joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe7b888
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff0000
je 0xe7b964
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
jmp 0xe7b906
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x20]
jae 0xe7b95b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00e7b828
add esp, 8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jne 0xe7b959
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x30]
mov cx, word [eax + edx*2]
mov word [ebp - 4], cx
movzx edx, word [ebp - 4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
jmp 0xe7b982
jmp 0xe7b8fd
mov dword [ebp - 0x10], 0
jmp 0xe7b97f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
sub eax, dword [edx + 0x10]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0xe8ff39
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xf3c704]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00e796c2
and dword [ebp - 0x14], 0
cmp dword [0xf44094], 0
mov dword [ebp - 0x18], eax
jne 0xe8ffec
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0xe90094
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0xe90094
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0xef1fe8
push ebx
mov dword [0xf44094], eax
call edi
push eax
call esi
push 0xef1fd4
push ebx
mov dword [0xf44098], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0xf4409c], eax
call edi
push eax
call esi
mov dword [0xf440a4], eax
test eax, eax
je 0xe8ffec
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0xf440a0], eax
mov eax, dword [0xf440a0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0xe90045
cmp dword [0xf440a4], ecx
je 0xe90045
push eax
call esi
push dword [0xf440a4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0xe90045
test ebx, ebx
je 0xe90045
call edi
test eax, eax
je 0xe9003c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0xe9003c
test byte [ebp - 8], 1
jne 0xe90045
or dword [ebp + 0x10], 0x200000
jmp 0xe90078
mov eax, dword [0xf44098]
cmp eax, dword [ebp - 0x18]
je 0xe90078
push eax
call esi
test eax, eax
je 0xe90078
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0xe90078
mov eax, dword [0xf4409c]
cmp eax, dword [ebp - 0x18]
je 0xe90078
push eax
call esi
test eax, eax
je 0xe90078
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0xf44094]
call esi
test eax, eax
je 0xe90094
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0xe90096
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00e6d43c
leave
ret
Function at 0x401350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.004013f0
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x401388
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push 7
push dword [ebp - 4]
call sub.kernel32.dll_SetConsoleMode
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
mov eax, dword [ebp - 8]
leave
ret 8

Function at 0x4013c0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
shl eax, 0x10
mov ax, cx
push eax
push dword [ebp - 4]
call sub.kernel32.dll_SetConsoleCursorPosition
leave
ret 8
Function at 0x5ae4b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7b000]
push edi
jmp 0x5ae4ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5ae4d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5ae4c0
mov eax, 1
add ebx, ebx
jne 0x5ae4e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5ae4f4
jne 0x5ae513
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5ae513
dec eax
add ebx, ebx
jne 0x5ae500
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5ae4d8
add ebx, ebx
jne 0x5ae50f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5ae565
xor ecx, ecx
sub eax, 3
jb 0x5ae52b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5ae59a
sar eax, 1
mov ebp, eax
jmp 0x5ae536
add ebx, ebx
jne 0x5ae536
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5ae504
inc ecx
add ebx, ebx
jne 0x5ae544
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5ae504
add ebx, ebx
jne 0x5ae551
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5ae546
jne 0x5ae562
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5ae546
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5ae584
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5ae576
jmp 0x5ae4c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5ae584
add edi, ecx
jmp 0x5ae4c6
pop esi
mov edi, esi
mov ecx, 0x3ede
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5ae5a2
cmp byte [edi], 0x11
jne 0x5ae5a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5ae5a7
lea edi, [esi + 0x1a0000]
mov eax, dword [edi]
or eax, eax
je 0x5ae61f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b3418]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b3594]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5ae5d4
mov ecx, edi
jns 0x5ae603
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b3598]
or eax, eax
je 0x5ae619
mov dword [ebx], eax
add ebx, 4
jmp 0x5ae5f1
call dword [esi + 0x1b35a8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5ae650
cmp al, 0xef
ja 0x5ae643
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5ae625
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5ae632
mov ebp, dword [esi + 0x1b359c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5ae684
sub esp, 0xffffff80
jmp 0x4276e7
Function at 0x402bc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x402dc0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
push 0
call esi
mov dword [0x5178f8], eax
test eax, eax
je 0x402d48
push 0
push 0
push 0
call esi
mov dword [0x5178fc], eax
test eax, eax
je 0x402d48
push 0
push 0
push 0
call esi
mov dword [0x517900], eax
test eax, eax
je 0x402d48
push 0
push 0
push 0
call esi
mov dword [0x517908], eax
test eax, eax
je 0x402d48
push 0
push 0
push 0
call esi
mov dword [0x51790c], eax
test eax, eax
je 0x402d48
push 0
push 0
push 0
call esi
mov dword [0x517904], eax
test eax, eax
je 0x402d48
call fcn.0041b010
test eax, eax
je 0x402dc0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [0x5178d8], eax
mov eax, dword [ebp + 0x14]
push 0
mov dword [0x5178e0], eax
mov ax, word [ebp + 0x18]
push 0
mov word [0x5178e4], ax
mov ax, word [ebp + 0x1c]
push 1
push 0
mov dword [0x5178d4], edi
mov dword [0x5178dc], esi
mov word [0x5178e6], ax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x5178e8], eax
test eax, eax
je 0x402d48
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x403150
push 0
push 0
call edi
mov dword [0x5178ec], eax
test eax, eax
je 0x402d48
test esi, esi
je 0x402d3d
call fcn.00401e70
cmp eax, 1
jne 0x402d3d
cmp dword [0x517914], eax
je 0x402d3d
cmp dword [0x5178dc], 0
je 0x402d48
call fcn.0041b010
mov esi, eax
test esi, esi
je 0x402d48
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x5178f0], eax
test eax, eax
je 0x402d48
push 0
push 0
push 0
push 0x403040
push 0
push 0
call edi
mov dword [0x5178f4], eax
test eax, eax
je 0x402d48
push dword [0x5178e0]
push eax
call esi
mov dword [0x517914], 1
pop edi
mov eax, 1
pop esi
pop ebp
ret 0x18
mov dword [0x5178d4], 0
mov dword [0x5178dc], 0
mov dword [0x5178e8], 0
mov dword [0x5178ec], 0
mov dword [0x5178f0], 0
mov dword [0x5178f4], 0
mov dword [0x5178f8], 0
mov dword [0x5178fc], 0
mov dword [0x517900], 0
mov dword [0x517908], 0
mov dword [0x517904], 0
mov dword [0x51790c], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x18

Function at 0x402f90
Capabilities:
Check mutex on windows

Disassembly:
cmp dword [0x517918], 1
je 0x402fba
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x517910], eax
test eax, eax
je 0x402fdc
mov dword [0x517918], 1
jmp 0x402fbf
mov eax, dword [0x517910]
test eax, eax
je 0x402fdc
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x402fdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp fcn.00411640
ret
Function at 0x405a40
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x4c]
push edi
push 0
push 0
push 0
push eax
mov dword [ebp - 0x4c], 0xe6178a1b
mov dword [ebp - 0x48], 0x9a43ef26
mov dword [ebp - 0x44], 0x7dc961fa
mov dword [ebp - 0x40], 0xff95de60
mov dword [ebp - 0x3c], 0x3b258b37
mov dword [ebp - 0x38], 0xad34d28b
mov dword [ebp - 0x34], 0x1bf1006f
mov dword [ebp - 0x30], 0x5b9f25f
mov dword [ebp - 0x2c], 0x7ec2da2b
mov dword [ebp - 0x28], 0xe89d1842
mov dword [ebp - 0x24], 0x8a878e8d
mov dword [ebp - 0x20], 0xdf9b93e5
mov dword [ebp - 0x1c], 0x1a2efe5c
mov dword [ebp - 0x18], 0xb5fc94d9
mov dword [ebp - 0x14], 0x20804bee
mov dword [ebp - 0x10], 0x3f8d90e8
mov dword [ebp - 0xc], 0xc3245ad7
mov byte [ebp - 8], 0xd2
call fcn.0041fef0
mov edi, dword [ebp + 8]
test edi, edi
je 0x405b8c
test esi, esi
je 0x405b8c
mov eax, dword [ebp + 0xc]
xor edx, edx
test eax, eax
jle 0x405b73
lea ecx, [eax - 1]
add edi, 2
mov eax, 0xaaaaaaab
mul ecx
push ebx
mov ebx, edx
shr ebx, 1
inc ebx
lea edx, [ebx + ebx*2]
movzx eax, byte [edi - 2]
lea edi, [edi + 3]
shr eax, 2
movzx eax, byte [ebp + eax - 0x4c]
mov byte [esi], al
movzx ecx, byte [edi - 5]
movzx eax, byte [edi - 4]
and ecx, 3
shr eax, 4
shl ecx, 4
or ecx, eax
movzx eax, byte [ebp + ecx - 0x4c]
mov byte [esi + 1], al
movzx ecx, byte [edi - 4]
movzx eax, byte [edi - 3]
and ecx, 0xf
shr eax, 6
shl ecx, 2
or ecx, eax
movzx eax, byte [ebp + ecx - 0x4c]
mov byte [esi + 2], al
movzx eax, byte [edi - 3]
and eax, 0x3f
movzx eax, byte [ebp + eax - 0x4c]
mov byte [esi + 3], al
add esi, 4
sub ebx, 1
jne 0x405b11
mov eax, dword [ebp + 0xc]
pop ebx
mov byte [esi], 0
cmp edx, eax
jle 0x405b8c
sub edx, eax
nop dword [eax]
mov byte [esi - 1], 0x3d
lea esi, [esi - 1]
sub edx, 1
jne 0x405b80
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00441849
mov esp, ebp
pop ebp
ret 0xc
Function at 0x412b00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1110
call fcn.00441cb0
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.004162e0
mov esi, eax
call fcn.00415d80
mov ebx, eax
call fcn.00416680
mov edi, eax
call fcn.004159e0
mov dword [ebp - 0x1110], eax
mov dword [ebp - 0x20], 0xe454e3c9
mov word [ebp - 0x1c], 0xefa2
mov dword [ebp - 0x18], 0xaa5b5e1b
mov dword [ebp - 0x14], 0x72842d28
mov dword [ebp - 0x10], 0x1b106ccf
mov dword [ebp - 0xc], 0x644df7e5
mov byte [ebp - 8], 0x86
mov dword [ebp - 0x40], 0x1b5d1ba6
mov dword [ebp - 0x3c], 0x1a27ef34
mov dword [ebp - 0x38], 0x59c0b17
mov word [ebp - 0x34], 0x7245
mov byte [ebp - 0x32], 0x27
mov dword [ebp - 0x30], 0xe45ce3f7
mov dword [ebp - 0x2c], 0x464d23d3
mov dword [ebp - 0x28], 0x644648f1
mov word [ebp - 0x24], 0xbb1b
mov dword [ebp - 0x110c], 0
test esi, esi
je 0x412d7a
test ebx, ebx
je 0x412d7a
test edi, edi
je 0x412d7a
test eax, eax
je 0x412d7a
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0041fef0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
push 0x1000
lea eax, [ebp - 0x1108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1108]
push 0x1000
push eax
push 0
call esi
test eax, eax
je 0x412c80
dec eax
cmp byte [ebp + eax - 0x1108], 0x5c
je 0x412c2f
nop
test eax, eax
jle 0x412c31
dec eax
cmp byte [ebp + eax - 0x1108], 0x5c
jne 0x412c20
test eax, eax
je 0x412d7a
inc eax
cmp eax, 0x1000
jae 0x412d8b
mov byte [ebp + eax - 0x1108], 0
lea eax, [ebp - 0x18]
push eax
push 0x1000
lea eax, [ebp - 0x1108]
push eax
call fcn.0041eb10
lea eax, [ebp - 0x1108]
push eax
call ebx
cmp eax, 0xffffffff
je 0x412c80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x412c80
add dword [0x517e6c], 2
lea eax, [ebp - 0x110c]
push eax
lea eax, [ebp - 0x18]
push eax
push 2
call edi
test eax, eax
je 0x412d57
push 0x1000
lea eax, [ebp - 0x1108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1108]
push 0x1000
push eax
push dword [ebp - 0x110c]
call esi
test eax, eax
je 0x412d57
push 0
push 0
push 0
lea eax, [ebp - 0x40]
push eax
call fcn.0041fef0
push 0xc8
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push 0xc8
push eax
lea eax, [ebp - 0x40]
push eax
call dword [ebp - 0x1110]
test eax, eax
je 0x412d57
push 0
push 0
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.0041fef0
lea eax, [ebp - 0x30]
push eax
push 0xc8
lea eax, [ebp - 0x108]
push eax
call fcn.0041eb10
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x1108]
push eax
call fcn.0041f030
test eax, eax
jne 0x412d57
mov eax, dword [0x517e6c]
cmp eax, 2
jge 0x412d5c
add eax, 2
mov dword [0x517e6c], eax
jmp 0x412d5c
mov eax, dword [0x517e6c]
push 0x10
push 0x517e3c
push eax
call fcn.0041e500
inc word [0x517e64]
mov dword [0x517e68], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
call fcn.00441bca
int3
Function at 0x4131f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x4132a3
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4132a3
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4132a3
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4132a3
add eax, 0x18
je 0x4132a3
add eax, 0x60
mov dword [ebp - 0x10], eax
je 0x4132a3
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
add eax, esi
je 0x4132a3
mov ebx, dword [eax + 0x20]
add ebx, esi
je 0x4132a3
mov ecx, dword [eax + 0x1c]
add ecx, esi
mov dword [ebp - 8], ecx
je 0x4132a3
mov ecx, dword [eax + 0x18]
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x4132a3
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 4], eax
je 0x4132a3
mov eax, dword [ebx + edi*4]
mov ecx, edx
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x413291
test dl, dl
je 0x41328d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x413291
add ecx, 2
add eax, 2
test dl, dl
jne 0x413271
xor eax, eax
jmp 0x413296
sbb eax, eax
or eax, 1
test eax, eax
je 0x4132ae
mov edx, dword [ebp + 0xc]
inc edi
cmp edi, dword [ebp + 8]
jb 0x41326a
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41332d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41332d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x413316
lea ecx, [esi + 1]
push ecx
push eax
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
lea eax, [ecx + esi]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x413410
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0
push 0
push dword [ebp + 0xc]
call fcn.0041fef0
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4134eb
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0x30
je 0x4134eb
test ebx, ebx
je 0x4134eb
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4134e5
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4134e5
add eax, 0x18
je 0x4134e5
add eax, 0x60
mov dword [ebp - 0x10], eax
je 0x4134e5
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
add eax, esi
je 0x4134e5
mov edx, dword [eax + 0x20]
add edx, esi
mov dword [ebp + 0x10], edx
je 0x4134e5
mov edi, dword [eax + 0x1c]
add edi, esi
mov dword [ebp - 8], edi
je 0x4134e5
mov edi, dword [eax + 0x18]
mov dword [ebp + 8], edi
test edi, edi
je 0x4134e5
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 4], eax
je 0x4134e5
mov eax, dword [edx + edi*4]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4134d0
test dl, dl
je 0x4134cc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4134d0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4134b0
xor eax, eax
jmp 0x4134d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4134f6
mov ecx, dword [ebp + 0xc]
inc edi
mov edx, dword [ebp + 0x10]
cmp edi, dword [ebp + 8]
jb 0x4134ab
mov dword [ebx], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x413563
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x413563
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x413555
lea ecx, [esi + 1]
push ecx
push eax
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x413565
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x413565
add esi, ecx
mov dword [ebx], esi
test esi, esi
je 0x4134eb
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x413580
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518054]
mov dword [ebp - 0x14], 0x8a5ac9e4
mov dword [ebp - 0x10], 0x51469281
mov dword [ebp - 0xc], 0x54a930f7
mov dword [ebp - 8], 0x789c92c3
push edi
test esi, esi
jne 0x413725
mov esi, dword [0x517e74]
test esi, esi
jne 0x4135d4
call fcn.0041bb20
mov esi, eax
mov dword [0x517e74], esi
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0041fef0
test esi, esi
je 0x413693
cmp byte [ebp - 0x14], 0x30
je 0x413693
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x413689
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x413689
add eax, 0x18
je 0x413689
add eax, 0x60
mov dword [ebp - 0x28], eax
je 0x413689
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
add eax, esi
je 0x413689
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x18], ecx
je 0x413689
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x20], edx
je 0x413689
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x413689
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x1c], eax
je 0x413689
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x14]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x413678
test dl, dl
je 0x413674
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x413678
add ecx, 2
add eax, 2
test dl, dl
jne 0x413658
xor eax, eax
jmp 0x41367d
sbb eax, eax
or eax, 1
test eax, eax
je 0x4136a6
mov ecx, dword [ebp - 0x18]
inc edi
cmp edi, ebx
jb 0x413650
mov dword [0x518054], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x413715
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x413715
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x413707
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x413717
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x413717
add esi, ecx
mov dword [0x518054], esi
test esi, esi
je 0x413693
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret