joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407b70
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 8], 0x237c
mov dword [ebp - 0x40], 0x9f2a
mov dword [ebp - 0x44], 0x177c6
mov dword [ebp - 0x48], 0x5bc6
mov dword [ebp - 0x24], 0x8781
mov dword [ebp - 0x34], 0x2eaa
mov dword [ebp - 0x4c], 0x64bd
mov dword [ebp - 0x18], 0x140e2
mov dword [ebp - 0x38], 0x8d3b
mov dword [ebp - 0x2c], 0xbc8d
mov dword [ebp - 0x50], 0x11c09
mov dword [ebp - 0x10], 0x13f7b
mov dword [ebp - 0xc], 0x1822f
mov dword [ebp - 0x28], 0x17ce2
mov dword [ebp - 0x1c], 0x9a95
mov dword [ebp - 0x20], 0x17de2
mov dword [ebp - 0x30], 0x10a2d
mov dword [ebp - 0x14], 0xe2b3
mov dword [ebp - 0x54], 0xc2eb
mov dword [ebp - 0x58], 0xb173
mov dword [ebp - 0x3c], 0x13eac
mov dword [ebp - 0x5c], 0xe5a5
mov eax, dword [ebp - 0xc]
sub eax, 0x14eeb
push eax
call fcn.004076f0
add esp, 4
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jge 0x407c32
mov dword [ebp - 4], 1
jmp 0x407c39
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x18]
or edx, dword [ebp - 4]
je 0x407c78
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
jne 0x407c78
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x28]
jne 0x407c78
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x30]
jne 0x407c78
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp + 0x18]
jne 0x407c78
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x3c]
jne 0x407c78
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov esp, ebp
pop ebp
ret
Function at 0x409b00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x38], 0x1141d
mov dword [ebp - 0x44], 0x1cff
mov dword [ebp - 0x48], 0x17ae9
mov dword [ebp - 0xc], 0x19f0
mov dword [ebp - 0x24], 0x64d0
mov dword [ebp - 0x4c], 0xd987
mov dword [ebp - 0x50], 0x98b2
mov dword [ebp - 0x54], 0x10032
mov dword [ebp - 0x58], 0x21a1
mov dword [ebp - 0x40], 0x6a07
mov dword [ebp - 8], 0x3d3d
mov dword [ebp - 0x34], 0x86f3
mov dword [ebp - 0x5c], 0xb990
mov dword [ebp - 0x2c], 0x1300f
mov dword [ebp - 0x60], 0x3f82
mov dword [ebp - 4], 0x13af1
mov dword [ebp - 0x28], 0x110d7
mov dword [ebp - 0x1c], 0x138a5
mov dword [ebp - 0x3c], 0x1e0a
mov dword [ebp - 0x30], 0x4936
mov dword [ebp - 0x64], 0x121a9
mov dword [ebp - 0x68], 0xf7d3
mov dword [ebp - 0x20], 0x13131
mov dword [ebp - 0x18], 0x16e20
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x24]
add edx, 0x3b4a
push edx
call fcn.00410180
add esp, 4
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x18]
jge 0x409c58
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jge 0x409bf4
mov dword [ebp - 0x10], 1
jmp 0x409bfb
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x1c]
jge 0x409c0c
mov dword [ebp - 0x14], 1
jmp 0x409c13
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp + 0xc]
and ecx, dword [ebp - 0x10]
or ecx, dword [ebp - 0x30]
or ecx, dword [ebp - 0x14]
je 0x409c58
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x34]
jne 0x409c58
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x38]
jne 0x409c58
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x40]
jne 0x409c58
push 0x2c6f
push 0xb504
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add esp, 8
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov esp, ebp
pop ebp
ret
Function at 0x40e800
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov dword [ebp - 0x7c], 0x14fa0
mov dword [ebp - 0x78], 0x11321
mov dword [ebp - 0x80], 0xd198
mov dword [ebp - 0x4c], 0x999c
mov dword [ebp - 0x10], 0x127da
mov dword [ebp - 0x48], 0x14340
mov dword [ebp - 0x68], 0x8126
mov dword [ebp - 0x50], 0xa429
mov dword [ebp - 0x24], 0x16a9d
mov dword [ebp - 0x2c], 0xe104
mov dword [ebp - 4], 0x27b6
mov dword [ebp - 0xc], 0x472a
mov dword [ebp - 0x20], 0x1295f
mov dword [ebp - 8], 0xaefd
mov dword [ebp - 0x14], 0x143b3
mov dword [ebp - 0x28], 0x13362
mov dword [ebp - 0x58], 0x1949
mov dword [ebp - 0x54], 0x37f7
mov dword [ebp - 0x70], 0xe733
mov dword [ebp - 0x84], 0x164e5
mov dword [ebp - 0x74], 0xb513
mov dword [ebp - 0x40], 0xf305
mov dword [ebp - 0x6c], 0x7bd0
mov dword [ebp - 0x88], 0x248c
mov dword [ebp - 0x18], 0
jmp 0x40e8c9
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x127d9
cmp dword [ebp - 0x18], ecx
jge 0x40e8e2
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x40e8c0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x58]
jge 0x40e8f3
mov dword [ebp - 0x30], 1
jmp 0x40e8fa
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x14]
jge 0x40e90b
mov dword [ebp - 0x34], 1
jmp 0x40e912
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
and edx, dword [ebp - 0x30]
and edx, dword [ebp - 0x34]
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x5c], 0
je 0x40e939
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], 0
jmp 0x40e94b
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 4]
sub eax, 0x27b5
cmp dword [ebp - 0x1c], eax
jge 0x40e963
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x20], ecx
jmp 0x40e942
cmp dword [ebp - 0x2c], 0xe105
jge 0x40eafd
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x40]
jge 0x40e981
mov dword [ebp - 0x38], 1
jmp 0x40e988
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x64]
jge 0x40e9b1
mov dword [ebp - 0x3c], 1
jmp 0x40e9b8
mov dword [ebp - 0x3c], 0
mov ecx, dword [ebp - 0x38]
or ecx, dword [ebp - 0x3c]
je 0x40eaef
mov edx, dword [ebp - 0x40]
imul edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x68]
jge 0x40eaef
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jne 0x40eaef
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 0x6c]
jne 0x40eaef
push 0xc125
push 0x616c
push 0xaf72
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
jmp 0x40e963
mov esp, ebp
pop ebp
ret
Function at 0x411900
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov dword [ebp - 0x38], 0x11b22
mov dword [ebp - 0x20], 0xff21
mov dword [ebp - 8], 0xbd0a
mov dword [ebp - 0x48], 0xdcef
mov dword [ebp - 0x90], 0xaed6
mov dword [ebp - 0x88], 0x82cf
mov dword [ebp - 0x94], 0x4daa
mov dword [ebp - 0x10], 0x7f52
mov dword [ebp - 0x74], 0xa549
mov dword [ebp - 0x68], 0x61b
mov dword [ebp - 0x78], 0x11d2b
mov dword [ebp - 0x60], 0x74f5
mov dword [ebp - 0x1c], 0x180f1
mov dword [ebp - 0x3c], 0x15859
mov dword [ebp - 0xc], 0xad5d
mov dword [ebp - 0x30], 0x126c6
mov dword [ebp - 0x2c], 0xde11
mov dword [ebp - 0x18], 0x9f8d
mov dword [ebp - 0x98], 0xa5d9
mov dword [ebp - 0x14], 0x31b4
mov dword [ebp - 0x80], 0xcc99
mov dword [ebp - 4], 0xd08
mov dword [ebp - 0x34], 0x5266
mov dword [ebp - 0x24], 0xb137
mov dword [ebp - 0x7c], 0x18567
mov dword [ebp - 0x28], 0
jmp 0x4119d6
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0x1c]
sub ecx, 0x14f7b
cmp dword [ebp - 0x28], ecx
jge 0x411cb0
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x74]
jge 0x411cab
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jne 0x411cab
mov ecx, dword [ebp - 0x78]
cmp ecx, dword [ebp - 0x68]
jne 0x411cab
mov edx, dword [ebp + 0x20]
cmp edx, dword [ebp - 4]
jne 0x411cab
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x18]
jne 0x411cab
push 0x56a6
push 0x1e56
push 0x15a68
push 0x15390
push 0xee14
push 0x5214
push 0x137d9
push 0x4e56
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
jmp 0x4119cd
cmp dword [ebp + 0x1c], 0x14f7d
jge 0x411d10
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x24]
jge 0x411ccd
mov dword [ebp - 0x6c], 1
jmp 0x411cd4
mov dword [ebp - 0x6c], 0
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 8]
jge 0x411ce5
mov dword [ebp - 0x70], 1
jmp 0x411cec
mov dword [ebp - 0x70], 0
mov eax, dword [ebp - 0x6c]
or eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0xc]
or ecx, dword [ebp + 0x20]
or eax, ecx
je 0x411d05
mov edx, dword [ebp - 0x3c]
sub edx, 1
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 0x1c]
add eax, 1
mov dword [ebp + 0x1c], eax
jmp 0x411cb0
mov ecx, dword [ebp + 0x14]
add ecx, 1
mov dword [ebp + 0x14], ecx
mov dword [ebp - 0x40], 0
jmp 0x411d2b
mov edx, dword [ebp - 0x40]
add edx, 1
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x24]
sub eax, 0xb136
cmp dword [ebp - 0x40], eax
jge 0x411d43
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x411d22
mov edx, dword [ebp - 0x10]
sub edx, 0x6f3f
push edx
mov eax, dword [ebp + 8]
sub eax, 0xa2a9
push eax
mov ecx, dword [ebp - 0x74]
sub ecx, 0x1dbb
push ecx
mov edx, dword [ebp - 0x78]
sub edx, 0x2375
push edx
mov eax, dword [ebp - 0x7c]
sub eax, 0x40b0
push eax
call fcn.0040feb0
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x4121c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x48], 0x5eb8
mov dword [ebp - 0x4c], 0x13145
mov dword [ebp - 0x28], 0x14795
mov dword [ebp - 0x50], 0x17cb8
mov dword [ebp - 0x54], 0xc2f8
mov dword [ebp - 0x24], 0x135a8
mov dword [ebp - 0x2c], 0x1703c
mov dword [ebp - 0x1c], 0x17eb3
mov dword [ebp - 0x58], 0x1595c
mov dword [ebp - 0x30], 0xc2b4
mov dword [ebp - 0x5c], 0x7d67
mov dword [ebp - 0x60], 0x17017
mov dword [ebp - 0x64], 0x153d5
mov dword [ebp - 0x68], 0x15225
mov dword [ebp - 4], 0x4257
mov dword [ebp - 0x40], 0xf48e
mov dword [ebp - 0x44], 0x1a58
mov dword [ebp - 0x6c], 0x16874
mov dword [ebp - 0x3c], 0x9972
mov dword [ebp - 8], 0xc1
mov dword [ebp - 0x34], 0x1096f
mov dword [ebp - 0x38], 0x4142
mov dword [ebp - 0x10], 0xca0e
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 8]
jge 0x412278
mov dword [ebp - 0x14], 1
jmp 0x41227f
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x24]
jge 0x412290
mov dword [ebp - 0x18], 1
jmp 0x412297
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x14]
or edx, dword [ebp - 4]
or edx, dword [ebp - 0x18]
je 0x41232b
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x38]
jge 0x4122b7
mov dword [ebp - 0x20], 1
jmp 0x4122be
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x1c]
or ecx, dword [ebp - 0x20]
je 0x41232b
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jne 0x41232b
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x28]
jne 0x41232b
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x48]
jne 0x41232b
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp + 8]
jne 0x41232b
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x28]
jne 0x41232b
push 0xbb3e
push 0x13a58
push 0x169d7
push 0x8d92
push 0x524
push 0x8533
push 0x16081
push 0x86ed
call dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x20
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0xc], 0
jmp 0x412346
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
sub ecx, 0xc0
cmp dword [ebp - 0xc], ecx
jge 0x41235f
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x41233d
mov esp, ebp
pop ebp
ret
Function at 0x413530
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x6c], 0x7de0
mov dword [ebp - 0x5c], 0x3935
mov dword [ebp - 0x68], 0x89ea
mov dword [ebp - 0x30], 0x1678a
mov dword [ebp - 4], 0xb8da
mov dword [ebp - 0x38], 0x31e7
mov dword [ebp - 0xc], 0x98ac
mov dword [ebp - 0x58], 0x3563
mov dword [ebp - 0x2c], 0x14ad
mov dword [ebp - 0x70], 0x1575f
mov dword [ebp - 0x54], 0xac22
mov dword [ebp - 0x74], 0x86da
mov dword [ebp - 0x3c], 0x1f4a
mov dword [ebp - 0x28], 0x15fe8
mov dword [ebp - 0x14], 0x6000
mov dword [ebp - 0x10], 0x93b3
mov dword [ebp - 0x64], 0x2a32
mov dword [ebp - 0x50], 0x11ca4
mov dword [ebp - 0x34], 0x10f00
mov dword [ebp - 8], 0x6bca
mov dword [ebp - 0x78], 0x12a5f
mov dword [ebp - 0x60], 0x247a
mov dword [ebp - 0x24], 0x16e76
mov dword [ebp - 0x7c], 0xe242
cmp dword [ebp - 8], 0x6bcb
jge 0x413609
mov eax, dword [ebp + 0x14]
and eax, dword [ebp - 0x30]
xor eax, dword [ebp + 0x18]
or eax, dword [ebp + 0x1c]
je 0x4135fe
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x4135de
cmp dword [ebp + 8], 0x14e93
jge 0x41362e
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x38]
jge 0x413623
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x413609
cmp dword [ebp - 0x10], 0x93b4
jge 0x413723
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x3c]
jge 0x41364c
mov dword [ebp - 0x18], 1
jmp 0x413653
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 0x44]
jge 0x413679
mov dword [ebp - 0x1c], 1
jmp 0x413680
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x18]
or edx, dword [ebp - 0x1c]
je 0x413715
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp + 0x18]
sub edx, 1
mov dword [ebp + 0x18], edx
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x4c]
jge 0x4136b2
mov dword [ebp - 0x20], 1
jmp 0x4136b9
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x50]
add ecx, dword [ebp - 0x28]
or ecx, dword [ebp - 0x20]
je 0x413715
mov edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0xc]
jge 0x413715
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x24]
jne 0x413715
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x28]
jne 0x413715
mov edx, dword [ebp - 0x5c]
cmp edx, dword [ebp - 0x60]
jne 0x413715
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x20]
jne 0x413715
mov ecx, dword [ebp - 0x64]
cmp ecx, dword [ebp - 0x68]
jne 0x413715
push 0x15493
push 0x1964
push 0x15c9b
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0xc
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x41362e
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc21e
push ecx
call fcn.00410ca0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x413e90
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x38], 0x8f4
mov dword [ebp - 0x10], 0x184b2
mov dword [ebp - 0x4c], 0x5662
mov dword [ebp - 0x28], 0xc97e
mov dword [ebp - 0x50], 0xae1
mov dword [ebp - 0x58], 0x958c
mov dword [ebp - 0x5c], 0xe01a
mov dword [ebp - 0x3c], 0x61ea
mov dword [ebp - 0x60], 0x6be4
mov dword [ebp - 0x68], 0xb71e
mov dword [ebp - 0x64], 0x6a01
mov dword [ebp - 0x44], 0x11d0e
mov dword [ebp - 0x20], 0x23b
mov dword [ebp - 0x14], 0xec73
mov dword [ebp - 0x54], 0x14645
mov dword [ebp - 4], 0x1e51
mov dword [ebp - 0x6c], 0x1759a
mov dword [ebp - 0x18], 0x50a3
mov dword [ebp - 0x70], 0x12889
mov dword [ebp - 0x40], 0xa124
mov dword [ebp - 0x24], 0x1cef
mov dword [ebp - 0x74], 0x7e73
mov dword [ebp - 0x78], 0x2981
mov dword [ebp - 0x48], 0x86d7
cmp dword [ebp - 4], 0x1e52
jge 0x413f5b
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x413f3e
mov dword [ebp - 8], 0
jmp 0x413f6d
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x44]
sub eax, 0x11d0d
cmp dword [ebp - 8], eax
jge 0x413fac
mov ecx, dword [ebp - 0x38]
imul ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x28]
jge 0x413f8f
mov dword [ebp - 0x1c], 1
jmp 0x413f96
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x3c]
or edx, dword [ebp - 0x20]
and edx, dword [ebp - 0x1c]
je 0x413faa
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x413f64
mov dword [ebp - 0xc], 0
jmp 0x413fbe
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x48]
sub edx, 0x86d6
cmp dword [ebp - 0xc], edx
jge 0x41406c
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jge 0x413fe4
mov dword [ebp - 0x2c], 1
jmp 0x413feb
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x28]
jge 0x413ffc
mov dword [ebp - 0x30], 1
jmp 0x414003
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x50]
jge 0x414014
mov dword [ebp - 0x34], 1
jmp 0x41401b
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x2c]
or eax, dword [ebp - 0x30]
or eax, dword [ebp - 0x34]
je 0x414067
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x38]
jne 0x414067
mov edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0x58]
jne 0x414067
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x60]
jne 0x414067
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x64]
jne 0x414067
push 0x13675
push 0x7416
push 0x15746
call dword [sym.imp.USER32.dll_GetWindowTextA]
add esp, 0xc
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
jmp 0x413fb5
mov eax, dword [ebp - 0x40]
sub eax, 1
mov dword [ebp - 0x40], eax
mov esp, ebp
pop ebp
ret
Function at 0x4175b0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x10], 0x37b6
mov dword [ebp - 0x48], 0xbf6c
mov dword [ebp - 0x3c], 0x10f31
mov dword [ebp - 0x58], 0x52dd
mov dword [ebp - 0x2c], 0x16eb9
mov dword [ebp - 0x28], 0xd29b
mov dword [ebp - 0x50], 0xad85
mov dword [ebp - 0x54], 0x7656
mov dword [ebp - 0x4c], 0x16a5a
mov dword [ebp - 0x40], 0xfd72
mov dword [ebp - 0x44], 0x59a
mov dword [ebp - 0xc], 0x4bd9
mov dword [ebp - 0x30], 0x54e5
mov dword [ebp - 0x18], 0x7745
mov dword [ebp - 8], 0x10132
mov dword [ebp - 0x5c], 0x41a7
mov dword [ebp - 0x14], 0x165e3
mov dword [ebp - 0x60], 0xcf11
mov dword [ebp - 4], 0x9ffa
mov dword [ebp - 0x34], 0xf26f
mov dword [ebp - 0x38], 0x116c2
mov dword [ebp - 0x64], 0x16a74
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 4]
jge 0x4177ae
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x10]
jne 0x4177ae
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x3c]
jne 0x4177ae
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jne 0x4177ae
push 0xbd6b
push 0x4b3f
push 0x15e0f
push 0x176f6
push 0x10937
push 0xca5d
push 0x1544c
call dword [sym.imp.KERNEL32.dll_CompareStringW]
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x28]
jge 0x4176bd
mov dword [ebp - 0x1c], 1
jmp 0x4176c4
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x40]
jge 0x4176d5
mov dword [ebp - 0x20], 1
jmp 0x4176dc
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
je 0x4177ae
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 4]
jne 0x4177ae
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 8]
jne 0x4177ae
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jne 0x4177ae
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 8]
jne 0x4177ae
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0xc]
jge 0x417729
mov dword [ebp - 0x24], 1
jmp 0x417730
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 4]
and eax, dword [ebp - 0x24]
je 0x41778c
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x4c]
jne 0x41778c
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x54]
jne 0x41778c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x41778c
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x2c]
jne 0x41778c
mov edx, dword [ebp + 8]
sub edx, 1
mov dword [ebp + 8], edx
push 0x2997
push 0x12431
push 0xd692
push 0x38a7
push 0xb5c5
push 0x153a5
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
add esp, 0x18
push 0x3357
push 0x152af
push 0xa1fa
push 0x80aa
push 0x17cc5
call dword [sym.imp.USER32.dll_EndDialog]
add esp, 0x14
mov eax, dword [ebp - 0x14]
sub eax, 0xa058
push eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x3582
push ecx
mov edx, dword [ebp - 4]
sub edx, 0x9491
push edx
mov eax, dword [ebp - 0x30]
sub eax, 1
push eax
call fcn.00409b00
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x41a840
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x70], 0x16050
mov dword [ebp - 0x80], 0x6b01
mov dword [ebp - 0x24], 0x4a66
mov dword [ebp - 0x1c], 0x1e34
mov dword [ebp - 0x6c], 0x2b12
mov dword [ebp - 0x50], 0x6cad
mov dword [ebp - 0x60], 0x142b3
mov dword [ebp - 0x58], 0x5dc5
mov dword [ebp - 0x68], 0x42c9
mov dword [ebp - 0x84], 0x11cd0
mov dword [ebp - 0x48], 0x1810a
mov dword [ebp - 0x5c], 0x16192
mov dword [ebp - 0x74], 0x14fd7
mov dword [ebp - 0x4c], 0xfb93
mov dword [ebp - 0x54], 0x163d3
mov dword [ebp - 0x2c], 0x165e7
mov dword [ebp - 0x7c], 0x14db
mov dword [ebp - 4], 0x13d7
mov dword [ebp - 0x14], 0x5105
mov dword [ebp - 0x64], 0xfa73
mov dword [ebp - 0x3c], 0x176ef
mov dword [ebp - 0x18], 0x13568
mov dword [ebp - 8], 0
jmp 0x41a8f8
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x5104
cmp dword [ebp - 8], ecx
jge 0x41a917
mov edx, dword [0x4e0430]
add edx, 1
mov dword [0x4e0430], edx
jmp 0x41a8ef
mov eax, dword [ebp - 0x24]
add eax, 0xaa03
push eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x153a8
push ecx
call fcn.0040b0f0
add esp, 8
mov dword [ebp - 0xc], 0
jmp 0x41a944
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x54]
sub eax, 0x163d2
cmp dword [ebp - 0xc], eax
jge 0x41a95c
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
jmp 0x41a93b
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]