joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472226
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b300
push 0x4724ec
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x2c], 0x3459fe
mov dword [ebp - 0x28], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd8
call fcn.004726e0
add esp, 4
test eax, eax
je 0x472271
mov ecx, eax
call fcn.00472190
mov dword [ebp - 0x1c], eax
jmp 0x472278
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xb8
mov ecx, eax
mov dword [ebp - 0x20], eax
call fcn.004720f0
test eax, eax
je 0x4722b2
cmp dword [ebp - 0x1c], 0
je 0x4722a8
mov ecx, dword [ebp - 0x1c]
call fcn.00472200
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004726f0
add esp, 4
mov eax, 0x2a
jmp 0x4723de
wait
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.00471700
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0
mov eax, dword fs:[0x20]
je 0x4722e1
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.00471880
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc4], 0
je 0x472324
mov esi, eax
test esi, esi
je 0x472312
mov ecx, esi
call fcn.00472200
push esi
call fcn.004726f0
add esp, 4
mov eax, 0x926
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x4723de
mov ecx, dword [ebp - 0x20]
call fcn.00471b30
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x2c], 0
jne 0x47236c
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
je 0x472366
mov esi, eax
test esi, esi
je 0x472357
mov ecx, esi
call fcn.00472200
push esi
call fcn.004726f0
add esp, 4
mov eax, 0xc3
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x4723de
mov eax, dword ds:[0]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004712e0
mov ecx, dword [ebp - 0x20]
call fcn.00471c90
xor dword [ebp - 0x24], eax
wait
jmp 0x4723ad
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x4723ce
mov ecx, dword [ebp - 0x1c]
call fcn.00472200
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004726f0
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x4723db
mov dword [ebp - 0x24], 0x4e6
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x472da0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [esp + 0xc]
push ebp
mov eax, ecx
push edi
sub eax, 0x80
je 0x472dcf
sub eax, 0x40
je 0x472dc8
sub eax, 0x40
je 0x472dc1
pop edi
mov eax, 0xfffffffe
pop ebp
ret
mov edi, 8
jmp 0x472dd4
mov edi, 6
jmp 0x472dd4
mov edi, 4
mov eax, dword [esp + 0x10]
cmp eax, ecx
jge 0x472dde
mov eax, ecx
sub eax, 0x80
je 0x472e05
sub eax, 0x40
je 0x472dfe
sub eax, 0x40
je 0x472df7
pop edi
mov eax, 0xfffffffd
pop ebp
ret
mov ebp, 0xe
jmp 0x472e0a
mov ebp, 0xc
jmp 0x472e0a
mov ebp, 0xa
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebx
push esi
call fcn.00472ea0
add esp, 0xc
cmp ebp, 1
jle 0x472e67
lea eax, [ebp - 1]
add ebx, 0x20
mov dword [esp + 0x1c], eax
push edi
push 0x46add8
push esi
call fcn.00472f80
push edi
push 0
push esi
call fcn.00472ef0
push edi
push esi
call fcn.00472fc0
push edi
push ebx
push esi
call fcn.00472ea0
mov eax, dword [esp + 0x48]
add esp, 0x2c
add ebx, 0x20
dec eax
mov dword [esp + 0x1c], eax
jne 0x472e2e
mov ebx, dword [esp + 0x20]
push edi
push 0x46add8
push esi
call fcn.00472f80
push edi
push 0
push esi
call fcn.00472ef0
shl ebp, 5
add ebp, ebx
push edi
push ebp
push esi
call fcn.00472ea0
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x472ea0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
and edi, 0xff
mov ebp, edx
mov dword [esp + 0x1c], 4
test edi, edi
jle 0x472ed3
mov ecx, dword [esp + 0x18]
mov eax, ebp
sub ecx, edx
mov esi, edi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec esi
jne 0x472eca
mov eax, dword [esp + 0x1c]
add ebp, 8
dec eax
mov dword [esp + 0x1c], eax
jne 0x472ebc
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5292de
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x5292fb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5292ec
add dl, dl
jne 0x529306
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x529352
xor eax, eax
add dl, dl
jne 0x529313
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5293ef
add dl, dl
jne 0x529322
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x52932d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x529338
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x529343
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x52934d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x5292f2
mov eax, 1
add dl, dl
jne 0x529360
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x52936b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x529357
sub eax, 2
jne 0x52939a
mov ecx, 1
add dl, dl
jne 0x529380
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x52938b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x529377
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5292f2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x5293b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x5293bc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x5293a8
cmp eax, 0x7d00
jae 0x5293df
cmp eax, 0x500
jb 0x5293da
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5292f2
cmp eax, 0x7f
ja 0x5293e2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5292f2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x52940b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5292f2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x10001104
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
push 0x200
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
push 0x200
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
push str.system32msimg32.dll
mov edi, dword [ebp - 4]
push edi
call sub.shlwapi.dll_PathAppendA
push edi
call sub.kernel32.dll_LoadLibraryA
or eax, eax
pushfd
je 0x10001190
mov ebx, eax
push str.AlphaBlend
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x100035f0], eax
push str.DllInitialize
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x100035f4], eax
push str.GradientFill
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x100035f8], eax
push str.TransparentBlt
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x100035fc], eax
push str.vSetDdrawflag
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x10003600], eax
push edi
call sub.kernel32.dll_GlobalFree
popfd
nop
popal
leave
ret

Function at 0x10001218
Capabilities:
Allocate or change rwx memory

Disassembly:
enter 4, 0
pushal
mov ebx, 0x604e8f
lea edi, [ebp - 4]
push edi
push 0x40
push 2
push ebx
call sub.kernel32.dll_VirtualProtect
mov word [ebx], 0x3eb
push edi
push dword [edi]
push 2
push ebx
call sub.kernel32.dll_VirtualProtect
popal
leave
ret
Function at 0x403594
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5a2008], 0x8088405
inc edx
mov dword [ebx + 0x5a2008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41c674
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41c6a5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c68d
add dl, dl
jne 0x41c6b0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c701
xor eax, eax
add dl, dl
jne 0x41c6bd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41c79e
add dl, dl
jne 0x41c6cc
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c6d7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c6e2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c6ed
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41c6f7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41c69c
mov eax, 1
add dl, dl
jne 0x41c70f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41c71a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c706
sub eax, ebx
mov ebx, 1
jne 0x41c74d
mov ecx, 1
add dl, dl
jne 0x41c733
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41c73e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c72a
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41c69c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41c764
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41c76f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41c75b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41c69c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41c7bf
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41c69c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41d33c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x41d34f
add esp, 0xfffffff0
call fcn.00403d6c
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00403af4
mov byte [ebx + 4], 0
cmp dword [esi + 0x5c], 0
jne 0x41d375
cmp dword [esi + 0x58], 0x40
jb 0x41d55b
jmp 0x41d37b
jl 0x41d55b
lea eax, [ebx + 0xc]
mov edx, 0x40
call fcn.00406e44
push 0
push 0
push 0
push 0x40
lea edx, [ebx + 0xc]
mov eax, esi
call fcn.0041cef4
cmp word [ebx + 0xc], 0x5a4d
jne 0x41d55b
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jle 0x41d55b
cmp ecx, 0x10000
jge 0x41d55b
mov eax, ecx
add eax, 4
add eax, 0x14
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d3d6
cmp eax, dword [esi + 0x58]
ja 0x41d55b
jmp 0x41d3dc
jg 0x41d55b
lea eax, [ebx + 0x4c]
mov edx, 4
call fcn.00406e44
mov eax, dword [ebx + 0x48]
cdq
push edx
push eax
push 0
push 4
lea edx, [ebx + 0x4c]
mov eax, esi
call fcn.0041cef4
cmp dword [ebx + 0x4c], 0x4550
jne 0x41d55b
lea eax, [ebx + 0x50]
mov edx, 0x14
call fcn.00406e44
mov eax, dword [ebx + 0x48]
add eax, 4
cdq
push edx
push eax
push 0
push 0x14
lea edx, [ebx + 0x50]
mov eax, esi
call fcn.0041cef4
mov ax, word [ebx + 0x50]
cmp ax, 0x8664
jne 0x41d493
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xf0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d457
cmp eax, dword [esi + 0x58]
ja 0x41d4e4
jmp 0x41d45d
jg 0x41d4e4
lea eax, [ebx + 0x144]
mov edx, 0xf0
call fcn.00406e44
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xf0
lea edx, [ebx + 0x144]
mov eax, esi
call fcn.0041cef4
mov byte [ebx + 4], 1
jmp 0x41d4e4
cmp ax, 0x14c
jne 0x41d4e4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xe0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d4b4
cmp eax, dword [esi + 0x58]
ja 0x41d4e4
jmp 0x41d4b6
jg 0x41d4e4
lea eax, [ebx + 0x64]
mov edx, 0xe0
call fcn.00406e44
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xe0
lea edx, [ebx + 0x64]
mov eax, esi
call fcn.0041cef4
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
je 0x41d55b
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
mov di, word [ebx + 0x52]
movzx edx, di
shl edx, 3
lea edx, [edx + edx*4]
add eax, edx
cdq
cmp edx, dword [esi + 0x5c]
jne 0x41d515
cmp eax, dword [esi + 0x58]
ja 0x41d55b
jmp 0x41d517
jg 0x41d55b
movzx eax, di
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x58ce0c]
call fcn.00405b38
add esp, 4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
cdq
push edx
push eax
movzx eax, word [ebx + 0x52]
shl eax, 3
lea eax, [eax + eax*4]
xor edx, edx
push edx
push eax
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.0041cef4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x41d572
call fcn.00403dc4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x41e270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x58e72f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e321
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e30a
test esi, esi
jbe 0x41e321
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.00408868
test eax, eax
jne 0x41e2fc
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e321
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e2d9
jmp 0x41e321
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e321
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58e736
ret
Function at 0x41e340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov dword [ebp - 4], edx
mov eax, dword [0x5a4188]
mov eax, dword [eax]
mov eax, dword [eax + 0x58]
call fcn.00403250
mov dword [ebp - 0x10], eax
mov eax, dword [0x5a4188]
mov eax, dword [eax]
cmp dword [eax + 0x5c], 0
jbe 0x41e449
push 0
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x5a4188]
mov eax, dword [eax]
mov eax, dword [eax + 8]
call fcn.00404ec8
push eax
call fcn.0041a658
push 0
push 0
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x58]
mov ecx, 0x40
call fcn.0040d9ac
lea eax, [ebp - 0x24]
push eax
push 0
push 0x80
push 1
push 1
push 0x60
push 0
push 0
lea ecx, [ebp - 0x58]
lea eax, [ebp - 0x1c]
mov edx, 0x80100080
call fcn.0041bb4c
test eax, eax
jne 0x41e440
mov eax, dword [0x5a4188]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
xor edx, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push 8
push 0xe
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
call fcn.0041ba8c
mov eax, dword [0x5a4188]
mov eax, dword [eax]
mov eax, dword [eax + 0x5c]
call fcn.00403250
mov ebx, eax
push 0
lea eax, [ebp - 0x24]
push eax
push ebx
mov eax, dword [0x5a4188]
mov eax, dword [eax]
mov eax, dword [eax + 0x5c]
push eax
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.0041baf4
test eax, eax
jne 0x41e431
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0041c674
mov eax, ebx
call fcn.00403270
mov eax, dword [ebp - 0x1c]
call fcn.0041ba6c
lea eax, [ebp - 0x18]
push eax
call fcn.0041a668
mov edx, dword [ebp - 0x10]
mov eax, edx
mov ebx, dword [eax + 0x3c]
add ebx, edx
push 0x40
push 0x1000
mov eax, dword [ebx + 0x50]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax]
push eax
call fcn.00406d90
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x50]
call fcn.00403250
dec dword [ebx + 0x50538bf8]
Function at 0x41eb80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x58f12f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404c94
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41ebbb
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41ebd4
lea eax, [ebp - 0x10]
mov edx, dword [0x5a4188]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404cf4
jmp 0x41ebe7
lea eax, [ebp - 0x10]
mov edx, dword [0x5a4188]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404cf4
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ebf3
adc edx, 0
mov edx, dword [edx*4 + 0x5a2ca8]
call fcn.00404ee4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404ec8
push eax
call fcn.00406ab8
mov esi, eax
cmp esi, 0xffffffff
je 0x41ed01
mov eax, 0x40
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d00
test eax, eax
je 0x41ecf4
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ecf4
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d58
mov eax, edi
call fcn.00403270
mov eax, 0x18
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d00
test eax, eax
je 0x41ecf4
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ecf4
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ecf4
cmp dx, 0x150
ja 0x41ecf4
mov eax, edi
call fcn.00403270
mov eax, 0xe0
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d00
test eax, eax
je 0x41ecf4
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ecf4
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404cd0
mov eax, edi
call fcn.00403270
push esi
call fcn.00406a70
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404ff0
jne 0x41ed19
inc ebx
cmp ebx, 0x19
jne 0x41ebad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58f136
lea eax, [ebp - 0x10]
call fcn.00404c94
ret
Function at 0x10001020
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 8
call fcn.100016f0
cmp dword [0x10010018], 0
jne 0x10001083
push 0x10010018
push 0x100020c8
call fcn.10001150
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x10001072
push 0x100020c8
push 0x6f
push str.wcsftime.c
push str.NT_SUCCESS_Status_
push str.Assertion_failure:__s___s:_d_in__s__r_n
call dword [sym.imp.ntdll.dll_DbgPrint]
add esp, 0x14
int 0x2c
xor eax, eax
jne 0x1000104b
cmp dword [ebp - 8], 0
jge 0x10001083
xor eax, eax
jmp 0x1000114b
cmp dword [0x10010018], 0
jne 0x100010ad
push 0x100020c8
push 0x76
push str.wcsftime.c
push str.UcrtWGetdays___NULL
push str.Assertion_failure:__s___s:_d_in__s__r_n
call dword [sym.imp.ntdll.dll_DbgPrint]
add esp, 0x14
int 0x2c
xor ecx, ecx
jne 0x10001083
call dword [0x10010018]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100010e1
push 0x100020c8
push 0x79
push str.wcsftime.c
push str.UcrtGetdaysResult___NULL
push str.Assertion_failure:__s___s:_d_in__s__r_n
call dword [sym.imp.ntdll.dll_DbgPrint]
add esp, 0x14
int 0x2c
xor edx, edx
jne 0x100010ba
cmp dword [ebp - 4], 0
jne 0x100010ef
xor eax, eax
jmp 0x1000114b
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.10001300
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x1000113a
push 0x100020c8
push 0x83
push str.wcsftime.c
push str.NT_SUCCESS_Status_
push str.Assertion_failure:__s___s:_d_in__s__r_n
call dword [sym.imp.ntdll.dll_DbgPrint]
add esp, 0x14
int 0x2c
xor eax, eax
jne 0x10001110
cmp dword [ebp - 8], 0
jge 0x10001148
xor eax, eax
jmp 0x1000114b
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10001150
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.100016f0
cmp dword [ebp + 8], 0
jne 0x10001184
push str.GetUcrtProcAddress
push 0x18
push str.wcsftime.c
push str.ProcedureName___NULL
push str.Assertion_failure:__s___s:_d_in__s__r_n
call dword [sym.imp.ntdll.dll_DbgPrint]
add esp, 0x14
int 0x2c
xor eax, eax
jne 0x1000115d
cmp dword [ebp + 0xc], 0
jne 0x100011af
push str.GetUcrtProcAddress
push 0x19
push str.wcsftime.c
push str.ProcedureAddress___NULL
push str.Assertion_failure:__s___s:_d_in__s__r_n
call dword [sym.imp.ntdll.dll_DbgPrint]
add esp, 0x14
int 0x2c
xor ecx, ecx
jne 0x10001188
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [0x10010010], 0
jne 0x10001231
mov eax, 0x18
mov word [ebp - 0x14], ax
mov ecx, 0x1a
mov word [ebp - 0x12], cx
mov dword [ebp - 0x10], str.ucrtbase.dll
xor edx, edx
jne 0x100011c5
push 0x10010010
lea eax, [ebp - 0x14]
push eax
push 0
push 0
call dword [sym.imp.ntdll.dll_LdrLoadDll]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x1000121f
push str.GetUcrtProcAddress
push 0x28
push str.wcsftime.c
push str.NT_SUCCESS_Status_
push str.Assertion_failure:__s___s:_d_in__s__r_n
call dword [sym.imp.ntdll.dll_DbgPrint]
add esp, 0x14
int 0x2c
xor ecx, ecx
jne 0x100011f8
cmp dword [ebp - 0xc], 0
jge 0x10001231
mov eax, dword [ebp - 0xc]
jmp 0x100012ee
cmp dword [0x10010010], 0
jne 0x1000125b
push str.GetUcrtProcAddress
push 0x2f
push str.wcsftime.c
push str.UcrtDllHandle___NULL
push str.Assertion_failure:__s___s:_d_in__s__r_n
call dword [sym.imp.ntdll.dll_DbgPrint]
add esp, 0x14
int 0x2c
xor edx, edx
jne 0x10001231
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.ntdll.dll_RtlInitAnsiStringEx]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x10001297
push str.GetUcrtProcAddress
push 0x32
push str.wcsftime.c
push str.NT_SUCCESS_Status_
push str.Assertion_failure:__s___s:_d_in__s__r_n
call dword [sym.imp.ntdll.dll_DbgPrint]
add esp, 0x14
int 0x2c
xor edx, edx
jne 0x10001270
cmp dword [ebp - 0xc], 0
jge 0x100012a6
mov eax, dword [ebp - 0xc]
jmp 0x100012ee
mov eax, dword [ebp + 0xc]
push eax
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [0x10010010]
push edx
call dword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x100012e7
push str.GetUcrtProcAddress
push 0x3e
push str.wcsftime.c
push str.NT_SUCCESS_Status_
push str.Assertion_failure:__s___s:_d_in__s__r_n
call dword [sym.imp.ntdll.dll_DbgPrint]
add esp, 0x14
int 0x2c
xor eax, eax
jne 0x100012c0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret