joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a84c970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a86fb58
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a89c5b8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov dword [esi], vtable.icu_3_0::ICUNotifier.0
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
lea edx, [edi + 0xc]
push edx
lea ecx, [esi + 0xc]
mov dword [esp + 0x1c], 0
mov dword [esi], vtable.icu_3_0::ICUService.0
call sym.icuuc30.dll_public:_void___thiscall_icu_3_0::UnicodeString::constructor_class_icu_3_0::UnicodeString_const__
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
mov edx, dword [edi + 0x34]
mov dword [esi + 0x34], edx
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov ecx, dword [edi + 0x3c]
mov dword [esi + 0x3c], ecx
mov edx, dword [edi + 0x40]
mov dword [esi + 0x40], edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4a84cdc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a86fc68
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4a89c5b8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
mov cl, byte [eax + 0x98]
test cl, cl
je 0x4a84ce10
mov esi, dword [esp + 0x3c]
mov ecx, esi
call sym.icuuc30.dll_public:_void___thiscall_icu_3_0::UnicodeString::setToBogus_void_
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
mov eax, dword [eax + 0x20]
push 0
push eax
lea ecx, [esp + 0x10]
call sym.icuuc30.dll_public:_void___thiscall_icu_3_0::UnicodeString::constructor_char_const___char_const__
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x3c]
mov edx, dword [esi + 4]
push eax
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push edx
mov ecx, esi
mov dword [esp + 0x44], 0
call sym.icuuc30.dll_private:_class_icu_3_0::UnicodeString____thiscall_icu_3_0::UnicodeString::doReplace_int__int__class_icu_3_0::UnicodeString_const___int__int_
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call sym.icuuc30.dll_public_virtual:_void___thiscall_icu_3_0::UnicodeString::destructor_void_
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
Function at 0x4a84f6c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4a8705e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a89c5b8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call sym.icuuc30.dll_public:_void___thiscall_icu_3_0::ICUNotifier::constructor_void_
xor edi, edi
lea ecx, [esi + 0xc]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.icu_3_0::ICUService.0
call sym.icuuc30.dll_public:_void___thiscall_icu_3_0::UnicodeString::constructor_void_
lea eax, [esi + 0x2c]
push eax
mov dword [eax], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
call sym.icuuc30.dll_umtx_init_3_0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4a84f740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a870618
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a89c5b8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call sym.icuuc30.dll_public:_void___thiscall_icu_3_0::ICUNotifier::constructor_void_
mov eax, dword [esp + 0x20]
xor edi, edi
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x1c], edi
mov dword [esi], vtable.icu_3_0::ICUService.0
call sym.icuuc30.dll_public:_void___thiscall_icu_3_0::UnicodeString::constructor_class_icu_3_0::UnicodeString_const__
lea eax, [esi + 0x2c]
push eax
mov dword [eax], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
call sym.icuuc30.dll_umtx_init_3_0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4a853290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a870ab8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4a89c5b8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 0x14]
push eax
push ecx
lea ecx, [esp + 0xc]
call sym.icuuc30.dll_public:_void___thiscall_icu_3_0::UnicodeString::constructor_wchar_t_const___int_
mov ecx, dword [esp + 0x34]
push eax
mov dword [esp + 0x30], 0
call fcn.4a856140
lea ecx, [esp + 4]
mov dword [esp + 0x2c], 0xffffffff
call sym.icuuc30.dll_public_virtual:_void___thiscall_icu_3_0::UnicodeString::destructor_void_
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
add esp, 0x2c
ret 4

Function at 0x4a859707
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a89c5b8]
jne 0x4a859711
repz ret
jmp fcn.4a85d865
Function at 0x4a86874c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.4a85eb75
xor ebx, ebx
cmp dword [0x4a89f310], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4a868821
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4a86878c
xor eax, eax
jmp 0x4a8688e5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4a868785
push eax
call fcn.4a85eb12
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4a89f310], eax
call esi
push eax
call fcn.4a85eb12
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a89f314], eax
call esi
push eax
call fcn.4a85eb12
mov dword [0x4a89f318], eax
lea eax, [ebp - 8]
push eax
call fcn.4a862226
test eax, eax
pop ecx
pop ecx
je 0x4a8687ef
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.4a8603ee
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4a868821
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.4a85eb12
cmp eax, ebx
pop ecx
mov dword [0x4a89f320], eax
je 0x4a868821
push 0x4a8845d8
push edi
call esi
push eax
call fcn.4a85eb12
pop ecx
mov dword [0x4a89f31c], eax
mov eax, dword [0x4a89f31c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4a86889a
cmp dword [0x4a89f320], esi
je 0x4a86889a
push eax
call fcn.4a85eb7e
pop ecx
call eax
cmp eax, ebx
je 0x4a868867
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4a89f320]
call fcn.4a85eb7e
pop ecx
call eax
test eax, eax
je 0x4a868867
test byte [ebp - 0x18], 1
jne 0x4a86889a
lea eax, [ebp - 0xc]
push eax
call fcn.4a86225d
test eax, eax
pop ecx
je 0x4a868882
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.4a8603ee
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4a868891
or dword [ebp + 0x10], 0x200000
jmp 0x4a8688cb
or dword [ebp + 0x10], 0x40000
jmp 0x4a8688cb
mov eax, dword [0x4a89f314]
cmp eax, esi
je 0x4a8688cb
push eax
call fcn.4a85eb7e
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4a8688cb
mov eax, dword [0x4a89f318]
cmp eax, esi
je 0x4a8688cb
push dword [ebp - 4]
push eax
call fcn.4a85eb7e
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4a89f310]
call fcn.4a85eb7e
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402788
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402796
call dword [0x49a01c]
or eax, eax
je 0x402797
ret
mov al, 1
jmp fcn.00402814

Function at 0x4027a0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027ae
call dword [0x49a020]
or eax, eax
jne 0x4027af
ret
mov al, 2
jmp fcn.00402814

Function at 0x4027b8
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4027f0
test edx, edx
je 0x4027da
push eax
mov eax, ecx
call dword [0x49a024]
pop ecx
or eax, eax
je 0x4027e9
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402814
mov dword [eax], edx
mov eax, ecx
call dword [0x49a020]
or eax, eax
jne 0x4027d3
ret
mov al, 1
jmp fcn.00402814
test edx, edx
je 0x402804
push eax
mov eax, edx
call dword [0x49a01c]
pop ecx
or eax, eax
je 0x4027e9
mov dword [ecx], eax
ret

Function at 0x402814
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x49d004]
test ecx, ecx
je 0x402824
pop edx
call ecx
dec eax
mov al, byte [eax + 0x40283d]
jns 0x402838
call fcn.00406b68
mov eax, dword [eax + 4]
jmp fcn.00403b2c

Function at 0x40299c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4029cb
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403c1c
jmp 0x4029e9
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402924
mov edi, eax
test ebx, ebx
je 0x4029e9
cmp dword [esi], 0
je 0x4029e9
dec ebx
jmp 0x4029d2
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402dbc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402e54
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402e34
xor eax, eax
push ebp
push 0x402e2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402e70
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e34
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x4030d4
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4030ee
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x4030ee
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x4030da
mov al, 0xa
jmp fcn.00402814
ret

Function at 0x403120
Capabilities:
Terminate process

Disassembly:
cmp dword [0x49d01c], 0
je 0x402a3f
call dword [0x49d01c]
mov eax, 0xd2
jmp fcn.00403b2c
push eax
push ecx
mov eax, dword [eax]
call fcn.004030f0
pop ecx
pop eax
je 0x40312f
jmp ebx
pop ecx
jmp 0x402a30
Function at 0x403138
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.004030f0
mov eax, ebx
pop ebx
jne 0x40314d
pop ecx
jmp 0x402a30
ret

Function at 0x403a08
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x49d4a4
mov esi, 0x49d038
mov edi, 0x49d03c
cmp byte [ebx + 0x24], 0
jne 0x403a37
cmp dword [edi], 0
je 0x403a37
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403a26
cmp dword [0x49d040], 0
je 0x403a7e
call fcn.00403984
cmp byte [0x49d048], 0
je 0x403a64
mov edx, 0x49a02c
mov eax, 0x49d21c
call fcn.00406404
call fcn.00406387
jmp 0x403a77
push 0
push 0x49a04c
push 0x49a02c
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x49d040], eax
cmp byte [ebx + 0x24], 2
jne 0x403a8e
cmp dword [esi], 0
jne 0x403a8e
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403858
cmp byte [ebx + 0x24], 1
jbe 0x403a9e
cmp dword [esi], 0
je 0x403abb
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403abb
call fcn.00405e08
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403abb
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.00403830
cmp byte [ebx + 0x24], 1
jne 0x403ac9
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403ad4
call fcn.004039d4
cmp dword [ebx], 0
jne 0x403ae1
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403a7e

Function at 0x40419c
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00404160
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00404160
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x404148
ret

Function at 0x404244
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402814
test ecx, ecx
je fcn.00404160
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x404148
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x40431c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40435b
cmp al, 0xb
je 0x40435b
cmp al, 0xc
je 0x404365
cmp al, 0xd
je 0x404378
cmp al, 0xe
je 0x404396
cmp al, 0xf
je 0x40435b
cmp al, 0x11
je 0x40435b
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402814
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40435b
jmp 0x4043aa
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404365
jmp 0x4043aa
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.0040431c
dec edi
jg 0x40437b
pop ebp
jmp 0x4043aa
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004042f0
dec edi
jg 0x404399
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4043b0
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.0040431c

Function at 0x4043e8
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x40442f
cmp al, 0xb
je 0x404449
cmp al, 0xc
je 0x404460
cmp al, 0xd
je 0x40446f
cmp al, 0xe
je 0x40448d
cmp al, 0xf
je 0x4044a3
cmp al, 0x11
je 0x4044b2
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402814
cmp ecx, 1
mov eax, ebx
jg 0x404440
call fcn.00403b38
jmp 0x4044c1
mov edx, ecx
call fcn.00403b5c
jmp 0x4044c1
cmp ecx, 1
mov eax, ebx
jg 0x404457
call fcn.00404160
jmp 0x4044c1
mov edx, ecx
call fcn.00404178
jmp 0x4044c1
mov eax, ebx
add ebx, 0x10
call fcn.004051b4
dec edi
jg 0x404460
jmp 0x4044c1
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004043e8
dec edi
jg 0x404472
pop ebp
jmp 0x4044c1
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004043bc
dec edi
jg 0x404490
pop ebp
jmp 0x4044c1
mov eax, ebx
add ebx, 4
call fcn.00405ed0
dec edi
jg 0x4044a3
jmp 0x4044c1
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00405a64
dec edi
jg 0x4044b2
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x4044c8
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004043e8

Function at 0x4044d4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x404500
mov edx, eax
add eax, esi
add edx, ebx
call fcn.004028e4
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x40453f
cmp cl, 0xb
je 0x404550
cmp cl, 0xc
je 0x404561
cmp cl, 0xd
je 0x404572
cmp cl, 0xe
je 0x404592
cmp cl, 0xf
je 0x4045ab
cmp cl, 0x11
je 0x4045bc
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402814
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403b8c
mov eax, 4
jmp 0x4045cd
mov edx, dword [esi + eax]
add eax, ebx
call fcn.0040419c
mov eax, 4
jmp 0x4045cd
lea edx, [esi + eax]
add eax, ebx
call fcn.004048a0
mov eax, 0x10
jmp 0x4045cd
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.004045f0
pop eax
jmp 0x4045cd
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.004044d4
pop eax
jmp 0x4045cd
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405ee8
mov eax, 4
jmp 0x4045cd
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405aa0
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x4044ee
pop ecx
sub ecx, eax
jle 0x4045e9
lea edx, [ebx + eax]
add eax, esi
call fcn.004028e4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4045f0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x404636
cmp cl, 0xb
je 0x40464d
cmp cl, 0xc
je 0x404661
cmp cl, 0xd
je 0x404675
cmp cl, 0xe
je 0x404696
cmp cl, 0xf
je 0x4046b3
cmp cl, 0x11
je 0x4046c7
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402814
mov eax, ebx
mov edx, dword [esi]
call fcn.00403b8c
add ebx, 4
add esi, 4
dec ebp
jne 0x404636
jmp 0x4046db
mov eax, ebx
mov edx, dword [esi]
call fcn.0040419c
add ebx, 4
add esi, 4
dec ebp
jne 0x40464d
jmp 0x4046db
mov eax, ebx
mov edx, esi
call fcn.004048a0
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x404661
jmp 0x4046db
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.004045f0
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x40467e
jmp 0x4046db
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.004044d4
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x404696
jmp 0x4046db
mov eax, ebx
mov edx, dword [esi]
call fcn.00405ee8
add ebx, 4
add esi, 4
dec ebp
jne 0x4046b3
jmp 0x4046db
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00405aa0
add ebx, 4
add esi, 4
dec ebp
jne 0x4046c7
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4048a0
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402814
cmp eax, edx
je 0x404937
cmp word [eax], 8
jb 0x4048d8
push eax
push edx
cmp word [eax], 0x100
je 0x4048ce
cmp word [eax], 0x101
je 0x4048c6
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x4048d6
call dword [0x49d3e8]
jmp 0x4048d6
add eax, 8
call fcn.00403b38
pop edx
pop eax
cmp word [edx], 8
jae 0x4048ef
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x40490a
cmp word [edx], 0x101
jne 0x404923
push eax
call 0x4048de
pop eax
jmp dword [0x49d3f0]
mov edx, dword [edx + 8]
or edx, edx
je 0x40491a
mov ecx, dword [edx - 8]
inc ecx
jle 0x40491a
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x404854
ret

Function at 0x404d38
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 8
jne 0x404d46
mov edx, dword [edx + 8]
jmp fcn.0040419c
push ebx
mov ebx, eax
sub esp, 0x10
mov word [esp], 0
mov eax, esp
mov ecx, 8
call fcn.00404ab0
mov eax, ebx
mov edx, dword [esp + 8]
call fcn.00404150
add esp, 0x10
pop ebx
ret
Function at 0x404f3c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
lea eax, [ebp - 0x10]
call fcn.004051bc
xor eax, eax
push ebp
push 0x404f2e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call dword [0x49d3ec]
mov eax, ebx
lea edx, [ebp - 0x10]
call fcn.00404f3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404f35
lea eax, [ebp - 0x10]
call fcn.004051b4
ret
cmp word [edx], 0x101
je 0x404ed8
cmp word [edx], 0x100
jne fcn.004048a0
cmp word [eax], 8
jb 0x404f61
push eax
push edx
call fcn.0040485c
pop edx
pop eax
mov word [eax], 8
add eax, 8
add edx, 8
xor ecx, ecx
mov edx, dword [edx]
mov dword [eax], ecx
jmp fcn.00404268

Function at 0x4050a4
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov esi, edx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x4050ca
cmp eax, 0x100
jne 0x4050f9
mov eax, 8
cmp edx, 0x11
jbe 0x4050dc
cmp edx, 0x100
jne case.default.0x4050f0
mov edx, 8
mov al, byte [eax + 0x49a064]
mov dl, byte [edx + 0x49a064]
movzx ecx, byte [edx + eax*8 + 0x49a078]
jmp dword [ecx*4 + 0x40510b]
mov eax, edx
cmp eax, 0x101
jne case.0x4050f0.0
pop edi
pop esi
call fcn.00405010
push eax
popf
ret
pop edi
pop esi
jmp 0x404854
cmp al, dl
pop edi
pop esi
ret
mov eax, esi
call fcn.00404ba4
xchg edi, eax
call fcn.00404ba4
cmp eax, edi
pop edi
pop esi
ret
mov eax, edi
call fcn.00404c44
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404c44
fld xword [esp]
add esp, 0xc
fcompp
fnstsw ax
mov al, ah
and ax, 0x4001
ror al, 1
or ah, al
sahf
pop edi
pop esi
ret
mov eax, edi
call fcn.00404ca0
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00404ca0
fld xword [esp]
add esp, 0xc
jmp 0x405163
mov eax, edi
mov edx, esi
call fcn.00404fa8
cmp eax, 0
pop edi
pop esi
ret
mov eax, esi
call fcn.00404c10
xchg edi, eax
call fcn.00404c10
mov edx, edi
cmp al, dl
pop edi
pop esi
ret