joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444a18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x444a31
cmp dword [esi + 8], 0
jne 0x444a38
xor eax, eax
jmp 0x444b2b
mov edx, dword [esi + 4]
and edx, 0x100
mov dword [ebp - 8], edx
mov eax, dword [esi]
test eax, eax
jne 0x444a53
mov dword [ebp - 4], 1
jmp 0x444ab0
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [esi + 8]
cmp dword [ebp - 8], 0
mov al, byte [edx]
jne 0x444a71
cmp eax, 0x7f
jle 0x444a71
mov ebx, 1
xor ecx, ecx
jmp 0x444aad
cmp dword [ebp - 8], 0
je 0x444aad
cmp eax, 0x80
jle 0x444a87
mov ebx, 1
mov cl, 0xff
jmp 0x444aad
cmp eax, 0x80
jne 0x444aad
mov eax, 1
mov edx, dword [esi + 8]
inc edx
jmp 0x444aa9
cmp byte [edx], 0
je 0x444aa7
mov ebx, 1
mov cl, 0xff
jmp 0x444aad
inc eax
inc edx
cmp eax, dword [esi]
jl 0x444a99
add dword [ebp - 4], ebx
cmp dword [ebp + 0xc], 0
jne 0x444abb
mov eax, dword [ebp - 4]
jmp 0x444b2b
mov edx, dword [ebp + 0xc]
test ebx, ebx
mov edx, dword [edx]
je 0x444ac7
mov byte [edx], cl
inc edx
cmp dword [esi], 0
jne 0x444ad1
mov byte [edx], 0
jmp 0x444b20
cmp dword [ebp - 8], 0
jne 0x444ae9
mov eax, dword [esi]
push eax
mov ecx, dword [esi + 8]
push ecx
push edx
call fcn.0040a364
add esp, 0xc
jmp 0x444b20
mov eax, dword [esi]
mov ecx, dword [esi + 8]
add ecx, eax
mov ebx, eax
dec ebx
dec ecx
add edx, ebx
jmp 0x444afe
mov byte [edx], 0
dec edx
dec ecx
dec eax
cmp byte [ecx], 0
je 0x444af8
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
inc ebx
mov byte [edx], bl
dec edx
test eax, eax
jle 0x444b20
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
mov byte [edx], bl
dec edx
test eax, eax
jg 0x444b12
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
add dword [eax], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x444b34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
cmp dword [ebp + 8], 0
je 0x444b4a
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x444b68
push 2
call fcn.00448e64
pop ecx
mov esi, eax
test eax, eax
jne 0x444b5f
xor eax, eax
jmp 0x444cb2
mov dword [esi + 4], 2
jmp 0x444b6d
mov edx, dword [ebp + 8]
mov esi, dword [edx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
add eax, ebx
mov dword [ebp - 4], eax
push 0xc7
push 0x529b38
mov edx, dword [ebp + 0x10]
inc edx
push edx
call fcn.00418280
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x444ba4
mov eax, 0x41
jmp 0x444c7e
cmp dword [ebp + 0x10], 0
mov edx, dword [ebp - 8]
jne 0x444bb9
mov dword [esi + 4], 2
jmp 0x444c4e
test byte [ebx], 0x80
je 0x444c27
mov dword [esi + 4], reloc.ADVAPI32.DLL_DeregisterEventSource
cmp byte [ebx], 0xff
jne 0x444bd4
cmp dword [ebp + 0x10], 1
je 0x444bd4
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 1]
add ebx, ecx
add edx, ecx
jmp 0x444be6
mov byte [edx], 0
dec edx
dec eax
dec ebx
cmp byte [ebx], 0
jne 0x444bef
test eax, eax
jne 0x444be0
test eax, eax
jne 0x444c08
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
mov byte [eax + edx], 0
inc dword [ebp + 0x10]
jmp 0x444c4e
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
inc ecx
mov byte [edx], cl
dec edx
test eax, eax
jle 0x444c4e
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
mov byte [edx], cl
dec edx
test eax, eax
jg 0x444c17
jmp 0x444c4e
mov dword [esi + 4], 2
cmp byte [ebx], 0
jne 0x444c3d
cmp dword [ebp + 0x10], 1
je 0x444c3d
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
push eax
push ebx
mov edx, dword [ebp - 8]
push edx
call fcn.0040a364
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x444c5c
push eax
call fcn.00418440
pop ecx
mov edx, dword [ebp - 8]
mov dword [esi + 8], edx
mov ecx, dword [ebp + 0x10]
mov dword [esi], ecx
cmp dword [ebp + 8], 0
je 0x444c72
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, esi
jmp 0x444cb2
push 0x103
push 0x529b4e
push eax
push 0xc2
push 0xd
call fcn.00441f34
add esp, 0x14
test esi, esi
je 0x444cb0
cmp dword [ebp + 8], 0
je 0x444ca9
mov edx, dword [ebp + 8]
cmp esi, dword [edx]
je 0x444cb0
push esi
call fcn.00448eb4
pop ecx
xor eax, eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x96fd01
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, al
bt ecx, esi
mov ax, 0x64cd
not al
lea ebx, [ebx + 2]
jmp 0x96fd4d
rdtsc
bts edx, esp
clc
xchg dword [esp], ebx
mov ch, dl
jmp 0x96fceb
mov ax, bp
lea edx, reloc.ADVAPI32.DLL_DeregisterEventSource
lea ecx, [ecx + ebp]
shr cl, 6
call fcn.0096fd37
rol dx, cl
stc
not bh
rdtsc
push dword [esp + 4]
ret 8

Function at 0x977d15
Capabilities:
Hash data with md5

Disassembly:
jmp 0x978a6e
jmp 0x95d49c
jmp 0x95d4bb
and dword [eax + 4], 0
sub esp, 9
jmp 0x99deec
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret
lea esp, [esp + 0x20]
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
pushal
pop word [esp + 0x15]
jmp 0x99ddcc
lea esp, [esp + 1]
lea esp, [esp + 8]
and dword [eax], 0
pushal
jmp 0x99de5f

Function at 0x9781a5
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x95de73
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x95de8d
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x95de7c
pop esi
jmp 0x95de98
ret 4
pop word [esp + 3]
lea esp, [esp + 2]
mov dword [esp], eax
jmp 0x9781da
pushfd
push dword [esp + 1]
jmp 0x97818f
lea eax, reloc.ADVAPI32.DLL_DeregisterEventSource
push ecx
push bx
bswap ecx
mov ax, 0xa04c
jmp 0x97820c
lea eax, [ebp*4]
mov ah, 0xc9
mov eax, 0xf4001a45
jmp 0x9781c4
setbe cl
xchg cx, bp
xchg cx, ax
not ch
mov ah, dh
mov ebp, dword [esp]
jmp 0x97871e
mov al, ch
xchg word [esp], cx
lea esp, [esp + 2]
push ebp
mov eax, 0x6e3c3698
mov bp, dx
jmp 0x9781f6
lea eax, [edi + 0x29]
mov ax, word [esp]
mov ax, 0x4c13
lea eax, [edx + ebp]
pop eax
jmp 0x95de66
lea ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
lea ecx, [edx*4]
not ecx
pop ecx
mov ax, word [esp]
lea eax, [ebx*4]
jmp 0x97829e
mov ax, sp
pop ebp
mov cx, word [esp]
mov cx, word [esp]
lea eax, [ebx + edi]
mov cx, si
jmp 0x9783a8

Function at 0x97e4f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x12cf78d8
call fcn.0097e66f
cmp ch, bl
jmp 0x97d6ba
mov byte [esp + 2], bh
mov ebx, dword [esp + 2]
bsr ebx, ebp
jno 0x97e58e
jo 0x97d700
sbb al, 0x6f
rdtsc
mov dx, 0x67e9
jmp 0x96fcc6
call 0x97e530

Function at 0x990344
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ecx
sub esp, 0x15
push word [esp + 1]
jmp 0x99038c
lea esp, [esp + 3]
cmp edi, eax
call fcn.00990350

Function at 0x990350
Capabilities:
Encode data using base64

Disassembly:
push word [esp + 3]
lea esp, [esp + 2]
jmp 0x990376
lea esp, [esp + 0x1c]
setne cl
call fcn.009903ad
dec edx
salc
inc esp
and ebx, esi
push 0xffffffffffffffc7
outsb dx, byte [esi]
jns 0x9903e4
invalid

Function at 0x9903ad
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
lea ecx, [ecx*4 + 0x2b]
jmp 0x95bbe5
Function at 0x9903d3
Capabilities:
Encode data using base64

Disassembly:
push bp
lea esp, [esp + 2]
jmp 0x9904e7
jmp 0x9903bd
cmp dword [ebp + 0xc], 3
jmp 0x9903e0
lea esp, [esp + 4]
mov byte [edx + 2], 0x3d
jmp 0x98fe8c
jne 0x98fe76
cmp ebx, 0x1a
call fcn.00990508
div dword [ebp - 0x1b]
invalid
mov byte [edx + 3], 0x3d
jmp 0x990bf1
call fcn.009904d1
movzx eax, al
add eax, 4
jmp fcn.009906ba

Function at 0x9903fd
Capabilities:
Encode data using base64

Disassembly:
jmp 0x990397
cmp edi, eax
jae 0x98fec0
mov ecx, esp
jmp 0x95bc21
lea ecx, [edi - 4]
jmp 0x95bbe5
call fcn.00990344
aaa
mov ah, 0x2a
dec ebp
mov esp, 0x31a1237e
push eax
mov dword [reloc.ADVAPI32.DLL_DeregisterEventSource], eax
xor eax, 0xe8d83b24
sub al, 5
add byte [eax], al
lea ecx, [edi + 0x47]
jmp 0x95bbe5
jae 0x95bc11
push esi
xchg dword [esp], ecx
lea esp, [esp + 4]
jmp 0x99033c
mov byte [edx + 2], cl
jmp 0x98fe8c
lea esp, [esp + 4]
cmp edi, 0x34
jmp 0x990366

Function at 0x99062a
Capabilities:
Encode data using base64

Disassembly:
call fcn.009903fd
inc edx
std
int3
mov ch, 0x49
lea ecx, [edi + 0x41]
jmp 0x95bbe5
lea esp, [esp + 4]
jae 0x95bbfb
mov cl, ch
jmp 0x99057b

Function at 0x9e2676
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [ecx + edx]
lea ebx, reloc.ADVAPI32.DLL_DeregisterEventSource
mov ch, byte [esp]
xchg dword [esp], eax
call fcn.009e25cd
Function at 0xa1b07a
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc si
xchg cx, si
jmp 0xa1b0b7
cmc
dec ax
not cx
inc bp
not dx
sets bh
jmp 0xa1b0c8
rdtsc
xchg bp, bx
pop word [esp]
pop esi
bswap eax
mov ax, bp
jmp 0xa1b0a1
setns bl
lea ebx, [edi + ebp]
push ebp
lea ecx, [edx*4]
mov dword [esp], eax
rdtsc
jmp 0xa1b300
push bx
clc
dec cl
sub esp, 9
push dword [esp]
mov dword [esp + 6], ecx
jmp 0xa1b1f4
xchg word [esp], bx
mov edi, 0x76c1c99a
xchg word [esp], cx
xchg byte [esp], cl
pop word [esp + 1]
pop ebx
jmp 0xa1b18a
lea edi, [ebx - 0xe8]
mov ecx, esi
bswap eax
mov bx, si
not di
jmp 0xa1b2ad
lea ebx, [ebx + ebp]
bsf edx, edx
setne ah
sub esp, 2
std
pop si
jmp 0xa1b1b8
push dword [esp + 0xb]
not eax
sub esp, 0x1e
not ax
bts ebx, ecx
xchg byte [esp + 0x28], ch
jmp 0xa1b1ce
lea eax, [edx + edi]
xchg ah, cl
push word [esp + 7]
mov bx, sp
push dword [esp + 0xb]
pop bp
jmp 0xa1b238
pushfd
not dx
and ah, ah
pushfd
neg eax
push ecx
jmp 0xa1b209
pop di
push dword [esp + 0xd]
mov ebp, dword [esp + 0xa]
bswap edi
lea esp, [esp + 2]
rol cx, 0
jmp 0xa1b281
add dl, 0x7d
cpuid
lea eax, [esp - 0xf5]
neg ebx
or ebx, edi
dec edi
jmp 0xa1b22c
lea eax, reloc.ADVAPI32.DLL_DeregisterEventSource
pop dword [esp + 7]
jmp 0xa1b2dc
cpuid
lea edx, reloc.ADVAPI32.DLL_DeregisterEventSource
btr edi, edx
setg dl
bsf eax, eax
push word [esp + 0xa]
jmp 0xa1b26b
lea ebx, [ecx*4]
xchg edi, eax
xchg dword [esp + 0x27], ebp
mov ecx, dword [esp + 0x10]
sub esp, 0x13
lea esp, [esp + 0x44]
jmp 0xa1b258
mov cx, bp
mov word [esp + 1], ax
mov ecx, 0x74709f70
jmp 0xa1b381
lea edi, [edi*4]
mov bx, 0x9a25
mov si, word [esp + 0xd]
mov ebx, eax
xchg word [esp + 8], si
setl ch
jmp 0xa1b2c6
mov ebx, 0xad6386ac
mov cx, di
pop bp
lea edx, [eax + edx]
xchg ebx, esi
pushfd
jmp 0xa1b1a0
mov dword [esp + 5], eax
bsf eax, eax
xchg byte [esp + 2], ah
mov bp, 0x2430
push dword [esp + 8]
xor edi, 0xd6bbdcbc
jmp 0xa1b362
ror edx, 0xb
mov eax, ecx
lea ebp, [ecx + ecx]
cmc
bswap ebp
bt ebx, ebp
jmp 0xa1b315
bsf edx, esp
mov word [esp + 7], sp
xchg si, cx
call fcn.00a1b34c
int 0x41
sal dword [eax + reloc.ADVAPI32.DLL_DeregisterEventSource], 1
nop
test dword [edx], reloc.ADVAPI32.DLL_DeregisterEventSource
xchg byte [esp + 3], bl
rcr ch, cl
mov edx, dword [esp + 7]
mov ch, 0x37
mov bl, cl
pop edx
jmp 0xa1b33c

Function at 0xa1d16f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, 0x9c952ba8
mov ebp, edi
mov byte [esp + 0xe], al
add esp, 8
pop eax
jmp 0xa1d17a
sub esp, 5
mov ebp, 0x92d7dc36
xchg dh, cl
pop dword [esp + 0xc]
xchg edi, eax
jmp 0xa1d142
mov word [esp + 0x16], bp
push dword [esp + 1]
jmp 0xa1d158
ror ah, 4
xchg word [esp + 7], cx
rdtsc
xchg word [esp + 8], bx
xchg ebp, edx
pop di
jmp 0xa1d229
pop word [esp + 1]
mov di, word [esp + 8]
not ax
pop word [esp + 4]
pop di
rdtsc
jmp 0xa1d1b0
cld
bsr ecx, esp
bswap esi
bt ax, bx
xchg di, bx
lea ebx, [esp + edx]
jmp 0xa1d1d2
Function at 0xa1d2d4
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dl, al
popal
neg esi
pop edx
jmp 0xa1d2e0
lea esp, [esp + 0xe]
cpuid
lea ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
jmp 0xa1d322
lea ecx, reloc.ADVAPI32.DLL_DeregisterEventSource
cld
lea ebx, [edi + ebp]
push word [esp]
xchg dh, cl
lea edx, [ebp - 0xd9]
jmp 0xa1d30a

Function at 0xa1d8b1
Capabilities:
Execute anti-debugging instructions

Disassembly:
popal
xchg cl, al
mov ecx, dword [esp + 3]
jmp 0xa1d8be
lea ebp, [eax + esi]
xchg cl, al
mov edi, esp
mov dx, 0xe46a
pop word [esp + 7]
pop word [esp + 2]
jmp 0xa1d8ed
xchg dword [esp + 3], eax
xchg edi, ebp
mov dl, byte [esp + 6]
rdtsc
xchg cx, dx
rdtsc
jmp 0xa1d94f
sete bl
xchg al, dh
sub esp, 8
xchg ebp, edi
jmp 0xa1d966
rdtsc
xchg word [esp], bx
pop ax
stc
mov edx, dword [esp + 3]
mov ebx, edi
jmp 0xa1d922
inc bh
bsr esi, ebp
pop si
lea esi, [esi - 0xd9]
xchg dword [esp], eax
push word [esp + 1]
jmp 0xa1d938
lea eax, [esi*4]
cpuid
neg bh
mov bp, 0x8d0f
pop dword [esp + 5]
xchg dword [esp + 3], ecx
jmp 0xa1dc44

Function at 0xa1fcf1
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00a1f015
push dword [esp + 4]
mov word [esp + 5], bp
lea esp, [esp + 2]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], esi
jmp 0xa1ffb1
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xa1f010
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xa1fec1
push si
mov word [esp], bp
lea esp, [esp + 1]
lea esp, [esp + 1]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0xa1ff62
Function at 0x47f7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x47f805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x47f878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x47f83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x47f86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x47f86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x47f831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x47f7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x406802
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x406811
pop dword [ebp - 0x28]
mov eax, 0x406811
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x8ecd8979
add dword [ebp - 0x38], 0xbf84bbd2
mov dword [ebp - 0x34], 0xd46a619b
sub dword [ebp - 0x34], 0xa2371556
mov dword [ebp - 0x30], 0xefa414e5
add dword [ebp - 0x30], 0x5ca82f49
mov dword [ebp - 0x2c], 0xe990df3f
add dword [ebp - 0x2c], 0x166f20c1
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x3af47a9d
sub dword [ebp - 0x38], 0xc6821147
mov dword [ebp - 0x34], 0x2ef70368
sub dword [ebp - 0x34], 0xed8aa1f3
mov dword [ebp - 0x30], 0x2cf3738a
sub dword [ebp - 0x30], 0xc984071e
mov dword [ebp - 0x2c], 0x88acdfef
sub dword [ebp - 0x2c], 0x88acdfef
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x67af7746
sub eax, 0x676e96be
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3c66a
push 0
call eax
mov ecx, 0xbd669944
add ecx, 0x4299c187
xor edx, edx
add edx, eax
mov edi, 0x41f000
add edi, dword [ebp - 0x28]
mov esi, 0xce4b1de0
add esi, 0xaba2a5b1
mov dword [ebp - 0xc], 0xd6bee979
mov ebx, dword [edi]
sub dword [ebp - 0x24], 0x4558fd2a
sub ebx, esi
sub dword [ebp - 8], ebx
mov dword [edx], ebx
xor dword [ebp - 0x24], 0x2f774af8
add edx, 0xa9e57d9c
add edx, 0x561a8268
add edi, 0xf99c55a8
sub edi, 0xf99c55a4
loop 0x406925
add eax, 0x15dff
mov ebx, eax
add eax, 0x6da09e58
sub eax, 0x6da09e53
mov ecx, 0x776aeab0
add ecx, 0x88d51550
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x406b16
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x108]
sub esp, 0x108
push 0xffffffffffffffff
push 0x40d6f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x41a174]
xor eax, ebp
mov dword [ebp + 0x104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x110]
lea eax, [ebp]
mov edi, dword [ebp + 0x114]
mov ebx, 0x104
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp]
push ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x406bb4
cmp eax, ebx
jae 0x406bb4
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004060ea
pop ecx
pop ecx
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x18]
jmp 0x406ba7
push esi
lea ecx, [edi + 0x18]
call fcn.00403db8
add esi, 0x18
cmp esi, dword [ebp - 0x14]
jne 0x406b9b
lea ecx, [ebp - 0x18]
call fcn.0040422a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x104]
xor ecx, ebp
call fcn.0040baa8
add ebp, 0x108
leave
ret
Function at 0x40e6f0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
push edi
cmp eax, 1
je 0x40e77d
add eax, 0xfffffffe
cmp eax, 1
ja 0x40e76c
mov ebx, dword [esp + 0x14]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
push ebp
mov ebp, dword [esp + 0x1c]
mov edi, ebx
imul edi, ebp
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x40e753
sub eax, ecx
mov edi, eax
mov eax, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCR90.dll_memcpy
add dword [esi + 0x14], edi
add esp, 0xc
pop ebp
mov eax, edi
pop edi
mov dword [esi + 0x20], 1
xor edx, edx
pop esi
div ebx
mov dword [0x52b0e0], 0xfffffffc
pop ebx
ret
push edi
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
add dword [esi + 0x14], edi
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov dword [0x52b0e0], 0xfffffff6
or eax, 0xffffffff
pop ebx
ret
mov edx, dword [esi + 4]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.MSVCR90.dll_fread]
mov edi, eax
add esp, 0x10
cmp edi, ebx
jae 0x40e7b8
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.MSVCR90.dll_ferror]
add esp, 4
neg eax
sbb eax, eax
add eax, 0xfffffffc
mov dword [0x52b0e0], eax
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x414760
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x308
push ebx
push esi
push edi
push 0x414720
push 0x414740
push 0
push str.1.2.38
call fcn.00490230
add esp, 0x10
mov dword [ebp - 4], eax
test eax, eax
jne 0x4147a4
push str.png_create_write_struct_error__n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.00491c80
add esp, 4
mov dword [ebp - 8], eax
push 0
test eax, eax
jne 0x4147d5
lea eax, [ebp - 4]
push eax
call fcn.00490a90
push str.png_create_info_struct_error__n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.MSVCR90.dll_exit]
mov ecx, dword [ebp - 4]
push ecx
call sub.MSVCR90.dll__setjmp3
add esp, 8
test eax, eax
je 0x414807
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
call fcn.00490a90
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.MSVCR90.dll_exit]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
push edx
push eax
call fcn.00492360
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
add esp, 8
cmp dword [eax], 0
mov ecx, 2
je 0x41482e
mov ecx, 3
jmp 0x414839
cmp dword [eax + 0x1c], 0
je 0x414839
mov ecx, 6
mov edx, dword [esi + 8]
mov eax, dword [ebp - 8]
push 0
push 0
push 0
push ecx
mov ecx, dword [esi + 0xc]
push 8
push ecx
mov ecx, dword [ebp - 4]
push edx
push eax
push ecx
call fcn.004926b0
mov edx, dword [esi + 4]
add esp, 0x24
cmp dword [edx], 0
je 0x4148bd
mov ecx, dword [edx]
xor eax, eax
cmp dword [ecx], eax
jle 0x4148a1
mov edi, edx
lea ecx, [ebp - 0x307]
mov ebx, dword [edi]
mov ebx, dword [ebx + 4]
movzx ebx, byte [ebx + eax*4]
mov byte [ecx - 1], bl
mov ebx, dword [edi]
mov ebx, dword [ebx + 4]
movzx ebx, byte [ebx + eax*4 + 1]
mov byte [ecx], bl
mov ebx, dword [edi]
mov ebx, dword [ebx + 4]
movzx ebx, byte [ebx + eax*4 + 2]
mov byte [ecx + 1], bl
mov ebx, dword [edx]
inc eax
add ecx, 3
cmp eax, dword [ebx]
jl 0x414872
mov edx, dword [edx]
mov eax, dword [edx]
mov edx, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x308]
push ecx
push edx
push eax
call fcn.00492990
add esp, 0x10
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
push ecx
push edx
call fcn.0048fb20
mov eax, dword [ebp - 4]
push eax
call fcn.00491140
mov ecx, dword [esi + 0xc]
add ecx, ecx
add ecx, ecx
push ecx
call dword [sym.imp.MSVCR90.dll_malloc]
mov edi, eax
xor eax, eax
add esp, 0x10
cmp dword [esi + 0xc], eax
jle 0x414904
lea ecx, [ecx]
movzx edx, word [esi + 0x10]
imul edx, eax
add edx, dword [esi + 0x14]
inc eax
mov dword [edi + eax*4 - 4], edx
cmp eax, dword [esi + 0xc]
jl 0x4148f0
mov eax, dword [ebp - 4]
push edi
push eax
call fcn.004904f0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
push ecx
push edx
call fcn.0048ffd0
push edi
call dword [sym.imp.MSVCR90.dll_free]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.00490a90
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0x20
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415b20
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp dword [0x52b36c], 0
push ebx
push ebp
push esi
push edi
push 0x49ccb0
je 0x415bf0
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.MSVCR90.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x415b98
mov edi, dword [sym.imp.MSVCR90.dll_ftell]
push esi
call edi
add esp, 4
push 2
push 0
push esi
mov ebp, eax
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
push esi
call edi
add esp, 4
push 0
push ebp
push esi
mov ebx, eax
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
push ebx
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov edi, eax
push esi
test edi, edi
jne 0x415ba2
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 1
push ebx
push edi
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
push esi
cmp eax, 0xffffffff
je 0x415b8f
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
push ebx
mov eax, edi
call fcn.0040e860
mov esi, eax
add esp, 4
test esi, esi
jne 0x415be3
push edi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebp, dword [esp + 0x1c]
mov dword [esi + 0x18], 1
jmp 0x415c03
mov ebp, dword [esp + 0x20]
push ebp
call fcn.0040e7f0
mov esi, eax
add esp, 8
test esi, esi
je 0x415b98
push 0
push 0
push esi
call fcn.0040eb20
add esp, 0xc
mov ebx, ebp
call fcn.0040e1d0
sub eax, 3
je 0x415c99
sub eax, 1
jne 0x415b98
lea ecx, [esp + 0x14]
push ecx
mov ebx, esi
call fcn.004161f0
mov edi, eax
add esp, 4
test edi, edi
jne 0x415c4b
mov eax, esi
call fcn.0040eab0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x14]
mov eax, ecx
sub eax, 0
je 0x415c6a
sub eax, 2
push ebp
je 0x415c7b
push ecx
push str.Invalid_status_code__d_returned_while_loading_SND_file__engines_fault_:__s_n
call fcn.00444320
add esp, 0xc
mov eax, esi
call fcn.0040eab0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push str.Ignored_error_s__while_loading_SND_file:__s_n
call fcn.00444320
add esp, 8
mov eax, esi
call fcn.0040eab0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 1
call fcn.004153c0
mov edi, eax
add esp, 4
mov eax, esi
test edi, edi
je 0x415c3c
lea edx, [esp + 0x14]
call fcn.00415d00
test eax, eax
jne 0x415cca
mov eax, dword [esp + 0x14]
call fcn.004372b0
push eax
push ebp
push str.Error_loading_wave_file___s_:__s_n
jmp 0x415c62
push eax
push edi
xor ecx, ecx
xor edx, edx
call fcn.00415410
add esp, 8
test eax, eax
jne 0x415c6a
mov eax, esi
call fcn.0040eab0
push edi
call fcn.00415470
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret