joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x41c26b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x41c28f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x41c2aa
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x41eeb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x428a20
call fcn.0040d370
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.00425831
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x41eeef
call fcn.00425831
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41eefd
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41ef0b
or eax, 0xffffffff
jmp 0x41eff3
mov ecx, esi
call fcn.0041ee26
mov dword [ebp - 0x14], eax
call fcn.0041fce2
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x41ef42
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41ef42
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0041fc96
push dword [ebp - 0x14]
call fcn.0041f7c8
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0041ebbe
cmp eax, edi
je 0x41efb5
test byte [esi + 0x24], 0x10
je 0x41ef83
push 4
mov ecx, esi
pop ebx
call fcn.0041e6d7
test ah, 1
je 0x41ef7b
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.004217f0
cmp dword [esi + 0x1c], edi
je 0x41efb5
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0041e7bd
jmp 0x41efb5
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x41efc9
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x41efe2
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x41efe2
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0041ee60
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x42169e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4216e0
call fcn.00425831
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4216e0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4216d7
xor eax, eax
jmp 0x4216e8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004216ee
pop edi
pop esi
pop ebx
ret 4
Function at 0x425f1f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x425f4d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x425f6b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00425e85
jmp 0x425f6b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x425f6b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00425e85
test edi, edi
mov eax, edi
jne 0x425f55
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40ba30
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00405060
call sub.kernel32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.kernel32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40ba66
jmp 0x40baa5
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x40ba63
cmp al, 0x20
je 0x40ba63
cmp al, 0x22
jne 0x40ba89
jmp 0x40baf4
cmp al, 0x20
lea esi, [esi]
je 0x40ba90
test al, al
je 0x40baa5
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x40ba77
movzx eax, byte [ebx]
cmp al, 0x20
jne 0x40bb0a
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x40ba97
cmp al, 0x20
je 0x40ba97
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x40bab4
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.kernel32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401803
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
je 0x40bafe
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x40baf0
cmp al, 0x22
sete al
movzx eax, al
add ebx, eax
jmp 0x40ba90
cmp al, 9
je 0x40ba97
jmp 0x40baa5

Function at 0x4025ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x406330
cmp edx, dword [eax]
je 0x4025cf
add eax, 8
inc ecx
cmp eax, 0x4063c0
jl 0x4025c0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x406330]
jne 0x4026fd
mov eax, dword [0x40873c]
cmp eax, 1
je 0x4026d7
test eax, eax
jne 0x402600
cmp dword [0x406284], 1
je 0x4026d7
cmp edx, 0xfc
je 0x4026fd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402637
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00402b90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402d40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40267a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402d40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x405418
push edi
call fcn.004043e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00402b90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402ba0
lea eax, [ebp - 0xa0]
push 0x4053f8
push eax
call fcn.00402ba0
push dword [esi + 0x406334]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402ba0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00404354
add esp, 0x2c
pop edi
jmp 0x4026fd
lea eax, [ebp + 8]
lea esi, [esi + 0x406334]
push 0
push eax
push dword [esi]
call fcn.00402d40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x417e80
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
test esi, esi
je 0x417ee2
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov dword [edi], 0
lea esp, [esp]
cmp esi, 0x400000
mov eax, 0x400000
ja 0x417eaf
mov eax, esi
mov edx, dword [ebp]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x417ee7
test ecx, ecx
je 0x417ee0
test esi, esi
ja 0x417ea0
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop ebp
pop ebx
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x417f00
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
test esi, esi
je 0x417f62
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov dword [edi], 0
lea esp, [esp]
cmp esi, 0x400000
mov eax, 0x400000
ja 0x417f2f
mov eax, esi
mov edx, dword [ebp]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x1c]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x417f67
test ecx, ecx
je 0x417f60
test esi, esi
ja 0x417f20
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop ebp
pop ebx
pop edi
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x4182d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x549fc0], ecx
add edx, 1
cmp edx, 0x100
jl 0x4182d2
cmp edx, 0x800
jae 0x4183bb
mov edi, edi
mov eax, dword [edx*4 + 0x549bc0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x549fc0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x549fbc], eax
jb 0x418390
mov dword [0x546960], 0x41a900
call fcn.0041aad0
test eax, eax
jne 0x4183d8
mov dword [0x546960], 0x41a9b0
ret
Function at 0x41e950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x10]
xor eax, eax
and ebp, 7
cmp ecx, 5
jae 0x41e969
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], edx
jmp 0x41e990
mov ecx, dword [esp + 0x18]
lea edi, [eax + ecx]
cmp edi, edx
jae 0x41e9af
jmp 0x41e9a0
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x41e9af
add edi, 1
cmp edi, edx
jb 0x41e9a0
mov eax, edi
sub eax, ecx
mov ecx, eax
sub ecx, dword [esp + 0x1c]
cmp edi, edx
jae 0x41eac5
cmp ecx, 3
jbe 0x41e9e5
xor ebp, ebp
mov cl, byte [edi + 4]
test cl, cl
mov dword [esp + 0x1c], eax
je 0x41ea23
cmp cl, 0xff
je 0x41ea23
and ebp, 3
add ebp, ebp
or ebp, 1
add eax, 1
jmp 0x41e990
add ecx, 0xffffffff
shl ebp, cl
and ebp, 7
je 0x41e9c8
movzx ecx, byte [ebp + 0x4fe9c4]
mov ebx, edi
sub ebx, ecx
cmp byte [ebp + 0x4fe9bc], 0
mov cl, byte [ebx + 4]
je 0x41ea0f
test cl, cl
je 0x41ea0f
cmp cl, 0xff
jne 0x41e9c8
and ebp, 3
add ebp, ebp
mov dword [esp + 0x1c], eax
or ebp, 1
add eax, 1
jmp 0x41e990
xor edx, edx
mov dh, cl
movzx ecx, byte [edi + 2]
mov dl, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
lea esp, [esp]
cmp dword [esp + 0x28], 0
je 0x41ea4e
lea ebx, [edx + eax]
add ebx, esi
jmp 0x41ea54
sub edx, eax
sub edx, esi
mov ebx, edx
test ebp, ebp
je 0x41ea96
movzx esi, byte [ebp + 0x4fe9c4]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x41ea79
cmp dl, 0xff
jne 0x41ea92
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
sub edx, 1
xor edx, ebx
jmp 0x41ea40
mov esi, dword [esp + 0x20]
mov edx, ebx
shr edx, 0x18
and dl, 1
sub dl, 1
not dl
mov byte [edi + 4], dl
mov edx, ebx
shr edx, 8
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x10]
mov byte [edi + 3], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x41e990
cmp ecx, 3
pop edi
pop esi
pop ebx
jbe 0x41ead8
mov ecx, dword [esp + 0x18]
xor ebp, ebp
mov dword [ecx], ebp
pop ebp
pop ecx
ret
add ecx, 0xffffffff
shl ebp, cl
mov ecx, dword [esp + 0x18]
and ebp, 7
mov dword [ecx], ebp
pop ebp
pop ecx
ret

Function at 0x425aa0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x425abd
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call fcn.00425a80
add esp, 4
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x425add
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x2f
je 0x425add
push str.Comments_must_start_with__
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
call fcn.00425b00
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x425b00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0xffffffff
jne 0x425b19
mov eax, dword [ebp + 8]
push eax
call fcn.004b6350
add esp, 4
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
push ecx
call fcn.004b854b
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x425b3c
push str.Failed_to_allocate_string_value_buffer
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004b69e0
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, dword [ebp + 0xc]
mov byte [edx], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x426b50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
shl ecx, 0x18
sar ecx, 0x18
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 7
ja case.default.0x426b7c
mov edx, dword [ebp - 0xc]
jmp dword [edx*4 + 0x426c34]
push 0x4fee57
mov ecx, dword [ebp + 8]
call fcn.004023e0
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x426c2c
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0
je 0x426bb3
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
jmp 0x426bba
mov dword [ebp - 0x10], 0x4fee58
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004023e0
mov edx, dword [ebp - 4]
or edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
jmp 0x426c2c
mov eax, dword [ebp - 8]
movzx ecx, byte [eax]
test ecx, ecx
je 0x426be7
mov dword [ebp - 0x14], 0x4fee5c
jmp 0x426bee
mov dword [ebp - 0x14], 0x4fee64
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.004023e0
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x426c2c
push str.Type_is_not_convertible_to_string
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x4fee59
mov ecx, dword [ebp + 8]
call fcn.004023e0
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x426c60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
shl ecx, 0x18
sar ecx, 0x18
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 7
ja case.default.0x426c85
mov edx, dword [ebp - 8]
jmp dword [edx*4 + 0x426d68]
xor eax, eax
jmp 0x426d62
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 0xffffffff
jl 0x426ccb
jg 0x426caf
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0x80000000
jb 0x426ccb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 4], 0
jl 0x426cd6
jg 0x426ccb
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x7fffffff
jbe 0x426cd6
push 0x4fee90
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
jmp 0x426d62
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx + 4], 0
ja 0x426cfa
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0x7fffffff
jbe 0x426d05
push str.unsigned_integer_out_of_signed_int_range
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
jmp 0x426d62
mov edx, dword [ebp - 4]
fld qword [0x4ff118]
fcomp qword [edx]
fnstsw ax
test ah, 0x41
jp 0x426d30
mov eax, dword [ebp - 4]
fld qword [0x4ff110]
fcomp qword [eax]
fnstsw ax
test ah, 1
je 0x426d3b
push str.Real_out_of_signed_integer_range
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
fld qword [ecx]
call fcn.004bb8f0
jmp 0x426d62
mov edx, dword [ebp - 4]
movzx eax, byte [edx]
neg eax
sbb eax, eax
neg eax
jmp 0x426d62
push str.Type_is_not_convertible_to_int
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x426ed0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
shl ecx, 0x18
sar ecx, 0x18
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 7
ja case.default.0x426ef5
mov edx, dword [ebp - 8]
jmp dword [edx*4 + 0x426fa4]
xor eax, eax
xor edx, edx
jmp 0x426f9d
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
jmp 0x426f9d
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0x7fffffff
jb 0x426f39
ja 0x426f2e
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], 0xffffffff
jbe 0x426f39
push str.unsigned_integer_out_of_Int64_range
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov edx, dword [edx + 4]
jmp 0x426f9d
mov eax, dword [ebp - 4]
fld qword [0x4ff130]
fcomp qword [eax]
fnstsw ax
test ah, 0x41
jp 0x426f67
mov ecx, dword [ebp - 4]
fld qword [0x4ff128]
fcomp qword [ecx]
fnstsw ax
test ah, 1
je 0x426f72
push str.Real_out_of_Int64_range
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 4]
fld qword [edx]
call fcn.004bb8f0
cdq
jmp 0x426f9d
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
neg eax
sbb eax, eax
neg eax
cdq
jmp 0x426f9d
push str.Type_is_not_convertible_to_Int64
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x426fd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
shl ecx, 0x18
sar ecx, 0x18
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 7
ja case.default.0x426ff5
mov edx, dword [ebp - 8]
jmp dword [edx*4 + 0x4270b0]
xor eax, eax
xor edx, edx
jmp 0x4270aa
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 0
jg 0x427029
jl 0x42701e
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jae 0x427029
push str.Negative_integer_can_not_be_converted_to_UInt64
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
jmp 0x4270aa
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov edx, dword [edx + 4]
jmp 0x4270aa
mov eax, dword [ebp - 4]
fldz
fcomp qword [eax]
fnstsw ax
test ah, 0x41
jp 0x42705d
mov ecx, dword [ebp - 4]
fld qword [0x4ff138]
fcomp qword [ecx]
fnstsw ax
test ah, 1
je 0x427068
push str.Real_out_of_UInt64_range
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 4]
fld qword [edx]
fnstcw word [ebp - 0xe]
movzx eax, word [ebp - 0xe]
or eax, 0xc00
mov dword [ebp - 0x14], eax
fldcw word [ebp - 0x14]
fistp qword [ebp - 0x1c]
fldcw word [ebp - 0xe]
mov eax, dword [ebp - 0x1c]
xor edx, edx
jmp 0x4270aa
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
neg eax
sbb eax, eax
neg eax
cdq
jmp 0x4270aa
push str.Type_is_not_convertible_to_UInt64
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret