joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407ac4
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x4176c4], 0
jne 0x407b83
mov dword [ebp - 0x10], 0x80000000
push 0x400
call fcn.0040db3d
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x4176c4], eax
mov dword [ebp - 0xc], 0
jmp 0x407b08
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x100
jge 0x407b83
push 8
mov edx, dword [ebp - 0xc]
push edx
call fcn.00407a6e
add esp, 8
shl eax, 0x18
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
jmp 0x407b37
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 8
jge 0x407b64
mov ecx, dword [ebp - 0x18]
and ecx, 0x80000000
test ecx, ecx
je 0x407b5a
mov edx, dword [ebp - 0x18]
shl edx, 1
xor edx, 0x4c11db7
mov dword [ebp - 0x18], edx
jmp 0x407b62
mov eax, dword [ebp - 0x18]
shl eax, 1
mov dword [ebp - 0x18], eax
jmp 0x407b2e
push 0x20
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00407a6e
add esp, 8
mov edx, dword [ebp - 0xc]
mov ecx, dword [0x4176c4]
mov dword [ecx + edx*4], eax
jmp 0x407aff
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jmp 0x407b9d
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jae 0x407bc9
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
xor ecx, dword [ebp + 0x10]
and ecx, 0xff
mov edx, dword [ebp + 0x10]
shr edx, 8
mov eax, dword [0x4176c4]
mov ecx, dword [eax + ecx*4]
xor ecx, edx
mov dword [ebp + 0x10], ecx
jmp 0x407b94
mov eax, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x40878a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x4087f6
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x40883f
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00413a70
add esp, 8
test eax, eax
jne 0x40883d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x408841
jmp 0x4087ed
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40d584
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.0040a549
add esp, 4
and eax, 0xff
test eax, eax
je 0x40d60d
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.0040e280
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x40d60b
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0x40d60b
jmp 0x40d60d
jmp 0x40d58d
mov esp, ebp
pop ebp
ret

Function at 0x410252
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x414ae8
cmp edx, dword [eax]
je 0x410274
add eax, 8
inc ecx
cmp eax, 0x414b78
jl 0x410265
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x414ae8]
jne 0x4103a2
mov eax, dword [0x417bf0]
cmp eax, 1
je 0x41037c
test eax, eax
jne 0x4102a5
cmp dword [0x414824], 1
je 0x41037c
cmp edx, 0xfc
je 0x4103a2
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4102dc
lea eax, [ebp - 0x1a4]
push 0x4175b0
push eax
call fcn.0040e5c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040e370
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41031f
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040e370
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4175ac
push edi
call fcn.0040e770
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x417590
push eax
call fcn.0040e5c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040e5d0
lea eax, [ebp - 0xa0]
push 0x41758c
push eax
call fcn.0040e5d0
push dword [esi + 0x414aec]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040e5d0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x417564
push eax
call fcn.00412838
add esp, 0x2c
pop edi
jmp 0x4103a2
lea eax, [ebp + 8]
lea esi, [esi + 0x414aec]
push 0
push eax
push dword [esi]
call fcn.0040e370
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x402b10
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
or esi, 0xffffffff
cmp dword [edi], 0xa
jne 0x402c32
mov ecx, dword [edi + 4]
push ebx
xor ebx, ebx
mov edx, dword [ecx + 8]
mov eax, edx
not eax
movzx esi, al
mov esi, dword [esi*4 + 0x413b08]
not esi
test edx, edx
jle 0x402bc0
mov ecx, dword [ecx]
mov ecx, dword [ecx + ebx*4]
call fcn.00402b10
xor eax, esi
sar esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x413b08]
mov eax, dword [edi + 4]
mov ecx, dword [eax]
mov ecx, dword [ecx + ebx*4]
call fcn.00402b10
sar eax, 8
xor eax, esi
sar esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x413b08]
mov eax, dword [edi + 4]
mov ecx, dword [eax]
mov ecx, dword [ecx + ebx*4]
call fcn.00402b10
sar eax, 0x10
xor eax, esi
sar esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x413b08]
mov eax, dword [edi + 4]
mov ecx, dword [eax]
mov ecx, dword [ecx + ebx*4]
call fcn.00402b10
mov ecx, dword [edi + 4]
inc ebx
shr eax, 0x18
xor eax, esi
sar esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x413b08]
cmp ebx, dword [ecx + 8]
jl 0x402b41
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 4]
call fcn.00402b10
mov ecx, dword [edi + 4]
xor eax, esi
movzx eax, al
sar esi, 8
mov ecx, dword [ecx + 4]
xor esi, dword [eax*4 + 0x413b08]
call fcn.00402b10
mov ecx, dword [edi + 4]
sar eax, 8
xor eax, esi
sar esi, 8
movzx eax, al
mov ecx, dword [ecx + 4]
xor esi, dword [eax*4 + 0x413b08]
call fcn.00402b10
mov ecx, dword [edi + 4]
sar eax, 0x10
xor eax, esi
sar esi, 8
movzx eax, al
mov ecx, dword [ecx + 4]
xor esi, dword [eax*4 + 0x413b08]
call fcn.00402b10
shr eax, 0x18
xor eax, esi
sar esi, 8
movzx eax, al
pop ebx
xor esi, dword [eax*4 + 0x413b08]
mov eax, dword [edi]
xor eax, esi
sar esi, 8
movzx eax, al
pop edi
xor esi, dword [eax*4 + 0x413b08]
mov eax, esi
pop esi
ret

Function at 0x402c50
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
or esi, 0xffffffff
mov edx, dword [edi]
mov al, byte [edx]
test al, al
je 0x402c7b
nop
movsx eax, al
lea edx, [edx + 1]
xor eax, esi
sar esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x413b08]
mov al, byte [edx]
test al, al
jne 0x402c60
mov ecx, dword [edi + 4]
mov al, byte [ecx]
test al, al
je 0x402c9f
movsx eax, al
lea ecx, [ecx + 1]
xor eax, esi
sar esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x413b08]
mov al, byte [ecx]
test al, al
jne 0x402c84
mov ecx, dword [edi + 8]
call fcn.00402b10
mov edx, eax
xor eax, esi
movzx eax, al
sar esi, 8
pop edi
xor esi, dword [eax*4 + 0x413b08]
mov eax, edx
sar eax, 8
xor eax, esi
sar esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x413b08]
mov eax, edx
sar eax, 0x10
xor eax, esi
shr edx, 0x18
movzx ecx, al
sar esi, 8
xor esi, dword [ecx*4 + 0x413b08]
xor edx, esi
sar esi, 8
movzx ecx, dl
xor esi, dword [ecx*4 + 0x413b08]
mov eax, esi
pop esi
ret
Function at 0x402d00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
mov edi, ecx
mov ecx, dword [edi + 0x10]
call fcn.00402b10
mov ebx, eax
mov edx, eax
mov ecx, ebx
not edx
sar ecx, 8
movzx eax, dl
mov edx, dword [edi + 0x20]
mov eax, dword [eax*4 + 0x413b08]
not eax
xor ecx, eax
sar eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x413b08]
mov ecx, ebx
sar ecx, 0x10
xor ecx, eax
shr ebx, 0x18
movzx ecx, cl
sar eax, 8
xor eax, dword [ecx*4 + 0x413b08]
xor ebx, eax
sar eax, 8
movzx ecx, bl
xor eax, dword [ecx*4 + 0x413b08]
test edx, edx
je 0x402dbd
mov edx, dword [edx + 0xc]
movzx ecx, word [edx]
test cx, cx
je 0x402d8a
nop word [eax + eax]
xor ecx, eax
lea edx, [edx + 2]
movzx ecx, cl
sar eax, 8
xor eax, dword [ecx*4 + 0x413b08]
movzx ecx, word [edx]
test cx, cx
jne 0x402d70
mov edx, dword [edi + 0x24]
movzx ecx, word [edx]
test cx, cx
je 0x402e69
nop dword [eax]
xor ecx, eax
lea edx, [edx + 2]
movzx ecx, cl
sar eax, 8
xor eax, dword [ecx*4 + 0x413b08]
movzx ecx, word [edx]
test cx, cx
jne 0x402da0
pop edi
pop ebx
ret
push esi
mov esi, dword [edi + 0x24]
test esi, esi
je 0x402e68
mov ecx, dword [esi + 0x20]
mov edx, dword [ecx + 0xc]
movzx ecx, word [edx]
test cx, cx
je 0x402df1
xor ecx, eax
lea edx, [edx + 2]
movzx ecx, cl
sar eax, 8
xor eax, dword [ecx*4 + 0x413b08]
movzx ecx, word [edx]
test cx, cx
jne 0x402dd7
mov edx, dword [esi + 0x24]
movzx ecx, word [edx]
test cx, cx
je 0x402e1a
nop dword [eax]
xor ecx, eax
lea edx, [edx + 2]
movzx ecx, cl
sar eax, 8
xor eax, dword [ecx*4 + 0x413b08]
movzx ecx, word [edx]
test cx, cx
jne 0x402e00
mov edx, dword [edi + 0xc]
mov ecx, edx
xor ecx, eax
sar eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x413b08]
mov ecx, edx
sar ecx, 8
xor ecx, eax
sar eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x413b08]
mov ecx, edx
sar ecx, 0x10
xor ecx, eax
shr edx, 0x18
movzx ecx, cl
sar eax, 8
xor eax, dword [ecx*4 + 0x413b08]
xor edx, eax
sar eax, 8
movzx ecx, dl
xor eax, dword [ecx*4 + 0x413b08]
pop esi
pop edi
pop ebx
ret
Function at 0x404290
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x194]
mov ebx, dword [edi]
sub ebx, dword [edi + 0x1ac]
lea eax, [ecx - 0x100]
cmp ebx, eax
jle 0x40436b
shl ecx, 2
mov eax, 0x55555556
imul ecx
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4042ed
mov eax, dword [edi + 0x1b0]
mov eax, dword [eax]
mov ecx, dword [eax + 0x20]
test ecx, ecx
jle 0x4042ea
mov eax, dword [eax + 0x64]
add eax, 8
nop dword [eax]
add esi, dword [eax]
lea eax, [eax + 0x28]
sub ecx, 1
jne 0x4042e0
shl esi, 2
mov eax, dword [edi + 0x194]
add eax, 0x400
cmp esi, eax
cmovl esi, eax
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x404334
push 0x18a
push esi
push str.JIT_ERROR__d__jit.c_line__d__n
call fcn.00401010
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40432c
int3
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [edi + 0x1ac]
test ecx, ecx
je 0x40435b
push ebx
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [edi + 0x1ac]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 4]
add esp, 4
mov dword [edi + 0x1ac], eax
add eax, ebx
mov dword [edi], eax
mov dword [edi + 0x194], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405a70
Capabilities:
Terminate process

Disassembly:
mov eax, ecx
push esi
test edx, edx
je 0x405adc
test edx, 0x40000000
je 0x405aca
mov ecx, dword [eax]
and edx, 0x3fffffff
mov esi, dword [eax + 0x1ac]
sub ecx, esi
sub ecx, edx
dec ecx
lea eax, [ecx + 0x80]
cmp eax, 0xff
ja 0x405aa4
mov byte [esi + edx], cl
pop esi
ret
push 0x32e
push ecx
push str.JIT_ERROR__d__jit.c_line__d__n
call fcn.00401010
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x405ac2
int3
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [eax + 0x1ac]
mov eax, dword [eax]
sub eax, ecx
sub eax, edx
sub eax, 4
mov dword [ecx + edx], eax
pop esi
ret

Function at 0x405ae0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
test edx, edx
je 0x405b4b
mov ecx, dword [ebp + 8]
test edx, 0x40000000
je 0x405b3d
and edx, 0x3fffffff
sub ecx, edx
dec ecx
lea eax, [ecx + 0x80]
cmp eax, 0xff
ja 0x405b17
mov eax, dword [esi + 0x1ac]
mov byte [edx + eax], cl
pop esi
pop ebp
ret
push 0x33b
push ecx
push str.JIT_ERROR__d__jit.c_line__d__n
call fcn.00401010
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x405b35
int3
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [esi + 0x1ac]
sub ecx, edx
sub ecx, 4
mov dword [edx + eax], ecx
pop esi
pop ebp
ret
Function at 0x405e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov esi, dword [edi + 0xc]
test esi, esi
jne 0x405e54
lea esi, [edi + 0x10]
cmp dword [esi], 1
je 0x405ed4
mov eax, dword [edi + 8]
mov eax, dword [eax]
cmp eax, 6
je 0x405e93
cmp eax, 5
je 0x405e93
cmp eax, 4
je 0x405e93
push 0x3cb
push eax
push str.JIT_ERROR__d__jit.c_line__d__n
call fcn.00401010
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x405e8b
int3
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov edx, 1
call fcn.00405b50
cmp byte [ebp + 8], 0
mov esi, eax
je 0x405eb9
push edi
mov edx, esi
mov ecx, ebx
call fcn.00405de0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [edi + 0xc]
test eax, eax
je 0x405ec7
mov dword [eax + 0xc], 0
mov dword [edi + 0xc], esi
mov eax, esi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebx + 0x1a4]
cmp dword [esi + 8], eax
jge 0x405ee2
mov dword [esi + 8], eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x405ef0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov esi, dword [edi + 0xc]
test esi, esi
jne 0x405f08
lea esi, [edi + 0x10]
cmp dword [esi], 0
je 0x405f9b
mov eax, dword [edi + 8]
cmp dword [eax], 4
jne 0x405f2b
push dword [ebp + 8]
call fcn.00405e40
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
cmp eax, 4
jle 0x405f59
push 0x3e6
push eax
push str.JIT_ERROR__d__jit.c_line__d__n
call fcn.00401010
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x405f51
int3
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor edx, edx
call fcn.00405b50
cmp byte [ebp + 8], 0
mov esi, eax
je 0x405f7e
push edi
mov edx, esi
mov ecx, ebx
call fcn.00405de0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xc]
test eax, eax
je 0x405f8c
mov dword [eax + 0xc], 0
mov dword [edi + 0xc], esi
mov eax, esi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x1a4]
cmp dword [esi + 8], eax
jge 0x405fa9
mov dword [esi + 8], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405fc0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov esi, dword [edi + 0xc]
test esi, esi
jne 0x405fd1
lea esi, [edi + 0x10]
cmp dword [esi], 0
je 0x406039
mov eax, dword [edi + 8]
cmp dword [eax], 4
jne 0x405fec
push 1
call fcn.00405e40
add esp, 4
pop edi
pop esi
pop ebx
ret
mov eax, dword [edi + 4]
cmp eax, 4
jle 0x40601a
push 0x3f8
push eax
push str.JIT_ERROR__d__jit.c_line__d__n
call fcn.00401010
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x406012
int3
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov edx, 9
call fcn.00405b50
mov esi, eax
mov ecx, ebx
push edi
mov edx, esi
call fcn.00405de0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
mov eax, dword [ebx + 0x1a4]
cmp dword [esi + 8], eax
jge 0x406047
mov dword [esi + 8], eax
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4066c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov eax, dword [edi + 4]
cmp eax, 4
jle 0x4066fb
push 0x4e2
push eax
push str.JIT_ERROR__d__jit.c_line__d__n
call fcn.00401010
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4066f3
int3
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ebp + 8]
push 0
test eax, eax
jne 0x406726
call fcn.00405ef0
add esp, 4
mov edx, edi
mov ecx, ebx
mov esi, eax
push 0
call fcn.00405ef0
add esp, 4
mov edx, 0xe
push 0
push esi
jmp 0x406747
mov dword [ebp - 0x14], 3
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], eax
call fcn.00405ef0
add esp, 4
lea ecx, [ebp - 0x14]
xor edx, edx
push 0
push ecx
push eax
mov ecx, ebx
call fcn.004043b0
add esp, 0xc
mov edx, edi
mov ecx, ebx
push 0
push dword [edi + 0xc]
call fcn.00406530
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406e70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
push esi
mov esi, ecx
push edi
test ebx, ebx
jns 0x406e8a
or edi, 0xffffffff
jmp 0x406e96
mov eax, dword [esi + 0x1b0]
mov eax, dword [eax + 0x14]
mov edi, dword [eax + ebx*4]
mov eax, dword [esi + 0x1b0]
mov edx, dword [ebp + 0xc]
push 0
push dword [esi + 4]
mov eax, dword [eax]
push dword [ebp + 0x10]
cmp edi, dword [eax + 0x20]
setge byte [ebp + 0xb]
call fcn.00406c40
add esp, 0xc
mov ecx, eax
mov dword [ebp - 8], ecx
test edi, edi
jns 0x406ee7
push 0x5d5
push edi
push str.JIT_ERROR__d__jit.c_line__d__n
call fcn.00401010
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x406edf
int3
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp byte [ebp + 0xb], 0
mov eax, dword [esi + 0x1b0]
je 0x406f09
mov edx, dword [eax + 0x10]
push ecx
mov ecx, esi
mov edx, dword [edx + ebx*4]
call fcn.00406db0
add esp, 4
jmp 0x406fe0
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
sub edx, dword [esi + 0x1ac]
mov dword [ebp + 8], edx
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x406f47
sub eax, edx
mov dword [ebp - 0x1c], 3
sub eax, 5
mov dword [ebp - 0x10], 0
push ecx
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, esi
call fcn.00406d50
add esp, 4
jmp 0x406fd9
mov eax, dword [esi + 0x1b0]
lea ecx, [edi + edi*4]
mov eax, dword [eax]
mov eax, dword [eax + 0x64]
lea eax, [eax + ecx*8]
cmp eax, dword [esi + 0x1b4]
jne 0x406f8e
mov eax, dword [esi + 0x19c]
mov ecx, esi
push dword [ebp - 8]
sub eax, edx
mov dword [ebp - 0x1c], 3
sub eax, 5
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x18], eax
call fcn.00406d50
add esp, 4
jmp 0x406fd9
lea eax, [esi + 0x1c8]
push 0xc
push eax
call dword [sym.imp.libhl.dll_hl_malloc]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x1c]
push dword [ebp - 8]
mov dword [ebp - 0x1c], 3
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov ecx, dword [esi + 0x1bc]
mov dword [eax + 8], ecx
mov ecx, esi
mov dword [esi + 0x1bc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
call fcn.00406d50
add esp, 0xc
mov ecx, esi
call fcn.00406770
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x406ff0
mov edx, eax
mov ecx, esi
call fcn.004065a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40fb80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], edx
push 0x414250
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40fbbb
push esi
push str.File_not_found__s_n
call fcn.0040fb10
add esp, 8
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push edi
push 2
push 0
push ebx
call esi
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call esi
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 0x20
mov ecx, eax
xor esi, esi
mov dword [ebp - 4], ecx
test edi, edi
jle 0x40fc12
nop
push ebx
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ecx]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jle 0x40fc2b
mov ecx, dword [ebp - 4]
add esi, eax
cmp esi, edi
jl 0x40fbf0
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [ebp - 0xc]
add esp, 4
mov dword [eax], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
push str.Failed_to_read__s_n
call fcn.0040fb10
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40fc50
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
lea edx, [ebp - 4]
call fcn.0040fb80
mov ebx, eax
test ebx, ebx
je 0x40fc89
push 0x104
push 0x416908
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40fc94
push str.Failed_to_find_HL_executable_n
call fcn.00401010
add esp, 4
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push esi
push 0x416908
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40fcbf
push esi
push str.Failed_to_write__s_n
call fcn.0040fb10
add esp, 8
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edi, eax
test edi, edi
jne 0x40fce7
push esi
push str.Failed_to_open__s.
call fcn.0040fb10
add esp, 8
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
push ebx
push 0x400
push str.hlboot.dat
push 0xa
push edi
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret