joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4094e0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
xor ebx, ebx
push ebx
lea eax, [esp + 0x18]
push eax
push 0x40
push edi
push ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40960e
cmp dword [esp + 0x14], 0x40
jne 0x40960e
movzx eax, word [edi]
mov ecx, 0x5a4d
mov esi, 0xf8
cmp ax, cx
je 0x409566
mov edx, 0x4550
cmp ax, dx
jne 0x40960e
cmp dword [edi + 0x40], esi
mov dword [edi + 0x14c], ebx
jl 0x40960e
mov eax, dword [edi + 0x14c]
push ebx
cdq
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x40958b
mov eax, dword [esp + 0x14]
jmp 0x409595
mov eax, dword [edi + 0x3c]
cmp eax, ebx
je 0x40960e
lea ecx, [eax + 0xf8]
cmp ecx, dword [edi + 0x40]
mov dword [edi + 0x14c], eax
jg 0x40960e
cmp eax, 0x40
jmp 0x409540
lea ecx, [edi + 0x44]
mov edx, ebp
call fcn.00409a60
cmp eax, ebx
je 0x40960e
cmp dword [edi + 0x44], 0x4550
je 0x4095e3
movzx eax, word [edi + 0x44]
mov edx, 0x5a4d
cmp dx, ax
je 0x4095c4
mov ecx, 0x454e
cmp cx, ax
je 0x4095c4
mov edx, 0x454c
cmp dx, ax
jne 0x40960e
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
mov dword [edi + 0x150], ebx
mov byte [edi + 0x155], bl
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp word [edi + 0x58], bx
je 0x40960e
cmp byte [edi + 0x5e], 3
jae 0x4095f5
cmp byte [edi + 0x5f], 5
jb 0x40960e
movzx ecx, word [edi + 0x4a]
mov eax, 1
mov byte [edi + 0x155], al
mov dword [edi + 0x150], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x4096c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov edi, ecx
xor esi, esi
push esi
cdq
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x40973a
test edi, edi
jle 0x40972c
cmp edi, 0x1000
mov esi, edi
jl 0x4096f5
mov esi, 0x1000
push 0
lea edx, [esp + 0x28]
push edx
push esi
push ebx
push ebp
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409745
cmp dword [esp + 0x24], esi
jne 0x409745
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
push esi
push ebx
push ecx
call edx
sub edi, esi
test edi, edi
jg 0x4096e6
mov eax, 1
pop edi
pop esi
pop ebp
add esp, 0x10
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x10
ret 8
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10
ret 8
Function at 0x409840
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4bbbf0
push 0x476cc0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x4c1280]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x2c]
push eax
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x409a30
cmp dword [ebp - 0x2c], edi
jne 0x40989f
cmp dword [ebp - 0x28], edi
jne 0x40989f
lea edi, [ebx + 0x57]
jmp 0x409a33
push 0x158
call fcn.00476728
add esp, 4
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, edi
je 0x409a30
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x14c], edi
mov dword [ebx + 0x150], edi
mov byte [ebx + 0x154], 0
mov byte [ebx + 0x155], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ebx + 0x40], ecx
push esi
mov edi, ebx
call fcn.004094e0
add esp, 4
test eax, eax
jne 0x4098f1
mov byte [ebx + 0x155], al
mov edi, 0x57
mov dword [ebp - 0x20], edi
lea edx, [ebp - 0x64]
mov esi, dword [ebp + 0xc]
mov dword [esi], edx
mov eax, dword [esi + 4]
xor ecx, ecx
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [edx + 4], ecx
mov dword [esi + 8], 0x409c00
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
mov dword [ebp - 4], ecx
cmp dword [ebx + 0x150], ecx
jbe 0x409a01
movzx eax, word [ebx + 0x5c]
mov edx, 0x10b
cmp ax, dx
je 0x409946
mov edx, 0x20b
cmp ax, dx
jne 0x409a01
mov edx, 0x10b
cmp ax, dx
jne 0x409985
push 4
mov edi, dword [ebx + 0x14c]
add edi, 0x58
mov eax, esi
call fcn.00409670
mov edi, dword [ebx + 0x14c]
add edi, 0x98
push 8
mov eax, esi
call fcn.00409670
mov eax, dword [ebx + 0xe0]
mov edi, dword [ebx + 0xdc]
jmp 0x4099f9
mov eax, dword [ebx + 0x14c]
cdq
push ecx
lea ecx, [ebp - 0x34]
push ecx
push edx
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4099a6
mov eax, dword [ebp - 0x24]
jmp 0x4099b9
lea ecx, [ebx + 0x44]
mov esi, pe_nt_image_headers32
mov edx, dword [ebp + 8]
call fcn.00409a60
mov esi, dword [ebp + 0xc]
test eax, eax
jne 0x4099c6
mov dword [ebp - 4], 0xfffffffe
jmp 0x409a33
push 4
mov edi, dword [ebx + 0x14c]
add edi, 0x58
mov eax, esi
call fcn.00409670
mov edi, dword [ebx + 0x14c]
add edi, 0xa8
push 8
mov eax, esi
call fcn.00409670
mov eax, dword [ebx + 0xf0]
mov edi, dword [ebx + 0xec]
push eax
mov eax, esi
call fcn.00409670
mov ecx, dword [ebx + 0x40]
push ecx
mov edx, dword [ebp + 8]
push edx
push esi
call fcn.00409750
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0xfffffffe
jmp 0x409a33
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x409a47
push ebx
call fcn.00476105
add esp, 4
xor eax, eax
test edi, edi
sete al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409d50
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x498439
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c1280]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push ebp
push eax
mov dword [esp + 0x3c], eax
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
lea edi, [ebx + 1]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x18], edi
neg ecx
or ecx, eax
push ecx
call fcn.0047159e
mov edi, eax
lea eax, [ebx + ebx + 2]
push eax
xor ebx, ebx
push ebx
push edi
call fcn.00472990
mov ecx, dword [esp + 0x28]
add esp, 0x10
push ecx
push edi
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov word [esi + 4], dx
mov eax, edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], 1
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x409e00
sub eax, edx
sar eax, 1
push eax
push edi
mov ecx, esi
call fcn.00402110
push edi
call fcn.0047311d
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x409e40
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x498439
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c1280]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push ebp
push eax
mov dword [esp + 0x3c], eax
push 0xfde9
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
lea edi, [ebx + 1]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x18], edi
neg ecx
or ecx, eax
push ecx
call fcn.0047159e
mov edi, eax
lea eax, [ebx + ebx + 2]
push eax
xor ebx, ebx
push ebx
push edi
call fcn.00472990
mov ecx, dword [esp + 0x28]
add esp, 0x10
push ecx
push edi
push 0xffffffffffffffff
push ebp
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov word [esi + 4], dx
mov eax, edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], 1
lea edx, [eax + 2]
jmp 0x409f00
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x409f00
sub eax, edx
sar eax, 1
push eax
push edi
mov ecx, esi
call fcn.00402110
push edi
call fcn.0047311d
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x40a0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4975e9
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c1280]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], eax
mov byte [edi + 4], bl
xor ebp, ebp
cmp dword [esp + 0x78], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x20], 1
jle 0x40a1d5
mov ecx, dword [esp + 0x1c]
movzx ecx, byte [ecx + ebp]
mov eax, ecx
cdq
and edx, 0xf
add eax, edx
sar eax, 4
and ecx, 0x8000000f
jns 0x40a132
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp eax, 9
ja 0x40a13b
add al, 0x30
jmp 0x40a13d
add al, 0x37
mov byte [esp + 0x14], al
cmp ecx, 9
ja 0x40a14b
add cl, 0x30
jmp 0x40a14e
add cl, 0x37
mov edx, dword [esp + 0x14]
push edx
push edi
lea esi, [esp + 0x4c]
mov byte [esp + 0x20], cl
call fcn.0040a5e0
mov ecx, dword [esp + 0x20]
push ecx
push eax
lea esi, [esp + 0x38]
mov dword [esp + 0x78], 1
call fcn.0040a5e0
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [esp + 0x74], 2
call fcn.004048b0
mov esi, 0x10
cmp dword [esp + 0x40], esi
jb 0x40a1a3
mov edx, dword [esp + 0x2c]
push edx
call fcn.0047295c
add esp, 4
mov byte [esp + 0x68], bl
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp dword [esp + 0x5c], esi
jb 0x40a1ca
mov eax, dword [esp + 0x48]
push eax
call fcn.0047295c
add esp, 4
inc ebp
cmp ebp, dword [esp + 0x78]
jl 0x40a112
mov eax, edi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret

Function at 0x40a790
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.System32drivers
push esi
push edi
call fcn.00472b79
add esp, 0xc
pop edi
mov eax, 1
pop esi
ret

Function at 0x40a7c0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.System32_
push esi
push edi
call fcn.00472b79
push str.SDIR
push esi
push edi
call fcn.00472b79
add esp, 0x18
pop edi
mov eax, 1
pop esi
ret

Function at 0x40a800
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.System32_
push esi
push edi
call fcn.00472b79
push str.SDIR
push esi
push edi
call fcn.00472b79
push 0x4b12bc
push esi
push edi
call fcn.00472b79
push str.System.dat
push esi
push edi
call fcn.00472b79
add esp, 0x30
pop edi
mov eax, 1
pop esi
ret
Function at 0x40a850
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.System32_
push esi
push edi
call fcn.00472b79
push str.SDIR
push esi
push edi
call fcn.00472b79
push 0x4b12bc
push esi
push edi
call fcn.00472b79
push str.applications.dat
push esi
push edi
call fcn.00472b79
add esp, 0x30
pop edi
mov eax, 1
pop esi
ret

Function at 0x40a8a0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.System32_
push esi
push edi
call fcn.00472b79
push str.SDIR
push esi
push edi
call fcn.00472b79
push 0x4b12bc
push esi
push edi
call fcn.00472b79
mov eax, dword [esp + 0x38]
push eax
push esi
push edi
call fcn.00472b79
add esp, 0x30
pop edi
mov eax, 1
pop esi
ret

Function at 0x40a8f0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.System32_
push esi
push edi
call fcn.00472b79
push str.SDIR
push esi
push edi
call fcn.00472b79
push 0x4b12bc
push esi
push edi
call fcn.00472b79
push str.DigestConf.dat
push esi
push edi
call fcn.00472b79
add esp, 0x30
pop edi
mov eax, 1
pop esi
ret
Function at 0x40ab10
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x414
mov eax, dword [0x4c1280]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x418]
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebp
mov ebp, dword [esp + 0x428]
push esi
mov esi, dword [esp + 0x428]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40ab58
push ebp
push esi
push 0
call edi
push esi
call ebx
jmp 0x40ab63
push eax
push ebp
push esi
call fcn.00472a0a
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.00472990
add esp, 0xc
test esi, esi
jne 0x40ab97
push 0x104
lea edx, [esp + 0x14]
push edx
push esi
call edi
lea eax, [esp + 0x10]
push eax
call ebx
jmp 0x40abaa
push esi
lea ecx, [esp + 0x14]
push 0x104
push ecx
call fcn.00472a0a
add esp, 0xc
push 0x4b12bc
lea edx, [esp + 0x14]
push 0x104
push edx
call fcn.00472b79
push str.skin_version.ini
lea eax, [esp + 0x20]
push 0x104
push eax
call fcn.00472b79
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x23a]
push edx
mov word [esp + 0x23c], cx
call fcn.00472990
add esp, 0x24
lea eax, [esp + 0x10]
push eax
push 0x104
lea ecx, [esp + 0x220]
push ecx
push str.NoString
push 0x4b291c
push str.SETTING
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x40ac84
mov ecx, str.NoString
lea eax, [esp + 0x218]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ac56
test dx, dx
je 0x40ac52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ac56
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ac30
xor eax, eax
jmp 0x40ac5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40ac84
push 0x4b12bc
push ebp
push esi
call fcn.00472b79
lea edx, [esp + 0x224]
push edx
push ebp
push esi
call fcn.00472b79
add esp, 0x18
mov eax, 1
jmp 0x40ac86
xor eax, eax
mov ecx, dword [esp + 0x420]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00472a79
add esp, 0x414
ret

Function at 0x40ad60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x4c1280]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, dword [esp + 0x420]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov dword [esp + 0x10], 0
mov word [esp + 0x14], ax
call fcn.00472990
add esp, 0xc
lea edx, [esp + 0x210]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
ja 0x40add6
test eax, eax
je 0x40add6
lea eax, [esp + 8]
push eax
push 0
push 0x4b2970
lea ecx, [esp + 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
lea eax, [esp + 8]
mov word [esi + 4], dx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40adf1
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00402110
mov ecx, dword [esp + 0x418]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00472a79
add esp, 0x418
ret
Function at 0x40b580
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49837b
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x4c1280]
xor eax, esp
mov dword [esp + 0x264], eax
push ebx
push edi
mov eax, dword [0x4c1280]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 4]
push ecx
mov ecx, esi
call fcn.0040bd80
mov eax, dword [esi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x18]
xor ebx, ebx
mov dword [esi + 0x1c], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x18]
mov dword [eax + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x206
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x6a]
xor edx, edx
xor eax, eax
push ebx
push ecx
mov word [esp + 0x68], dx
mov dword [esp + 0x6a], ebx
mov word [esp + 0x70], ax
call fcn.00472990
add esp, 0xc
xor edi, edi
mov eax, dword [esp + 0xc]
mov edx, 1
mov ecx, edi
shl edx, cl
test eax, edx
je 0x40b6ef
lea ecx, [edi + 0x41]
push ecx
lea edx, [esp + 0x60]
push 0x4b2cdc
push edx
call fcn.00474c5a
add esp, 0xc
push 0x103
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
xor edx, edx
mov word [esp + eax*2 + 0x64], dx
lea eax, [esp + 0x5c]
push eax
call fcn.004794ea
lea ecx, [esp + 0x68]
add esp, 4
push ecx
call fcn.004794ea
add esp, 4
lea ecx, [esp + 0x18]
lea edx, [esp + 0x5c]
lea eax, [esp + 0x64]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call fcn.0040c7b0
lea edx, [esp + 0x50]
push edx
push esi
lea eax, [esp + 0x20]
mov dword [esp + 0x288], ebx
call fcn.0040bbb0
mov dword [esp + 0x280], 0xffffffff
cmp dword [esp + 0x4c], 8
jb 0x40b6c8
mov eax, dword [esp + 0x38]
push eax
call fcn.0047295c
add esp, 4
xor ecx, ecx
cmp dword [esp + 0x30], 8
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], cx
jb 0x40b6ef
mov edx, dword [esp + 0x1c]
push edx
call fcn.0047295c
add esp, 4
inc edi
cmp edi, 0x1a
jl 0x40b614
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.00472a79
mov esp, ebp
pop ebp
ret
Function at 0x412250
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x49726b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4c1280]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00471719
push 4
mov dword [esp + 0x24], 0
call fcn.00475d7a
mov edi, eax
add esp, 4
test edi, edi
je 0x4122d2
call fcn.004719cb
mov dword [edi], eax
call fcn.004717f9
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00471b1b
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4122c7
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00471b43
jmp 0x4122d4
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x415130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x498168
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c1280]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x8c]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 4]
mov esi, dword [edi + 0x14]
sub eax, 2
mov ebx, 1
cmp esi, eax
ja 0x41519a
cmp dword [edi + 0x18], eax
je 0x41519a
push ebx
push eax
call fcn.00405090
test al, al
je 0x41519a
cmp dword [edi + 0x18], 0x10
mov dword [edi + 0x14], esi
jb 0x415193
mov eax, dword [edi + 4]
jmp 0x415196
lea eax, [edi + 4]
mov byte [eax + esi], 0
mov esi, dword [ebp + 4]
mov ecx, dword [ebp + 8]
sub ecx, ebx
add esi, ebx
mov dword [esp + 0x18], ecx
cmp esi, ecx
je 0x41537b
jmp 0x4151b6
mov ecx, dword [esp + 0x18]
mov al, byte [esi]
add esi, ebx
mov byte [esp + 0x20], al
cmp al, 0x22
je 0x41537b
cmp al, 0x5c
jne 0x4152b7
cmp esi, ecx
je 0x4152d3
mov al, byte [esi]
movsx eax, al
add esi, ebx
add eax, 0xffffffde
mov dword [esp + 0x8c], esi
cmp eax, 0x53
ja case.0x4151f7.35
movzx eax, byte [eax + 0x4153bc]
jmp dword [eax*4 + 0x415394]
push 0x22
jmp 0x4152bc
push 0x2f
jmp 0x4152bc
push 0x5c
jmp 0x4152bc
push 8
jmp 0x4152bc
push 0xc
jmp 0x4152bc
push 0xa
jmp 0x4152bc
push 0xd
jmp 0x4152bc
push 9
jmp 0x4152bc
mov eax, dword [esp + 0x88]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
lea ecx, [esp + 0x98]
mov edx, ebp
call fcn.00415410
test al, al
je 0x41531f
mov ecx, dword [esp + 0x1c]
lea esi, [esp + 0x5c]
call fcn.004134f0
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
mov dword [esp + 0x8c], ebx
call fcn.00417580
mov dword [esp + 0x80], 0xffffffff
cmp dword [esp + 0x74], 0x10
jb 0x415299
mov ecx, dword [esp + 0x60]
push ecx
call fcn.0047295c
add esp, 4
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
jmp 0x4152c4
mov edx, dword [esp + 0x20]
push edx
push ebx
mov ecx, edi
call fcn.0040a680
cmp esi, dword [esp + 0x18]
jne 0x4151b2
jmp 0x41537b
push 0x1f
xor edi, edi
push str.Empty_escape_sequence_in_string
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], edi
mov byte [esp + 0x30], 0
call fcn.00405c80
mov edx, dword [esp + 0x88]
push esi
push ebp
lea ecx, [esp + 0x2c]
mov dword [esp + 0x88], edi
call fcn.004156c0
cmp dword [esp + 0x3c], 0x10
mov bl, al
jb 0x41537b
mov eax, dword [esp + 0x28]
push eax
jmp 0x415373
xor al, al
jmp 0x41537d
push 0x1d
push str.Bad_escape_sequence_in_string
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], 0
mov byte [esp + 0x4c], 0
call fcn.00405c80
mov edx, dword [esp + 0x88]
push esi
push ebp
lea ecx, [esp + 0x48]
mov dword [esp + 0x88], 2
call fcn.004156c0
cmp dword [esp + 0x58], 0x10
mov bl, al
jb 0x41537b
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0047295c
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8