joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416165
Capabilities:
Get socket status
Receive data
Receive data on socket
Terminate process

Disassembly:
push esi
push edi
mov dword [ebp - 0x6c], 0
sub esp, 0x104
mov ax, word [ebp - 0x46]
call fcn.00419bd7
jb 0x41625e
test byte [esi + 0xc], 0x80
je 0x416262
and word [esi + 0x2c], 0xfffd
add esp, 0x104
mov eax, dword [esi + 6]
mov ecx, 0x40
push eax
loop 0x4161a0
push 0x40
mov edx, esp
mov eax, dword [esi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push 0
push edx
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x41624f
test eax, eax
je 0x41626e
lea ecx, [esi + 0x34]
lea edx, [esi + 0x44]
push 0
push 0
push dword [esi + 0x34]
push word [esi + 0x30]
push 2
mov ecx, esp
lea edx, [esi + 0x44]
push 0x10
push esp
push ecx
push 0
push 0x10000
push edx
push dword [esi + 6]
call dword [sym.imp.WSOCK32.DLL_recvfrom]
add esp, 4
mov ebx, dword [esp + 4]
movzx ecx, word [esp + 2]
add esp, 0x10
cmp eax, 0xffffffff
je 0x41624f
test eax, eax
jne 0x416225
or word [esi + 0x2c], 2
xchg ecx, eax
call fcn.00419b03
jb 0x416270
add esi, 0x44
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041c9d7
mov ecx, ebx
xchg ah, al
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x416266
jmp 0x41626a
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0041c9d5
add esp, 0x104
pop edi
pop esi
jmp fcn.004132bc

Function at 0x416282
Capabilities:
Get socket status
Send data
Send data on socket
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x104
mov ebx, ecx
push eax
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00419b5f
call fcn.00419c15
pop eax
jb 0x41633b
test byte [edi + 0xc], 0x80
je 0x41633f
xchg ah, al
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ebx
add esp, 0x104
mov ebx, ecx
mov eax, dword [edi + 6]
mov ecx, 0x40
push eax
loop 0x4162ce
push 0x40
mov edx, esp
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.WSOCK32.DLL_select]
cmp eax, 0xffffffff
je 0x41632c
test eax, eax
je 0x41634b
push 0
push 0
push dword [edi + 0x34]
push word [edi + 0x30]
push 2
mov ecx, esp
push 0x10
push ecx
push 0
push ebx
push esi
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_sendto]
add esp, 0x10
cmp eax, 0xffffffff
je 0x41632c
cmp eax, ebx
jb 0x416347
and word [edi + 0x2c], 0xfffd
call fcn.0041cf1b
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x416343
jmp 0x416347
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0041cf1b
add esp, 0x104
pop edi
pop esi
jmp fcn.004132bc
Function at 0x41667a
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00419b5f
test eax, eax
jns 0x416693
add eax, ecx
test edx, edx
je 0x4166d3
jns 0x41669e
add edx, ecx
js 0x4166d3
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x4166a7
xor ecx, ecx
cmp ecx, eax
jb 0x4166ad
mov ecx, eax
call fcn.00419b03
jb 0x4166d7
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041a337
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x4166c1
pop edi
pop esi
jmp fcn.004132bc

Function at 0x4166de
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00419b5f
test eax, eax
jns 0x4166f6
add eax, ecx
cmp eax, ecx
jae 0x416722
xchg ecx, eax
call fcn.00419b03
jb 0x416726
sub eax, ecx
add esi, eax
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041a337
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
ret
pop edi
pop esi
pop ecx
jmp fcn.004132bc

Function at 0x4197b9
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, eax
call fcn.00419b03
jb 0x4197dc
mov eax, 0x20202020
cld
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
call fcn.0041c9d7
pop edi
pop ecx
ret
pop edi
pop ecx
call fcn.0041c9d5
jmp fcn.004132bc

Function at 0x4197e8
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, 1
call fcn.00419b03
jb 0x4197dc
mov byte [edi], 0x20
call fcn.0041c9d7
pop edi
pop ecx
ret

Function at 0x41981a
Capabilities:
Terminate process

Disassembly:
push edi
xchg ecx, ebx
call fcn.00419b03
jb 0x41983a
call fcn.0041c9d7
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
ret
call fcn.0041c9d5
pop edi
jmp fcn.004132bc

Function at 0x419845
Capabilities:
Terminate process

Disassembly:
push eax
push esi
push edi
xchg ecx, ebx
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x6c]
call fcn.00419b72
mov al, 0
je 0x41985f
mov al, byte [edi]
call fcn.0041a337
call fcn.00419b03
jb 0x419882
mov dword [ebp + esi - 0x6c], edx
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
pop esi
pop eax
ret
mov dword [ebp + esi - 0x6c], 0
mov edx, eax
pop edi
pop esi
pop eax
jmp fcn.004132b1

Function at 0x41a3dd
Capabilities:
Terminate process

Disassembly:
call fcn.0041cac9
jb 0x41a3e5
ret
jmp fcn.004132bc
Function at 0x41a444
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [0x41e3e0]
mov ecx, eax
jecxz 0x41a49e
cld
lodsb al, byte [esi]
test al, al
je 0x41a49a
cmp al, 0x20
je 0x41a452
cmp al, 0x22
je 0x41a47a
lea edi, [esi - 1]
lodsb al, byte [esi]
test al, al
je 0x41a46f
cmp al, 0x20
jne 0x41a462
loop 0x41a452
jmp 0x41a471
loop 0x41a49a
lea ecx, [esi - 1]
mov esi, edi
sub ecx, esi
jmp 0x41a4ad
mov edi, esi
lodsb al, byte [esi]
test al, al
je 0x41a48f
cmp al, 0x22
jne 0x41a47c
cmp byte [esi - 2], 0x22
je 0x41a452
loop 0x41a452
jmp 0x41a491
loop 0x41a49a
lea ecx, [esi - 1]
mov esi, edi
sub ecx, esi
jmp 0x41a4ad
xor ecx, ecx
jmp 0x41a4ad
push esi
mov ecx, 0xffffffff
dec esi
inc ecx
inc esi
test byte [esi], 0xff
jne 0x41a4a5
pop esi
call fcn.0041ca1e
pop edi
pop esi
pop ecx
jb 0x41a4b8
ret
jmp fcn.004132bc

Function at 0x41a54c
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.00419b72
mov esi, dword [ebp + esi - 0x6c]
call fcn.00419b5f
jecxz 0x41a56c
jmp 0x41a571
jmp 0x41a606
test eax, eax
je 0x41a594
jns 0x41a57a
add eax, edx
inc eax
dec eax
sub edx, eax
jbe 0x41a594
push eax
add edi, eax
push edi
call fcn.0041ace2
pop eax
pop edx
jae 0x41a590
test edx, edx
je 0x41a606
mov ecx, edi
jmp 0x41a5d5
xor edx, edx
jmp 0x41a5ed
mov esi, eax
sub ecx, eax
call fcn.00419b03
jb 0x41a60d
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041cf1b
call fcn.0041a337
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0041cf1b
jmp 0x41a601
call fcn.0041cf1b
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.004132b1

Function at 0x41a61d
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.00419b72
je 0x41a662
mov esi, dword [ebp + esi - 0x6c]
call fcn.00419b5f
je 0x41a662
test eax, eax
je 0x41a662
jns 0x41a646
add eax, edx
inc eax
dec eax
sub edx, eax
jbe 0x41a662
add edi, eax
push ecx
call fcn.0041ace2
pop ecx
jb 0x41a662
mov esi, edi
sub edx, ecx
add esi, ecx
mov ecx, edx
jecxz 0x41a662
jmp 0x41a6a0
xor edx, edx
jmp 0x41a6b4
call fcn.00419b03
jb 0x41a6cd
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041cf1b
call fcn.0041a337
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0041cf1b
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.004132b1
Function at 0x41a6fe
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00419b5f
je 0x41a745
mov al, 0x20
cmp byte [esi], al
je 0x41a71f
jmp 0x41a745
cmp byte [esi], al
jne 0x41a722
inc esi
loop 0x41a71b
call fcn.00419b03
jb 0x41a74a
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041a337
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
pop eax
ret
mov edx, eax
pop edi
pop esi
pop ecx
pop eax
jmp fcn.004132b1

Function at 0x41a755
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00419b5f
je 0x41a745
lea edi, [esi - 1]
add edi, ecx
mov al, 0x20
cmp byte [edi], al
je 0x41a77b
jmp 0x41a745
cmp byte [edi], al
jne 0x41a722
dec edi
loop 0x41a777
jmp 0x41a722

Function at 0x41a780
Capabilities:
Terminate process

Disassembly:
push eax
call fcn.0041a862
jb 0x41a7da
cmp ecx, edx
ja 0x41a7da
mov eax, esi
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x41a7a2
mov eax, esi
sub edx, ebx
jl 0x41a7a2
mov ecx, ebx
mov edi, ebp
jmp 0x41a792
or edx, edx
jns 0x41a7a8
xor edx, edx
mov esi, eax
mov ecx, edx
pop ebp
call fcn.00419b03
jb 0x41a7e2
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041cf1b
call fcn.0041a337
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
pop ebp
call fcn.0041cf1b
jmp 0x41a7d4
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.004132b1

Function at 0x41a7ee
Capabilities:
Terminate process

Disassembly:
push eax
call fcn.0041a862
jb 0x41a7da
cmp ecx, edx
ja 0x41a7da
mov eax, esi
add esi, edx
sub esi, ecx
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x41a7a2
sub esi, ebx
sub esi, ebx
sub edx, ebx
jl 0x41a7a2
mov ecx, ebx
mov edi, ebp
jmp 0x41a804
Function at 0x41a88c
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.00419b72
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edx
push dword [ebp + esi - 0x6c]
mov esi, dword [ebp + esi - 0x64]
call fcn.00419b5f
pop edi
call fcn.00419b72
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x64], edx
jecxz 0x41a8c0
jne 0x41a913
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
call fcn.00419b03
jb 0x41a8f8
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041cf1b
call fcn.0041cf1b
call fcn.0041a337
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
ret
mov al, 5
pop edi
pop esi
call fcn.0041cf1b
call fcn.0041cf1b
call fcn.0041cf1b
call fcn.0041c9d5
jmp fcn.004132bc
mov ebx, edi
mov dword [ebp - 0x54], ecx
sub edx, ecx
jb 0x41a8c0
add ebx, edx
inc ebx
mov edx, esi
mov dword [ebp - 0x58], 0
cld
call fcn.0041a9cf
jb 0x41a93c
inc dword [ebp - 0x58]
add edi, dword [ebp - 0x54]
mov esi, edx
cmp edi, ebx
jb 0x41a929
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0x41a8c0
mov esi, edx
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x54]
imul ecx
jno 0x41a955
jmp 0x41a8f6
mov ecx, dword [ebp - 0x64]
add ecx, eax
js 0x41a953
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x64], eax
call fcn.00419b03
jb 0x41a8f8
mov dword [ebp - 0x68], edi
push edx
mov edi, dword [ebp - 0x6c]
mov edx, esi
call fcn.0041a9cf
jb 0x41a9b2
mov esi, dword [ebp - 0x6c]
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push esi
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x68], edi
mov edi, dword [ebp - 0x54]
add edi, esi
mov dword [ebp - 0x6c], edi
mov esi, edx
jmp 0x41a972
mov ecx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x6c]
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edx
jmp 0x41a8da

Function at 0x41aa66
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 7
xor edx, edx
call fcn.0041aad4
pop ecx
jb 0x41aacf
ret

Function at 0x41aa77
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
xor edx, edx
call fcn.0041aad4
pop ecx
jb 0x41aacf
ret
jmp fcn.004132b1

Function at 0x41aaaa
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
mov edx, 0x80000000
call fcn.0041aad4
pop ecx
jb 0x41aacf
ret
Function at 0x41b081
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov ebx, eax
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.00419b72
mov esi, dword [ebp + esi - 0x6c]
call fcn.00419b5f
jecxz 0x41b0bc
test ebx, ebx
jns 0x41b0b5
push edx
push edi
push ebx
call fcn.0041acb9
pop ebx
add ebx, eax
add ebx, 2
pop edi
pop edx
call fcn.0041b1b9
jmp 0x41b112
test ebx, ebx
jns 0x41b0d0
push ecx
push edi
push ebx
call fcn.0041b057
pop eax
add ebx, eax
add ebx, 2
pop edi
pop ecx
call fcn.0041b159
jmp 0x41b112
call fcn.00419b03
jb 0x41b149
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041cf1b
call fcn.0041a337
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0041cf1b
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.004132b1

Function at 0x41bb9b
Capabilities:
Terminate process

Disassembly:
mov esi, eax
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x68]
call fcn.0041cf1b
call fcn.0041a337
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
jmp 0x41bb7a
call fcn.0041cf1b
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
call fcn.0041cf1b
call fcn.0041cf1b
call fcn.0041c9d5
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.004132b1
push eax
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x68]
call fcn.00419b5f
je 0x41bb75
mov edi, dword [ebp + edi - 0x6c]
call fcn.00419b72
je 0x41bb75
mov dword [ebp - 0x64], esi
add dword [ebp - 0x64], ecx
cld
push ecx
push esi
call fcn.0041acd0
pop esi
pop ecx
test eax, eax
je 0x41bb75
push edi
push edx
push ecx
sub ecx, eax
call fcn.00419b03
jb 0x41bc28
jecxz 0x41bc20
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edx
pop ecx
pop edx
pop edi
call fcn.0041adf3
jb 0x41bc16
push ecx
mov ecx, esi
sub ecx, eax
push esi
mov esi, eax
push edi
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x6c], edi
pop edi
pop esi
pop ecx
inc esi
or ecx, ecx
jne 0x41bbe7
jmp 0x41bb5c
mov ecx, dword [ebp - 0x64]
sub ecx, eax
jmp 0x41bb4b
add esp, 0xc
jmp 0x41bb5f
add esp, 0xc
jmp 0x41bb80
Function at 0x41be7e
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x41be9e
and esi, 0xfffffffe
jne 0x41bea8
xchg dword [ebx], esi
call fcn.00419b37
pop edi
pop esi
ret
call fcn.00419b5f
mov edi, dword [ebx]
or edi, edi
je 0x41beb8
cmp ecx, dword [edi - 4]
je 0x41bed8
call fcn.00419b03
jb 0x41bee8
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.00419b37
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.00419b37
pop edi
pop esi
jmp fcn.004132bc

Function at 0x41bef8
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x41bf15
mov dword [ebx], eax
ret
push esi
push edi
mov esi, eax
call fcn.00419b5f
call fcn.00419b03
jb 0x41bf37
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx], edx
pop edi
pop esi
ret
mov dword [ebx], edx
pop edi
pop esi
jmp fcn.004132bc

Function at 0x41bf40
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x41bf60
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.00419b5f
call fcn.00419b03
jb 0x41bf85
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.004132bc

Function at 0x41c142
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.00419b5f
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.00419b5f
jecxz 0x41c1b8
test ebx, ebx
je 0x41c1c0
add ebx, ecx
xchg ecx, ebx
call fcn.00419b03
jb 0x41c1cd
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.00419b37
mov esi, dword [ebp + edi - 0x6c]
call fcn.00419b37
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.004132bc
Function at 0x41c87e
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xa
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x41c8ab
je 0x41c8a7
shr esi, 1
jae 0x41c8cc
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.00419b37
jmp 0x41c88a
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x41c8dd
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.00413c99
pop ebx
jae 0x41c88a
pop esi
pop edx
pop eax
jmp fcn.004132bc
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x41c88a
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x41c88a
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x41c88a

Function at 0x41d5bc
Capabilities:
Terminate process

Disassembly:
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x6c]
mov esp, ebp
pop ebp
ret 0x3c
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x6c]
mov esp, ebp
pop ebp
pop edx
add esp, 0x3c
push edx
jmp fcn.004132bc
push ebp
mov ebp, esp
push ebx
sub esp, 0x17c
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], edi
call fcn.0041d647
call fcn.0041d98a
jb 0x41d635
call fcn.0041d959
jb 0x41d635
call fcn.0041da13
jb 0x41d635
call fcn.0041d65a
mov esi, dword [ebp - 0x20]
call fcn.00419b5f
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], esi
call dword [ebp - 0x50]
call dword [ebp - 0x54]
jb 0x41d613
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x2c]
jne 0x41d5f9
xor edx, edx
jmp 0x41d61a
mov edx, dword [ebp + 0x1c]
sub edx, dword [ebp - 0x2c]
inc edx
call fcn.0041d63f
mov esi, dword [ebp - 4]
mov word [esi], dx
test dword [ebp + 8], 0x100
je 0x41d630
mov dword [esi], edx
jmp 0x41d070
call fcn.0041d63f
jmp 0x41d07c
Function at 0x402dc9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x406318
cmp edx, dword [eax]
je 0x402deb
add eax, 8
inc ecx
cmp eax, 0x4063a8
jl 0x402ddc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x406318]
jne 0x402f19
mov eax, dword [0x4065e0]
cmp eax, 1
je 0x402ef3
test eax, eax
jne 0x402e1c
cmp dword [0x406088], 1
je 0x402ef3
cmp edx, 0xfc
je 0x402f19
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402e53
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004032d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00401e80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x402e96
lea eax, [ebp - 0x1a4]
push eax
call fcn.00401e80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4053e4
push edi
call fcn.00404060
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004032d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004032e0
lea eax, [ebp - 0xa0]
push 0x4053c4
push eax
call fcn.004032e0
push dword [esi + 0x40631c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004032e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00403fcb
add esp, 0x2c
pop edi
jmp 0x402f19
lea eax, [ebp + 8]
lea esi, [esi + 0x40631c]
push 0
push eax
push dword [esi]
call fcn.00401e80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x402500
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x436298
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
push eax
lea ecx, [esp + 0x34]
call fcn.0042fced
mov esi, dword [esp + 0x54]
mov dword [esp + 0x4c], 0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
lea edx, [eax + 0x14]
lea edi, [ecx + 0x14]
push edx
push edi
push eax
push ecx
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.USER32.dll_SetRect]
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
sub edi, eax
mov dword [esp + 0x10], eax
sar edi, 1
lea ebp, [edx + 1]
add edi, eax
push ebp
lea eax, [esp + 0x1c]
push edi
push eax
lea ecx, [esp + 0x3c]
sar ebx, 1
call fcn.0042fabe
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.GDI32.dll_BeginPath]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push ebx
push edx
mov edx, dword [esp + 0x2c]
push ebp
push edi
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
push eax
lea ecx, [esp + 0x50]
call fcn.0042fb7b
mov ecx, dword [esi + 0xc]
mov edx, dword [esi]
push ecx
push edx
lea ecx, [esp + 0x38]
call fcn.0042fb0a
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push eax
push ecx
lea ecx, [esp + 0x38]
call fcn.0042fb0a
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
sub eax, 0x15
push edx
push eax
lea ecx, [esp + 0x38]
call fcn.0042fb0a
mov edx, dword [esi]
mov ecx, dword [esi + 4]
add edx, 8
push ecx
push edx
lea ecx, [esp + 0x38]
call fcn.0042fb0a
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.GDI32.dll_EndPath]
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.GDI32.dll_PathToRegion]
lea ecx, [esp + 0x30]
mov esi, eax
mov dword [esp + 0x4c], 0xffffffff
call fcn.0042fd5f
mov ecx, dword [esp + 0x44]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4