joyce8/EMBER2024-capa huggingface dataset:
Function at 0x885058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008851a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x88507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88506a
add dl, dl
jne 0x885089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8850dc
xor eax, eax
add dl, dl
jne 0x885096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x88517d
add dl, dl
jne 0x8850a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8850b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8850bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8850c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8850d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x885075
mov eax, 1
add dl, dl
jne 0x8850ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8850f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8850e1
sub eax, ebx
mov ebx, 1
jne 0x885128
mov ecx, 1
add dl, dl
jne 0x88510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x885119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x885105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x885075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x88513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x88514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x885136
cmp eax, 0x7d00
jae 0x88516d
cmp eax, 0x500
jb 0x885168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x885075
cmp eax, 0x7f
ja 0x885170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x885075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x88519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x885075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6a
sub eax, 0x403d10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x434389
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x434398
pop dword [ebp - 0x4c]
mov eax, 0x434398
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x64f0830f
sub dword [ebp - 0x5c], 0x169e3dc4
mov dword [ebp - 0x58], 0x1b562a3c
sub dword [ebp - 0x58], 0xe922ddf7
mov dword [ebp - 0x54], 0x3aad9e47
sub dword [ebp - 0x54], 0xee615a19
mov dword [ebp - 0x50], 0x7526b0eb
add dword [ebp - 0x50], 0x8ad94f15
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x4c6713d9
add eax, 0xb3de9c8b
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xb45e8b32
sub dword [ebp - 0x5c], 0x3fec21dc
mov dword [ebp - 0x58], 0xf52f137b
add dword [ebp - 0x58], 0x4c3d4dfa
mov dword [ebp - 0x54], 0x737f5f29
add dword [ebp - 0x54], 0xeff00d43
mov dword [ebp - 0x50], 0x7aa953fc
add dword [ebp - 0x50], 0x8556ac04
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x3ac3ca95
add eax, 0xc581e5eb
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x52b3f
push 0
call eax
mov ecx, 0xa66b917c
sub ecx, 0xa66b33d7
mov edi, eax
mov edx, 0xd5a8fdd5
sub edx, 0xd5619dd5
add edx, dword [ebp - 0x4c]
mov esi, 0x845904e2
add esi, 0x30872279
add dword [ebp - 0x10], eax
mov ebx, dword [edx]
xor dword [ebp - 0x40], 0x629c1e4
sub ebx, esi
sub dword [ebp - 0x38], 0xbd6e2bc
mov dword [edi], ebx
sub dword [ebp - 0x48], 0x17c15517
add edi, 4
add edx, 4
loop 0x4344b5
add eax, 0x16967
xor ebx, ebx
add ebx, eax
add eax, 0x9f36627e
sub eax, 0x9f366279
mov ecx, 0x99d22847
add ecx, 0x666dd7b9
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412eaa
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x1e
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x86
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xa2
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xcd
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc3
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xea
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa5
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2f
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe6
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe5
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x54
add esp, 0x40
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd9
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xa0
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x6d
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x5e
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d20
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451bc9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451bda
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405907
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b072
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b083
pop esi
ret
push ebx
push edi
push esi
call fcn.0049af59
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fda
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b0ab
push ebx
push esi
push edi
call fcn.004056fa
add esp, 0xc
push 0
call fcn.00406244
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x499611
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x510768]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x49965c
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00499ad3
test al, al
jne 0x499656
sub edx, 2
cmp edx, edi
jne 0x49963c
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x49967e
lea eax, [edi + 2]
cmp edx, eax
je 0x49967e
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0049920a
add esp, 0x10
jmp 0x499778
push esi
lea ecx, [ebp - 0x255]
call fcn.00499ad3
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4996c1
push dword [ebp - 0x25c]
jmp 0x49966e
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4996fe
cmp word [ebp - 0x226], 0
je 0x49971f
cmp word [ebp - 0x226], ax
jne 0x4996fe
cmp word [ebp - 0x224], 0
je 0x49971f
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0049920a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x49976b
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4996d8
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x499753
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x499778
push 0x498bf2
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00405542
add esp, 0x10
jmp 0x499748
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403044
leave
ret

Function at 0x408bea
Capabilities:
Encode data using xor

Disassembly:
call fcn.00408b09
sub ecx, ecx
sub cx, 0xff7e
call 0x408bea
rcr byte [esi - 0x7f], 0x76
push cs
cmp byte [edi + 0x1c], dh
and al, byte [ebx - 0xb1d0312]
rcl dword [edi + eax*2 - 0x55], cl
out 0xc7, eax
retf 0x96de

Function at 0x40b2d0
Capabilities:
Check for vm using instruction vpcext
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
test byte [ebx - 0x4b67f78b], 0x2c
test al, al
test byte [esi - 0x75000000], bh
dec esi
push ebx
xor edi, dword [ebx + 0x1b28353]
push edi
mov dword [ebp - 4], eax
mov dword [ebp + 8], eax
invalid
Function at 0x41b73d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x41b74c
pop dword [ebp - 0x10]
mov eax, 0x41b74c
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x51464
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x4c65
xor esi, esi
add esi, eax
mov edx, 0x488e00
add edx, dword [ebp - 0x10]
mov ebx, 0x875ae730
add ebx, 0x778dd2d7
add dword [ebp - 8], 0x5e05c5d
mov edi, dword [edx]
add dword [ebp - 4], 0xadc8b04b
sub edi, ebx
mov dword [ebp - 8], 0xed27b1ff
mov dword [esi], edi
xor dword [ebp - 8], eax
add esi, 0xe60ad60
add esi, 0xf19f52a4
add edx, 4
loop 0x41b797
add eax, 0x4a0910f3
sub eax, 0x4a07ec8c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x402860
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x4495f0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x45f5e0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x34], 0
call fcn.00401620
push eax
mov byte [esp + 0x38], 1
call fcn.00401680
call fcn.0041472e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4028bc
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x34], 2
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x18]
push 0x45146c
push edx
call fcn.00403290
mov dword [esp + 0x28], 0
add esp, 8
mov byte [esp + 0x38], 3
mov edi, dword [esp + 0x18]
mov ebx, esp
mov dword [esp + 0x1c], esp
push edi
call fcn.00401160
lea eax, [esp + 0x24]
push eax
call fcn.004017d0
mov esi, dword [eax]
test esi, esi
je 0x4029c9
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
mov dword [esp + 0x20], esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], 0
call edx
test eax, eax
jge 0x40294a
push 0x451230
push esi
push eax
call fcn.00446c50
mov byte [esp + 0x34], 2
cmp word [esp + 0x18], 0
push esi
je 0x4029d3
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call ecx
lea eax, [edi - 0x10]
mov byte [esp + 0x34], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402980
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
call fcn.00401650
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4029b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
push 0x80004003
call fcn.00446c30
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
call edx
lea eax, [edi - 0x10]
mov byte [esp + 0x34], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4029fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
call fcn.00401650
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402a2c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x403810
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403829
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403864
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403860
lea ebx, [ebx]
cmp esi, eax
jae 0x403864
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403850
cmp esi, eax
jb 0x40386a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x409ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4494c0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x45f5e0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x24]
call fcn.00401620
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x10], eax
push 0x452c10
lea ebx, [esp + 0x14]
mov byte [esp + 0x3c], 1
call fcn.00401f70
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x24]
push 0x452c28
push ecx
call fcn.00403090
push 0x4513dc
push eax
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0x50], 2
call fcn.00402fb0
add esi, 8
push esi
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x5c], 3
call fcn.00402ef0
push 0x4513d8
push eax
lea ecx, [esp + 0x40]
push ecx
mov byte [esp + 0x68], 4
call fcn.00402fb0
add esp, 0x30
mov byte [esp + 0x38], 5
mov eax, dword [eax]
push eax
call fcn.00401f70
mov byte [esp + 0x38], 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409fc4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x38], 3
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409fe9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x38], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a00e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x38], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a033
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x10]
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
mov dword [eax], esi
test esi, esi
je 0x40a04e
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0x28]
call fcn.00401990
lea edi, [esp + 0x24]
call fcn.00401af0
mov byte [esp + 0x38], 0
test esi, esi
je 0x40a09d
lea edx, [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40a09d
mov eax, dword [esi]
test eax, eax
je 0x40a084
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x40a094
push eax
call fcn.00413827
add esp, 4
push esi
call fcn.00413827
add esp, 4
lea ecx, [esp + 0x24]
call fcn.00401650
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x40c3d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4494c0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x45f5e0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x24]
call fcn.00401620
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x10], eax
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x24]
push 0x452fe0
push ecx
mov byte [esp + 0x44], 1
call fcn.00403090
push 0x4513dc
push eax
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0x50], 2
call fcn.00402fb0
add esi, 8
push esi
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x5c], 3
call fcn.00402ef0
push 0x4513d8
push eax
lea ecx, [esp + 0x40]
push ecx
mov byte [esp + 0x68], 4
call fcn.00402fb0
add esp, 0x30
mov byte [esp + 0x38], 5
mov eax, dword [eax]
push eax
lea ebx, [esp + 0x14]
call fcn.00401f70
mov byte [esp + 0x38], 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c49a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x38], 3
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c4bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x38], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c4e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x38], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c509
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x10]
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
mov dword [eax], esi
test esi, esi
je 0x40c524
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0x28]
call fcn.00401990
lea edi, [esp + 0x24]
call fcn.00401af0
mov byte [esp + 0x38], 0
test esi, esi
je 0x40c573
lea edx, [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40c573
mov eax, dword [esi]
test eax, eax
je 0x40c55a
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x40c56a
push eax
call fcn.00413827
add esp, 4
push esi
call fcn.00413827
add esp, 4
lea ecx, [esp + 0x24]
call fcn.00401650
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x40d690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4494c0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x45f5e0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x24]
call fcn.00401620
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x10], eax
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x24]
push 0x453260
push ecx
mov byte [esp + 0x44], 1
call fcn.00403090
push 0x4513dc
push eax
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0x50], 2
call fcn.00402fb0
add esi, 8
push esi
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x5c], 3
call fcn.00402ef0
push 0x4513d8
push eax
lea ecx, [esp + 0x40]
push ecx
mov byte [esp + 0x68], 4
call fcn.00402fb0
add esp, 0x30
mov byte [esp + 0x38], 5
mov eax, dword [eax]
push eax
lea ebx, [esp + 0x14]
call fcn.00401f70
mov byte [esp + 0x38], 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d75a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x38], 3
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d77f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x38], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d7a4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x38], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d7c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x10]
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
mov dword [eax], esi
test esi, esi
je 0x40d7e4
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0x28]
call fcn.00401990
lea edi, [esp + 0x24]
call fcn.00401af0
mov byte [esp + 0x38], 0
test esi, esi
je 0x40d833
lea edx, [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x40d833
mov eax, dword [esi]
test eax, eax
je 0x40d81a
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x40d82a
push eax
call fcn.00413827
add esp, 4
push esi
call fcn.00413827
add esp, 4
lea ecx, [esp + 0x24]
call fcn.00401650
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret