joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b40c
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x435a78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x208
push esi
push 0
push eax
mov dword [ebp - 0x214], 1
call sub.VCRUNTIME140.dll_memset
mov edx, 0x447510
mov dword [ebp - 0x210], esi
add esp, 0xc
mov eax, edx
xor ecx, ecx
cmp dword [eax], 0
je 0x42b46d
add eax, 0x14
inc ecx
cmp eax, 0x447538
jl 0x42b458
jmp 0x42b5c4
imul esi, ecx, 0x14
add esi, edx
je 0x42b5c4
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42b5a8
cmp dword [ebp - 0x214], 1
jne 0x42b5a8
cmp word [ebp - 0x20c], ax
je 0x42b5a8
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x42b5a8
shr eax, 1
mov dword [ebp - 0x210], eax
cmp eax, 0x104
jae 0x42b4ef
add eax, eax
cmp eax, 0x208
jae 0x42b5d7
xor ecx, ecx
mov word [ebp + eax - 0x20c], cx
jmp 0x42b4f5
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.0042b96d
mov dword [esi], eax
test eax, eax
je 0x42b5a8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._GetPerfhostHookVersion_0
push eax
call edi
test eax, eax
jne 0x42b522
mov eax, dword [ebp + 0x10]
jmp 0x42b524
call eax
mov dword [esi + 4], eax
cmp eax, 1
jne 0x42b548
push str._InitPerf_4
push dword [esi]
call edi
push str._PerfCodeMarker_12
push dword [esi]
mov dword [esi + 8], eax
call edi
push str._UnInitPerf_4
jmp 0x42b57c
cmp eax, 2
jne 0x42b55d
push str._InitPerf_4
push dword [esi]
call edi
push str._PerfCodeMarker_8
jmp 0x42b53a
cmp eax, 3
jne 0x42b586
push str._InitPerf_v3_4
push dword [esi]
call edi
push str._PerfCodeMarker_v3_8
push dword [esi]
mov dword [esi + 8], eax
call edi
push str._UnInitPerf_v3_4
push dword [esi]
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0xc], eax
cmp dword [esi + 8], 0
je 0x42b5a8
cmp dword [esi + 0x10], 0
je 0x42b5a8
cmp dword [esi + 0xc], 0
je 0x42b5a8
push dword [0x447540]
push esi
call fcn.0042b3d3
test eax, eax
jns 0x42b5c4
cmp dword [esi], 0
je 0x42b5b5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [esi], 0
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004297cb
mov esp, ebp
pop ebp
ret 0xc
call fcn.0042a806
int3

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40ae40
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b00e
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40ae6b
mov eax, 0x7000000
jmp 0x40ae73
test eax, eax
je 0x40afe9
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.00458520
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x123a1e0]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40b001
cmp ecx, 0x21
jae 0x40aff5
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00451970
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.00451a40
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0xf8fd0c]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0xf8fe1c]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40afc4
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0xf8fec4]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00458600
mov eax, ecx
mov ecx, 0x21
call fcn.004586e0
nop
call fcn.00457160
jmp fcn.0040ae40
Function at 0x413bd0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x413df4
sub esp, 0x18
mov eax, dword [0x128cb30]
test eax, eax
jne 0x413ddd
nop
lea eax, [0x128cb1c]
mov dword [esp], eax
call fcn.00408f50
mov eax, dword [0x128cb20]
test eax, eax
je 0x413c19
cmp dword [eax + 8], 0xcc
jne 0x413c8f
mov edx, dword [0x128cb14]
test edx, edx
jne 0x413c71
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x1292610]
mov dword [esp + 8], eax
call fcn.0040b020
mov eax, dword [esp + 0xc]
mov dword [0x128cb14], eax
mov ecx, dword [0x128cad8]
mov dword [eax], ecx
mov eax, dword [0x128cb14]
mov dword [0x128cad8], eax
movzx eax, byte [0x128d720]
test al, al
jne 0x413c71
xor eax, eax
jmp 0x413d89
mov edx, dword [0x128cb14]
mov ebx, dword [edx + 4]
mov dword [0x128cb14], ebx
mov ebx, dword [0x128cb20]
mov dword [edx + 4], ebx
mov dword [0x128cb20], edx
mov edx, dword [0x128cb20]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x413d71
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402110
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x128cf40]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x413ced
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x413cfa
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00458570
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x128cf40]
test edx, edx
jne 0x413d26
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x413d47
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00458570
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00458570
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00458570
nop
lea eax, [0x128cb1c]
mov dword [esp], eax
call fcn.00409150
nop
lea eax, [0x128cb18]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402290
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00458600
lea esi, [0x128d720]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x413c71
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x413dd3
lea edx, [0x12321f4]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x413d7b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.004585f0
mov ecx, 5
call fcn.004585f0
lea eax, str.queuefinalizer_during_GCr
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00431490
nop
call fcn.00457160
jmp fcn.00413bd0
Function at 0x41b990
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41bbbe
sub esp, 0x20
mov eax, dword [esp + 0x24]
test eax, 3
jne 0x41bba7
mov edx, dword [esp + 0x30]
mov ebx, dword [edx + 0x2c]
test byte [ebx], al
nop
movzx ebp, byte [0x128ca77]
mov ecx, dword [esp + 0x38]
mov esi, ecx
shr ecx, 3
mov dword [esp + 0x1c], ecx
mov edi, esi
and esi, 7
mov ecx, esi
mov eax, 1
shl eax, cl
mov esi, dword [esp + 0x1c]
mov ecx, eax
lea eax, [ebx + esi]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x41bab8
mov ebp, dword [0x128d58c]
test ebp, ebp
jle 0x41ba1c
cmp dword [edx + 0x58], edi
ja 0x41ba1c
mov ebp, dword [edx + 0x28]
test byte [ebp], al
movzx ebp, byte [ebp + esi]
nop
xchg ebp, eax
test cl, al
xchg ebp, eax
je 0x41bb2e
movzx ebx, byte [esi + ebx]
test cl, bl
jne 0x41bab4
nop
mov dword [esp], eax
mov byte [esp + 4], cl
call fcn.00402260
mov eax, dword [0x126cb9c]
test byte [eax], al
nop
nop
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0xc]
nop
mov ebx, edx
shr edx, 0x16
mov edx, dword [eax + edx*4]
test byte [edx], al
mov ebp, ebx
shr ebx, 0x10
and ebx, 0x3f
movzx esi, byte [edx + ebx + 0x21840]
lea edx, [edx + ebx + 0x21840]
shr ebp, 0xd
and ebp, 7
mov eax, ecx
mov ecx, ebp
mov ebx, 1
shl ebx, cl
xchg esi, eax
test bl, al
xchg esi, eax
jne 0x41ba8f
mov dword [esp], edx
mov byte [esp + 4], bl
call fcn.00402260
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + 0x3a]
test dl, 1
je 0x41bae9
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx + 8]
mov ebx, dword [ecx + 0xc]
mov eax, dword [eax + 0x40]
add edx, eax
adc ebx, 0
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], ebx
add esp, 0x20
ret
add esp, 0x20
ret
mov edx, dword [esp + 0x24]
mov dword [esp], edx
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], cl
mov dword [esp + 0x14], edi
call fcn.00413560
movzx eax, byte [esp + 0x18]
test al, al
jne 0x41bb20
mov edx, dword [esp + 0x34]
mov ebx, dword [edx]
test ebx, ebx
je 0x41bb0c
mov eax, dword [ebx + 0xc]
cmp eax, 0x1fc
je 0x41bb0c
jae 0x41bb24
mov ecx, dword [esp + 0x24]
mov dword [ebx + eax*4 + 0x10], ecx
inc dword [ebx + 0xc]
jmp 0x41bb1c
mov dword [esp], edx
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00421dd0
add esp, 0x20
ret
add esp, 0x20
ret
mov ecx, 0x1fc
call fcn.004585f0
lea eax, [0xcb0680]
mov dword [esp], eax
mov dword [esp + 4], 4
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
call fcn.0041bbd0
lea eax, [0xcb04be]
mov dword [esp], eax
mov dword [esp + 4], 3
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
call fcn.0041bbd0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x9d], 2
lea eax, [0xcb5dc0]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00431490
lea eax, [0xcc0fd4]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00431490
nop
call fcn.00457160
jmp fcn.0041b990
Function at 0x425100
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42521c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x425195
cmp cl, 2
je 0x42513d
cmp cl, 3
jne 0x425205
mov byte [eax + 8], 1
jmp 0x425201
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00429960
nop
lea eax, [0x12710b8]
mov dword [esp], eax
call fcn.00408f50
nop
mov eax, dword [0x1271084]
sub eax, dword [0x1271068]
mov dword [0x1271084], eax
mov eax, dword [0x1271074]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x1271074], ecx
nop
lea eax, [0x12710b8]
mov dword [esp], eax
call fcn.00409150
jmp 0x425201
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413bd0
nop
lea eax, [0x12710b8]
mov dword [esp], eax
call fcn.00408f50
nop
mov eax, dword [0x127105c]
sub eax, dword [0x1271040]
mov dword [0x127105c], eax
mov eax, dword [0x127104c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x127104c], ecx
nop
nop
lea eax, [0x12710b8]
mov dword [esp], eax
call fcn.00409150
add esp, 0x14
ret
lea eax, [0xcb3ecd]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00431490
nop
call fcn.00457160
jmp fcn.00425100
Function at 0x458420
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x128d500]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x456beb
je 0x456c3e
cmp ebx, 0x20
jbe 0x456c44
cmp ebx, 0x40
jbe 0x456c8a
jmp 0x456d2b
test ebx, ebx
je 0x456c34
add eax, 0x10
test ax, 0xff0
je 0x456c20
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0xf9e920]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0xf9ea20]
jmp 0x456c08
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x456c08
pxor xmm1, xmmword [0x128d510]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x128d510]
pxor xmm2, xmmword [0x128d520]
pxor xmm3, xmmword [0x128d530]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x128d510]
pxor xmm2, xmmword [0x128d520]
pxor xmm3, xmmword [0x128d530]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x456d8a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x128ca76], 0
je 0x45843a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x456bb0
jmp fcn.00407890
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
jmp 0x41c781
push 0x14
push 0x472a90
call fcn.0041c790
push 1
call fcn.0041c339
pop ecx
test al, al
je 0x41c76b
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041c307
mov byte [ebp - 0x24], al
mov eax, dword [0x47aabc]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x41c76b
test eax, eax
jne 0x41c68f
mov dword [0x47aabc], ecx
push 0x468384
push 0x46836c
call fcn.00421931
pop ecx
pop ecx
test eax, eax
je 0x41c672
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41c75b
push 0x468368
push 0x468314
call fcn.004218d5
pop ecx
pop ecx
mov dword [0x47aabc], 2
jmp 0x41c694
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041c4ab
pop ecx
call fcn.0041cd94
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41c6c5
push esi
call fcn.0041c417
pop ecx
test al, al
je 0x41c6c5
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x468310]
call esi
call fcn.0041cd9a
mov esi, eax
cmp dword [esi], edi
je 0x41c6e3
push esi
call fcn.0041c417
pop ecx
test al, al
je 0x41c6e3
push dword [esi]
call fcn.00420d94
pop ecx
call fcn.0041cbc3
movzx eax, ax
push eax
call fcn.00421882
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0041cbfc
test al, al
je 0x41c772
test bl, bl
jne 0x41c711
call fcn.00420d6f
push edi
push 1
call fcn.0041c4c8
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41c75b
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.0041caa9
push esi
call fcn.00420dcc
push dword [ebp - 0x20]
call fcn.00420d7e
int3
call fcn.0041cce1
jmp 0x41c605
Function at 0x401a20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46426f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x479008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
call fcn.00436130
mov ecx, eax
test ecx, ecx
js 0x401a75
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebx + 0x18]
cmp dword [ebx + 0x14], edx
jne 0x401aa6
cmp edx, 0x7fffffff
jae 0x401b3d
mov eax, edx
mov ecx, SysReAllocString
sub ecx, edx
shr eax, 2
inc eax
cmp eax, ecx
cmovbe ecx, eax
add ecx, edx
push ecx
lea ecx, [ebx + 0x10]
call fcn.004017c0
push 0x34
call fcn.0041c058
mov edi, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
mov dword [edi], 0
push 8
mov dword [edi + 4], 0
call fcn.0041bfdb
mov dword [edi + 4], eax
xor ecx, ecx
mov dword [edi + 8], 0
add esp, 8
mov dword [edi + 0xc], 3
mov word [eax], cx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ecx
mov dword [edi + 0x24], ecx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], ecx
lea ecx, [edi + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebx + 0x14]
push dword [ebp + 8]
lea eax, [edx + 1]
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [eax + edx*4], edi
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
call fcn.00435880
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x473048
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x7e5
push eax
call fcn.0041db1a
int3
Function at 0x4055b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.00420584
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x4055de
xor eax, eax
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x407310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464600
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x479008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0xcc]
call fcn.0041bebc
push dword [esi + 0xc0]
call fcn.0041bebc
push dword [esi + 0x9c]
call fcn.0041bebc
push dword [esi + 0x90]
call fcn.0041bebc
push dword [esi + 0x30]
call fcn.0041bebc
push dword [esi + 0x24]
call fcn.0041bebc
push dword [esi + 0x18]
call fcn.0041bebc
add esp, 0x1c
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x407390
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4073a4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 2
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4073b8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 3
mov ecx, dword [esi]
test ecx, ecx
je 0x4073cb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4078f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4646e7
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x479008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x14], 0
mov dword [esi], vtable.COpenCallbackImp.4.0
mov dword [esi + 4], vtable.COpenCallbackImp.3.0
mov dword [esi + 8], vtable.COpenCallbackImp.2.0
mov dword [esi + 0xc], vtable.COpenCallbackImp.1.0
mov dword [esi + 0x10], vtable.COpenCallbackImp.0
mov byte [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
push 8
mov dword [esi + 0x48], 0
call fcn.0041bfdb
xor ecx, ecx
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 3
mov word [eax], cx
mov byte [ebp - 4], 3
push 8
mov dword [esi + 0x54], ecx
call fcn.0041bfdb
xor ecx, ecx
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], 0
add esp, 8
mov dword [esi + 0x5c], 3
mov word [eax], cx
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 4
call fcn.00402130
mov dword [esi + 0x98], 0
mov eax, esi
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0xffffffff
mov dword [esi + 0xa8], 0xffffffff
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0x54fffc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4082c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4648ea
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x479008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.CBrowseDialog.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov byte [ebp - 4], 2
push 8
mov dword [esi + 0x48], 0
call fcn.0041bfdb
xor ecx, ecx
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 3
mov word [eax], cx
mov byte [ebp - 4], 3
push 8
mov dword [esi + 0x54], ecx
call fcn.0041bfdb
xor ecx, ecx
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 3
mov word [eax], cx
mov word [esi + 0x60], cx
mov dword [esi + 0x64], 0xffffffff
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x70], ecx
mov byte [ebp - 4], 5
push 8
mov dword [esi + 0x74], ecx
call fcn.0041bfdb
xor ecx, ecx
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 3
mov word [eax], cx
mov byte [ebp - 4], 6
push 8
mov dword [esi + 0x80], ecx
call fcn.0041bfdb
add esp, 0x10
mov dword [esi + 0x80], eax
xor ecx, ecx
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 3
mov word [eax], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret