joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44df20
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x44df46
mov eax, esp
push eax
push 0x44dee8
call sub.user32.dll_EnumWindows
jmp 0x44df59
mov eax, esp
push eax
push 0x44dec8
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x44dfe4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x44e038]
test si, 4
je 0x44dff9
or bl, 1
test si, 8
je 0x44e003
or bl, 4
test si, 1
je 0x44e00d
or bl, 8
test si, 2
je 0x44e017
or bl, 0x10
test si, 0x10
je 0x44e021
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44e030
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44e03c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x44e078]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44e056
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44e065
or bl, 4
test esi, 0x20000000
je 0x44e070
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4560e4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4560f6
add esp, 0xfffffff0
call fcn.00403d0c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a324
mov eax, dword [0x461a5c]
mov dword [eax + 4], ebx
mov dword [eax], 0x456488
mov eax, dword [0x461a68]
mov dword [eax + 4], ebx
mov dword [eax], 0x456494
mov eax, ebx
call fcn.004564a0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.004039d0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.004039d0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.004039d0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.004039d0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.004039d0
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x451948
push eax
push 0
push 0
mov eax, dword [0x461ba4]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x423734]
call fcn.00424c54
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x423734]
call fcn.00424c54
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x423734]
call fcn.00424c54
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00456918
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4567e8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4567e8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4567e8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x456233
call fcn.00403d64
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4565cc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x456777
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x456758
mov dl, 1
mov eax, dword [0x4124f8]
call fcn.004039d0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404814
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x456747
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00447d64
test al, al
je 0x45673a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x456788
lea eax, [ebp - 0x254]
call fcn.00409278
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45673a
xor eax, eax
push ebp
push 0x456733
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4567c0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45671c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a84
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45671c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404a84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45673a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45663d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.004161d0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45677e
lea eax, [ebp - 0x260]
call fcn.00404814
ret

Function at 0x4570f0
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x467c98]
cmp byte [eax + 0xad], 0
jne 0x457161
cmp dword [0x467cb4], 0
jne 0x457122
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4570ac
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x467cb4], eax
cmp dword [0x467cb0], 0
jne 0x45713d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x467cb0], eax
cmp dword [0x467cb8], 0
jne 0x457161
push esp
push 0
push 0
push 0x457050
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x467cb8], eax
pop edx
ret
Function at 0x457364
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45737b
add esp, 0xfffffff0
call fcn.00403d0c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a324
mov eax, dword [0x461b90]
cmp word [eax + 2], 0
jne 0x4573a3
mov eax, dword [0x461b90]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00458e14
mov eax, dword [0x461c34]
cmp word [eax + 2], 0
jne 0x4573bd
mov eax, dword [0x461c34]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00459020
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.004039d0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.004039d0
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.004039d0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x423f10]
call fcn.00429ddc
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x457574
mov eax, dword [0x461ac0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042a1b0
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4596e4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x461ac0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c9b4
test eax, eax
je 0x4574c4
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408c30
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c9e8
test eax, eax
je 0x4574d8
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404a84
mov byte [ebx + 0xd4], 0
push ebx
push 0x458ae0
call fcn.0041b4a0
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4619cc]
cmp byte [eax], 0
jne 0x457529
mov eax, ebx
call fcn.004576b8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004598f8
mov eax, ebx
call fcn.0045a45c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x457569
call fcn.00403d64
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457938
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x4579d7
cmp dword [ebx + 0x94], 0
jne 0x4579d1
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4578c0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4579d1
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x457997
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4579d1
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414478
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4579a6
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x457bf0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x467c98]
cmp dword [eax + 0x30], 0
je 0x457d4d
test bl, bl
jne 0x457c9e
cmp dword [esi + 0x9c], 0
jne 0x457c93
mov eax, esi
call fcn.0045a2d8
push eax
push 0x457b1c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x457c64
mov eax, dword [0x467c98]
call fcn.0045a8c8
test al, al
je 0x457c64
mov eax, dword [0x467cbc]
call fcn.00405750
mov edi, eax
cmp edi, 0
jl 0x457c64
push 0
mov eax, dword [0x467cbc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x457c4e
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x457c93
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414478
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x457c73
inc dword [esi + 0x9c]
jmp 0x457d4d
cmp dword [esi + 0x9c], 0
jle 0x457d4d
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x457d4d
cmp dword [esi + 0x44], 0
je 0x457cf9
mov eax, dword [0x467c98]
call fcn.0045a8c8
test al, al
je 0x457cf9
mov eax, dword [0x467cbc]
call fcn.00405750
mov edi, eax
cmp edi, 0
jl 0x457cf9
push 5
mov eax, dword [0x467cbc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x457ce3
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x457d28
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414478
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x457d08
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x467cbc
mov ecx, 1
mov edx, dword [0x457afc]
call fcn.00405904
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x458834
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45889e
mov eax, ebx
call fcn.0045a8c8
test al, al
jne 0x45889e
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404904
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x45888b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4588ab
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404868
jmp 0x4588ab
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404868
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x459adc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x459b4a
mov eax, esi
call fcn.00442b9c
test al, al
je 0x459b4a
mov eax, dword [ebx + 0x84]
call fcn.004428a0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x459b4a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x459b3e
push 0
mov eax, dword [ebx + 0x84]
call fcn.004428a0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043a944
jmp 0x459b4a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00459918
pop esi
pop ebx
ret
Function at 0x42d000
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push 0xca62c1d6
push 0x8f1bbcdc
push 0x6ed9eba1
push 0x5a827999
push edx
call fcn.0042d3b0
ret 0x18

Function at 0x42d290
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
and eax, 0xfffffff
imul eax, eax, 8
jo 0x42d2b0
test ecx, 0x10000000
je 0x42d2ad
or eax, 0x80000000
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x42d2c0
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
and eax, 0x3fffffff
imul eax, eax, 2
jo 0x42d2ea
test ecx, 0x40000000
je 0x42d2dd
or eax, 0x80000000
test ecx, 0x80000000
je 0x42d2e7
or al, 1
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]

Function at 0x42d2f0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
mov eax, esi
and ecx, 0x3ffffff
imul ecx, ecx, 0x20
jo 0x42d32e
and eax, 0xf8000000
cdq
and edx, 0x7ffffff
add eax, edx
sar eax, 0x1b
and eax, 0x1f
or ecx, eax
test esi, 0x4000000
pop esi
je 0x42d329
or ecx, 0x80000000
mov eax, ecx
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x42d340
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, eax
xor edx, ecx
jge 0x42d355
add eax, ecx
jo 0x42d366
ret 8
xor eax, 0x80000000
add eax, ecx
jo 0x42d366
xor eax, 0x80000000
ret 8
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop

Function at 0x42d370
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov ecx, ebx
mov eax, ebx
and ecx, 1
imul ecx, ecx, 0x40000000
jo 0x42d3a7
and al, 0xfc
cdq
and edx, 3
add eax, edx
sar eax, 2
and eax, 0x3fffffff
or ecx, eax
test bl, 2
pop ebx
je 0x42d3a2
or ecx, 0x80000000
mov eax, ecx
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
Function at 0x401140
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4546a0
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 0xc], eax
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], eax
mov word [esi + 4], cx
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x20]
mov ecx, esi
mov byte [esp + 0x14], 1
call fcn.00401860
cmp dword [esp + 0x30], 8
mov dx, word [esp + 0x34]
mov ax, word [esp + 0x38]
mov cx, word [esp + 0x3c]
mov word [esi + 0x1c], dx
mov word [esi + 0x1e], ax
mov word [esi + 0x20], cx
jb 0x4011b2
mov edx, dword [esp + 0x1c]
push edx
call fcn.00430981
add esp, 4
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x2c
Function at 0x4054d0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4548b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
xor edx, edx
push edi
mov dword [esp + 0x14], edx
mov eax, 1
mov dword [esp + 0x30], eax
xor ecx, ecx
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], edx
mov word [ebp + 4], cx
mov ecx, dword [esp + 0x54]
mov edi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
cmp ecx, 0x10
jb 0x40564b
mov esi, edi
cmp edi, edx
je 0x40554e
mov eax, edi
cmp ecx, 0x10
jae 0x405535
lea eax, [esp + 0x40]
cmp eax, esi
ja 0x40554e
mov eax, edi
cmp ecx, 0x10
jae 0x405544
lea eax, [esp + 0x40]
mov edx, dword [esp + 0x50]
add eax, edx
cmp esi, eax
jbe 0x40555f
call fcn.00430e4d
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov edi, dword [esp + 0x40]
lea ebx, [esp + 0x3c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
jmp 0x405570
mov eax, edi
cmp ecx, 0x10
jae 0x40557b
lea eax, [esp + 0x40]
lea esi, [eax + edx]
test esi, esi
je 0x4055a2
mov eax, edi
cmp ecx, 0x10
jae 0x40558d
lea eax, [esp + 0x40]
cmp eax, esi
ja 0x4055a2
mov eax, edi
cmp ecx, 0x10
jae 0x40559c
lea eax, [esp + 0x40]
add eax, edx
cmp esi, eax
jbe 0x4055b3
call fcn.00430e4d
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov edi, dword [esp + 0x40]
cmp ebx, 0xfffffffc
je 0x4055d5
test ebx, ebx
je 0x4055c4
lea eax, [esp + 0x3c]
cmp ebx, eax
je 0x4055d5
call fcn.00430e4d
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov edi, dword [esp + 0x40]
cmp dword [esp + 0x1c], esi
je 0x405654
mov eax, edi
cmp ecx, 0x10
jae 0x4055e6
lea eax, [esp + 0x40]
lea esi, [eax + edx]
test esi, esi
je 0x40560d
mov eax, edi
cmp ecx, 0x10
jae 0x4055f8
lea eax, [esp + 0x40]
cmp eax, esi
ja 0x40560d
mov eax, edi
cmp ecx, 0x10
jae 0x405607
lea eax, [esp + 0x40]
add eax, edx
cmp esi, eax
jbe 0x405612
call fcn.00430e4d
lea edx, [esp + 0x20]
lea ecx, [esp + 0x3c]
push edx
lea ebx, [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], esi
call fcn.00405d30
add esp, 4
mov ecx, ebp
call fcn.00406660
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x18]
jmp 0x405570
lea esi, [esp + 0x40]
jmp 0x40552a
cmp ecx, 0x10
jb 0x405662
push edi
call fcn.00430981
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret
Function at 0x40a760
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x455785
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
call fcn.0040ae40
xor ecx, ecx
mov dword [esp + 0xc], ecx
lea eax, [esi + 0x10]
mov dword [esi], vtable.XMPP.0
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
lea ecx, [esi + 0x44]
push ecx
push eax
lea edx, [esi + 0x48]
push edx
mov byte [esp + 0x18], 1
call fcn.0040afa0
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4

Function at 0x40e0e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4554b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov edx, dword [edi]
mov esi, dword [edx + 4]
add esi, edi
call fcn.004111e0
mov eax, dword [esp + 0x24]
push esi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
call fcn.0040fa20
mov word [esi + 0x30], ax
cmp dword [esi + 0x28], ebx
jne 0x40e143
mov eax, dword [esi + 8]
or eax, 4
push ebx
push eax
mov ecx, esi
call fcn.00411ba0
mov ecx, dword [esp + 0x10]
mov eax, edi
mov dword [esi + 4], ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 8

Function at 0x40eaf0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x45449b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00442df6
push 4
mov dword [esp + 0x18], 0
call fcn.00430c2e
mov edi, eax
add esp, 4
test edi, edi
je 0x40eb64
push ebx
call fcn.00443215
mov dword [edi], eax
call fcn.00443043
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00442f67
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40eb58
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00442f8f
pop ebx
jmp 0x40eb66
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4