joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10048590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061ffa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
and dword [ebp - 0x24], 0
mov eax, dword [0x1060aac4]
and eax, 1
jne 0x100485ea
mov eax, dword [0x1060aac4]
or eax, 1
mov dword [0x1060aac4], eax
and dword [ebp - 4], 0
mov ecx, 0x1060aaa0
call fcn.10048a05
push 0x10062239
call fcn.1004bb9c
pop ecx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
call fcn.10047449
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 6
jae 0x1004865e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x3c]
push eax
mov ecx, 0x1060aaa0
call fcn.100358d8
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x40]
push eax
mov ecx, 0x1060aaa0
call fcn.100358ef
mov ecx, eax
call fcn.1003590a
movzx eax, al
test eax, eax
je 0x1004865e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x1060aaa0
call fcn.10048a59
push eax
mov ecx, dword [ebp + 8]
call fcn.1003570e
mov eax, dword [ebp - 0x24]
or eax, 1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
jmp 0x100487c4
mov dword [ebp - 0x28], 0x6034
mov dword [ebp - 0x38], 0x1000c148
cmp dword [ebp - 0x28], 0x62b9
jle 0x1004870b
and dword [ebp - 0x1c], 0
jmp 0x10048686
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1629
jge 0x100486fe
and dword [ebp - 0x20], 0
jmp 0x1004869c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x948
jge 0x100486fc
and dword [ebp - 0x14], 0
jmp 0x100486b2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1cd9
jge 0x100486fa
and dword [ebp - 0x18], 0
jmp 0x100486c8
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6acf
jge 0x100486f8
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
or ecx, dword [ebp - 0x20]
or eax, ecx
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x10609898
call fcn.1000fe8e
jmp 0x100486c1
jmp 0x100486ab
jmp 0x10048695
jmp 0x1004867f
push 0
push 0x1207
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x60]
call fcn.100487d5
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
cmp dword [ebp - 0x28], 0x5c67
jge 0x10048734
mov edx, dword [ebp - 0x38]
mov ecx, 0x10609898
call fcn.10011938
jmp 0x10048750
mov dword [ebp - 4], 1
jmp 0x10048760
lea eax, [ebp + 0xc]
push eax
push 0x8a9
push 0x43a3
push 0x1060aaa0
push 0x536e
push 0x1068
push 1
lea eax, [ebp - 0x60]
push eax
push 1
push 0x17ff
push 0x9b5
lea eax, [ebp - 0x2c]
push eax
push 0x7d0d
call fcn.100481a2
add esp, 0x34
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp + 8]
call fcn.100487e8
mov eax, dword [ebp - 0x24]
or eax, 1
mov dword [ebp - 0x24], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.1003575b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005d365
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10067750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1004f4f8
mov dword [ebp - 0x14], eax
cmp dword [0x1060a8fc], esi
jne 0x1005d458
push 0x800
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1005d3e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1005d538
push esi
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1005d538
push 0x10007528
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005d538
push eax
call ebx
push 0x10007534
push edi
mov dword [0x1060a8fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007544
push edi
mov dword [0x1060a900], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007558
push edi
mov dword [0x1060a904], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060a90c], eax
test eax, eax
je 0x1005d455
push 0x10007574
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060a908], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1005d47d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1005d470
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1005d492
push 4
pop eax
jmp 0x1005d53a
cmp dword [ebp - 0x14], esi
je 0x1005d492
push dword [0x1060a8fc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1005d477
mov eax, dword [0x1060a908]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1005d4f0
cmp dword [0x1060a90c], edi
je 0x1005d4f0
push eax
call ebx
push dword [0x1060a90c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1005d4f0
test eax, eax
je 0x1005d4f0
call ecx
test eax, eax
je 0x1005d4e5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1005d4e5
test byte [ebp - 8], 1
jne 0x1005d4f0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1005d520
mov eax, dword [0x1060a900]
cmp eax, edi
je 0x1005d51d
push eax
call ebx
test eax, eax
je 0x1005d51d
call eax
mov esi, eax
test esi, esi
je 0x1005d51d
mov eax, dword [0x1060a904]
cmp eax, edi
je 0x1005d51d
push eax
call ebx
test eax, eax
je 0x1005d51d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1060a8fc]
call ebx
test eax, eax
je 0x1005d538
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1005d53a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004ca0c
mov esp, ebp
pop ebp
ret
Function at 0x4030a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebx, 1
push esi
mov esi, eax
or eax, 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x70], eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], ebx
call fcn.0040aa4c
sub esi, dword [esp + 0x80]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
mov dword [esp + 0x10], esi
fmul qword [0x420010]
fild dword [esp + 0x10]
fmulp st(1)
fiadd dword [esp + 0x80]
call fcn.004178c0
mov ebp, eax
xor esi, esi
xor edi, edi
test ebp, ebp
jle 0x4031e0
jmp 0x403170
call fcn.0040aa4c
mov dword [esp + 0x80], eax
fild dword [esp + 0x80]
fmul qword [0x420010]
fmul qword [0x420020]
fadd qword [0x420018]
call fcn.004178c0
mov ecx, eax
mov eax, dword [esp + ecx*4 + 0x14]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jle 0x4031c8
jmp 0x4031b0
add ecx, ebx
cmp ecx, 0x1a
jne 0x4031b9
xor ecx, ecx
mov eax, dword [esp + ecx*4 + 0x14]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jg 0x4031b0
add esi, dword [esp + ecx*4 + 0x14]
mov eax, dword [esp + 0x84]
add ecx, 0x61
mov word [eax + edi*2], cx
add edi, ebx
cmp edi, ebp
jl 0x403170
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
Function at 0x4053e0
Capabilities:
Hash data using sha1
Read file on windows

Disassembly:
mov eax, 0x1068
call fcn.00415980
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x1064], eax
mov eax, dword [esp + 0x106c]
push ebx
push ebp
push 0x41dd14
push eax
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x14], ebx
xor ebp, ebp
call fcn.0040ac04
mov eax, dword [esp + 0x14]
add esp, 0xc
cmp eax, ebx
jne 0x40544b
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
pop ebp
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
pop ebx
mov ecx, dword [esp + 0x1064]
xor ecx, esp
call fcn.0040a982
add esp, 0x1068
ret
push esi
push 2
push ebx
push eax
call fcn.0040ace1
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0040af03
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push edx
mov dword [esp + 0x2c], eax
call fcn.0040ace1
mov eax, dword [esp + 0x28]
push eax
push 0x1000
lea ecx, [esp + 0x94]
push 1
push ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], 0x67452301
mov dword [esp + 0x4c], 0xefcdab89
mov dword [esp + 0x50], 0x98badcfe
mov dword [esp + 0x54], 0x10325476
mov dword [esp + 0x58], 0xc3d2e1f0
call fcn.0040b32a
mov esi, eax
add esp, 0x2c
cmp esi, ebx
jbe 0x4054f6
lea edx, [esp + 0x70]
push esi
push edx
lea ebx, [esp + 0x1c]
call fcn.00405250
mov eax, dword [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x80]
push 1
push ecx
add ebp, esi
call fcn.0040b32a
mov esi, eax
add esp, 0x18
test esi, esi
ja 0x4054c1
xor ebx, ebx
push edi
lea esi, [esp + 0x18]
call fcn.004052f0
mov edx, dword [esp + 0x10]
push edx
call fcn.0040b3be
add esp, 8
pop esi
cmp ebp, dword [esp + 0xc]
jb 0x405424
mov ecx, dword [esp + 0x106c]
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0040a982
add esp, 0x1068
ret

Function at 0x405c80
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x100c
call fcn.00415980
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x1008], eax
mov edx, dword [ebx]
mov eax, dword [esp + 0x1010]
push ebp
mov ebp, dword [0x41c1e0]
push edi
xor edi, edi
push edi
push 4
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x1c], eax
call ebp
cmp eax, 4
je 0x405cd8
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.0040a982
add esp, 0x100c
ret
cmp dword [esp + 8], edi
jbe 0x405d1d
push esi
nop
mov ecx, dword [ebx]
push 0
push 0x1000
lea eax, [esp + 0x1c]
push eax
push ecx
call ebp
mov esi, eax
test esi, esi
je 0x405d1c
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push eax
push esi
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.0040b59c
add edi, esi
add esp, 0x10
mov dword [0x42471c], edi
cmp edi, dword [esp + 0xc]
jb 0x405ce0
pop esi
mov edx, dword [esp + 0xc]
mov eax, dword [edx]
push eax
call fcn.0040b3be
mov ecx, dword [esp + 0x1014]
add esp, 4
cmp edi, dword [esp + 8]
pop edi
sbb eax, eax
pop ebp
xor ecx, esp
inc eax
call fcn.0040a982
add esp, 0x100c
ret
Function at 0x407c40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x407c47
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x407d24
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f998]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x41f998]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x41f998]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f998]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f998]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f998]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f998]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f998]
inc ecx
sub edx, 8
sub esi, 1
jne 0x407c60
pop edi
test edx, edx
je 0x407d4b
jmp 0x407d30
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x41f998]
inc ecx
sub edx, 1
jne 0x407d30
not eax
pop esi
ret

Function at 0x407d50
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x41f998]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x41f998]
mov dword [edx + 8], ecx
ret

Function at 0x407da0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x41f998]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x41f998]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0x40a4c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push 0x206
xor esi, esi
lea ecx, [esp + 0x12]
xor eax, eax
push esi
push ecx
mov word [esp + 0x18], ax
call fcn.0040f8c0
add esp, 0xc
cmp edi, esi
je 0x40a5a8
mov eax, 0x41de30
mov dword [esp + 4], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40a505
sub eax, edx
sar eax, 1
je 0x40a52f
push 0x41dd1c
lea edx, [esp + 8]
push 0x41de30
push edx
call fcn.0040ac04
add esp, 0xc
jmp 0x40a56a
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [0x41c0c4]
push 0x41fff4
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.0040a9bd
push 0x41dd1c
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0040ac04
add esp, 0x18
mov eax, dword [esp + 4]
cmp eax, esi
je 0x40a58d
push eax
push 1
push 0x200
push edi
call fcn.0040b59c
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040b3be
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040a982
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040a982
add esp, 0x214
ret

Function at 0x40a5c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.0040f8c0
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x40a6c5
mov eax, 0x41dd3c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a605
sub eax, edx
sar eax, 1
je 0x40a6c5
cmp dword [0x423070], 3
jne 0x40a64c
push 0x104
lea edx, [esp + 0x10]
push edx
call dword [fcn.0041c01c]
push 0x41dc88
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0040a9bd
add esp, 0xc
jmp 0x40a65c
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [0x41c0c4]
push 0x41dd3c
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.0040a9bd
push 0x41dd14
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0040ac04
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x40a6c5
push eax
push 1
push 0x200
push esi
call fcn.0040b32a
mov edx, dword [esp + 0x14]
push edx
call fcn.0040b3be
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040a982
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0040a982
add esp, 0x214
ret
Function at 0x40a6e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.0040f8c0
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x40a7af
mov eax, 0x41fff4
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40a725
sub eax, edx
sar eax, 1
je 0x40a7af
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [0x41c0c4]
push 0x41fff4
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.0040a9bd
push 0x41dd14
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.0040ac04
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x40a7af
push eax
push 1
push 0x200
push esi
call fcn.0040b32a
mov eax, dword [esp + 0x14]
push eax
call fcn.0040b3be
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040a982
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.0040a982
add esp, 0x214
ret
Function at 0x405cc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414ca2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
call fcn.00414058
lea edi, [esi + 0x5c]
mov byte [esp + 0x18], 1
mov ecx, edi
call fcn.00413fd4
lea ecx, [esi + 0x6c]
mov byte [esp + 0x18], 2
call fcn.00407410
lea ecx, [esi + 0xcc]
mov byte [esp + 0x18], 3
call fcn.00407ff0
lea ecx, [esi + 0x114]
mov byte [esp + 0x18], 4
call fcn.00407be0
mov al, byte [esp + 0x34]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov byte [esi + 0x46], al
mov eax, dword [esp + 0x24]
push 0x7fe2
push ebx
mov byte [esp + 0x20], 5
mov dword [esi], 0x417348
mov dword [esi + 0x64], ecx
mov dword [esi + 0x54], edx
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], ebx
call dword [0x4167e0]
lea ecx, [esp + 0x28]
mov dword [esi + 0x68], eax
push ecx
mov ecx, edi
call fcn.00413ff2
push 0x15
mov dword [esi + 0x154], esi
mov dword [esi + 0xc0], esi
mov dword [esi + 0x10c], esi
call dword [0x416750]
mov dl, byte [esp + 0x30]
or edi, 0xffffffff
push 8
mov dword [esi + 0x50], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x4c], dl
mov byte [esi + 0x160], 1
mov dword [esi + 0x48], edi
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], 1
call dword [0x416764]
lea ecx, [esp + 0x28]
mov dword [esi + 0x164], eax
mov dword [esp + 0x18], edi
call fcn.00413fc8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x405cd7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x414ca2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
call fcn.00414058
lea edi, [esi + 0x5c]
mov byte [esp + 0x18], 1
mov ecx, edi
call fcn.00413fd4
lea ecx, [esi + 0x6c]
mov byte [esp + 0x18], 2
call fcn.00407410
lea ecx, [esi + 0xcc]
mov byte [esp + 0x18], 3
call fcn.00407ff0
lea ecx, [esi + 0x114]
mov byte [esp + 0x18], 4
call fcn.00407be0
mov al, byte [esp + 0x34]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov byte [esi + 0x46], al
mov eax, dword [esp + 0x24]
push 0x7fe2
push ebx
mov byte [esp + 0x20], 5
mov dword [esi], 0x417348
mov dword [esi + 0x64], ecx
mov dword [esi + 0x54], edx
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], ebx
call dword [0x4167e0]
lea ecx, [esp + 0x28]
mov dword [esi + 0x68], eax
push ecx
mov ecx, edi
call fcn.00413ff2
push 0x15
mov dword [esi + 0x154], esi
mov dword [esi + 0xc0], esi
mov dword [esi + 0x10c], esi
call dword [0x416750]
mov dl, byte [esp + 0x30]
or edi, 0xffffffff
push 8
mov dword [esi + 0x50], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x4c], dl
mov byte [esi + 0x160], 1
mov dword [esi + 0x48], edi
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], 1
call dword [0x416764]
lea ecx, [esp + 0x28]
mov dword [esi + 0x164], eax
mov dword [esp + 0x18], edi
call fcn.00413fc8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x414dda
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx], ecx
inc edi
add ebx, 4
or edi, eax
add edi, 0xb6ef7b62
add edi, esi
cmp ebx, edx
jne fcn.00414dda
sub edi, 0x6c64459
ret
Function at 0x402d85
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x405533], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.Magnetick
push str.Charge_Window_App
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402dcc
xor eax, eax
jmp 0x402de3
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
leave
ret

Function at 0x403202
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404488
push 0x403364
push eax
mov eax, dword [0x4055b0]
mov dword fs:[0], esp
mov ecx, dword [sym.imp.CRTDLL.dll__fmode_dll]
sub esp, 0x6c
mov dword [ecx], eax
mov edx, dword [0x4055ac]
mov eax, dword [sym.imp.CRTDLL.dll__commode_dll]
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [eax], edx
call fcn.0040335a
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
push dword [0x4055a8]
push edx
push eax
lea ecx, [ebp - 0x30]
push ecx
call sub.CRTDLL.dll___GetMainArgs
add esp, 0x10
push 0x4040d0
push 0x4040cc
call sub.CRTDLL.dll__initterm
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.CRTDLL.dll__acmdln_dll]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x40329d
mov al, byte [ebp - 0x34]
inc esi
mov al, byte [esi]
test al, al
je 0x403295
cmp al, 0x22
jne 0x40328a
cmp byte [esi], 0x22
jne 0x4032a7
inc esi
jmp 0x4032a7
cmp al, 0x20
jbe 0x4032a7
inc esi
cmp byte [esi], 0x20
ja 0x4032a1
cmp byte [esi], 0
je 0x4032b7
cmp byte [esi], 0x20
ja 0x4032b7
inc esi
cmp byte [esi], 0
jne 0x4032ac
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x50], 1
mov eax, 0xa
je 0x4032d7
movzx eax, word [ebp - 0x4c]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call sub.CRTDLL.dll_exit
jmp 0x403313
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret