joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ab8a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0041b842
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0041acea
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41acd4
test ebx, ebx
jl 0x41ac78
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcd0fee
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41ac99
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x41ac8b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0041c65a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0041c65a
add esp, 8
mov ebx, 0x80070057
jmp 0x41ac78
Function at 0x431a1a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004326d2
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00431b7a
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x431b64
test ebx, ebx
jl 0x431b08
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce7e7e
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x431b29
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x431b1b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004334ea
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004334ea
add esp, 8
mov ebx, 0x80070057
jmp 0x431b08
Function at 0x44845a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00449112
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004485ba
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4485a4
test ebx, ebx
jl 0x448548
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcfe8be
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x448569
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x44855b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00449f2a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00449f2a
add esp, 8
mov ebx, 0x80070057
jmp 0x448548
Function at 0x45eeba
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0045fb72
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045f01a
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45f004
test ebx, ebx
jl 0x45efa8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd1531e
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45efc9
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45efbb
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0046098a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0046098a
add esp, 8
mov ebx, 0x80070057
jmp 0x45efa8
Function at 0x475cba
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00476972
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00475e1a
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x475e04
test ebx, ebx
jl 0x475da8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2c11e
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x475dc9
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x475dbb
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0047778a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0047778a
add esp, 8
mov ebx, 0x80070057
jmp 0x475da8
Function at 0x48d3da
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0048e092
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0048d53a
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x48d524
test ebx, ebx
jl 0x48d4c8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd4383e
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48d4e9
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x48d4db
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0048eeaa
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0048eeaa
add esp, 8
mov ebx, 0x80070057
jmp 0x48d4c8
Function at 0x4a429a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004a4f52
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004a43fa
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a43e4
test ebx, ebx
jl 0x4a4388
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd5a6fe
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a43a9
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4a439b
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004a5d6a
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004a5d6a
add esp, 8
mov ebx, 0x80070057
jmp 0x4a4388
Function at 0x4b95c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1368
cmp edx, dword [eax]
je 0x4b95e3
add eax, 8
inc ecx
cmp eax, 0x4c13f8
jl 0x4b95d4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1368]
jne 0x4b9711
mov eax, dword [0x4c5cec]
cmp eax, 1
je 0x4b96eb
test eax, eax
jne 0x4b9614
cmp dword [0x4c1290], 1
je 0x4b96eb
cmp edx, 0xfc
je 0x4b9711
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b964b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9fa0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba430
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b968e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba430
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be9cc
push edi
call fcn.004bc300
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9fa0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9fb0
lea eax, [ebp - 0xa0]
push 0x4be9ac
push eax
call fcn.004b9fb0
push dword [esi + 0x4c136c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9fb0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bc274
add esp, 0x2c
pop edi
jmp 0x4b9711
lea eax, [ebp + 8]
lea esi, [esi + 0x4c136c]
push 0
push eax
push dword [esi]
call fcn.004ba430
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40cb00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
mov al, byte [eax + 0x4c]
mov byte [esp + 0x10], al
mov esi, dword [edi]
cmp esi, dword [esp + 0x18]
je 0x40cc83
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x24]
nop word [eax + eax]
mov cl, byte [esi + 5]
test cl, 0x18
je 0x40cc38
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x40cb57.11
movzx eax, byte [eax + 0x40ccb0]
jmp dword [eax*4 + 0x40cc88]
push esi
push ebx
call fcn.0040a450
add esp, 8
jmp case.0x40cb57.11
lea eax, [esi + 0x10]
cmp dword [esi + 8], eax
je 0x40cb7e
push esi
call fcn.0040a740
add esp, 4
push 0x20
push esi
push ebx
call fcn.0040f210
add esp, 0xc
jmp case.0x40cb57.11
movzx eax, byte [esi + 6]
lea eax, [eax*4 + 0x10]
push eax
push esi
push ebx
call fcn.0040f210
add esp, 0xc
jmp case.0x40cb57.11
movzx eax, byte [esi + 6]
inc eax
shl eax, 4
push eax
push esi
push ebx
call fcn.0040f210
add esp, 0xc
jmp case.0x40cb57.11
push esi
push ebx
call fcn.004154c0
add esp, 8
jmp case.0x40cb57.11
push esi
push ebx
call fcn.00414290
add esp, 8
jmp case.0x40cb57.11
movzx eax, word [esi + 6]
test ax, ax
jne 0x40cbf0
mov ecx, 0x10
jmp 0x40cbf8
mov ecx, eax
shl ecx, 4
add ecx, 0x18
mov eax, dword [esi + 8]
add eax, ecx
push eax
push esi
push ebx
call fcn.0040f210
add esp, 0xc
jmp case.0x40cb57.11
push esi
push ebx
call fcn.00414f90
movzx eax, byte [esi + 7]
add eax, 0x11
push eax
push esi
push ebx
call fcn.0040f210
add esp, 0x14
jmp case.0x40cb57.11
mov eax, dword [esi + 0xc]
add eax, 0x11
push eax
push esi
push ebx
call fcn.0040f210
add esp, 0xc
jmp case.0x40cb57.11
test cl, 7
jne 0x40cc4c
and cl, 0xc1
and al, 0x18
or cl, al
or cl, 1
mov byte [esi + 5], cl
jmp 0x40cc6f
movzx eax, cl
and cl, 0xf8
and eax, 7
or cl, byte [eax + 0x462140]
mov byte [esi + 5], cl
and cl, 7
cmp cl, 3
jne 0x40cc6f
cmp dword [ebp], 0
jne 0x40cc6f
mov dword [ebp], esi
mov edi, esi
mov esi, dword [edi]
mov al, byte [esp + 0x18]
cmp esi, dword [esp + 0x20]
jne 0x40cb30
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x410230
Capabilities:
Check http status code

Disassembly:
sub esp, 0xd8
mov eax, dword [0x470d00]
xor eax, esp
mov dword [esp + 0xd4], eax
push ebx
push ebp
mov ebp, dword [esp + 0xe8]
lea eax, [esp + 8]
push esi
push edi
mov edi, dword [esp + 0xec]
push eax
push edi
call fcn.0040f730
mov esi, eax
add esp, 8
test esi, esi
je 0x410284
mov ecx, dword [esp + 0x10]
sub esi, edi
mov edx, dword [esp + 0x14]
mov al, 3
mov dword [ebp], ecx
mov dword [ebp + 4], edx
mov byte [ebp + 8], al
lea eax, [esi + 1]
jmp 0x4102a4
push 0x462578
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x4102bd
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x4102bf
xor eax, eax
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045f6d1
add esp, 0xd8
ret
xor ebx, ebx
push ebx
lea eax, [esp + 0x14]
push eax
push edi
call fcn.0040f6b0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x41035c
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
mov esi, eax
add esp, 8
test esi, esi
je 0x4102a2
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4102f0
sub ecx, edx
cmp ecx, 0xc8
ja 0x4102a2
lea edx, [esp + 0x18]
mov ecx, edi
sub edx, edi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x410310
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub esi, edi
push ebx
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esp + esi + 0x1c], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0040f6b0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4102a2
mov eax, edi
lea ecx, [esp + 0x18]
sub eax, ecx
add esi, eax
test esi, esi
je 0x4102a2
movsd xmm0, qword [esp + 0x10]
sub esi, edi
mov al, 0x13
movsd qword [ebp], xmm0
mov byte [ebp + 8], al
lea eax, [esi + 1]
jmp 0x4102a4
Function at 0x410420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push esi
push edi
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
mov ecx, dword [esp + 0x1c]
xor edi, edi
xor esi, esi
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov al, byte [ecx]
mov byte [esp + 0x1f], al
movzx eax, al
test byte [eax + 0x461d49], 8
je 0x410475
mov al, byte [ecx + 1]
inc ecx
mov byte [esp + 0x1f], al
movzx eax, al
test byte [eax + 0x461d49], 8
jne 0x410461
mov al, byte [esp + 0x1f]
lea edx, [ecx + 1]
cmp al, 0x2d
jne 0x41048a
mov dword [esp + 0xc], 1
jmp 0x410493
cmp al, 0x2b
mov dword [esp + 0xc], esi
cmovne edx, ecx
cmp byte [edx], 0x30
jne 0x4105d9
mov al, byte [edx + 1]
cmp al, 0x78
je 0x4104ab
cmp al, 0x58
jne 0x4105d9
movsd xmm2, qword [0x4625e0]
add edx, 2
mov al, byte [edx]
movsx ecx, al
mov byte [esp + 0x1f], al
cmp ecx, dword [esp + 8]
jne 0x4104d7
cmp dword [esp + 0x14], 0
jne 0x41052c
mov dword [esp + 0x14], 1
inc edx
jmp 0x4104b6
movzx eax, al
test byte [eax + 0x461d49], 0x10
je 0x41052c
test edi, edi
jne 0x4104f4
cmp byte [esp + 0x1f], 0x30
jne 0x4104f4
inc dword [esp + 0x10]
jmp 0x410521
inc edi
cmp edi, 0x1e
jg 0x410520
test byte [ecx + 0x461d49], 2
je 0x410508
add ecx, 0xffffffd0
jmp 0x41050e
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x410521
inc esi
cmp dword [esp + 0x14], 0
je 0x410529
dec esi
inc edx
jmp 0x4104b6
mov eax, dword [esp + 0x10]
add eax, edi
je 0x4105d9
mov eax, dword [esp + 0x20]
shl esi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x41054b
cmp al, 0x50
jne 0x4105b3
mov al, byte [edx + 1]
xor ecx, ecx
mov byte [esp + 0x1f], al
cmp al, 0x2d
jne 0x410560
lea edi, [ecx + 1]
lea eax, [ecx + 2]
jmp 0x41056d
xor eax, eax
xor edi, edi
cmp byte [esp + 0x1f], 0x2b
sete al
inc eax
add edx, eax
mov al, byte [edx]
mov byte [esp + 0x1f], al
movzx eax, al
test byte [eax + 0x461d49], 2
je 0x4105d9
movsx eax, byte [esp + 0x1f]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [esp + 0x1f], al
movzx eax, al
test byte [eax + 0x461d49], 2
jne 0x410581
mov eax, ecx
neg eax
test edi, edi
cmove eax, ecx
add esi, eax
mov eax, dword [esp + 0x20]
mov dword [eax], edx
cmp dword [esp + 0xc], 0
je 0x4105c1
xorps xmm1, xmmword [0x4625f0]
push esi
sub esp, 8
movsd qword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret
fldz
pop edi
pop esi
add esp, 0x10
ret