joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], edx
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x4029a0
mov dword [esi], 1
jmp 0x402a6a
push 2
push 0
push 0
push ebx
call fcn.0041885e
push ebx
call fcn.00418286
add esp, 0x14
mov dword [ebp - 4], edx
mov edi, eax
push 0
push 0
push 0
push ebx
call fcn.0041885e
mov eax, dword [ebp - 4]
add esp, 0x10
test eax, eax
jg 0x4029e0
jl 0x4029d6
test edi, edi
jae 0x4029e0
mov eax, 2
jmp 0x402a68
xor ecx, ecx
cmp ecx, eax
jne 0x402a63
lea eax, [edi + 1]
push eax
mov dword [ebp - 4], eax
call fcn.00418aef
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x402a03
mov dword [esi], 3
jmp 0x402a6a
push dword [ebp + 8]
push edi
push 1
push ebx
call fcn.00418473
add esp, 0x10
cmp eax, edi
je 0x402a27
push ebx
call fcn.00417cb9
add esp, 4
mov dword [esi], 2
jmp 0x402a6a
push edi
mov edx, ebx
xor ecx, ecx
call fcn.00401860
add esp, 4
cmp eax, 1
jne 0x402a40
mov byte [edi + ebx], 0
mov edi, dword [ebp - 4]
push dword [ebp + 0x14]
sub esp, 8
push eax
mov eax, dword [ebp - 8]
mov edx, eax
push ecx
push edi
push ebx
push eax
mov ecx, esi
call fcn.00402880
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 3
mov dword [esi], eax
pop edi
mov dword [esi + 4], 0
mov eax, esi
mov dword [esi + 8], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4040d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bfcc
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x5c
mov eax, dword [0x43e070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x64], esi
mov dword [esi + 0xc], 0
lea ecx, [esi + 0x30]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 0x68], esi
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
call fcn.00404920
lea ecx, [esi + 0x70]
mov dword [ebp - 4], 0
call fcn.00404920
mov byte [ebp - 4], 1
lea eax, [ebp - 0x60]
mov dword [esi], 0x41f00000
mov ecx, esi
mov dword [esi + 4], 0x42de0000
mov dword [esi + 8], 0x41a80000
push eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
call fcn.004043a0
push fcn.00401180
push 4
push 0x10
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 2
push eax
call fcn.0040f417
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040eedb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x404280
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c036
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x5c
mov eax, dword [0x43e070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mulss xmm1, dword [0x438c30]
push ecx
movss xmm0, dword [ebx + 8]
lea ecx, [ebp - 0x60]
movss dword [esp], xmm0
call fcn.004049d0
mov edx, eax
add esp, 4
mov ecx, dword [edx]
mov dword [esi + 0x30], ecx
mov ecx, dword [edx + 4]
mov dword [esi + 0x34], ecx
mov ecx, dword [edx + 8]
mov dword [esi + 0x38], ecx
mov ecx, dword [edx + 0xc]
mov dword [esi + 0x3c], ecx
mov eax, dword [edx + 0x10]
mov dword [esi + 0x40], eax
mov eax, dword [edx + 0x14]
mov dword [esi + 0x44], eax
mov eax, dword [edx + 0x18]
mov dword [esi + 0x48], eax
mov eax, dword [edx + 0x1c]
mov dword [esi + 0x4c], eax
mov eax, dword [edx + 0x20]
mov dword [esi + 0x50], eax
mov eax, dword [edx + 0x24]
mov dword [esi + 0x54], eax
mov eax, dword [edx + 0x28]
mov dword [esi + 0x58], eax
mov eax, dword [edx + 0x2c]
mov dword [esi + 0x5c], eax
mov eax, dword [edx + 0x30]
mov dword [esi + 0x60], eax
mov eax, dword [edx + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edx + 0x38]
mov dword [esi + 0x68], eax
mov eax, dword [edx + 0x3c]
mov dword [esi + 0x6c], eax
push fcn.00401180
push 4
push 0x10
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 0
push eax
call fcn.0040f417
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040eedb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x4043a0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c066
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x78
mov eax, dword [0x43e070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movss xmm0, dword [esi + 8]
mulss xmm0, dword [0x438c30]
mov edi, dword [ebx + 8]
mov dword [ebp - 0x80], 0
movss dword [ebp - 0x64], xmm0
cvtps2pd xmm0, xmm0
call fcn.0042afd0
movss xmm1, dword [esi]
cvtsd2ss xmm0, xmm0
mulss xmm1, xmm0
movss xmm0, dword [ebp - 0x64]
cvtps2pd xmm0, xmm0
movss dword [ebp - 0x6c], xmm1
call fcn.0042ae10
cvtsd2ss xmm0, xmm0
mulss xmm0, dword [esi]
movss dword [ebp - 0x64], xmm0
movss xmm0, dword [esi + 4]
mulss xmm0, dword [0x438c30]
movss dword [ebp - 0x68], xmm0
cvtps2pd xmm0, xmm0
call fcn.0042ae10
cvtsd2ss xmm0, xmm0
mulss xmm0, dword [ebp - 0x64]
movss dword [ebp - 0x70], xmm0
movss xmm0, dword [ebp - 0x68]
cvtps2pd xmm0, xmm0
call fcn.0042afd0
movss xmm2, dword [esi + 0x20]
lea eax, [esi + 0x18]
movss xmm1, dword [eax + 4]
lea ecx, [ebp - 0x7c]
addss xmm1, dword [ebp - 0x6c]
cvtsd2ss xmm0, xmm0
lea edx, [esi + 0xc]
mov dword [ebp - 0x7c], 0
push ecx
push eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x78], 0x3f800000
mov dword [ebp - 0x74], 0
mulss xmm0, dword [ebp - 0x64]
addss xmm2, xmm0
movss xmm0, dword [eax]
addss xmm0, dword [ebp - 0x70]
movss dword [edx + 4], xmm1
movss dword [edx + 8], xmm2
movss dword [edx], xmm0
call fcn.00404ab0
mov ecx, eax
add esp, 8
add esi, 0x70
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [ecx + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [ecx + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [ecx + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [ecx + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [ecx + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [ecx + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ecx + 0x3c]
mov dword [esi + 0x3c], eax
push fcn.00401180
push 4
push 0x10
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 0
push eax
call fcn.0040f417
push esi
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.00404890
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040eedb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x406de0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov eax, dword [0x43e070]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
push edi
push str._nInitialising_Winsock...
mov byte [esi + 4], 0
call fcn.00406db0
add esp, 4
lea eax, [ebp - 0x1ac]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x406e37
call edi
push eax
push str.Failed._Error_Code_:__d_n
call fcn.00406db0
add esp, 8
jmp 0x406e44
push 0x438570
call fcn.00406db0
add esp, 4
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x406e69
call edi
push eax
push str.Could_not_create_socket_:__d_n
call fcn.00406db0
add esp, 8
jmp 0x406e76
push str.Socket_created._n
call fcn.00406db0
add esp, 4
cmp dword [ebp + 0x20], 0x10
mov eax, 2
mov word [ebp - 0x18], ax
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x18]
push 0x10
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x406ec6
call edi
push eax
push str.Connection_failed_:__d_n
call fcn.00406db0
add esp, 8
jmp 0x406ed7
push str.Connection_is_established._n
call fcn.00406db0
add esp, 4
mov byte [esi + 4], 1
mov bl, byte [esi + 4]
lea ecx, [ebp + 0xc]
call fcn.00403190
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040eedb
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x406f00
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x43e070]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x38], ebx
push edi
mov dword [ebp - 0x3c], 0
cmp byte [esi + 4], 0
jne 0x406f4c
push 0x1d
mov dword [ebx + 0x14], 0xf
mov ecx, ebx
mov dword [ebx + 0x10], 0
push str.Connection_is_not_established
mov byte [ebx], 0
call fcn.00403310
jmp 0x40705f
mov eax, 1
mov dword [ebp - 0x2c], 0x10000
push 0
mov word [ebp - 0x28], ax
mov dword [ebp - 0x26], eax
lea eax, [ebp - 0x2c]
push 0xb
push eax
push dword [esi]
mov byte [ebp - 0x22], 0
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xb
jae 0x406f8c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Data_was_not_send:__d._n
call fcn.00406db0
add esp, 8
mov edi, dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 0x30], 0
nop dword [eax]
lea eax, [ebp - 0x30]
push eax
push 0x4004667f
push dword [esi]
call edi
cmp dword [ebp - 0x30], 0xb
jb 0x406fa0
push 0
push 0xb
lea eax, [ebp - 0x2c]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [ebp - 0x26]
mov dword [ebp - 0x30], 0
lea eax, [ecx - 1]
test eax, eax
je 0x406fee
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
push 0x4004667f
push dword [esi]
call edi
cmp dword [ebp - 0x30], ebx
jb 0x406fd6
mov ecx, dword [ebp - 0x26]
mov ebx, dword [ebp - 0x38]
lea eax, [ecx - 1]
push eax
call fcn.0040f567
mov ecx, dword [ebp - 0x26]
add esp, 4
dec ecx
mov edi, eax
push 0
push ecx
push edi
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x20], 0
cmp byte [edi], 0
jne 0x407027
xor ecx, ecx
jmp 0x407039
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407030
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x20]
call fcn.00403310
push edi
call fcn.0040eeec
add esp, 4
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.00403200
lea ecx, [ebp - 0x20]
call fcn.00403190
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040eedb
mov esp, ebp
pop ebp
ret 4
Function at 0x407080
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c19b
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x43e070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 4], 0
cmp byte [esi + 4], 0
jne 0x407107
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
jmp 0x407277
mov eax, 1
mov dword [ebp - 0x1a], 0x11
mov word [ebp - 0x1c], ax
mov cl, 2
mov ax, word [ebp - 0x18]
push 0
mov dword [ebp - 0x20], 0x10000
movq xmm0, qword [ebp - 0x20]
movq qword [ebp - 0x3c], xmm0
movss xmm0, dword [ebp + 0xc]
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x3c]
push 0x1b
push eax
push dword [esi]
movss dword [ebp - 0x29], xmm0
movss xmm0, dword [ebp + 0x10]
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x32], cl
movss dword [ebp - 0x31], xmm2
movss dword [ebp - 0x2d], xmm3
movss dword [ebp - 0x25], xmm0
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 0xa0], 0
nop word [eax + eax]
lea eax, [ebp - 0xa0]
push eax
push 0x4004667f
push dword [esi]
call edi
cmp dword [ebp - 0xa0], 0xb
jb 0x407180
mov ebx, dword [sym.imp.WS2_32.dll_recv]
lea eax, [ebp - 0x20]
push 0
push 0xb
push eax
push dword [esi]
call ebx
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
nop
lea eax, [ebp - 0xa0]
push eax
push 0x4004667f
push dword [esi]
call edi
cmp dword [ebp - 0xa0], 4
jb 0x4071c0
push 0
push 4
lea eax, [ebp - 0xa4]
push eax
push dword [esi]
call ebx
xor ebx, ebx
cmp dword [ebp - 0xa4], ebx
jbe 0x407257
nop dword [eax]
nop word [eax + eax]
mov dword [ebp - 0xa0], 0
nop word [eax + eax]
lea eax, [ebp - 0xa0]
push eax
push 0x4004667f
push dword [esi]
call edi
cmp dword [ebp - 0xa0], 0x60
jb 0x407210
push 0
push 0x60
lea eax, [ebp - 0x9c]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004072a0
inc ebx
cmp ebx, dword [ebp - 0xa4]
jb 0x407200
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb0]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xac]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xa8]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040eedb
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4082d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c2d8
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x168
mov eax, dword [0x43e070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebx + 0xc]
lea ecx, [ebp - 0x150]
inc dword [0x43f8c0]
push ecx
mov ecx, eax
mov dword [ebp - 0x154], eax
call fcn.00405520
mov esi, eax
lea eax, [ebp - 0x110]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x40]
call fcn.004043a0
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd0]
call fcn.00409cd0
add esp, 4
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x88], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ebp - 0x78], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [ebp - 0x68], xmm0
movups xmm0, xmmword [eax + 0x30]
movups xmmword [ebp - 0x58], xmm0
push fcn.00401180
push 4
push 0x10
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 2
push eax
call fcn.0040f417
push fcn.00401180
push 4
push 0x10
lea eax, [ebp - 0x110]
mov byte [ebp - 4], 3
push eax
call fcn.0040f417
push fcn.00401180
push 4
push 0x10
lea eax, [ebp - 0x150]
mov dword [ebp - 4], 4
push eax
call fcn.0040f417
mov esi, dword [ebp - 0x154]
lea eax, [ebp - 0x170]
add esi, 0x10
mov dword [ebp - 4], 0xffffffff
push eax
mov ecx, esi
call fcn.004057a0
mov ecx, esi
movups xmm0, xmmword [eax]
lea eax, [ebp - 0x170]
push eax
movups xmmword [ebp - 0x48], xmm0
call fcn.004057c0
mov ecx, esi
movups xmm0, xmmword [eax]
lea eax, [ebp - 0x170]
push eax
movups xmmword [ebp - 0x38], xmm0
call fcn.004057f0
push dword [ebx + 8]
push 0x8a11
movups xmm0, xmmword [eax]
mov eax, dword [sym.imp.glew32.dll___glewBindBuffer]
movups xmmword [ebp - 0x28], xmm0
mov eax, dword [eax]
call eax
push 0x88e8
lea eax, [ebp - 0x88]
push eax
mov eax, dword [sym.imp.glew32.dll___glewBufferData]
push 0x70
push 0x8a11
mov eax, dword [eax]
call eax
mov eax, dword [sym.imp.glew32.dll___glewBindBuffer]
push 0
push 0x8a11
mov eax, dword [eax]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040eedb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x40b530
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x43e070]
xor eax, ebp
mov dword [ebp - 4], eax
sub esp, 0xc
mov byte [0x43fa95], 1
lea eax, [ebp - 0x10]
mov ecx, 0x43f9c8
push eax
call fcn.00402e40
lea ecx, [ebp - 0x10]
call fcn.00402c70
push eax
push str.XML_loading_result:__s_n
call fcn.0040b210
add esp, 8
cmp dword [ebp - 0x10], 0
jne 0x40b5df
sub esp, 0x18
mov ecx, esp
push 9
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.127.0.0.1
mov byte [ecx], 0
call fcn.00403310
push 0x6978
mov ecx, 0x43fa90
call fcn.00406de0
lea eax, [ebp - 0x1c]
mov ecx, 0x43fa90
push eax
call fcn.00406f00
cmp dword [eax + 0x14], 0x10
jb 0x40b5bb
mov eax, dword [eax]
push eax
push 0x4387a4
call fcn.00406db0
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.00403190
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eedb
mov esp, ebp
pop ebp
ret
push 1
call fcn.0041c236
int3
Function at 0x40d420
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push str._n_n
mov edi, ecx
call fcn.00406db0
add esp, 4
push esi
push str.LOADING_VERTEX_SHADER___s__n
call fcn.00406db0
push 0x438210
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push esi
push eax
call fcn.00412dae
mov eax, dword [ebp - 4]
add esp, 0x14
test eax, eax
jne 0x40d482
push esi
push str.file__s_cant_be_found_n
call fcn.00406db0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 2
push 0
push eax
call fcn.00418879
add esp, 0xc
push dword [ebp - 4]
call fcn.0041829c
add esp, 4
mov esi, eax
push esi
push str.file_size:__i_bytes_n
call fcn.00406db0
lea ecx, [esi + 1]
push ecx
call fcn.0040f567
add esp, 0xc
mov dword [ebp - 8], 0
mov ebx, eax
mov dword [ebp - 0xc], ebx
push 0
push 0
push dword [ebp - 4]
call fcn.00418879
add esp, 0xc
push dword [ebp - 4]
push esi
push 1
push ebx
call fcn.00418473
push ebx
push str.vertex_shader_text:_n_n_s_n
mov byte [eax + ebx], 0
call fcn.00406db0
push dword [ebp - 4]
call fcn.00415cd0
mov eax, dword [sym.imp.glew32.dll___glewCreateShader]
add esp, 0x1c
mov eax, dword [eax]
push 0x8b31
call eax
mov dword [edi], eax
test eax, eax
jne 0x40d523
push str.Vertex_Shader_can_not_be_created_n
call fcn.00406db0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
push str._nvertex_shader_glCreateShader___4.4i__t_..._OK_n
call fcn.00406db0
add esp, 8
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [sym.imp.glew32.dll___glewShaderSource]
push 1
push dword [edi]
mov eax, dword [eax]
call eax
push str.vertex_shader_glShaderSource_t_t_..._OK_n
call fcn.00406db0
mov eax, dword [sym.imp.glew32.dll___glewCompileShader]
add esp, 4
push dword [edi]
mov eax, dword [eax]
call eax
push str.vertex_shader_glCompileShader_t_t_..._OK_n
call fcn.00406db0
add esp, 4
lea eax, [ebp - 8]
push eax
mov eax, dword [sym.imp.glew32.dll___glewGetShaderiv]
push 0x8b81
push dword [edi]
mov eax, dword [eax]
call eax
push dword [ebp - 8]
push str.vertex_shader_status_...__i_n_n
call fcn.00406db0
add esp, 8
cmp dword [ebp - 8], 0
jne 0x40d5c4
push ebx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [sym.imp.glew32.dll___glewGetShaderInfoLog]
push 0x400
push dword [edi]
mov eax, dword [eax]
call eax
push ebx
push str.vertex_shader_error:_n_s_n
call fcn.00406db0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40d5d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push str._n_n
mov edi, ecx
call fcn.00406db0
add esp, 4
push esi
push str.LOADING_FRAGMENT_SHADER___s__n
call fcn.00406db0
push 0x438210
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push esi
push eax
call fcn.00412dae
mov eax, dword [ebp - 4]
add esp, 0x14
test eax, eax
jne 0x40d632
push esi
push str.file__s_cant_be_found_n
call fcn.00406db0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 2
push 0
push eax
call fcn.00418879
add esp, 0xc
push dword [ebp - 4]
call fcn.0041829c
add esp, 4
mov esi, eax
push esi
push str.file_size:__i_bytes_n
call fcn.00406db0
lea ecx, [esi + 1]
push ecx
call fcn.0040f567
add esp, 0xc
mov dword [ebp - 8], 0
mov ebx, eax
mov dword [ebp - 0xc], ebx
push 0
push 0
push dword [ebp - 4]
call fcn.00418879
add esp, 0xc
push dword [ebp - 4]
push esi
push 1
push ebx
call fcn.00418473
push ebx
push str.fragment_shader_text:_n_n_s_n
mov byte [eax + ebx], 0
call fcn.00406db0
push dword [ebp - 4]
call fcn.00415cd0
mov eax, dword [sym.imp.glew32.dll___glewCreateShader]
add esp, 0x1c
mov eax, dword [eax]
push 0x8b30
call eax
mov dword [edi + 4], eax
test eax, eax
jne 0x40d6d4
push str.Fragment_Shader_can_not_be_created_n
call fcn.00406db0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
push str._nfragment_shader_glCreateShader___4.4i__t_..._OK_n
call fcn.00406db0
add esp, 8
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [sym.imp.glew32.dll___glewShaderSource]
push 1
push dword [edi + 4]
mov eax, dword [eax]
call eax
push str.fragment_shader_glShaderSource_t_t_..._OK_n
call fcn.00406db0
mov eax, dword [sym.imp.glew32.dll___glewCompileShader]
add esp, 4
push dword [edi + 4]
mov eax, dword [eax]
call eax
push str.fragment_shader_glCompileShader_t_t_..._OK_n
call fcn.00406db0
add esp, 4
lea eax, [ebp - 8]
push eax
mov eax, dword [sym.imp.glew32.dll___glewGetShaderiv]
push 0x8b81
push dword [edi + 4]
mov eax, dword [eax]
call eax
push dword [ebp - 8]
push str.fragment_shader_status_...__i_n_n
call fcn.00406db0
add esp, 8
cmp dword [ebp - 8], 0
jne 0x40d779
push ebx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [sym.imp.glew32.dll___glewGetShaderInfoLog]
push 0x400
push dword [edi + 4]
mov eax, dword [eax]
call eax
push ebx
push str.fragment_shader_error:_n_s_n
call fcn.00406db0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x423845
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004236c4

Function at 0x4269e4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004266a4
Function at 0x10001350
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10090f20
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100b70e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0x10
jb 0x10001387
mov eax, dword [edi]
jmp 0x10001389
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10001419
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.100015d0
mov esi, eax
push ecx
mov edx, edi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10003100
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10003200
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.10005690
lea ecx, [ebp - 0x58]
call fcn.10005690
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp dword [edi + 0x14], 0x10
jb 0x100013f1
mov edi, dword [edi]
push eax
push edi
call fcn.10072431
add esp, 8
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push 5
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0x28]
call fcn.10005690
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100524d2
mov esp, ebp
pop ebp
ret