joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e90
Capabilities:
Terminate process

Disassembly:
fld qword [0x424f70]
fld st(0)
fst qword [0x437508]
fld qword [0x424f68]
fcom qword [0x4374e8]
fnstsw ax
test ah, 0x41
jne 0x409eb9
fstp qword [0x4374e8]
jmp 0x409ebb
fstp st(0)
fld qword [0x4355b0]
fcom qword [0x437080]
fnstsw ax
test ah, 0x41
jne 0x409ed6
fstp qword [0x437080]
jmp 0x409ed8
fstp st(0)
fld qword [0x4370b0]
push ebx
push esi
fst qword [0x4371b0]
fld qword [0x4242f8]
push edi
mov ebx, 1
cmp ebx, 1
jle 0x409f03
fxch st(1)
fadd st(3)
fst qword [0x4371b0]
fxch st(1)
fld qword [0x437088]
fcomp st(2)
fnstsw ax
test ah, 5
jnp 0x40a032
fld qword [0x437070]
mov edi, 1
fst qword [0x437180]
cmp edi, 1
jle 0x409f34
fadd st(4)
fst qword [0x437180]
fld qword [0x4370c0]
fcomp st(1)
fnstsw ax
test ah, 5
jnp 0x40a024
fld qword [0x4370a8]
mov esi, 1
fst qword [0x437398]
jmp 0x409f7c
fld qword [0x437398]
fld qword [0x4242f8]
fld qword [0x424f70]
fxch st(5)
fxch st(4)
fxch st(3)
fxch st(1)
fxch st(2)
cmp esi, 1
jle 0x409f89
fadd st(5)
fst qword [0x437398]
fld qword [0x4370b8]
fcomp st(1)
fnstsw ax
test ah, 5
jnp 0x40a061
fstp st(5)
sub esp, 8
fld st(2)
fmul st(2)
faddp st(5)
fxch st(4)
fst qword [0x4371e0]
fld st(4)
fadd st(4)
fmulp st(2)
faddp st(1)
fstp qword [0x437360]
faddp st(2)
faddp st(1)
fst qword [0x437090]
fld qword [0x437080]
fsub st(1)
fadd qword [0x4374e8]
fstp qword [0x4373c8]
fstp qword [esp]
call fcn.0040cef0
fstp st(0)
add esi, 1
fld qword [0x437508]
add esp, 8
cmp esi, 0x64
fld qword [0x4371b0]
fld qword [0x437180]
jl 0x409f60
fld qword [0x4242f8]
fld qword [0x424f70]
fxch st(4)
fxch st(3)
fxch st(2)
add edi, 1
cmp edi, 0x64
jl 0x409f27
add ebx, 1
fstp st(0)
cmp ebx, 0x64
jl 0x409ef2
cmp dword [0x4370c8], 0
fstp st(1)
fstp st(0)
pop edi
fstp st(0)
pop esi
fstp st(0)
pop ebx
jne 0x40a065
push 0x40
push 0x424574
push 0x424f4c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040e6ae
fstp st(0)
jmp 0x40a018
ret
Function at 0x40a070
Capabilities:
Terminate process

Disassembly:
push ecx
push 0x64
push 0
push 0x436f38
call fcn.0040ee00
push 0x437008
push 0x64
push 0x436f38
call fcn.0040e9ca
push str.programT_OptiTw.txt
push 0x64
push 0x436f38
call fcn.0040ea2f
push 0x424584
lea eax, [esp + 0x28]
push 0x436f38
push eax
call fcn.0040edad
add esp, 0x30
test eax, eax
je 0x40a0d7
push 0x40
push 0x424960
push 0x424f98
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040e6ae
mov ecx, dword [esp]
push 0x4370b8
push 0x4370a8
push str._lf__lf
push ecx
call fcn.0040eccc
mov edx, dword [esp + 0x10]
push 0x437088
push 0x4370b0
push str._lf__lf
push edx
call fcn.0040eccc
mov eax, dword [esp + 0x20]
push 0x4370c0
push 0x437070
push str._lf__lf
push eax
call fcn.0040eccc
mov ecx, dword [esp + 0x30]
push 0x4370a0
push 0x437080
push str._lf__lf
push ecx
call fcn.0040eccc
mov edx, dword [esp + 0x40]
add esp, 0x40
push edx
call fcn.0040eb13
fld qword [0x4370a8]
fld qword [0x424370]
push 0x64
fdiv st(1), st(0)
push 0
push 0x436f38
fxch st(1)
fstp qword [0x4370a8]
fld qword [0x4370b8]
fdiv st(1)
fstp qword [0x4370b8]
fld qword [0x4370b0]
fdiv st(1)
fstp qword [0x4370b0]
fld qword [0x437088]
fdiv st(1)
fstp qword [0x437088]
fld qword [0x437070]
fdiv st(1)
fstp qword [0x437070]
fld qword [0x4370c0]
fdiv st(1)
fstp qword [0x4370c0]
fld qword [0x437080]
fdiv st(1)
fstp qword [0x437080]
fdivr qword [0x4370a0]
fstp qword [0x4370a0]
call fcn.0040ee00
push 0x437008
push 0x64
push 0x436f38
call fcn.0040ea2f
push str.program_
push 0x64
push 0x436f38
call fcn.0040ea2f
push 0x424f78
push 0x64
push 0x436f38
call fcn.0040ea2f
push 0x424f40
push 0x436f38
push 0x437098
call fcn.0040edad
add esp, 0x40
call fcn.00409e90
mov eax, dword [0x437098]
push eax
call fcn.0040eb13
add esp, 4
call fcn.0040cb90
pop ecx
ret

Function at 0x40a230
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x104
fld qword [0x425000]
push esi
fstp qword [esp + 8]
fld qword [0x4375e0]
call fcn.0040e7d0
test eax, eax
jne 0x40a301
mov esi, 1
cmp dword [0x436710], esi
jl 0x40a2f7
jmp 0x40a270
fld qword [esi*8 + 0x435fb8]
fstp qword [0x4375e0]
call fcn.0040a350
fst qword [esp + esi*8 + 0x18]
fldz
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x40a299
fstp st(0)
fld qword [0x425000]
fld qword [0x424ff8]
fld qword [0x437130]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x40a2ba
fxch st(1)
fmul qword [0x424ff0]
fxch st(1)
fld qword [esp + 8]
fcomp st(2)
fnstsw ax
test ah, 0x41
jne 0x40a2e4
fcomp qword [0x424fe8]
fnstsw ax
test ah, 5
jp 0x40a2e6
fstp qword [esp + 8]
fld qword [0x4375e0]
fstp qword [esp + 0x10]
jmp 0x40a2e8
fstp st(1)
fstp st(0)
add esi, 1
cmp esi, dword [0x436710]
jle 0x40a270
fld qword [esp + 0x10]
fstp qword [0x4375e0]
mov dword [0x437718], 1
call fcn.0040a350
fldz
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x40a343
cmp dword [0x437208], 1
fstp st(0)
jne 0x40a345
push 0x40
fstp st(0)
push 0x424960
push 0x424fd0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040e6ae
fstp st(1)
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c650
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x40
fld qword [0x4371e0]
fst qword [esp + 0x38]
fld qword [0x4375d8]
fld qword [0x4373f0]
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x40c67c
fstp st(1)
jmp 0x40c67e
fstp st(0)
mov ecx, dword [0x4374dc]
cmp ecx, 4
jne 0x40c69d
fstp st(0)
fld qword [0x437720]
fstp qword [esp + 0x30]
fld qword [0x4371b0]
jmp 0x40c6ad
fmul qword [0x437808]
fstp qword [esp + 0x30]
fld qword [0x4373c8]
fld qword [0x436250]
mov eax, 3
fld st(0)
fld qword [str._DT]
fmul st(1), st(0)
fxch st(1)
fmul st(2)
fld qword [0x425060]
fmul st(1), st(0)
fld st(3)
fld1
jmp 0x40c6d6
fxch st(7)
test al, 1
je 0x40c6dc
fmul st(1)
shr eax, 1
je 0x40c6ea
fstp st(7)
fmul st(0), st(0)
fld qword [esp + 0x38]
jmp 0x40c6d4
cmp ecx, 4
fstp st(1)
fmul st(3)
fmul qword [0x425a50]
jne 0x40c703
fxch st(3)
fmul st(6)
fmul st(6)
fmulp st(1)
jmp 0x40c70f
fstp st(3)
fstp st(0)
fld qword [0x437398]
fmul st(0), st(0)
fmulp st(4)
fxch st(3)
fmul qword [0x435fa8]
fadd qword [0x437190]
fdivrp st(3)
fdivr qword [esp + 0x30]
fld st(0)
fadd st(3)
fxch st(3)
fsubrp st(1)
fldz
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x40c73c
fstp st(1)
jmp 0x40c73e
fstp st(0)
cmp dword [0x437208], 0
fld st(2)
fsub st(1)
fld qword [0x425070]
fmul st(1), st(0)
fld st(3)
faddp st(6)
fxch st(1)
fmulp st(5)
fxch st(4)
fdivrp st(2)
faddp st(1)
faddp st(1)
fmul st(1)
fstp qword [0x4376b8]
fld qword [0x437508]
fadd qword [0x437180]
fld qword [0x437360]
fsub qword [0x4371e0]
fmulp st(2)
fdivrp st(1)
jne 0x40c79a
fld1
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x40c798
fstp st(1)
mov esp, ebp
pop ebp
ret
fstp st(0)
sub esp, 8
fstp qword [esp]
call fcn.00408730
add esp, 8
fst qword [0x4376a8]
cmp dword [0x43706c], 0
je 0x40c7c9
push 1
fstp st(0)
call fcn.0040c550
fld qword [0x4376a8]
add esp, 4
fld qword [0x4376b8]
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x40c806
cmp dword [0x437208], 1
jne 0x40c800
push 0x40
fstp st(1)
push 0x425324
fstp st(0)
push 0x425a2c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040e6ae
fsubrp st(1)
mov esp, ebp
pop ebp
ret
fstp st(1)
fstp st(0)
fldz
mov esp, ebp
pop ebp
ret
Function at 0x40c810
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
fld qword [0x4371e0]
mov eax, 4
fld qword [0x4374c8]
fstp qword [esp]
fld qword [0x436250]
fld st(0)
fld1
fld st(0)
test al, 1
je 0x40c839
fmul st(2)
shr eax, 1
je 0x40c843
fld st(2)
fmulp st(3)
jmp 0x40c833
fstp st(2)
mov eax, 4
fld st(3)
test al, 1
je 0x40c852
fmul st(1), st(0)
shr eax, 1
je 0x40c85a
fmul st(0), st(0)
jmp 0x40c84c
fstp st(0)
fsubp st(1)
fld qword [str._DT]
fld qword [0x425a80]
fmul st(1)
fmulp st(2)
fld st(2)
fld qword [0x425070]
fmul st(1), st(0)
fxch st(3)
fdivrp st(1)
fld st(3)
fmul st(4)
fld st(5)
fmul st(6)
fsubp st(1)
fmulp st(2)
fxch st(1)
fmul qword [0x425060]
fld qword [0x437400]
fld qword [0x4374c0]
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x40c8a9
fstp st(1)
jmp 0x40c8ab
fstp st(0)
cmp dword [0x4374dc], 4
jne 0x40c8be
fstp st(0)
fld qword [0x437720]
jmp 0x40c8c4
fmul qword [0x437808]
fdivrp st(2)
fdivr qword [esp]
fld st(0)
fadd st(2)
fxch st(1)
fsubrp st(2)
fldz
fcom st(2)
fnstsw ax
test ah, 0x41
jne 0x40c8e0
fstp st(2)
jmp 0x40c8e2
fstp st(0)
fld st(0)
sub esp, 8
fsub st(2)
fmul st(3)
fld st(4)
faddp st(6)
fmulp st(5)
fxch st(4)
fdivrp st(3)
faddp st(2)
fxch st(1)
faddp st(2)
fmul st(1), st(0)
fxch st(1)
fstp qword [esp + 8]
fld qword [0x437508]
fadd qword [0x437180]
fld qword [0x437360]
fsub qword [0x4371e0]
fmulp st(2)
fdivrp st(1)
fstp qword [esp]
call fcn.00408730
fst qword [esp + 0x10]
fld qword [esp + 8]
add esp, 8
cmp dword [0x43706c], 0
fst qword [0x4376a0]
fxch st(1)
fst qword [0x4376b0]
je 0x40c95f
fstp st(0)
push 2
fstp st(0)
call fcn.0040c550
fld qword [esp + 4]
add esp, 4
fld qword [esp + 8]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x40c996
cmp dword [0x437208], 1
jne 0x40c990
push 0x40
fstp st(0)
push 0x425324
fstp st(0)
push 0x425a58
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040e6ae
fsubp st(1)
add esp, 0x10
ret
fstp st(0)
fstp st(0)
fldz
add esp, 0x10
ret
Function at 0x40ce50
Capabilities:
Terminate process

Disassembly:
push ecx
push 0x64
push 0
push 0x436f38
call fcn.0040ee00
push 0x437008
push 0x64
push 0x436f38
call fcn.0040e9ca
push str.programT_OptiPrice.txt
push 0x64
push 0x436f38
call fcn.0040ea2f
push 0x424584
lea eax, [esp + 0x28]
push 0x436f38
push eax
call fcn.0040edad
add esp, 0x30
test eax, eax
je 0x40ceb7
push 0x40
push 0x424574
push 0x425b5c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040e6ae
mov ecx, dword [esp]
push 0x4376c8
push 0x437700
push 0x4376d0
push 0x4376d8
push str._lf__lf__lf__lf_n
push ecx
call fcn.0040eccc
mov edx, dword [esp + 0x18]
push edx
call fcn.0040eb13
add esp, 0x1c
pop ecx
ret
Function at 0x40d850
Capabilities:
Terminate process

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [0x4374dc]
cmp esi, 3
jne 0x40d867
fldz
fstp qword [0x4373c8]
cmp esi, 4
fld qword [0x437360]
fst qword [0x436250]
jne 0x40d898
fld qword [0x437180]
fld qword [0x4371b0]
fadd st(1), st(0)
fld qword [0x437508]
fadd st(2), st(0)
fxch st(2)
fst qword [0x437808]
jmp 0x40d8c2
fld qword [0x4371b0]
fld qword [0x4373c8]
fadd st(1)
fadd qword [0x437180]
fld qword [0x437508]
fadd st(1), st(0)
fxch st(1)
fst qword [0x437808]
fxch st(1)
fxch st(2)
fxch st(1)
fsub qword [0x4374e8]
fld st(0)
fst qword [0x437858]
fxch st(1)
fsub qword [0x437510]
fsub st(3)
fst qword [0x4378a0]
fdiv st(4)
fcomp qword [0x425d50]
fnstsw ax
test ah, 0x41
jne 0x40d912
push 0x40
fstp st(0)
push 0x425324
fstp st(2)
push str.ht_D___3.5
fstp st(1)
push 0
fstp st(0)
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040e6ae
fcomp qword [0x4355b0]
fnstsw ax
test ah, 5
jp 0x40d940
push 0x40
fstp st(2)
push 0x425324
fstp st(1)
push 0x425d28
fstp st(0)
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040e6ae
fld qword [0x4371e0]
fld st(0)
fmul st(1)
fld qword [0x425060]
fmul st(1), st(0)
fld st(1)
fld qword [str._DT]
fmul st(1), st(0)
fxch st(1)
fmulp st(5)
fxch st(4)
fstp qword [esp + 4]
fld st(5)
fmul st(6)
fmul st(1)
fxch st(3)
fmulp st(6)
fmulp st(5)
fadd st(1)
faddp st(4)
fxch st(3)
fdiv qword [0x424618]
fmul st(1)
fmul qword [0x437180]
fstp qword [esp + 0xc]
fmulp st(2)
fmulp st(1)
fstp qword [esp + 0x14]
fld qword [0x437690]
fmul st(0), st(0)
fadd qword [0x424300]
fld qword [0x437698]
fmul st(0), st(0)
faddp st(1)
call fcn.00410380
fmul qword [0x4373c8]
cmp esi, 6
fstp qword [0x437830]
fld qword [0x437690]
fld st(0)
fld qword [0x437808]
fmul st(1), st(0)
fxch st(1)
fstp qword [0x437810]
fmul qword [0x437698]
fstp qword [0x4378b0]
jne 0x40da52
fld qword [0x437398]
mov eax, 2
fld st(0)
fmulp st(2)
fld1
test al, 1
je 0x40d9fb
fmul st(2)
shr eax, 1
je 0x40da05
fld st(2)
fmulp st(3)
jmp 0x40d9f5
fstp st(2)
fmul st(0), st(0)
fst qword [esp + 0x1c]
faddp st(1)
call fcn.00410380
fstp qword [esp + 0x24]
fld qword [0x437398]
mov eax, 2
fmul qword [0x437698]
fld1
test al, 1
je 0x40da31
fmul st(1)
shr eax, 1
je 0x40da3b
fld st(1)
fmulp st(2)
jmp 0x40da2b
fstp st(1)
fadd qword [esp + 0x1c]
call fcn.00410380
fld qword [esp + 0x24]
fld qword [0x437398]
jmp 0x40da95
cmp esi, 4
fstp st(0)
fld qword [0x437398]
fld st(0)
fld st(1)
jne 0x40da93
fstp st(2)
fstp st(1)
fstp st(0)
fld qword [esp + 0xc]
fadd qword [esp + 4]
fadd qword [esp + 0x14]
fst qword [0x437870]
fld qword [0x4371e0]
fld qword [str._DT]
fmul st(1)
fmulp st(1)
fmul qword [0x425060]
jmp 0x40dab7
fxch st(2)
fxch st(2)
fmulp st(1)
fmul qword [0x4373c8]
fadd qword [esp + 4]
fadd qword [esp + 0xc]
fadd qword [esp + 0x14]
fst qword [0x437870]
fld st(1)
fmulp st(2)
fxch st(1)
fmul qword [0x4374e8]
xor ecx, ecx
mov dword [0x4372b8], 1
fsubp st(1)
fstp qword [0x437890]
fld qword [0x425d20]
fcom qword [0x4374b8]
fnstsw ax
test ah, 0x41
jnp 0x40daea
mov dword [0x4372b8], ecx
fcomp qword [0x4371f0]
mov dword [0x4371ec], ecx
fnstsw ax
test ah, 0x41
je 0x40db07
mov dword [0x4371ec], 1
pop esi
add esp, 0x28
ret
Function at 0x40dde0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x40
fld qword [0x436250]
fld qword [str._DT]
fmul st(1)
fmulp st(1)
fmul qword [0x425060]
call fcn.00410380
fstp qword [esp + 0x20]
fld qword [0x437858]
fstp qword [esp + 0x18]
fld qword [0x4371b8]
fstp qword [esp + 0x10]
call fcn.00409320
call fcn.0040d430
fld qword [0x437838]
sub esp, 0x28
cmp dword [0x4371ac], 1
fstp qword [esp + 0x20]
fld qword [0x437860]
fstp qword [esp + 0x18]
fld qword [esp + 0x38]
fstp qword [esp + 0x10]
fld qword [esp + 0x40]
fstp qword [esp + 8]
fld qword [esp + 0x48]
fstp qword [esp]
push 0
jne 0x40de66
call fcn.0040d300
jmp 0x40de6b
call fcn.0040d390
fld qword [0x4245f0]
add esp, 0x2c
fst qword [0x4379b8]
fdivp st(1)
fstp qword [0x4378d8]
fld qword [0x436250]
fld qword [str._DT]
fmul st(1)
fmul st(1)
fst qword [esp + 0x18]
fmulp st(1)
fmul qword [0x425a50]
fstp qword [esp + 0x10]
fld qword [0x4375d8]
fmul st(0), st(0)
fld qword [0x4373f0]
fmul st(0), st(0)
faddp st(1)
call fcn.00410380
fmul qword [0x437808]
fstp qword [esp + 0x20]
fld qword [0x4378b0]
fmul st(0), st(0)
fld qword [0x437810]
fmul st(0), st(0)
faddp st(1)
call fcn.00410380
fld qword [0x437190]
fmul st(1), st(0)
fld qword [esp + 0x20]
fsubrp st(2)
fxch st(1)
fst qword [esp + 0x38]
fld qword [0x435f68]
fmul qword [0x437870]
fst qword [esp + 0x30]
fld qword [esp + 0x18]
fmul qword [0x425060]
fld qword [0x437858]
fmul st(1)
fsub qword [0x437890]
fmul qword [0x437968]
fst qword [esp + 0x28]
fxch st(4)
faddp st(2)
fxch st(1)
faddp st(3)
fdiv st(2), st(0)
fxch st(2)
fst qword [esp + 0x20]
fxch st(1)
fdiv qword [esp + 0x10]
fld st(0)
fadd st(2)
fstp qword [esp + 0x10]
fsubp st(1)
fstp qword [esp + 0x18]
call fcn.00410380
fst qword [0x437820]
fldz
fld qword [esp + 0x18]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jp 0x40df9a
fld qword [esp + 0x28]
fadd qword [esp + 0x30]
fmul qword [0x424650]
fadd qword [0x437190]
fxch st(2)
fmul qword [0x425070]
fld qword [esp + 0x38]
fdiv st(3)
fsubp st(1)
fxch st(2)
fmul qword [str.ffffff]
fld st(2)
fmulp st(3)
fdivrp st(2)
fxch st(1)
fstp qword [esp + 0x10]
jmp 0x40df9c
fstp st(1)
cmp dword [0x43706c], 0
fld qword [esp + 0x20]
fst qword [0x4378f0]
fld qword [esp + 0x10]
fstp qword [0x437910]
fxch st(1)
fstp qword [0x437930]
je 0x40dfd1
push 0x15
fstp st(0)
call fcn.0040e080
fld qword [esp + 0x24]
add esp, 4
fld qword [0x4378d8]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x40e00e
cmp dword [0x437208], 1
jne 0x40e008
push 0x40
fstp st(1)
push 0x425324
fstp st(0)
push 0x425da4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040e6ae
fsubp st(1)
mov esp, ebp
pop ebp
ret
cmp dword [0x43706c], 0
fstp st(1)
fstp st(0)
je 0x40e025
push 0x16
call fcn.0040e080
add esp, 4
fld qword [0x4378d8]
fmul qword [0x424650]
fld qword [esp + 0x10]
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x40e06c
cmp dword [0x437208], 1
jne 0x40e066
push 0x40
fstp st(1)
push 0x425324
fstp st(0)
push 0x425d80
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040e6ae
fsubrp st(1)
mov esp, ebp
pop ebp
ret
fstp st(1)
fstp st(0)
fldz
mov esp, ebp
pop ebp
ret
Function at 0x40e73a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433818]
jne 0x40e744
repz ret
jmp fcn.00411f19

Function at 0x419580
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00410bcc
xor ebx, ebx
cmp dword [0x438440], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x419655
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4195c0
xor eax, eax
jmp 0x419719
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42ce48
push edi
call esi
cmp eax, ebx
je 0x4195b9
push eax
call fcn.00410b69
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x438440], eax
call esi
push eax
call fcn.00410b69
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x438444], eax
call esi
push eax
call fcn.00410b69
mov dword [0x438448], eax
lea eax, [ebp - 8]
push eax
call fcn.0040e4db
test eax, eax
pop ecx
pop ecx
je 0x419623
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00411426
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x419655
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00410b69
cmp eax, ebx
pop ecx
mov dword [0x438450], eax
je 0x419655
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410b69
pop ecx
mov dword [0x43844c], eax
mov eax, dword [0x43844c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4196ce
cmp dword [0x438450], esi
je 0x4196ce
push eax
call fcn.00410bd5
pop ecx
call eax
cmp eax, ebx
je 0x41969b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x438450]
call fcn.00410bd5
pop ecx
call eax
test eax, eax
je 0x41969b
test byte [ebp - 0x18], 1
jne 0x4196ce
lea eax, [ebp - 0xc]
push eax
call fcn.0040e512
test eax, eax
pop ecx
je 0x4196b6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00411426
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4196c5
or dword [ebp + 0x10], 0x200000
jmp 0x4196ff
or dword [ebp + 0x10], 0x40000
jmp 0x4196ff
mov eax, dword [0x438444]
cmp eax, esi
je 0x4196ff
push eax
call fcn.00410bd5
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4196ff
mov eax, dword [0x438448]
cmp eax, esi
je 0x4196ff
push dword [ebp - 4]
push eax
call fcn.00410bd5
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x438440]
call fcn.00410bd5
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f3be
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40f472
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040f34e
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40f44b
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f47e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40f499
test ebp, ebp
je 0x40f499
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40f4a1
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40f4e1
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40f53d
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40f538
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40f523
test dl, dl
je 0x40f51f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40f523
add ecx, 2
add eax, 2
test dl, dl
jne 0x40f503
xor eax, eax
jmp 0x40f528
sbb eax, eax
or eax, 1
test eax, eax
je 0x40f547
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40f4f0
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40f55e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040f3be
test eax, eax
jne 0x40f576
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040f47e
mov esi, eax
test esi, esi
jne 0x40f5ac
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40f5c6
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret