joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52856c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5286fa
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00403148
mov ebx, eax
call fcn.00403168
mov esi, eax
mov eax, dword [0x56b398]
xor edx, edx
mov dword [eax], edx
mov eax, esi
call fcn.0040e49c
test al, al
je 0x5285c2
mov eax, ebx
call fcn.0040e49c
test al, al
je 0x5285c2
mov eax, ebx
call fcn.0040eb9c
test al, al
jne 0x5285d9
call fcn.00403188
test eax, eax
je 0x5286e4
call fcn.004031bc
jmp 0x5286e4
mov eax, dword [0x56ad1c]
xor edx, edx
mov dword [eax], edx
push 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0052b874
test al, al
jne 0x52863b
mov eax, ebx
mov edx, dword [0x426e1c]
call fcn.00404198
test al, al
je 0x52863b
cmp dword [ebx + 4], 0
je 0x52863b
push 0
lea edx, [ebp - 0x104]
mov eax, dword [ebx]
call fcn.00403eec
lea edx, [ebp - 0x104]
lea eax, [ebp - 4]
call fcn.00405290
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 4]
mov ecx, 0x2010
call fcn.0041bb6c
mov eax, dword [0x56ad1c]
cmp dword [eax], 0
je 0x528652
mov eax, dword [0x56ad1c]
cmp dword [eax], 0x103
jne 0x5286d1
mov eax, ebx
mov edx, dword [0x426fe8]
call fcn.00404198
test al, al
je 0x528678
cmp dword [ebx + 0xc], 0
je 0x528678
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov edx, dword [0x56ad1c]
mov dword [edx], eax
jmp 0x5286af
mov eax, ebx
mov edx, dword [0x4277b0]
call fcn.00404198
test al, al
je 0x5286a4
mov eax, dword [ebx + 0xc]
test eax, eax
jns 0x528695
call fcn.00403edc
call fcn.00408788
mov edx, dword [0x56ad1c]
mov dword [edx], eax
jmp 0x5286af
mov eax, dword [0x56ad1c]
mov dword [eax], 0xeedfade
mov eax, dword [0x56ad1c]
cmp dword [eax], 0
je 0x5286c6
mov eax, dword [0x56ad1c]
cmp dword [eax], 0x103
jne 0x5286d1
mov eax, dword [0x56ad1c]
mov dword [eax], 0x1f
mov eax, dword [0x56ad1c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x528701
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x528fdc
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5290b9
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00415d7c
call fcn.00424c00
mov eax, 0x5290c8
call fcn.0041a7fc
mov eax, 0x5290c8
call fcn.00425240
test bl, bl
je 0x529088
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.00405224
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.004038b8
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, edi
call fcn.0040550c
push eax
push 0
push 0x200
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.0040f260
mov eax, dword [ebp - 0x5c]
call fcn.0040550c
push eax
call sub.kernel32.dll_CreateProcessA
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5290c0
lea eax, [ebp - 0x5c]
call fcn.0040502c
lea eax, [ebp - 4]
call fcn.0040502c
ret

Function at 0x52c540
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.004aa864
mov edi, eax
dec edi
test edi, edi
jl 0x52c5b6
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, esi
call fcn.004aa86c
mov byte [eax + 0x58], 0
mov edx, ebx
mov eax, esi
call fcn.004aa86c
mov eax, dword [eax + 4]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 4]
je 0x52c5b2
push ebp
mov edx, ebx
mov eax, esi
call fcn.004aa86c
call fcn.0052c4bc
pop ecx
test al, al
je 0x52c5b2
mov edx, ebx
mov eax, esi
call fcn.004aa86c
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x52c5b2
mov edx, ebx
mov eax, esi
call fcn.004aa86c
mov byte [eax + 0x58], 1
inc ebx
dec edi
jne 0x52c559
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x52c5c4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
mov eax, edi
call fcn.004aa864
mov esi, eax
dec esi
test esi, esi
jl 0x52c612
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, edi
call fcn.004aa86c
call fcn.0052c5bc
test al, al
je 0x52c60e
mov edx, ebx
mov eax, edi
call fcn.004aa86c
mov byte [eax + 0x58], 0
mov edx, ebx
mov eax, edi
call fcn.004aa86c
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_ResumeThread
inc ebx
dec esi
jne 0x52c5dd
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x52ecbc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x52ed64
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040ed60
mov ebx, eax
test bl, bl
jne 0x52ed49
mov bl, 1
push 4
lea eax, [ebp - 4]
push eax
push 0x52ed74
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x52ed49
push 4
lea eax, [ebp - 4]
push eax
push 0x52ed8c
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x52ed49
call fcn.00403544
mov esi, eax
test esi, esi
jle 0x52ed47
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004035a4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00427c80
mov eax, dword [ebp - 8]
mov edx, 0x52eda8
call fcn.00405458
je 0x52ed49
inc dword [ebp - 4]
dec esi
jne 0x52ed1c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52ed6b
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405050
ret

Function at 0x52ee90
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
call fcn.0040f7d8
test al, al
jne 0x52ef08
cmp dword [0x670bc4], 0
je 0x52ef08
mov eax, dword [0x670bc4]
call fcn.00444d28
mov eax, dword [0x56e7f8]
call fcn.0041bdec
test al, al
jne 0x52eee7
call sub.kernel32.dll_GetCurrentThreadId_1
mov edx, dword [0x56b554]
cmp eax, dword [edx]
jne 0x52eedb
mov eax, dword [0x670bc4]
mov eax, dword [eax + 4]
call fcn.0052ee34
jmp 0x52eefe
mov eax, dword [0x670bc4]
call fcn.00444d30
jmp 0x52eefe
push 0x64
call sub.kernel32.dll_Sleep_2
push 1
mov eax, dword [0x670bc4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, 0x670bc4
call fcn.0040f80c
pop ebp
ret

Function at 0x5329a8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x532a66
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0052f034
call fcn.00488ed4
test al, al
je 0x532a4b
call fcn.0040f4fc
lea edx, [ebp - 4]
call fcn.0040f260
mov eax, dword [ebp - 4]
call fcn.00457e1c
test al, al
je 0x532a0c
call fcn.0040f4fc
cmp eax, dword [0x56e7f8]
je 0x532a4b
lea edx, [ebp - 8]
mov eax, dword [0x56e7f8]
call fcn.0040f260
mov eax, dword [ebp - 8]
call fcn.00457e1c
test al, al
jne 0x532a4b
push 0
call fcn.0052f034
lea ecx, [ebp - 0xc]
mov dl, 2
call fcn.00489928
mov eax, dword [ebp - 0xc]
push eax
call fcn.0052f034
lea ecx, [ebp - 0x10]
mov dl, 0x99
call fcn.00489928
mov eax, dword [ebp - 0x10]
mov ecx, 0x10
pop edx
call fcn.0041bb6c
push 0xb
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x532a6d
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405050
ret
Function at 0x412281
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x412290
pop dword [ebp - 0x44]
mov eax, 0xb7d630b3
sub eax, 0xb7950e23
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3a7a2
push 0
mov eax, 0xee182849
add eax, 0x122a67e3
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x9b1ad781
sub ecx, 0x9b1a89c8
mov esi, eax
mov edi, 0x436e00
add edi, dword [ebp - 0x44]
mov ebx, 0xe707293d
sub ebx, 0x649b710f
add dword [ebp - 0x38], edx
mov edx, dword [edi]
sub dword [ebp - 0x28], esi
xor edx, ebx
xor dword [ebp - 0x1c], eax
mov dword [esi], edx
mov dword [ebp - 0xc], 0xa6d8d06f
add esi, 0x1ef09228
add esi, 0xe10f6ddc
add edi, 0xc75ee899
add edi, 0x38a1176b
loop 0x4122e9
add eax, 0xaf0ebcd8
add eax, 0x50f26cdf
mov ebx, eax
add eax, 0xf6a17804
sub eax, 0xf6a177ff
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x41c630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x41c63f
pop dword [ebp - 0x30]
mov eax, 0x41c63f
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x421fe
push 0
mov eax, 0xc3096c0a
add eax, 0x3d39d536
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x1b013d35
add ecx, 0xe4ff090f
xor edx, edx
add edx, eax
mov ebx, 0x6041dfd9
add ebx, 0xa0061627
add ebx, dword [ebp - 0x30]
mov edi, 0x773f2de1
mov dword [ebp - 0x2c], 0xc6490061
mov esi, dword [ebx]
sub dword [ebp - 0xc], 0xc866a0f1
sub esi, edi
sub dword [ebp - 0x24], 0x9c951118
mov dword [edx], esi
xor dword [ebp - 0x18], 0xd2d0aa86
add edx, 0xc212d4ac
add edx, 0x3ded2b58
add ebx, 0x666232a8
add ebx, 0x999dcd5c
loop 0x41c695
add eax, 0x3aaa55c2
add eax, 0xc556b621
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x42208d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445e00]
jne 0x422097
repz ret
jmp fcn.004281f4
Function at 0x4022e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ee9b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x43dfc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x4315f4
call fcn.0041aa34
push 4
mov dword [ebp - 4], 0
call fcn.0041ba4f
mov edi, eax
add esp, 4
test edi, edi
je 0x402360
call fcn.0041a38e
mov dword [edi], eax
call fcn.0041a14d
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0041a082
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x402356
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0041a0aa
jmp 0x402362
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406f80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ee9b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x43dfc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x4318dc
call fcn.0041aa34
push 4
mov dword [ebp - 4], 0
call fcn.0041ba4f
mov edi, eax
add esp, 4
test edi, edi
je 0x407000
call fcn.0041a38e
mov dword [edi], eax
call fcn.0041a14d
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0041a082
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406ff6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0041a0aa
jmp 0x407002
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f3a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x43dfc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x40b44c
cmp byte [edi + 0x4a], bl
je 0x40b44c
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffff
call edx
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
je 0x40b440
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x40b3a0
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x40b3b8
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
mov edx, dword [esi + 0x18]
push eax
lea eax, [edi + 0x4c]
push eax
call edx
sub eax, 0
je 0x40b3e1
dec eax
je 0x40b3e5
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x40b43b
jmp 0x40b447
mov byte [edi + 0x4a], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x40b3f5
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x40b41e
cmp ebx, 0x10
jae 0x40b404
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0041d0f4
add esp, 0x10
cmp esi, eax
jne 0x40b438
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x4a], 0
je 0x40b444
test esi, esi
jne 0x40b3ac
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00403610
jmp 0x40b3a6
lea ecx, [ebp - 0x2c]
call fcn.00403520
xor al, al
jmp 0x40b44e
lea ecx, [ebp - 0x2c]
call fcn.00403520
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b271
mov esp, ebp
pop ebp
ret
Function at 0x407c18
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48a300
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [esp + 0x20], 0
sub esp, 0xc
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x10], esp
push eax
call fcn.00404840
mov byte [esp + 0x2c], 1
mov byte [esp + 0x2c], 0
lea ecx, [esp + 0x14]
call fcn.00407b40
mov byte [esp + 0x20], 2
mov ecx, dword [esp + 0x28]
mov edx, dword [esi]
mov edx, dword [edx + 4]
lea eax, [esp + 8]
push eax
push ecx
mov ecx, esi
call edx
mov byte [esp + 0x20], 0
mov eax, dword [esp + 0xc]
push eax
call fcn.0046d942
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0046d942
mov ecx, dword [esp + 0x20]
add esp, 8
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0x14
Function at 0x40fc80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48a998
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, dword [esp + 0x38]
lea eax, [esp + 4]
push esi
push eax
call fcn.00407140
mov dword [esp + 0x38], 0
lea ecx, [esp + 0xc]
push ecx
call fcn.0043c840
add esp, 0xc
push 0x493d24
lea ecx, [esp + 0x20]
call fcn.00404790
mov byte [esp + 0x30], 1
push 0x493d1c
lea ecx, [esp + 0x14]
call fcn.00404790
mov byte [esp + 0x30], 2
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
call fcn.0040bd30
mov byte [esp + 0x30], 1
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0046d942
mov byte [esp + 0x34], 0
mov edx, dword [esp + 0x20]
push edx
call fcn.0046d942
mov eax, dword [esp + 0xc]
add esp, 8
push eax
push esi
call dword [0x493368]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 4]
push ecx
call fcn.0046d942
mov ecx, dword [esp + 0x2c]
add esp, 4
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x414a50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48a3f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
lea ecx, [esp + 0x14]
call fcn.0045a4c9
mov dword [esp + 0x28], 0
mov edi, dword [0x4b8728]
mov ecx, 0x4b8a8c
mov dword [esp + 0xc], edi
call fcn.00402110
mov ebx, dword [esp + 0x30]
mov esi, eax
mov eax, dword [ebx]
cmp esi, dword [eax + 0xc]
jae 0x414ac1
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x414ac5
cmp byte [eax + 0x14], 0
je 0x414ac5
call fcn.0045a5a5
cmp esi, dword [eax + 0xc]
jae 0x414acb
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x414ac7
xor ecx, ecx
jmp 0x414aa9
mov esi, ecx
test esi, esi
jne 0x414b1d
test edi, edi
je 0x414ad3
mov esi, edi
jmp 0x414b1d
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00413dd0
add esp, 8
cmp eax, 0xffffffff
jne 0x414b03
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.0046db4d
push 0x4a2a2c
lea ecx, [esp + 0x18]
push ecx
call fcn.0046ec7c
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x4b8728], esi
call fcn.00402180
push esi
call fcn.0045a66a
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0045a4f1
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x414f00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x48b011
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov ecx, dword [esp + 0x34]
push ebx
push esi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov dword [esp + 0x10], ebx
xor eax, eax
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], ax
call fcn.00410370
mov dword [esp + 0x30], 1
mov edx, dword [esp + 0x40]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x414f55
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.004121f0
mov esi, dword [esp + 0x38]
push 0xffffffffffffffff
push ebx
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.00410370
mov dword [esp + 8], 1
mov byte [esp + 0x30], bl
cmp dword [esp + 0x24], 8
jb 0x414fae
mov eax, dword [esp + 0x10]
push eax
call fcn.0046d9dc
add esp, 4
xor ecx, ecx
mov word [esp + 0x10], cx
mov ecx, dword [esp + 0x28]
mov eax, esi
mov dword [esp + 0x20], ebx
pop esi
mov dword [esp + 0x20], 7
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x415c80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48a9e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00413b50
xor edx, edx
mov dword [esp + 0x14], edx
mov dword [esi], 0x493d2c
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
lea eax, [edi + 0x30]
push edx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edx
push eax
mov byte [ecx + 4], dl
call fcn.00410180
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x415e20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48b493
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00415210
mov dword [esp + 0x18], 0
mov dword [esi + 0x3c], 0x49365c
mov byte [esp + 0x18], 1
mov dword [esi], 0x493db0
mov dword [esi + 0x28], 0x493da8
mov dword [esi + 0x3c], 0x493d98
test edi, edi
je 0x415e7a
lea ebx, [edi + 0x28]
jmp 0x415e7c
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov edi, dword [ebx + 4]
test ecx, ecx
je 0x415e8d
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov dword [esi + 0x2c], edi
test edi, edi
je 0x415e9d
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x417300
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48b240
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push 0x28
xor ebx, ebx
push str.Day_of_month_value_is_out_of_range_1..31
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00410750
mov dword [esp + 0x30], ebx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00413a80
mov byte [esp + 0x30], 2
cmp dword [esp + 0x24], 0x10
jb 0x41736b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0046d9dc
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov dword [esi], 0x493f6c
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x4173a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48b240
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push 0x27
xor ebx, ebx
push str.Year_is_out_of_valid_range:_1400..10000
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00410750
mov dword [esp + 0x30], ebx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00413a80
mov byte [esp + 0x30], 2
cmp dword [esp + 0x24], 0x10
jb 0x41740b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0046d9dc
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov dword [esi], 0x49409c
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x417440
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48b240
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push 0x22
xor ebx, ebx
push str.Month_number_is_out_of_range_1..12
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00410750
mov dword [esp + 0x30], ebx
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00413a80
mov byte [esp + 0x30], 2
cmp dword [esp + 0x24], 0x10
jb 0x4174ab
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0046d9dc
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov dword [esi], 0x4940d0
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret