joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4171a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
inc word [0x4594b0]
sub esp, 0xc
movsx eax, word [0x4594b0]
sub eax, 0x3c3b40b1
cmp eax, 0x9f2eac40
jg 0x4171f7
fld dword [0x459470]
fadd dword [0x44ee54]
fstp qword [ebp - 0xc]
fld qword [0x459540]
fcomp qword [ebp - 0xc]
fnstsw ax
fld qword [0x459540]
fsub qword [0x44e3a0]
fstp qword [0x459540]
test ah, 0x41
jne 0x4171f7
mov ax, word [0x4591bc]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
lea esi, [edx + eax*4]
mov eax, dword [ebp + 0x10]
cmp edx, esi
je 0x417248
jmp 0x417210
xor dword [edx], eax
mov ecx, 0xe0688c50
ror eax, 1
add edx, 4
mov dword [ebp - 4], eax
shr eax, 8
add al, byte [ebp - 4]
mov byte [ebp - 3], al
mov eax, dword [0x4590d4]
sub ecx, eax
mov al, byte [ebp - 3]
add byte [ebp - 4], al
mov eax, dword [ebp - 4]
mov dword [ebp + 8], ecx
fild dword [ebp + 8]
fstp qword [0x4594a8]
cmp edx, esi
jne 0x417210
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x418b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
fld qword [0x459190]
fld1
faddp st(1)
push ebx
push esi
push edi
fstp qword [0x459190]
mov eax, dword [0x45956c]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
fld qword [0x459190]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
fsubr qword [ebp - 0x10]
fstp dword [0x4592b8]
mov eax, dword [0x459558]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
fld dword [0x44ed00]
fsub dword [0x459290]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
fsubr qword [ebp - 0x10]
call fcn.0041d39c
mov dword [0x459558], eax
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
call fcn.0041c42d
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
mov edi, dword [ebp + 8]
fld qword [0x44e828]
fld qword [0x44e968]
mov cl, byte [edi + 0x449300]
mov byte [esi], cl
mov eax, dword [0x45ad3c]
movzx eax, byte [eax + edi]
xor al, cl
mov byte [esi], al
fld qword [0x459518]
mov eax, dword [0x459088]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 8]
fsub qword [ebp - 8]
movsx eax, word [0x4590b4]
mov dword [ebp + 8], eax
fstp qword [ebp - 0x18]
fild dword [ebp + 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fadd qword [ebp - 0x18]
movsx eax, word [0x4593f8]
mov dword [ebp + 8], eax
fstp qword [ebp - 8]
fild dword [ebp + 8]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [ebp - 8]
call fcn.0041d39c
mov word [0x4593f8], ax
inc word [0x4590b4]
mov cl, byte [edi + 0x449301]
mov byte [esi + 1], cl
mov eax, dword [0x45ad3c]
movzx eax, byte [eax + edi + 1]
add edi, 2
xor al, cl
mov dword [ebp + 8], edi
mov byte [esi + 1], al
fld qword [0x459468]
fsubp st(2)
fsubp st(1)
fstp dword [0x45911c]
fld qword [0x459468]
fld1
fsubp st(1)
fstp qword [0x459468]
movzx ebx, word [esi]
mov dword [ebp - 4], ebx
lea eax, [ebx + 3]
push eax
lea eax, [edi + 0x449300]
push eax
push esi
call fcn.0041d430
mov ecx, dword [ebp + 8]
lea edi, [esi + 3]
add ecx, dword [0x45ad3c]
add edi, ebx
mov eax, edi
add esp, 0xc
xor edx, edx
sub eax, esi
cmp edi, esi
sbb ebx, ebx
not ebx
and ebx, eax
je 0x418c8f
mov edi, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor byte [esi], al
lea esi, [esi + 1]
inc edx
cmp edx, ebx
jne 0x418c80
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
cmp edx, ebx
je 0x418cd9
mov byte [edi], 0
lea esi, [edi - 3]
mov ecx, dword [edi - 3]
mov eax, dword [0x459010]
mov dword [ebp + 8], ecx
mov ecx, 0xbc034aa9
sub ecx, eax
sub edx, ebx
mov dword [ebp + 0xc], ecx
fild dword [ebp + 0xc]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fstp qword [ebp - 0x18]
fld dword [0x459124]
fmul qword [ebp - 0x18]
mov dword [ebp + 0xc], edx
fstp dword [0x459124]
jmp 0x418b89
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419e50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
dec word [0x45949c]
mov ax, word [0x45949c]
mov edx, dword [0x459014]
cwde
sub edx, eax
mov eax, dword [0x459274]
sub edx, eax
mov dword [0x459014], edx
dec dword [0x459274]
push esi
mov esi, ecx
mov dword [esi], 0
fld dword [0x4592ec]
mov eax, dword [0x459134]
fstp qword [ebp - 0x10]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp qword [ebp - 8]
fld dword [0x4594e8]
fadd qword [ebp - 8]
fsub dword [0x44ec28]
fld qword [ebp - 0x10]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x419f33
dec dword [0x4590a0]
mov ecx, dword [0x4590a0]
mov eax, dword [0x459034]
add ecx, 0x5ebe433a
add eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp qword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
fld qword [0x459400]
fsubr qword [0x44e920]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
fld qword [ebp - 8]
fucompp
fnstsw ax
fld qword [0x459400]
fadd qword [0x44e3a0]
fstp qword [0x459400]
test ah, 0x44
jnp 0x419f1f
mov eax, dword [0x4593cc]
jmp 0x419f33
mov dword [0x4591f0], 0x82800000
mov dword [0x4591f4], 0x41d75ecc
mov dword [esi + 4], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42d1f2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45a1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041f71c
mov dword [ebp - 0x14], eax
cmp dword [0x45d420], esi
jne 0x42d2e5
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x42d272
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42d3c5
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x42d3c5
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42d3c5
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x45d420], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x45d424], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45d428], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45d430], eax
test eax, eax
je 0x42d2e2
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45d42c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x42d30a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x42d2fd
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x42d31f
push 4
pop eax
jmp 0x42d3c7
cmp dword [ebp - 0x14], esi
je 0x42d31f
push dword [0x45d420]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x42d304
mov eax, dword [0x45d42c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x42d37d
cmp dword [0x45d430], edi
je 0x42d37d
push eax
call ebx
push dword [0x45d430]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x42d37d
test eax, eax
je 0x42d37d
call ecx
test eax, eax
je 0x42d372
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x42d372
test byte [ebp - 8], 1
jne 0x42d37d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x42d3ad
mov eax, dword [0x45d424]
cmp eax, edi
je 0x42d3aa
push eax
call ebx
test eax, eax
je 0x42d3aa
call eax
mov esi, eax
test esi, esi
je 0x42d3aa
mov eax, dword [0x45d428]
cmp eax, edi
je 0x42d3aa
push eax
call ebx
test eax, eax
je 0x42d3aa
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x45d420]
call ebx
test eax, eax
je 0x42d3c5
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x42d3c7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e12d
mov esp, ebp
pop ebp
ret
Function at 0x401f40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7b4859
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0044a3d0
mov al, byte [esp + 0xb]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov byte [esi + 0x2c], al
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov cl, byte [esp + 0xb]
mov byte [esp + 0x18], 1
mov byte [esi + 0x3c], cl
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dl, byte [esp + 0xb]
mov byte [esp + 0x18], 2
push 0xc
mov byte [esi + 0x6c], dl
call fcn.007a2d8d
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 4
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], ebx
or eax, 0xffffffff
lea edx, [esi + 0x88]
mov byte [esp + 0x18], 3
xor ecx, ecx
mov dword [esi], fcn.004021d0
mov dword [esi + 0x78], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov word [esi + 0x58], 1
mov dword [esi + 0x64], eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
lea edx, [esi + 0x98]
mov dword [esi + 0x98], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov byte [esi + 0xa8], 1
mov byte [esi + 0xb4], bl
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0x60], 2
mov dword [esi + 0x5c], ebx
mov word [esi + 0x5a], bx
mov dword [esp + 0x18], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x409d00
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x7b4eb8
push eax
mov eax, dword [0x870c00]
mov dword fs:[0], esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x409df7
mov eax, dword [0x870c7c]
cmp eax, ebx
je 0x409df7
push ebp
push edi
push 0x200
push 0x870c98
push eax
call dword [sym.imp.user32.dll_GetWindowTextA]
mov al, byte [esp + 0xf]
mov edi, 0x870c98
mov byte [esp + 0x10], al
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], ebx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.00401b40
test al, al
je 0x409da3
mov edi, dword [esp + 0x14]
mov ecx, ebp
mov edx, ecx
push esi
mov esi, 0x870c98
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
pop esi
mov byte [eax + ebp], bl
mov ecx, dword [0x870c00]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x2c], ebx
mov edx, dword [ecx]
call dword [edx + 0x98]
mov eax, dword [esp + 0x14]
pop edi
cmp eax, ebx
mov dword [esp + 0x24], 0xffffffff
pop ebp
je 0x409df7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x409dee
cmp al, 0xff
je 0x409dee
dec al
pop ebx
mov byte [ecx], al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push ecx
call fcn.007a02e0
add esp, 4
mov ecx, dword [esp + 0x18]
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x409e50
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x7b4ed8
push eax
mov eax, dword [0x870c00]
mov dword fs:[0], esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x409f47
mov eax, dword [0x870c84]
cmp eax, ebx
je 0x409f47
push ebp
push edi
push 0x200
push 0x870c98
push eax
call dword [sym.imp.user32.dll_GetWindowTextA]
mov al, byte [esp + 0xf]
mov edi, 0x870c98
mov byte [esp + 0x10], al
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], ebx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.00401b40
test al, al
je 0x409ef3
mov edi, dword [esp + 0x14]
mov ecx, ebp
mov edx, ecx
push esi
mov esi, 0x870c98
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
pop esi
mov byte [eax + ebp], bl
mov ecx, dword [0x870c00]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x2c], ebx
mov edx, dword [ecx]
call dword [edx + 0x98]
mov eax, dword [esp + 0x14]
pop edi
cmp eax, ebx
mov dword [esp + 0x24], 0xffffffff
pop ebp
je 0x409f47
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x409f3e
cmp al, 0xff
je 0x409f3e
dec al
pop ebx
mov byte [ecx], al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push ecx
call fcn.007a02e0
add esp, 4
mov ecx, dword [esp + 0x18]
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x409fa0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x7b4ef8
push eax
mov eax, dword [0x870c00]
mov dword fs:[0], esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x40a097
mov eax, dword [0x870c80]
cmp eax, ebx
je 0x40a097
push ebp
push edi
push 0x200
push 0x870c98
push eax
call dword [sym.imp.user32.dll_GetWindowTextA]
mov al, byte [esp + 0xf]
mov edi, 0x870c98
mov byte [esp + 0x10], al
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], ebx
mov ebp, ecx
lea ecx, [esp + 0x14]
push ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.00401b40
test al, al
je 0x40a043
mov edi, dword [esp + 0x14]
mov ecx, ebp
mov edx, ecx
push esi
mov esi, 0x870c98
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
pop esi
mov byte [eax + ebp], bl
mov ecx, dword [0x870c00]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x2c], ebx
mov edx, dword [ecx]
call dword [edx + 0x98]
mov eax, dword [esp + 0x14]
pop edi
cmp eax, ebx
mov dword [esp + 0x24], 0xffffffff
pop ebp
je 0x40a097
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x40a08e
cmp al, 0xff
je 0x40a08e
dec al
pop ebx
mov byte [ecx], al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push ecx
call fcn.007a02e0
add esp, 4
mov ecx, dword [esp + 0x18]
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x40fe00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x7b5253
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
mov ebx, ecx
push ebp
push esi
lea eax, [ebx + 0x88]
xor esi, esi
push 0x100
mov dword [ebx + 0xbc], esi
mov ecx, dword [eax]
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x1c], esi
mov edx, dword [eax + 4]
mov dword [esp + 0x34], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x3c], edx
call fcn.007a2d8d
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, esi
mov dword [esp + 0x44], esi
je 0x40fe72
mov ecx, eax
call fcn.004126c0
mov ebp, eax
jmp 0x40fe74
xor ebp, ebp
cmp ebp, esi
mov dword [esp + 0x44], 0xffffffff
je 0x40ffac
mov eax, dword [ebp]
push esi
mov ecx, ebp
call dword [eax + 0x70]
mov eax, dword [ebx + 0xf4]
mov ecx, dword [ebx + 0xf0]
mov edx, dword [ebp]
push eax
mov eax, dword [ebx + 0xec]
push ecx
lea ecx, [ebx + 0xdc]
push eax
push ecx
mov ecx, ebp
call dword [edx + 0xa4]
mov ecx, dword [ebp + 0xbc]
mov eax, dword [ebx + 0xf8]
cmp ecx, esi
mov dword [ebp + 0xd8], eax
je 0x40fecd
mov dword [ecx + 0x2c], eax
push edi
mov edi, 0x82b614
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov dl, byte [esp + 0x13]
push 1
not ecx
dec ecx
mov byte [esp + 0x24], dl
mov edi, ecx
lea ecx, [esp + 0x24]
push edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x1c], edi
call fcn.00401b40
test al, al
je 0x40ff2e
mov ecx, edi
mov edi, dword [esp + 0x24]
mov eax, ecx
mov esi, 0x82b614
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], eax
xor esi, esi
mov byte [ecx + eax], 0
mov ecx, dword [ebp + 0xbc]
mov dword [esp + 0x48], 1
cmp ecx, esi
pop edi
je 0x40ff52
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push 1
push eax
call fcn.0043dbb0
mov eax, dword [esp + 0x20]
mov dword [esp + 0x44], 0xffffffff
cmp eax, esi
je 0x40ff7f
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40ff76
cmp al, 0xff
je 0x40ff76
dec al
mov byte [ecx], al
jmp 0x40ff7f
push ecx
call fcn.007a02e0
add esp, 4
mov eax, dword [esp + 0x18]
cmp eax, esi
jle 0x40ffa2
mov ecx, dword [ebx + 0xc4]
mov edx, dword [esp + 0x30]
add ecx, eax
mov eax, dword [esp + 0x38]
sub eax, edx
cdq
idiv ecx
mov dword [ebx + 0xbc], eax
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx + 4]
mov ecx, dword [esp + 0x3c]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x416810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7b5813
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0044a3d0
mov cl, byte [esp + 7]
xor eax, eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x2c], cl
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0xc]
or eax, 0x40000000
mov byte [esp + 0x14], 1
mov dword [esi], 0x7e5df8
mov dword [esi + 4], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4177c0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
lea edi, [esi + 0x1c]
test eax, eax
jle 0x4177d5
mov eax, dword [esi]
call dword [eax]
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.kernel32.dll_ReadFile]
lea ecx, [esp + 0x10]
push 0
push ecx
push 4
push edi
push ebx
mov dword [esp + 0x24], 0
call ebp
cmp dword [edi], 0
jle 0x4178b1
lea edx, [esp + 0x10]
push 0
lea eax, [esi + 0x18]
push edx
push 4
push eax
push ebx
call ebp
lea ecx, [esp + 0x10]
push 0
lea eax, [esi + 0x20]
push ecx
push 4
push eax
push ebx
call ebp
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x20]
mov ecx, dword [edi]
push edx
push eax
push ecx
mov ecx, esi
call fcn.004176a0
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x417873
mov ecx, dword [esi + 0x24]
push eax
mov eax, dword [edi]
lea edx, [esp + 0x14]
push edx
lea eax, [eax + eax*2]
shl eax, 2
push eax
push ecx
push ebx
call ebp
mov edi, dword [edi]
mov esi, dword [esi + 0x24]
lea edx, [edi + edi*2]
pop edi
mov ecx, dword [esi + edx*4 - 0xc]
lea eax, [esi + edx*4]
pop esi
pop ebp
mov dword [eax], ecx
mov edx, dword [eax - 8]
mov dword [eax + 4], edx
mov ecx, dword [eax - 4]
mov dword [eax + 8], ecx
mov al, 1
pop ebx
pop ecx
ret 4
cmp eax, 1
jne 0x4178b1
mov eax, dword [edi]
mov ecx, dword [esi + 0x24]
lea edx, [esp + 0x10]
push 0
shl eax, 4
push edx
push eax
push ecx
push ebx
call ebp
mov edx, dword [edi]
mov esi, dword [esi + 0x24]
shl edx, 4
lea eax, [edx + esi]
lea ecx, [eax - 0x10]
mov edx, dword [eax - 0x10]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 4
Function at 0x419e50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x7b5af6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0044a3d0
xor ebx, ebx
lea ecx, [esi + 0x130]
mov dword [esp + 0x2c], ebx
call fcn.00452900
mov eax, dword [esi + 4]
mov dl, 1
or ah, 0x80
mov byte [esp + 0x2c], dl
lea ebp, [esi + 0x54]
mov dword [esi + 4], eax
mov ecx, 0x17
xor eax, eax
mov edi, ebp
mov dword [esi], 0x7e5e9c
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x160], ebx
mov dword [esi + 0x164], ebx
mov byte [esi + 0x30], dl
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], 0x3f800000
mov ecx, dword [esp + 0x14]
mov eax, ebp
mov dword [esp + 0x18], 0x3f800000
mov dword [esp + 0x1c], 0x3f800000
mov dword [esp + 0x20], 0x3f800000
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [ebp + 0x44], 4
mov dword [ebp + 0x48], ebx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebp + 0x4c], 2
mov dword [ebp + 0x50], ebx
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x54], 5
mov dword [ebp + 0x58], 6
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
fld dword [ebp]
fmul dword [0x7e5860]
mov dword [ebp + 0x1c], eax
mov eax, 0x3f800000
fstp dword [ebp + 0x10]
fld dword [ebp + 4]
fmul dword [0x7e5860]
fstp dword [ebp + 0x14]
fld dword [ebp + 8]
fmul dword [0x7e5860]
fstp dword [ebp + 0x18]
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x110], ebx
mov dword [esi + 0x10c], ebx
mov dword [esi + 0x108], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0xfc], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0x12c], eax
mov dword [esi + 0x118], eax
mov dword [esi + 0x104], eax
mov dword [esi + 0xf0], eax
mov dword [esi + 0x48], eax
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xec], eax
mov dword [esi + 0xd8], eax
mov dword [esi + 0xc4], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0x34], ebx
mov byte [esi + 0x31], dl
mov eax, esi
pop edi
pop esi
mov dword [esp + 0x24], 0xffffffff
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret