joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e3e7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 8], 0x4c060c
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0
call fcn.0042e337
add esp, 8
mov dword [ebp - 0x40], eax
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x40]
push edx
call fcn.0042e337
add esp, 8
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
je 0x42e4b1
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0042e0e7
add esp, 4
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax]
cmp edx, ecx
je 0x42e46b
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 1]
cmp edx, ecx
je 0x42e46b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 0x30]
push edx
call fcn.0042e287
adc edi, esi
invalid
inc dword [ebx + 0x458904c4]
int3
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [eax + edx]
je 0x42e4b1
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [eax + edx]
je 0x42e4b1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x34]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0xc], 0
jmp fcn.0042e516
Function at 0x42e4f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 8], 0x4c060c
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0
call fcn.0042e337
add esp, 8
mov dword [ebp - 0x40], eax
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x40]
push edx
call fcn.0042e337
add esp, 8
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
je 0x42e4b1
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0042e0e7
add esp, 4
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax]
cmp edx, ecx
je 0x42e46b
movzx edx, byte [ebp - 1]
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 1]
cmp edx, ecx
je 0x42e46b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 0x30]
push edx
call fcn.0042e287
adc edi, esi
invalid
inc dword [ebx + 0x458904c4]
int3
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [eax + edx]
je 0x42e4b1
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [eax + edx]
je 0x42e4b1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x34]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0xc], 0
jmp fcn.0042e516

Function at 0x42e510
Capabilities:
Terminate process

Disassembly:
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x2c]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
Function at 0x4338a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
test eax, eax
jle 0x4339d1
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], 0
add edi, 8
mov dword [esp + 0x1c], eax
cmp dword [edi + 4], 2
jne 0x4338cc
fld dword [esp + 0x3c]
jmp 0x4338d0
fld dword [esp + 0x38]
xor ebp, ebp
fstp dword [esp + 0x18]
cmp dword [edi - 8], ebp
jle 0x4339b7
nop
xor ebx, ebx
cmp dword [edi], ebx
jle 0x4339ab
lea ecx, [ebp*4]
mov dword [esp + 0x10], ecx
jmp 0x433900
mov eax, dword [edi + 0xd34]
fld dword [ecx + eax]
mov edx, dword [edi + 0xd3c]
fst dword [esp + 0x20]
fld dword [ecx + edx]
fst dword [esp + 0x24]
fcompp
fnstsw ax
test ah, 5
jp 0x433999
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
lea esi, [eax + ebx]
add esi, ebp
add esi, esi
add esi, esi
fld dword [esi + ecx]
fadd dword [esp + 0x34]
fld dword [esp + 0x18]
call fcn.00471170
lea edx, [ebx + ebp]
fld dword [edi + edx*4 + 0xd50]
fmul dword [esp + 0x20]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x43398a
mov ecx, dword [esp + 0x2c]
cmp dword [esi + ecx], 0
je 0x43398a
fstp st(1)
fld dword [esp + 0x24]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x43397f
fstp st(0)
mov dword [esi + ecx], 2
jmp 0x43398c
fstp st(1)
mov dword [esi + ecx], 2
jmp 0x43398c
fstp st(0)
mov eax, dword [edi + 0xd3c]
mov ecx, dword [esp + 0x10]
fstp dword [ecx + eax]
add ebx, 1
add ecx, 4
cmp ebx, dword [edi]
mov dword [esp + 0x10], ecx
jl 0x433900
add ebp, dword [edi - 4]
cmp ebp, dword [edi - 8]
jl 0x4338e0
add dword [esp + 0x14], 0x78
add edi, 0x1028
sub dword [esp + 0x1c], 1
jne 0x4338c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x44c940
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48739f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x5c], bl
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov byte [esi + 0x94], bl
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov byte [esi + 0xac], bl
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
lea ecx, [esi + 0xc4]
mov byte [esp + 0x14], 8
call fcn.0044c5d0
mov ecx, dword [esp + 0xc]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov byte [esi + 0x58], bl
mov byte [esi + 0xa8], bl
mov dword [esi], 0xffffffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x44fe70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4875e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov ecx, dword [edi]
lea edx, [esp + 0xc]
lea eax, [esp + 0x28]
push edx
mov byte [esp + 0x24], 2
mov dword [esp + 0x10], eax
call fcn.0044dcf0
test eax, eax
mov ebx, dword [esp + 0x30]
je 0x44fee3
add eax, 4
push eax
lea ecx, [esp + 0x14]
call fcn.0044a270
mov eax, dword [esp + 0x14]
push ebx
push eax
call fcn.00459580
mov esi, dword [esp + 0x18]
add esp, 8
test al, al
jne 0x44ff03
sub esp, 8
mov ecx, esp
mov dword [esp + 0x14], esp
push ebx
push ecx
call fcn.0044f930
mov ecx, dword [edi + 4]
add esp, 8
lea edx, [esp + 0x30]
push edx
call fcn.0044f790
test esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov byte [esp + 0x20], 1
je 0x44ff26
lea eax, [esi + 4]
push eax
call edi
test eax, eax
jne 0x44ff26
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov esi, dword [esp + 0x28]
test esi, esi
je 0x44ff4f
add dword [esi], 0xffffffff
cmp dword [esi], 0
jne 0x44ff4f
mov eax, dword [esi + 4]
push eax
call fcn.0046e9f9
push esi
mov dword [esi + 4], 0
call fcn.0046d274
add esp, 8
mov esi, dword [esp + 0x2c]
test esi, esi
mov dword [esp + 0x20], 0xffffffff
je 0x44ff73
lea ecx, [esi + 4]
push ecx
call edi
test eax, eax
jne 0x44ff73
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 0xc
Function at 0x450600
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x487630
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [esp + 0x6c]
push ebx
push ebp
push esi
push edi
push eax
mov esi, ecx
call fcn.00450080
xor ebx, ebx
mov eax, 0x4a6c7c
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov eax, dword [esi + 0xc]
mov edi, dword [esp + 0x74]
mov ecx, dword [esi + 8]
mov edx, dword [edi]
mov edx, dword [edx + 0x18]
push eax
push ecx
mov ecx, edi
mov byte [esp + 0x74], 1
call edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x18]
push edx
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.00450960
add esp, 0x18
cmp dword [esp + 0x10], 0x766f6f6d
jne 0x450759
cmp dword [esp + 0x14], ebx
jne 0x450759
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
add eax, edx
adc ecx, ebp
cmp eax, dword [esi + 0x10]
jne 0x450759
cmp ecx, dword [esi + 0x14]
jne 0x450759
lea eax, [esp + 0x34]
push eax
push ebp
push edx
lea ecx, [esp + 0x60]
push ecx
mov ecx, esi
mov dword [esp + 0x64], 0x4a6a90
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], ebp
call fcn.0044f4d0
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x78]
push ebx
push ebx
push edx
push eax
push ebx
push ecx
push edi
mov ecx, esi
call fcn.0045a8a0
push ebx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x70], bl
mov dword [esp + 0x50], ebx
call fcn.004076b0
push ebx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x70], 0xffffffff
mov dword [esp + 0x40], ebx
call fcn.004076b0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x60
ret 0xc
push ebx
lea edx, [esp + 0x80]
push edx
lea ecx, [esp + 0x30]
mov dword [esp + 0x84], str.Bug_check
call fcn.0046d1c5
push 0x4bc504
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0x4a6b74
call fcn.0046d279
int3
Function at 0x46bb4e
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
pushal
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
prefetcht0 byte [0x4c97b0]
movaps xmm0, xmmword [esi + 0x20]
movaps xmm3, xmmword [0x4c9770]
movaps xmm1, xmm0
shufps xmm0, xmm0, 0x4e
xorps xmm1, xmm3
addps xmm0, xmm1
movaps xmm1, xmmword [esi + 0x30]
movaps xmm6, xmm1
shufps xmm1, xmm1, 0x4e
xorps xmm6, xmm3
addps xmm1, xmm6
movaps xmm2, xmm0
addps xmm2, xmm1
subps xmm0, xmm1
mulps xmm2, xmmword [0x4c97b0]
mulps xmm0, xmmword [0x4c97c0]
movaps xmm6, xmmword [esi]
movaps xmm4, xmm6
shufps xmm4, xmm4, 0x4e
xorps xmm6, xmm3
addps xmm4, xmm6
movaps xmm6, xmmword [esi + 0x10]
movaps xmm3, xmmword [0x4c9780]
movaps xmm5, xmm6
shufps xmm5, xmm5, 0x4e
xorps xmm6, xmm3
addps xmm5, xmm6
movaps xmm7, xmm4
movaps xmm1, xmm5
shufps xmm1, xmm0, 0xec
addps xmm7, xmm1
subps xmm4, xmm1
shufps xmm5, xmm5, 0x99
movaps xmm6, xmm2
shufps xmm6, xmm6, 0xbb
xorps xmm6, xmm3
addps xmm5, xmm6
shufps xmm2, xmm5, 0xe4
movaps xmm1, xmm7
addps xmm7, xmm2
subps xmm1, xmm2
movlps qword [esi], xmm7
movhps qword [esi + 8], xmm1
movlps qword [esi + 0x20], xmm1
movhps qword [esi + 0x38], xmm7
shufps xmm0, xmm5, 0x41
movaps xmm1, xmm4
addps xmm4, xmm0
subps xmm1, xmm0
movlps qword [esi + 0x10], xmm1
movhps qword [esi + 0x18], xmm4
movhps qword [esi + 0x28], xmm1
movlps qword [esi + 0x30], xmm4
sub ecx, 1
lea esi, [esi + 0x40]
ja 0x46bb60
popal
leave
ret

Function at 0x46bc34
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
pushal
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movaps xmm7, xmmword [0x4c9770]
nop
nop
movaps xmm1, xmmword [esi]
movaps xmm2, xmmword [esi + 0x10]
movaps xmm0, xmm1
movaps xmm3, xmm2
shufps xmm0, xmm1, 0x44
shufps xmm3, xmm2, 0x96
shufps xmm1, xmm1, 0xee
shufps xmm2, xmm2, 0x3c
xorps xmm1, xmm7
xorps xmm2, xmm7
addps xmm0, xmm1
addps xmm3, xmm2
movaps xmm1, xmm0
addps xmm0, xmm3
subps xmm1, xmm3
movaps xmmword [esi], xmm0
movaps xmmword [esi + 0x10], xmm1
sub ecx, 1
lea esi, [esi + 0x20]
ja 0x46bc48
popal
leave
ret
Function at 0x46bc8f
Capabilities:
Encode data using xor

Disassembly:
enter 4, 0
pushal
mov eax, dword [ebp + 0x10]
mov ecx, eax
and eax, 1
add eax, 4
sub ecx, eax
xor edx, edx
add edx, 1
shl edx, cl
mov dword [ebp - 4], edx
xor ebx, ebx
add ebx, 1
mov ecx, eax
sub ecx, 1
shl ebx, cl
mov edi, dword [ebp + 0xc]
nop
mov esi, dword [ebp + 8]
nop
mov eax, ebx
mov ecx, ebx
shr ecx, 2
movaps xmm7, xmmword [0x4c97a0]
nop
nop
movaps xmm0, xmmword [edi]
movaps xmm2, xmmword [esi + eax*4]
add eax, ebx
movaps xmm1, xmm0
movaps xmm3, xmm2
shufps xmm1, xmm1, 0xf5
shufps xmm0, xmm0, 0xa0
shufps xmm3, xmm3, 0xb1
mulps xmm2, xmm0
mulps xmm3, xmm1
xorps xmm3, xmm7
addps xmm2, xmm3
movaps xmm0, xmmword [esi]
movaps xmm1, xmm0
subps xmm1, xmm2
addps xmm0, xmm2
movaps xmm2, xmmword [edi + 0x10]
movaps xmm4, xmmword [esi + eax*4]
add eax, ebx
movaps xmm3, xmm2
movaps xmm5, xmm4
shufps xmm3, xmm3, 0xf5
shufps xmm2, xmm2, 0xa0
shufps xmm5, xmm5, 0xb1
mulps xmm2, xmm4
mulps xmm3, xmm5
xorps xmm3, xmm7
addps xmm2, xmm3
movaps xmm6, xmmword [edi + 0x20]
movaps xmm4, xmmword [esi + eax*4]
movaps xmm3, xmm6
movaps xmm5, xmm4
shufps xmm3, xmm3, 0xf5
shufps xmm6, xmm6, 0xa0
shufps xmm5, xmm5, 0xb1
mulps xmm4, xmm6
mulps xmm3, xmm5
xorps xmm3, xmm7
addps xmm4, xmm3
movaps xmm3, xmm2
subps xmm3, xmm4
addps xmm2, xmm4
xorps xmm3, xmmword [0x4c9790]
shufps xmm3, xmm3, 0xb1
movaps xmm4, xmm1
movaps xmm5, xmm0
addps xmm1, xmm3
subps xmm4, xmm3
addps xmm0, xmm2
subps xmm5, xmm2
movaps xmmword [esi + eax*4], xmm4
sub eax, ebx
movaps xmmword [esi + eax*4], xmm5
sub eax, ebx
movaps xmmword [esi + eax*4], xmm1
movaps xmmword [esi], xmm0
sub ecx, 1
lea esi, [esi + 0x10]
lea edi, [edi + 0x30]
ja 0x46bcdc
shl eax, 1
add eax, ebx
lea esi, [esi + eax*4]
neg eax
sub edx, 1
lea edi, [edi + eax*4]
ja 0x46bccc
neg eax
shl ebx, 2
mov edx, dword [ebp - 4]
shr edx, 2
mov dword [ebp - 4], edx
lea edi, [edi + eax*4]
ja 0x46bcc8
popal
leave
ret
Function at 0x46d97c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x46d9b9
cmp dword [ebp + 0x14], edi
je 0x46d9b9
cmp ecx, edi
jne 0x46d9c0
call fcn.00472ef3
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00473f8c
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x46d9d4
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x46d9f5
cmp ebx, 0xffffffff
je 0x46d9e4
push ebx
push edi
push ecx
call fcn.0046efc0
add esp, 0xc
cmp esi, edi
je 0x46d9a1
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x46d9a1
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x46da11
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x46da18
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x46db09
test word [esi + 0xc], 0x10c
je 0x46da6c
mov eax, dword [esi + 4]
test eax, eax
je 0x46da6c
jl 0x46db6a
cmp ebx, eax
mov edi, ebx
jb 0x46da3d
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x46db11
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0046f323
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x46db01
cmp ebx, dword [ebp - 0xc]
jb 0x46dad9
cmp dword [ebp - 0xc], 0
je 0x46da96
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x46da8b
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x46da92
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x46daa1
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x46daa1
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x46db3d
push eax
push dword [ebp - 8]
push esi
call fcn.0046e9cc
pop ecx
push eax
call fcn.004750da
add esp, 0xc
test eax, eax
je 0x46db7c
cmp eax, 0xffffffff
je 0x46db6a
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x46db01
push esi
call fcn.004749f9
cmp eax, 0xffffffff
pop ecx
je 0x46db6e
cmp dword [ebp - 4], 0
je 0x46db3d
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x46da20
mov eax, dword [ebp + 0x14]
jmp 0x46d9bb
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x46db28
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0046efc0
add esp, 0xc
call fcn.00472ef3
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x46d9b1
cmp dword [ebp + 0xc], 0xffffffff
je 0x46db53
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0046efc0
add esp, 0xc
call fcn.00472ef3
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x46d9b1
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x46d9bb
or dword [esi + 0xc], 0x10
jmp 0x46db6e
Function at 0x471c87
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ca170]
jne 0x471c91
repz ret
jmp fcn.0047ea32

Function at 0x477227
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4ca0b8]
je 0x477242
inc edi
cmp edi, 0x17
jb 0x477233
cmp edi, 0x17
jae 0x4773c2
push ebp
push 3
call fcn.00480503
cmp eax, 1
pop ecx
je 0x47738e
push 3
call fcn.00480503
test eax, eax
pop ecx
jne 0x477276
cmp dword [0x4c9be0], 1
je 0x47738e
cmp ebx, 0xfc
je 0x4773c1
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x620b00
push ebp
call fcn.00471e68
add esp, 0xc
test eax, eax
je 0x4772ac
push esi
push esi
push esi
push esi
push esi
call fcn.00473e90
add esp, 0x14
push 0x104
mov esi, 0x620b19
push esi
push 0
mov byte [0x620c1d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4772f0
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00471e68
add esp, 0xc
test eax, eax
je 0x4772f0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00473e90
add esp, 0x14
push esi
call fcn.00471d60
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x477335
push esi
call fcn.00471d60
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x620e14
push 0x4ab2dc
sub ecx, eax
push ecx
push eax
call fcn.00480450
add esp, 0x14
test eax, eax
je 0x477335
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00473e90
add esp, 0x14
jmp 0x477337
xor esi, esi
push 0x4ab2d8
push ebx
push ebp
call fcn.004803df
add esp, 0xc
test eax, eax
je 0x477357
push esi
push esi
push esi
push esi
push esi
call fcn.00473e90
add esp, 0x14
push dword [edi*8 + 0x4ca0bc]
push ebx
push ebp
call fcn.004803df
add esp, 0xc
test eax, eax
je 0x477379
push esi
push esi
push esi
push esi
push esi
call fcn.00473e90
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00480222
add esp, 0xc
jmp 0x4773c1
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4773c1
cmp ebp, 0xffffffff
je 0x4773c1
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4ca0bc]
push dword [esi]
call fcn.00471d60
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x480222
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00476be7
xor ebx, ebx
cmp dword [0x6214ac], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4802f8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4803d8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4803d8
push eax
call fcn.00476b79
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x6214ac], eax
call esi
push eax
call fcn.00476b79
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6214b0], eax
call esi
push eax
call fcn.00476b79
mov dword [0x6214b4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00474786
test eax, eax
pop ecx
pop ecx
je 0x4802c6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00473e90
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4802f8
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00476b79
cmp eax, ebx
pop ecx
mov dword [0x6214bc], eax
je 0x4802f8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00476b79
pop ecx
mov dword [0x6214b8], eax
mov eax, dword [0x6214b8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x48037d
cmp dword [0x6214bc], ecx
je 0x48037d
push eax
call fcn.00476bf0
push dword [0x6214bc]
mov esi, eax
call fcn.00476bf0
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x48037d
cmp edi, ebx
je 0x48037d
call esi
cmp eax, ebx
je 0x48034a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x48034a
test byte [ebp - 0x18], 1
jne 0x48037d
lea eax, [ebp - 0x10]
push eax
call fcn.004747bd
test eax, eax
pop ecx
je 0x480365
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00473e90
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x480374
or dword [ebp + 0x10], 0x200000
jmp 0x4803b8
or dword [ebp + 0x10], 0x40000
jmp 0x4803b8
mov eax, dword [0x6214b0]
cmp eax, dword [ebp - 8]
je 0x4803b8
push eax
call fcn.00476bf0
cmp eax, ebx
pop ecx
je 0x4803b8
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4803b8
mov eax, dword [0x6214b4]
cmp eax, dword [ebp - 8]
je 0x4803b8
push eax
call fcn.00476bf0
cmp eax, ebx
pop ecx
je 0x4803b8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6214ac]
call fcn.00476bf0
cmp eax, ebx
pop ecx
je 0x4803d8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4803da
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret