joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aabc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404b28
xor eax, eax
push ebp
push 0x40ac9a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
test ebx, ebx
je 0x40ac79
mov eax, ebx
call fcn.0040a940
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40ac64
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x78]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, ebx
mov edi, eax
test edi, edi
je 0x40ac64
mov eax, dword [edi + 0x18]
dec eax
test eax, eax
jl 0x40ac64
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x12c]
mov edx, dword [edi + 0x20]
add edx, ebx
mov ecx, dword [ebp - 0xc]
mov edx, dword [edx + ecx*4]
add edx, ebx
call fcn.00404878
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 4]
call fcn.00404a84
jne 0x40ac58
mov eax, dword [edi + 0x24]
add eax, ebx
mov edx, dword [ebp - 0xc]
mov si, word [eax + edx*2]
movzx eax, si
mov edx, dword [edi + 0x1c]
add edx, ebx
mov edi, dword [edx + eax*4]
mov eax, dword [ebp - 8]
cmp edi, dword [eax + 0x50]
jbe 0x40ac4b
xor edi, edi
push 0x104
lea eax, [ebp - 0x125]
push eax
push ebx
call fcn.00406fec
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x125]
push eax
call fcn.00406e6c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x40ac4b
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x14]
push eax
call fcn.00406e74
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40ac42
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x18]
push eax
call fcn.00407154
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40ac39
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0040aa68
add eax, dword [ebp - 0x1c]
mov edi, eax
mov edx, dword [edi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.0040aa68
add eax, dword [ebp - 0x1c]
movzx edx, si
mov edi, dword [eax + edx*4]
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00407214
push 0x104
lea eax, [ebp - 0x125]
push eax
push 0
call fcn.00406fec
mov eax, dword [ebp - 0x18]
push eax
call fcn.00406e54
mov eax, dword [ebp - 0x14]
push eax
call fcn.00406e54
mov edx, edi
mov eax, ebx
call fcn.0040a9b8
mov esi, eax
jmp 0x40ac64
inc dword [ebp - 0xc]
dec dword [ebp - 0x20]
jne 0x40ab38
test esi, esi
jne 0x40ac79
mov eax, dword [ebp - 4]
call fcn.00404b38
push eax
push ebx
call fcn.0040701c
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40aca1
lea eax, [ebp - 0x12c]
call fcn.00404688
lea eax, [ebp - 4]
call fcn.00404688
ret

Function at 0x412e6c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, eax
dec ecx
test ecx, ecx
jl 0x412e93
inc ecx
mov eax, edx
mov edx, esi
xor dl, byte [eax]
and edx, 0xff
mov edx, dword [edx*4 + 0x4f3d30]
shr esi, 8
xor edx, esi
mov esi, edx
inc eax
dec ecx
jne 0x412e77
mov eax, esi
pop esi
ret
Function at 0x4132bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, 0x12
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea eax, [esi + 1]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [eax + edx]
shl ebx, 0x10
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
shl eax, 0x18
add ebx, eax
lea eax, [esi + 2]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add ebx, eax
lea eax, [esi + 3]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ebx, eax
xor dword [ecx], ebx
lea eax, [esi + 4]
xor edx, edx
div dword [ebp - 8]
mov esi, edx
add ecx, 4
dec edi
jne 0x4132db
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00412efc
pop ecx
mov eax, edi
add eax, eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 0x1048], ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edx + eax*4 - 0x1044], ecx
inc edi
cmp edi, 9
jne 0x41333d
mov edi, 4
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x1000]
xor esi, esi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00412efc
pop ecx
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0xc]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebx + eax*4 + 4], edx
inc esi
cmp esi, 0x80
jne 0x41338c
add ebx, 0x400
dec edi
jne 0x41338a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4133d4
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa0
push ebx
push esi
push edi
mov byte [ebp - 0x1049], cl
mov edi, edx
mov ebx, eax
mov eax, dword [ebp + 0x14]
call fcn.00404b28
lea esi, [ebp - 0x1058]
xor eax, eax
push ebp
push 0x4135b5
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov esi, 0x4f4130
lea edi, [ebp - 0x1048]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
mov esi, 0x4f4178
lea edi, [ebp - 0x1000]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebp
mov eax, dword [ebp + 0x14]
call fcn.00404940
push eax
mov eax, dword [ebp + 0x14]
call fcn.00404b38
pop edx
call fcn.004132bc
pop ecx
cmp byte [ebp - 0x1049], 0
je 0x413470
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 1
jmp 0x413486
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 0xffffffff
shr edi, 3
dec edi
test edi, edi
jl 0x41359f
inc edi
mov dword [ebp - 0x1060], edi
cmp dword [ebp + 0x10], 0
jne 0x4134a3
cmp dword [ebp + 0xc], 0
je 0x41351f
mov dword [esi], 7
lea eax, [ebp + 0xc]
add eax, dword [esi]
mov dl, byte [eax]
inc edx
and dl, 0xff
mov byte [eax], dl
lea eax, [ebp + 0xc]
add eax, dword [esi]
cmp byte [eax], 0
jne 0x4134c9
dec dword [esi]
cmp dword [esi], 0xffffffff
jne 0x4134ab
lea eax, [ebp + 0xc]
mov eax, dword [eax]
call fcn.00412ed0
mov dword [esi], eax
lea eax, [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
call fcn.00412ed0
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.00412efc
pop ecx
mov eax, dword [esi]
call fcn.00412ed0
xor dword [ebx], eax
mov eax, dword [ebp - 0x105c]
call fcn.00412ed0
lea edx, [ebx + 4]
xor dword [edx], eax
jmp 0x413590
cmp byte [ebp + 8], 0
jne 0x413577
mov edi, ebx
mov eax, dword [edi]
call fcn.00412ed0
mov dword [esi], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
call fcn.00412ed0
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.00412efc
pop ecx
mov eax, dword [esi]
call fcn.00412ed0
mov dword [edi], eax
mov eax, dword [ebp - 0x105c]
call fcn.00412ed0
lea edx, [ebx + 4]
mov dword [edx], eax
jmp 0x413590
push ebp
mov eax, dword [ebp - 0x1054]
push eax
mov edx, ebx
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x1050]
call fcn.00412efc
pop ecx
add ebx, 8
dec dword [ebp - 0x1060]
jne 0x413499
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4135bc
lea eax, [ebp + 0x14]
call fcn.00404688
ret
Function at 0x41377c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
test edi, edi
jle 0x41389e
lea eax, [edi + 2]
mov ecx, 3
cdq
idiv ecx
mov edx, eax
shl edx, 2
mov eax, esi
call fcn.00404cc4
mov ecx, dword [esi]
mov eax, edi
mov esi, 3
cdq
idiv esi
mov esi, eax
test esi, esi
jle 0x413815
xor eax, eax
mov al, byte [ebx]
shl eax, 0x10
xor edx, edx
mov dl, byte [ebx + 1]
shl edx, 8
add eax, edx
xor edx, edx
mov dl, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x4f5178]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x4f5178]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
mov dl, byte [edx + 0x4f5178]
mov byte [ecx + 2], dl
and eax, 0x3f
mov al, byte [eax + 0x4f5178]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec esi
jne 0x4137b6
mov eax, edi
mov esi, 3
cdq
idiv esi
dec edx
je 0x413827
dec edx
je 0x413857
jmp 0x4138a5
xor eax, eax
mov al, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x4f5178]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + 0x4f5178]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x4138a5
xor eax, eax
mov al, byte [ebx]
shl eax, 0x10
xor edx, edx
mov dl, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x4f5178]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x4f5178]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
mov al, byte [eax + 0x4f5178]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
jmp 0x4138a5
mov eax, esi
call fcn.00404688
pop edi
pop esi
pop ebx
ret

Function at 0x413ca4
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b28
xor eax, eax
push ebp
push 0x413d93
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.00404b38
mov esi, eax
push esi
call fcn.00406fbc
cmp eax, 0xffffffff
je 0x413d7d
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push esi
call fcn.00406e6c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x413d7d
xor eax, eax
push ebp
push 0x413d76
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406fc4
mov edx, eax
mov eax, ebx
call fcn.00404cc4
cmp dword [ebx], 0
je 0x413d56
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx]
call fcn.00404940
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040718c
test eax, eax
je 0x413d56
mov eax, dword [ebx]
call fcn.00404940
cmp eax, dword [ebp - 0x10]
je 0x413d5a
xor eax, eax
jmp 0x413d5c
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413d7d
mov eax, dword [ebp - 0xc]
push eax
call fcn.00406e54
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413d9a
lea eax, [ebp - 4]
call fcn.00404688
ret
Function at 0x41b890
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41b974
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4f58dc], 0
je 0x41b8c5
mov eax, dword [0x4f58dc]
mov edi, dword [eax + 4]
jmp 0x41b8c7
xor edi, edi
lea eax, [ebp - 0x10]
push eax
call fcn.00406f7c
mov cl, 0x30
mov edx, 1
call fcn.00408d78
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x41b98c
call fcn.0040498c
mov eax, dword [ebp - 0xc]
call fcn.00404b38
push eax
push 0
push 0
call fcn.00406e84
mov esi, eax
test edi, edi
je 0x41b913
push 0x7d0
push edi
call fcn.0040723c
test eax, eax
je 0x41b917
xor ebx, ebx
jmp 0x41b919
mov bl, 1
test esi, esi
je 0x41b92c
push 0x7d0
push esi
call fcn.0040723c
test eax, eax
je 0x41b930
xor eax, eax
jmp 0x41b932
mov al, 1
mov byte [ebp - 5], al
test byte [ebp - 5], bl
je 0x41b943
mov eax, dword [ebp - 4]
push eax
call fcn.004071f4
test bl, bl
je 0x41b94d
push edi
call fcn.00407194
cmp byte [ebp - 5], 0
je 0x41b959
push esi
call fcn.00407194
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b97b
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004046ac
ret
Function at 0x41b998
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x41bb53
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [0x407dbc]
call fcn.00405ed4
xor ecx, ecx
push ebp
push 0x41bb1f
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov al, byte [ebp - 1]
and al, byte [ebp - 2]
je 0x41b9fc
lea eax, [ebp - 0x10]
call fcn.0041b270
mov edx, dword [ebp - 0x10]
mov eax, 0x4f98e8
mov ecx, dword [0x407dbc]
call fcn.00405f10
mov eax, dword [0x4f98e8]
call fcn.00405c00
test eax, eax
jl 0x41ba9a
inc eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
call fcn.00406f8c
mov edx, dword [0x4f98e8]
cmp eax, dword [edx + ebx*4]
je 0x41ba90
mov byte [ebp - 3], 1
mov eax, dword [0x4f98ec]
call fcn.00405c00
test eax, eax
jl 0x41ba57
inc eax
xor edx, edx
mov ecx, dword [0x4f98ec]
mov ecx, dword [ecx + edx*8]
mov esi, dword [0x4f98e8]
cmp ecx, dword [esi + ebx*4]
jne 0x41ba53
mov byte [ebp - 3], 0
jmp 0x41ba57
inc edx
dec eax
jne 0x41ba39
cmp byte [ebp - 3], 0
je 0x41ba90
mov eax, dword [0x4f98e8]
mov eax, dword [eax + ebx*4]
mov edx, 2
call fcn.0041b5a0
mov esi, eax
test esi, esi
je 0x41ba90
cmp byte [ebp - 1], 0
je 0x41ba84
mov eax, esi
call fcn.0041b890
jmp 0x41ba8a
push esi
call fcn.004071a4
push esi
call fcn.00406e54
inc ebx
dec dword [ebp - 0xc]
jne 0x41ba14
mov al, byte [ebp - 1]
xor al, 1
and al, byte [ebp - 2]
je 0x41bb15
lea eax, [ebp - 8]
call fcn.0041b270
mov eax, dword [ebp - 8]
call fcn.00405c00
test eax, eax
jl 0x41bb05
inc eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
mov byte [ebp - 3], 1
mov eax, dword [0x4f98e8]
call fcn.00405c00
test eax, eax
jl 0x41baee
inc eax
xor edx, edx
mov ecx, dword [0x4f98e8]
mov ecx, dword [ecx + edx*4]
mov esi, dword [ebp - 8]
cmp ecx, dword [esi + ebx*4]
jne 0x41baea
mov byte [ebp - 3], 0
jmp 0x41baee
inc edx
dec eax
jne 0x41bad3
cmp byte [ebp - 3], 0
je 0x41baff
mov eax, dword [ebp - 8]
mov eax, dword [eax + ebx*4]
call fcn.0041b7cc
inc ebx
dec dword [ebp - 0xc]
jne 0x41babe
mov eax, 0x4f98e8
mov edx, dword [0x407dbc]
call fcn.00405ed4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41bb29
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bb5a
lea eax, [ebp - 0x10]
mov edx, dword [0x407dbc]
call fcn.00405ed4
lea eax, [ebp - 8]
mov edx, dword [0x407dbc]
call fcn.00405ed4
ret

Function at 0x41bc8c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
mov dword [esp], 0x104
push esp
lea eax, [esp + 8]
push eax
call fcn.00406f6c
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.004048f0
add esp, 0x10c
pop ebx
ret
Function at 0x41bfa8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a940
test eax, eax
je 0x41c028
add eax, 0x80
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x41c028
jmp 0x41c022
mov eax, dword [esi + 0x10]
cmp eax, dword [ebp - 0x10]
jbe 0x41bfee
push ebp
call fcn.0041bedc
pop ecx
jmp 0x41c028
mov eax, dword [esi + 0x10]
test eax, eax
je 0x41c01f
mov ebx, dword [ebp - 4]
add ebx, eax
jmp 0x41c01a
cmp edi, dword [ebx]
jne 0x41c017
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call fcn.00407224
test eax, eax
je 0x41c017
mov eax, dword [ebp - 8]
mov dword [ebx], eax
add ebx, 4
cmp dword [ebx], 0
jne 0x41bffc
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x41bfdd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c98c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x24]
mov edx, dword [0x41c438]
call fcn.004050b8
xor eax, eax
push ebp
push 0x41cb57
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
jne 0x41c9d5
cmp dword [0x4f98d0], 0
jne 0x41ca0b
cmp dword [0x4f98d4], 0
jne 0x41ca0b
cmp bl, 1
jne 0x41c9ec
cmp dword [0x4f98d8], 0
jne 0x41ca0b
cmp dword [0x4f98dc], 0
jne 0x41ca0b
cmp bl, 2
jne 0x41cb3b
cmp dword [0x4f98e0], 0
jne 0x41ca0b
cmp dword [0x4f98e4], 0
je 0x41cb3b
mov byte [ebp - 0x24], bl
mov al, byte [ebp - 1]
mov byte [ebp - 0x23], al
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
mov edx, dword [esi]
call fcn.00404720
mov al, byte [edi]
mov byte [ebp - 0x14], al
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x13], al
mov eax, dword [ebp + 8]
mov al, byte [eax]
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
call fcn.0041c464
cmp byte [ebp - 0x12], 0
jne 0x41cb24
cmp byte [ebp - 1], 0
jne 0x41cb24
cmp dword [0x4f58f8], 0
je 0x41cb24
mov byte [ebp - 0x11], 1
mov eax, dword [0x4f7fe8]
mov eax, dword [eax]
mov edx, 2
call fcn.0041b5a0
mov ebx, eax
test ebx, ebx
je 0x41ca8f
push ebx
call fcn.004071a4
test eax, eax
jg 0x41ca93
xor eax, eax
jmp 0x41ca95
mov al, 1
mov byte [ebp - 0xd], al
lea eax, [ebp - 0xc]
push eax
push 0x5dc
push 2
lea eax, [ebp - 0x24]
push eax
push 1
mov eax, dword [0x4f58fc]
push eax
mov eax, dword [0x4f58f8]
push eax
call fcn.00407a44
test eax, eax
je 0x41caf6
cmp dword [ebp - 0xc], 0x309
jne 0x41caf6
lea eax, [ebp - 0xc]
push eax
push 0x7ffffffe
push 2
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [0x4f58fc]
push eax
mov eax, dword [0x4f58f8]
push eax
call fcn.00407a44
test eax, eax
je 0x41caf6
cmp dword [ebp - 0xc], 0x309
je 0x41cafa
xor eax, eax
jmp 0x41cafc
mov al, 1
mov byte [ebp - 0xe], al
test ebx, ebx
je 0x41cb16
cmp byte [ebp - 0xd], 0
je 0x41cb10
mov eax, ebx
call fcn.0041b890
push ebx
call fcn.00406e54
cmp byte [ebp - 0xe], 0
jne 0x41cb24
lea eax, [ebp - 0x24]
call fcn.0041c464
mov eax, esi
mov edx, dword [ebp - 0x18]
call fcn.004046dc
mov al, byte [ebp - 0x14]
mov byte [edi], al
mov eax, dword [ebp + 8]
mov dl, byte [ebp - 0x12]
mov byte [eax], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cb5e
lea eax, [ebp - 0x24]
mov edx, dword [0x41c438]
call fcn.00405188
ret
Function at 0x41cce0
Capabilities:
Create thread

Disassembly:
cmp dword [0x4f5908], 0
jne 0x41cd67
cmp dword [0x4f5890], 0
jle 0x41cd67
xor eax, eax
call fcn.0040a1e4
mov dword [0x4f5908], eax
cmp dword [0x4f5908], 0
je 0x41cd67
mov eax, 0x41cb98
xor ecx, ecx
xor edx, edx
call fcn.0040a644
mov dword [0x4f590c], eax
push 0x4f5900
push 0
push 0
push 0x41cbd8
push 0
push 0
call fcn.00406eb4
mov dword [0x4f5904], eax
cmp dword [0x4f5904], 0
je 0x41cd67
push 0
push 0
push 0
mov ecx, 0x41cd70
mov edx, dword [0x4f5904]
mov eax, dword [0x4f5900]
call fcn.0041c0c8
push 2
mov eax, dword [0x4f5904]
push eax
call fcn.004071dc
ret

Function at 0x41cd74
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x4f5908], 0
je 0x41cdd5
cmp dword [0x4f5890], 0
jle 0x41cdd5
mov eax, 0x41cb98
xor ecx, ecx
xor edx, edx
call fcn.0040a844
push 0
mov eax, dword [0x4f5904]
push eax
call fcn.0040720c
mov eax, dword [0x4f5904]
push eax
call fcn.00406e54
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x4f5900]
call fcn.0041c0c8
xor eax, eax
mov dword [0x4f5904], eax
xor eax, eax
mov dword [0x4f5900], eax
xor eax, eax
mov dword [0x4f5908], eax
ret

Function at 0x41cdd8
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
cmp dword [0x4f5904], 0
je 0x41ce13
call fcn.00406f8c
cmp eax, dword [0x4f5900]
je 0x41ce13
test bl, bl
jne 0x41ce09
mov eax, dword [0x4f5904]
push eax
call fcn.004071a4
xor eax, eax
mov dword [0x4f5910], eax
jmp 0x41ce13
mov eax, dword [0x4f5904]
call fcn.0041b890
pop ebx
ret
Function at 0x41db6c
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Read file via mapping
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x7c], eax
xor eax, eax
push ebp
push 0x41dc9e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x64]
mov edx, 0x44
call fcn.00407ba4
mov dword [ebp - 0x64], 0x44
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
call fcn.00406f64
push eax
push 0
call fcn.00406eac
test eax, eax
je 0x41dc76
mov dword [ebp - 0xc], 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
push 1
lea eax, [ebp - 0x20]
push eax
call fcn.00406e24
lea eax, [ebp - 0x7c]
push eax
mov cl, 0x30
mov edx, 1
mov eax, dword [ebp - 0x6c]
call fcn.00408d78
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
mov edx, 0x41dcb4
call fcn.0040498c
mov eax, dword [ebp - 0x78]
call fcn.00404b38
push eax
push 0x58
push 0
push 4
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
call fcn.00406e74
mov esi, eax
push 0
push 0
push 0
push 0xf001f
push esi
call fcn.00407154
mov ebx, eax
test ebx, ebx
je 0x41dc6d
call fcn.00406f7c
mov dword [ebx], eax
push 2
push 0
push 0
lea eax, [ebx + 4]
push eax
mov eax, dword [ebp - 0x74]
push eax
push esi
call fcn.00406f74
push eax
call fcn.00406ecc
lea edx, [ebx + 8]
mov eax, 0x4f5914
mov ecx, 0x50
call fcn.004029bc
mov eax, dword [ebp - 0x70]
push eax
call fcn.004071a4
push 0
call fcn.00406f74
push eax
call fcn.00407204
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dca5
lea eax, [ebp - 0x7c]
mov edx, 2
call fcn.004046ac
ret