joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ec1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4384d8
push esi
call fcn.004062da
push esi
call fcn.00405e72
mov edi, eax
test edi, edi
jne 0x405ee2
xor eax, eax
jmp 0x405f34
push edi
call fcn.0040654a
test byte [0x44bb10], 0x80
je 0x405efb
mov al, byte [edi]
or al, al
je 0x405ede
cmp al, 0x5c
je 0x405ede
sub edi, esi
push esi
call fcn.004062eb
cmp eax, edi
push esi
jle 0x405f1e
call fcn.0040677e
test eax, eax
je 0x405f16
test byte [eax], 0x10
je 0x405ede
push esi
call fcn.00405e26
jmp 0x405efd
call fcn.00405ddf
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
pop edi
pop esi
ret 4

Function at 0x405fab
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0
mov ecx, eax
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405fda
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
push esi
push 0x63
pop esi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
push 0x1a
pop ecx
div ecx
push edi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40601f
mov eax, esi
dec esi
or eax, eax
jne 0x405fe5
and byte [edi], al
pop esi
pop edi
pop ebp
ret 8
mov eax, edi
jmp 0x406019
Function at 0x406023
Capabilities:
Get common file path
Get file size

Disassembly:
push ebp
push ebx
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.004067bc
or eax, eax
mov esi, dword [esp + 0x18]
je 0x40604f
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x406193
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x43ae60], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x43ae60
je 0x406093
push 1
push 0
push esi
call fcn.00405fab
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406199
cmp eax, edi
jg 0x406199
mov esi, 0x43a8d8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x406199
cmp eax, edi
jg 0x406199
push esi
push ebp
push str._s_s_r_n
push 0x43a4d8
call dword [sym.imp.USER32.dll_wsprintfA]
sub esp, 0xfffffff0
push 0x3f0
mov ebp, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call fcn.004062f8
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406193
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esp + 0x14], eax
cmp eax, edi
je 0x40617b
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
or edi, edi
je 0x40616f
push str._Rename__r_n
push edi
call fcn.00405f39
or eax, eax
jne 0x4061a0
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call fcn.004062da
sub esi, 0xfffffff6
mov eax, esi
push ebp
push 0x43a4d8
add eax, edi
push eax
call fcn.00405f85
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x44bb90]
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0x40a9fc
add eax, 0xa
push eax
call fcn.00405f39
or eax, eax
je 0x406156
inc eax
mov ecx, eax
lea edx, [edi + esi]
cmp eax, edx
jae 0x4061c9
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
lea edx, [edi + esi]
inc ecx
cmp ecx, edx
jb 0x4061bc
sub eax, edi
jmp 0x406158
Function at 0x4061cd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406231
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x2000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
or eax, eax
jne 0x406220
cmp dword [ebp + 0x14], 1
je 0x406222
cmp dword [ebp + 0x14], 2
je 0x406222
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4065e3
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, esp
push ebx
xor ebx, ebx
cmp dword [esi + 8], ebx
je 0x406608
mov eax, dword [0x40a8f8]
cmp eax, 0xffffffff
je 0x4065ff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8f8], 0xffffffff
jmp 0x40667b
cmp dword [0x43ba60], ebx
je 0x40667b
cmp byte [0x43b660], bl
je 0x406647
cmp dword [0x40a8f8], 0xffffffff
jne 0x406650
push 4
push 0x40000000
push 0x43b660
call fcn.00405fab
mov dword [0x40a8f8], eax
cmp eax, 0xffffffff
je 0x40667b
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8f8], 0xffffffff
je 0x40667b
push ebp
push 0x40aacc
mov ebp, 0x43faa0
push ebp
call fcn.004062f8
push ebx
lea eax, [esi + 8]
push eax
push ebp
call fcn.004062eb
push eax
push ebp
push dword [0x40a8f8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop ebx
pop esi
ret 4

Function at 0x406823
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
xor eax, eax
cmp dword [0x43b264], eax
push esi
jne 0x40685d
mov ecx, 0x43b260
mov esi, eax
push 8
pop edi
mov edx, esi
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr esi, 1
xor esi, edx
dec edi
jne 0x406839
mov dword [ecx], esi
add ecx, 4
inc eax
cmp ecx, 0x43b660
jl 0x406834
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
not eax
mov ecx, edi
dec edi
test ecx, ecx
jbe 0x406892
lea edx, [edi + 1]
mov esi, dword [esp + 0x10]
movzx ecx, byte [esi]
mov edi, eax
and edi, 0xff
xor edi, ecx
mov edi, dword [edi*4 + 0x43b260]
shr eax, 8
xor eax, edi
inc esi
dec edx
jne 0x406875
not eax
pop esi
pop edi
ret 0xc
Function at 0x423b47
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x423b75
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x423b93
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00423ab1
jmp 0x423b93
mov eax, dword [esi + 0x14]
test eax, eax
je 0x423b93
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00423ab1
test edi, edi
mov eax, edi
jne 0x423b7d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x438c24]
test ecx, ecx
je 0x423c46
jmp 0x423b46
ret 8

Function at 0x4019f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019ff
push esp
mov dword [ebp - 0x24], 0x40171b
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a9e
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a7f
pop ebp
ret 0x10
Function at 0x40271c
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40272a
call dword [0x44c01c]
or eax, eax
je 0x40272b
ret
mov al, 1
jmp fcn.004027a8

Function at 0x402734
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402742
call dword [0x44c020]
or eax, eax
jne 0x402743
ret
mov al, 2
jmp fcn.004027a8

Function at 0x40274c
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402784
test edx, edx
je 0x40276e
push eax
mov eax, ecx
call dword [0x44c024]
pop ecx
or eax, eax
je 0x40277d
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.004027a8
mov dword [eax], edx
mov eax, ecx
call dword [0x44c020]
or eax, eax
jne 0x402767
ret
mov al, 1
jmp fcn.004027a8
test edx, edx
je 0x402798
push eax
mov eax, edx
call dword [0x44c01c]
pop ecx
or eax, eax
je 0x40277d
mov dword [ecx], eax
ret

Function at 0x4027a8
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x44d004]
test ecx, ecx
je 0x4027b8
pop edx
call ecx
dec eax
mov al, byte [eax + 0x4027d1]
jns 0x4027cc
call fcn.00406190
mov eax, dword [eax + 4]
jmp fcn.00403908

Function at 0x4028ec
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x40291b
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004039f8
jmp 0x402939
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402874
mov edi, eax
test ebx, ebx
je 0x402939
cmp dword [esi], 0
je 0x402939
dec ebx
jmp 0x402922
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402bf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402c88
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402c68
xor eax, eax
push ebp
push 0x402c61
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ca4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c68
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402f04
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402f1e
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x402f1e
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402f0a
mov al, 0xa
jmp fcn.004027a8
ret

Function at 0x402f50
Capabilities:
Terminate process

Disassembly:
cmp dword [0x44d01c], 0
je 0x40295f
call dword [0x44d01c]
mov eax, 0xd2
jmp fcn.00403908
push eax
push ecx
mov eax, dword [eax]
call fcn.00402f20
pop ecx
pop eax
je 0x402f5f
jmp ebx
pop ecx
jmp 0x402950
Function at 0x402f68
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00402f20
mov eax, ebx
pop ebx
jne 0x402f7d
pop ecx
jmp 0x402950
ret

Function at 0x4037e4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x44d4a4
mov esi, 0x44d038
mov edi, 0x44d03c
cmp byte [ebx + 0x24], 0
jne 0x403813
cmp dword [edi], 0
je 0x403813
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403802
cmp dword [0x44d040], 0
je 0x40385a
call fcn.00403760
cmp byte [0x44d048], 0
je 0x403840
mov edx, 0x44c028
mov eax, 0x44d21c
call fcn.00405a2c
call fcn.004059af
jmp 0x403853
push 0
push 0x44c048
push 0x44c028
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x44d040], eax
cmp byte [ebx + 0x24], 2
jne 0x40386a
cmp dword [esi], 0
jne 0x40386a
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403634
cmp byte [ebx + 0x24], 1
jbe 0x40387a
cmp dword [esi], 0
je 0x403897
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403897
call fcn.004053e8
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403897
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.0040360c
cmp byte [ebx + 0x24], 1
jne 0x4038a5
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x4038b0
call fcn.004037b0
cmp dword [ebx], 0
jne 0x4038bd
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x40385a

Function at 0x403f1c
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00403ee0
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00403ee0
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x403ec8
ret

Function at 0x403fc4
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.004027a8
test ecx, ecx
je fcn.00403ee0
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x403ec8
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x403fe8
Capabilities:
Terminate process

Disassembly:
xor ecx, ecx
test edx, edx
je 0x40401b
push edx
cmp cx, word [edx]
je 0x404014
cmp cx, word [edx + 2]
je 0x404011
cmp cx, word [edx + 4]
je 0x40400e
cmp cx, word [edx + 6]
je 0x40400b
add edx, 8
jmp 0x403fef
add edx, 2
add edx, 2
add edx, 2
mov ecx, edx
pop edx
sub ecx, edx
shr ecx, 1
jmp fcn.00403fc4
Function at 0x40415c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40419b
cmp al, 0xb
je 0x40419b
cmp al, 0xc
je 0x4041a5
cmp al, 0xd
je 0x4041b8
cmp al, 0xe
je 0x4041d6
cmp al, 0xf
je 0x40419b
cmp al, 0x11
je 0x40419b
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.004027a8
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40419b
jmp 0x4041ea
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4041a5
jmp 0x4041ea
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x40415c
dec edi
jg 0x4041bb
pop ebp
jmp 0x4041ea
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404130
dec edi
jg 0x4041d9
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x40415c

Function at 0x4041f0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40419b
cmp al, 0xb
je 0x40419b
cmp al, 0xc
je 0x4041a5
cmp al, 0xd
je 0x4041b8
cmp al, 0xe
je 0x4041d6
cmp al, 0xf
je 0x40419b
cmp al, 0x11
je 0x40419b
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.004027a8
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40419b
jmp 0x4041ea
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4041a5
jmp 0x4041ea
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x40415c
dec edi
jg 0x4041bb
pop ebp
jmp 0x4041ea
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404130
dec edi
jg 0x4041d9
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x40415c
Function at 0x404228
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x40426f
cmp al, 0xb
je 0x404289
cmp al, 0xc
je 0x4042a0
cmp al, 0xd
je 0x4042af
cmp al, 0xe
je 0x4042cd
cmp al, 0xf
je 0x4042e3
cmp al, 0x11
je 0x4042f2
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.004027a8
cmp ecx, 1
mov eax, ebx
jg 0x404280
call fcn.00403914
jmp 0x404301
mov edx, ecx
call fcn.00403938
jmp 0x404301
cmp ecx, 1
mov eax, ebx
jg 0x404297
call fcn.00403ee0
jmp 0x404301
mov edx, ecx
call fcn.00403ef8
jmp 0x404301
mov eax, ebx
add ebx, 0x10
call fcn.00404ca8
dec edi
jg 0x4042a0
jmp 0x404301
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404228
dec edi
jg 0x4042b2
pop ebp
jmp 0x404301
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004041fc
dec edi
jg 0x4042d0
pop ebp
jmp 0x404301
mov eax, ebx
add ebx, 4
call fcn.004054b0
dec edi
jg 0x4042e3
jmp 0x404301
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.0040504c
dec edi
jg 0x4042f2
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x404308
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404228

Function at 0x404314
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x404340
mov edx, eax
add eax, esi
add edx, ebx
call fcn.00402834
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x40437f
cmp cl, 0xb
je 0x404390
cmp cl, 0xc
je 0x4043a1
cmp cl, 0xd
je 0x4043b2
cmp cl, 0xe
je 0x4043d2
cmp cl, 0xf
je 0x4043eb
cmp cl, 0x11
je 0x4043fc
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.004027a8
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403968
mov eax, 4
jmp 0x40440d
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403f1c
mov eax, 4
jmp 0x40440d
lea edx, [esi + eax]
add eax, ebx
call fcn.004046d8
mov eax, 0x10
jmp 0x40440d
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.00404430
pop eax
jmp 0x40440d
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.00404314
pop eax
jmp 0x40440d
mov edx, dword [esi + eax]
add eax, ebx
call fcn.004054c8
mov eax, 4
jmp 0x40440d
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405088
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x40432e
pop ecx
sub ecx, eax
jle 0x404429
lea edx, [ebx + eax]
add eax, esi
call fcn.00402834
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x404430
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x404476
cmp cl, 0xb
je 0x40448d
cmp cl, 0xc
je 0x4044a1
cmp cl, 0xd
je 0x4044b5
cmp cl, 0xe
je 0x4044d6
cmp cl, 0xf
je 0x4044f3
cmp cl, 0x11
je 0x404507
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.004027a8
mov eax, ebx
mov edx, dword [esi]
call fcn.00403968
add ebx, 4
add esi, 4
dec ebp
jne 0x404476
jmp 0x40451b
mov eax, ebx
mov edx, dword [esi]
call fcn.00403f1c
add ebx, 4
add esi, 4
dec ebp
jne 0x40448d
jmp 0x40451b
mov eax, ebx
mov edx, esi
call fcn.004046d8
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x4044a1
jmp 0x40451b
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.00404430
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x4044be
jmp 0x40451b
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.00404314
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x4044d6
jmp 0x40451b
mov eax, ebx
mov edx, dword [esi]
call fcn.004054c8
add ebx, 4
add esi, 4
dec ebp
jne 0x4044f3
jmp 0x40451b
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00405088
add ebx, 4
add esi, 4
dec ebp
jne 0x404507
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4046d8
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.004027a8
cmp eax, edx
je 0x40476f
cmp word [eax], 8
jb 0x404710
push eax
push edx
cmp word [eax], 0x100
je 0x404706
cmp word [eax], 0x101
je 0x4046fe
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x40470e
call dword [0x44d3e8]
jmp 0x40470e
add eax, 8
call fcn.00403914
pop edx
pop eax
cmp word [edx], 8
jae 0x404727
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x404742
cmp word [edx], 0x101
jne 0x40475b
push eax
call 0x404716
pop eax
jmp dword [0x44d3f0]
mov edx, dword [edx + 8]
or edx, edx
je 0x404752
mov ecx, dword [edx - 8]
inc ecx
jle 0x404752
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x40468c
ret

Function at 0x404ac0
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 0
je fcn.004054b0
cmp word [edx], 0xd
je 0x404b0b
cmp word [edx], 9
je 0x404b0b
cmp word [edx], 0x400d
je 0x404b01
cmp word [edx], 0x4009
je 0x404b01
cmp word [edx], 0x101
jne fcn.00404684
jmp fcn.00404a50
mov edx, dword [edx + 8]
mov edx, dword [edx]
jmp fcn.004054c8
mov edx, dword [edx + 8]
jmp fcn.004054c8
Function at 0x404c6c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
lea eax, [ebp - 0x10]
call fcn.00404cb0
xor eax, eax
push ebp
push 0x404c5e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call dword [0x44d3ec]
mov eax, ebx
lea edx, [ebp - 0x10]
call fcn.00404c6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404c65
lea eax, [ebp - 0x10]
call fcn.00404ca8
ret
cmp word [edx], 0x101
je 0x404c08
cmp word [edx], 0x100
jne fcn.004046d8
cmp word [eax], 8
jb 0x404c91
push eax
push edx
call fcn.00404694
pop edx
pop eax
mov word [eax], 8
add eax, 8
add edx, 8
xor ecx, ecx
mov edx, dword [edx]
mov dword [eax], ecx
jmp fcn.00404024