc]
call fcn.0040afc0
mov ecx, esi
call fcn.00407ef0
mov edi, eax
mov al, byte [esi + 4]
add edi, 0x34
test al, al
je 0x408401
push 0x2f
push 0x5c
mov ecx, edi
call sub.MFC42.DLL_CString::Replace_1
mov al, byte [esi + 5]
test al, al
je 0x40840f
mov ecx, edi
call sub.MFC42.DLL_CString::CharToOemA
mov edx, dword [edi]
mov eax, dword [edx - 8]
test eax, eax
jne 0x40842e
mov ecx, esi
call fcn.00407a90
push eax
push str.file_i
push edi
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov ecx, ebx
call fcn.00409b30
mov ebp, dword [esp + 0x134]
cmp eax, 1
sete al
push eax
push ebp
mov ecx, esi
call fcn.00407ef0
mov ecx, eax
call fcn.0040c630
test al, al
jne 0x40845f
push 0xffffffffffffff95
mov ecx, esi
call fcn.00407950
push ebx
mov ecx, esi
call fcn.00407ef0
mov ecx, eax
call fcn.0040c470
lea edi, [esi + 0x54]
xor ebx, ebx
mov ecx, edi
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x14], ebx
call fcn.0040bbe0
mov ecx, edi
mov dword [esi + 0x20], eax
call fcn.0040bc80
mov ecx, esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x24], ebx
call fcn.00407ef0
mov ecx, dword [eax + 0x2c]
push ecx
mov ecx, esi
call fcn.004096e0
test al, al
je 0x4084c1
mov ecx, esi
call fcn.00407ef0
cmp word [eax + 0xe], bx
je 0x4084c1
mov ecx, esi
call fcn.00407ef0
mov word [eax + 0xe], bx
mov ecx, esi
call fcn.00407ef0
cmp word [eax + 0xe], 8
jne 0x408503
mov al, byte [esi + 6]
test al, al
je 0x4084de
lea eax, [esi + 0xac]
jmp 0x4084e0
xor eax, eax
push 0x38
push str.1.1.3
push ebx
push 8
push 0xfffffffffffffff1
push 8
lea edx, [esi + 0x10]
push ebp
push edx
mov dword [esi + 0x38], eax
call fcn.0040d1a0
push eax
mov ecx, esi
call fcn.00407ed0
mov al, byte [esp + 0x13]
pop edi
mov byte [esi + 0xc8], 1
pop ebp
pop esi
pop ebx
add esp, 0x11c
ret 0xc
Function at 0x408850
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x413c08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_1
push 0x41a588
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::TrimRight
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 8]
push ecx
push edx
call fcn.00408520
mov ecx, dword [esp + 0x24]
mov eax, dword [eax]
push ecx
push eax
mov byte [esp + 0x24], 1
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 0x10
or esi, 0xffffffff
test eax, eax
je 0x4088d2
mov edx, dword [esp + 0x1c]
push edx
call fcn.00408970
add esp, 4
cmp eax, esi
sete al
test al, al
jne 0x4088d2
xor bl, bl
jmp 0x4088d4
mov bl, 1
lea ecx, [esp + 8]
mov byte [esp + 0x14], 0
call fcn.00412bbc
test bl, bl
jne 0x40894d
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00408520
mov eax, dword [eax]
mov byte [esp + 0x1c], 2
push eax
call fcn.00408850
add esp, 0xc
lea ecx, [esp + 8]
test al, al
sete bl
mov byte [esp + 0x14], 0
call fcn.00412bbc
test bl, bl
jne 0x40892d
mov edx, dword [esp + 0x1c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40894d
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call fcn.00412bbc
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call fcn.00412bbc
mov ecx, dword [esp + 0xc]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x408970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x413c28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
lea ecx, [esp + 4]
call sub.MFC42.DLL_CFileFind::CFileFind
mov esi, dword [esp + 0x30]
push 0
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x4089f6
push esi
call fcn.00408a40
add esp, 4
mov dword [esp + 0x28], 0xffffffff
test al, al
lea ecx, [esp + 4]
je 0x4089df
call fcn.00412ce8
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
call fcn.00412ce8
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
lea ecx, [esp + 4]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov eax, dword [esp + 4]
push 0x10
lea ecx, [esp + 8]
call dword [eax + 0x40]
neg eax
sbb eax, eax
lea ecx, [esp + 4]
and al, 0xfe
mov dword [esp + 0x28], 0xffffffff
inc eax
mov esi, eax
call fcn.00412ce8
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x408af0
Capabilities:
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x413c78
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebp
mov ebp, dword [esp + 0x80]
push esi
push edi
test ebp, ebp
mov esi, ecx
jne 0x408b2e
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0xc
lea ecx, [esp + 0x28]
call fcn.0040bd30
mov edi, dword [esp + 0x80]
lea eax, [esp + 0x28]
push edi
push eax
mov ecx, esi
mov dword [esp + 0x80], 0
call fcn.00407aa0
mov ecx, dword [esp + 0x84]
push ecx
lea ecx, [esp + 0x8c]
call sub.MFC42.DLL_CString::CString_1
push 0x41a588
lea ecx, [esp + 0x8c]
mov byte [esp + 0x7c], 1
call sub.MFC42.DLL_CString::TrimRight
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x84]
push edx
push eax
call fcn.00408690
add esp, 8
push eax
lea ecx, [esp + 0x84]
push 0x41a588
push ecx
mov byte [esp + 0x84], 2
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0x8c]
mov byte [esp + 0x7c], 3
call fcn.00412c6a
lea ecx, [esp + 0x80]
mov byte [esp + 0x78], 2
call fcn.00412bbc
lea ecx, [esp + 0x84]
mov byte [esp + 0x78], 1
call fcn.00412bbc
push edi
mov ecx, esi
call fcn.00408aa0
test al, al
je 0x408c18
mov edx, dword [esp + 0x88]
push edx
call fcn.00408850
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x8c]
add esp, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x408d2d
push edi
mov ecx, esi
call fcn.00407d10
test al, al
jne 0x408c5b
lea ecx, [esp + 0x88]
mov byte [esp + 0x78], al
call fcn.00412bbc
lea ecx, [esp + 0x28]
mov dword [esp + 0x78], 0xffffffff
call fcn.0040bdb0
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0xc
mov edx, dword [esp + 0x88]
lea eax, [esp + 0x80]
push edx
push eax
call fcn.00408520
mov eax, dword [eax]
mov byte [esp + 0x80], 4
push eax
call fcn.00408850
add esp, 0xc
lea ecx, [esp + 0x80]
mov byte [esp + 0x78], 1
call fcn.00412bbc
mov ecx, dword [esp + 0x88]
push 0x1021
push ecx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFile::CFile
push 0
push ebp
lea ecx, [esp + 0x14]
mov byte [esp + 0x80], 5
call fcn.0040bb90
mov byte [esp + 0x78], 6
lea ecx, [esp + 0xc]
call fcn.0040bbe0
push eax
lea ecx, [esp + 0x10]
call fcn.0040bc80
push eax
mov ecx, esi
call fcn.00407f00
mov edi, eax
test edi, edi
je 0x408cf8
push edi
lea ecx, [esp + 0x10]
call fcn.0040bc80
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFile::Write
lea ecx, [esp + 0xc]
call fcn.0040bbe0
cmp edi, eax
je 0x408cc3
lea edx, [esp + 0x18]
mov ecx, esi
push edx
call fcn.00408160
lea ecx, [esp + 0xc]
mov byte [esp + 0x78], 5
call fcn.0040bbc0
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], 1
call fcn.00412c2e
lea ecx, [esp + 0x88]
mov byte [esp + 0x78], 0
call fcn.00412bbc
lea ecx, [esp + 0x28]
mov dword [esp + 0x78], 0xffffffff
call fcn.0040bdb0
mov ecx, dword [esp + 0x70]
pop edi
pop esi
mov al, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x70
ret 0xc
Function at 0x409320
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
push ebx
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00409350
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
lea ecx, [esp + 8]
sete bl
call fcn.00412bbc
mov al, bl
pop ebx
ret

Function at 0x409fb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x413eee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebx
xor ebx, ebx
push esi
test eax, eax
mov esi, ecx
mov dword [esp + 8], ebx
jne 0x409ff7
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0xc]
lea edx, [esp + 0x18]
push edx
call dword [eax + 0x20]
mov ebx, 1
mov dword [esp + 8], ebx
mov eax, dword [eax]
mov dword [esp + 0x28], ebx
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
test bl, 1
mov dword [esp + 0x28], 3
je 0x40a01e
and ebx, 0xfffffffe
lea ecx, [esp + 0x18]
mov dword [esp + 8], ebx
call fcn.00412bbc
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.00408520
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
mov byte [esp + 0x38], 4
call fcn.00408640
add esp, 0x10
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 5
call sub.MFC42.DLL_CString::CString
mov al, byte [esp + 0x34]
mov byte [esp + 0x28], 6
test al, al
je 0x40a06f
push 0x41a5c0
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CString::operator_1
jmp 0x40a085
mov ecx, dword [esi + 0x48]
lea edx, [esp + 0x38]
push ecx
push str._.3d
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
call sub.MFC42.DLL_operator_1
push 0x419398
push eax
lea eax, [esp + 0x3c]
mov byte [esp + 0x30], 7
push eax
call sub.MFC42.DLL_operator
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x38]
push ecx
push eax
push esi
mov byte [esp + 0x34], 8
call sub.MFC42.DLL_operator_1
or ebx, 2
mov dword [esp + 8], ebx
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 7
call fcn.00412bbc
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 6
call fcn.00412bbc
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 5
call fcn.00412bbc
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.00412bbc
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 3
call fcn.00412bbc
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.00412bbc
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x40a3f0
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x413f68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [ecx + 0xc]
add ecx, 0xc
lea edx, [esp + 4]
push ebx
push edx
call dword [eax + 0x20]
mov eax, dword [eax]
mov dword [esp + 0x24], 0
push eax
lea eax, [esp + 8]
push eax
call fcn.00409350
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
lea ecx, [esp + 4]
sete bl
call fcn.00412bbc
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.00412bbc
test bl, bl
pop ebx
je 0x40a481
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x40a800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x413fb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 0x1c]
call sub.MFC42.DLL_CString::CString
lea edi, [esi + 0x38]
mov dword [esp + 0x14], 0
mov ecx, edi
call sub.MFC42.DLL_CPtrArray::CPtrArray
mov dword [edi], 0x415914
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 1
call fcn.0040bb50
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x415910
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0x8000
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40afc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4140b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov ebx, ecx
push 0x48
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 8], esi
test esi, esi
mov dword [esp + 0x14], 0
je 0x40b0b2
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov cx, word [edi + 8]
mov word [esi + 8], cx
mov dx, word [edi + 0xa]
mov word [esi + 0xa], dx
mov ax, word [edi + 0xc]
mov word [esi + 0xc], ax
mov cx, word [edi + 0xe]
mov word [esi + 0xe], cx
mov dx, word [edi + 0x10]
mov word [esi + 0x10], dx
mov ax, word [edi + 0x12]
mov word [esi + 0x12], ax
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0x18]
mov dword [esi + 0x18], edx
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov cx, word [edi + 0x20]
mov word [esi + 0x20], cx
mov dx, word [edi + 0x22]
mov word [esi + 0x22], dx
mov ax, word [edi + 0x24]
mov word [esi + 0x24], ax
mov cx, word [edi + 0x26]
mov word [esi + 0x26], cx
mov dx, word [edi + 0x28]
mov word [esi + 0x28], dx
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ecx, dword [edi + 0x30]
lea edx, [edi + 0x34]
mov dword [esi + 0x30], ecx
push edx
lea ecx, [esi + 0x34]
call sub.MFC42.DLL_CString::CString_2
lea eax, [edi + 0x38]
lea ecx, [esi + 0x38]
push eax
mov byte [esp + 0x1c], 1
call fcn.0040bc90
add edi, 0x44
lea ecx, [esi + 0x44]
push edi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString_2
mov dword [esi], 0x415928
pop edi
jmp 0x40b0b4
xor esi, esi
lea ecx, [ebx + 0x38]
mov dword [ebx + 0x20], esi
push esi
mov dword [esp + 0x18], 0xffffffff
mov edx, dword [ecx + 8]
push edx
call sub.MFC42.DLL_CPtrArray::SetAtGrow
mov ecx, ebx
call fcn.0040b130
mov ecx, dword [ebx + 0x24]
push 2
add ecx, 0xc
push 0
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [ebx + 0x24]
call fcn.00409b30
test eax, eax
setne cl
mov byte [ebx + 0x58], cl
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x40c470
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414228
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, ecx
xor eax, eax
xor ecx, ecx
mov ax, word [ebx + 0x22]
mov cx, word [ebx + 0x20]
push ebp
push esi
push edi
lea ebp, [eax + ecx + 0x1e]
push 0
push ebp
lea ecx, [esp + 0x1c]
call fcn.0040bb90
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0
call fcn.0040bc80
mov edx, dword [0x41a600]
lea ecx, [esp + 0x14]
mov dword [eax], edx
call fcn.0040bc80
mov cx, word [ebx + 0xa]
mov word [eax + 4], cx
lea ecx, [esp + 0x14]
call fcn.0040bc80
mov dx, word [ebx + 0xc]
lea ecx, [esp + 0x14]
mov word [eax + 6], dx
call fcn.0040bc80
mov cx, word [ebx + 0xe]
mov word [eax + 8], cx
lea ecx, [esp + 0x14]
call fcn.0040bc80
mov dx, word [ebx + 0x10]
lea ecx, [esp + 0x14]
mov word [eax + 0xa], dx
call fcn.0040bc80
mov cx, word [ebx + 0x12]
mov word [eax + 0xc], cx
lea ecx, [esp + 0x14]
call fcn.0040bc80
mov edx, dword [ebx + 0x14]
lea ecx, [esp + 0x14]
mov dword [eax + 0xe], edx
call fcn.0040bc80
mov ecx, dword [ebx + 0x18]
mov dword [eax + 0x12], ecx
lea ecx, [esp + 0x14]
call fcn.0040bc80
mov edx, dword [ebx + 0x1c]
lea ecx, [esp + 0x14]
mov dword [eax + 0x16], edx
call fcn.0040bc80
mov cx, word [ebx + 0x20]
mov word [eax + 0x1a], cx
lea ecx, [esp + 0x14]
call fcn.0040bc80
mov dx, word [ebx + 0x22]
xor edi, edi
mov word [eax + 0x1c], dx
mov esi, dword [ebx + 0x34]
mov di, word [ebx + 0x20]
lea ecx, [esp + 0x14]
call fcn.0040bc80
mov dword [esp + 0x10], edi
mov edi, eax
mov eax, dword [esp + 0x10]
add edi, 0x1e
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
lea ecx, [ebx + 0x38]
mov di, word [ebx + 0x22]
call fcn.0040bc80
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.0040bc80
xor ecx, ecx
mov edx, edi
mov cx, word [ebx + 0x20]
push 1
push ebp
lea edi, [eax + ecx + 0x1e]
mov ecx, edx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
call fcn.0040bc80
mov esi, dword [esp + 0x38]
push eax
mov ecx, esi
call fcn.0040a590
lea ecx, [ebx + 0x38]
call fcn.0040bbf0
mov ecx, esi
mov word [ebx + 0x22], 0
call fcn.00409d70
mov ecx, esi
mov word [ebx + 0x26], ax
call fcn.0040a760
sub eax, ebp
lea ecx, [esp + 0x14]
mov dword [ebx + 0x30], eax
mov dword [esp + 0x28], 0xffffffff
call fcn.0040bbc0
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x40d020
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x40d02f
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x41a674]
test eax, eax
je 0x40d03d
call fcn.0040cfc0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
cmp edx, 8
push ebx
not eax
jb 0x40d13f
push edi
mov edi, edx
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x41bc7c]
sub edx, 8
xor eax, ebx
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x41bc7c]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x41bc7c]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x41bc7c]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x41bc7c]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x41bc7c]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x41bc7c]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x41bc7c]
xor eax, ecx
inc esi
dec edi
jne 0x40d057
pop edi
test edx, edx
je 0x40d161
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x41bc7c]
xor eax, ecx
inc esi
dec edx
jne 0x40d143
pop ebx
pop esi
not eax
ret 0xc