joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cbe4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x46cda9
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x46cc1c
mov byte [ebp - 9], 0
jmp 0x46cd81
mov byte [ebp - 9], 1
mov dl, 1
mov eax, dword [0x416d2c]
call fcn.00403cc4
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x46cd3f
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0046c90c
lea eax, [ebp - 0x24]
mov ecx, 0x46cdc0
mov edx, dword [ebp - 0x14]
call fcn.00404da8
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov edx, 0x3f
call fcn.0046c950
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x46cd29
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
push dword [ebp - 0x14]
push 0x46cdd0
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x28]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404e1c
mov bl, 1
mov eax, dword [ebp - 0x18]
call fcn.00404f5c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x46ccd4
test al, 0x10
je 0x46ccd4
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 1]
mov eax, dword [ebp - 0x18]
call fcn.0046cbe4
mov ebx, eax
jmp 0x46cd0f
cmp dword [ebp - 8], 0
je 0x46cce4
mov edx, eax
mov eax, dword [ebp - 0x18]
call dword [ebp - 8]
mov ebx, eax
test bl, bl
je 0x46cd0f
push 0x80
mov eax, dword [ebp - 0x18]
call fcn.00404f5c
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x46cd0f
mov eax, dword [ebp - 0x18]
call fcn.00409958
mov ebx, eax
test bl, bl
jne 0x46cd1d
mov byte [ebp - 9], 0
cmp byte [ebp - 1], 0
jne 0x46cd29
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x46cc83
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cd46
lea eax, [ebp - 0x10]
call fcn.0040ea5c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cdb0
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404ac0
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404ac0
ret
Function at 0x46cf18
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x46cfce
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404f5c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x46cfb8
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.004050e8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404f5c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46cfb8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x46cfe0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46cfb8
cmp dword [ebp - 8], 0x34
jne 0x46cfb8
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cfd5
lea eax, [ebp - 0x10]
call fcn.00404a9c
ret

Function at 0x4767f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47681e
mov eax, ebx
call fcn.004772a4
cmp dword [ebx + 0x40], 0
je 0x476817
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47688f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x476881
cmp dword [ebx + 8], 0
je 0x476840
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x476852
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x476881
cmp dword [ebx + 8], 0
je 0x476833
cmp eax, 3
je 0x476865
dec eax
jne 0x476833
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x476833
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x476833
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4768ad
cmp dword [ebx + 0x14], 0xcc
je 0x4768ad
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004768b8
pop ebx
ret
Function at 0x4891c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4891cc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4894ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x39c], 0
je 0x489203
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov dl, 1
call fcn.0043d238
mov eax, dword [ebp - 4]
cmp byte [eax + 0x39d], 0
je 0x48921f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov dl, 1
call fcn.0043d238
mov eax, dword [0x48f808]
mov eax, dword [eax]
call fcn.0045cf24
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.0043d318
mov dl, 1
mov eax, dword [0x416d2c]
call fcn.00403cc4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x489313
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x364]
call fcn.00404f5c
mov ecx, eax
mov edx, 0x4894fc
mov eax, 0x4894fc
call fcn.00418afc
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4892fd
inc ebx
xor esi, esi
lea ecx, [ebp - 0xc]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov al, byte [0x48951c]
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x489528
mov eax, dword [ebp - 0xc]
call fcn.0040e348
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00404b34
push 1
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004099f8
mov eax, dword [ebp - 0x18]
call fcn.00404f5c
push eax
push 0x489538
mov eax, dword [ebp - 0xc]
call fcn.00404f5c
push eax
push 0x48953c
mov eax, dword [0x48f808]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
inc esi
dec ebx
jne 0x48928e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48931a
mov eax, dword [ebp - 0x10]
call fcn.00403cf4
ret
Function at 0x402818
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402826
call dword [0x589024]
or eax, eax
je 0x402827
ret
mov al, 1
jmp fcn.004028a4

Function at 0x402830
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40283e
call dword [0x589028]
or eax, eax
jne 0x40283f
ret
mov al, 2
jmp fcn.004028a4

Function at 0x402848
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402880
test edx, edx
je 0x40286a
push eax
mov eax, ecx
call dword [0x58902c]
pop ecx
or eax, eax
je 0x402879
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.004028a4
mov dword [eax], edx
mov eax, ecx
call dword [0x589028]
or eax, eax
jne 0x402863
ret
mov al, 1
jmp fcn.004028a4
test edx, edx
je 0x402894
push eax
mov eax, edx
call dword [0x589024]
pop ecx
or eax, eax
je 0x402879
mov dword [ecx], eax
ret

Function at 0x4028a4
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x58d004]
test ecx, ecx
je 0x4028b4
pop edx
call ecx
dec eax
mov al, byte [eax + 0x4028cd]
jns 0x4028c8
call fcn.00407a80
mov eax, dword [eax + 4]
jmp fcn.00403dd8

Function at 0x4028e8
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push ecx
call fcn.00407a80
cmp dword [eax + 4], 0
pop ecx
pop edx
pop eax
jne 0x4028fd
ret
xor eax, eax
jmp fcn.004028a4

Function at 0x402a54
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402a83
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403ecc
jmp 0x402aa1
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.004029dc
mov edi, eax
test ebx, ebx
je 0x402aa1
cmp dword [esi], 0
je 0x402aa1
dec ebx
jmp 0x402a8a
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402eb4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402f4c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402f2c
xor eax, eax
push ebp
push 0x402f25
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402f68
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402f2c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x4031d0
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4031ea
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x4031ea
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x4031d6
mov al, 0xa
jmp fcn.004028a4
ret
Function at 0x40321c
Capabilities:
Terminate process

Disassembly:
cmp dword [0x58d01c], 0
je 0x402b13
call dword [0x58d01c]
mov eax, 0xd2
jmp fcn.00403dd8
push eax
push ecx
mov eax, dword [eax]
call fcn.004031ec
pop ecx
pop eax
je 0x40322b
jmp ebx
pop ecx
jmp 0x402b04

Function at 0x403234
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.004031ec
mov eax, ebx
pop ebx
jne 0x403249
pop ecx
jmp 0x402b04
ret

Function at 0x404450
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.004028a4
test edx, edx
je fcn.00404414
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00404414
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x4043fc
ret

Function at 0x4044f8
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
je fcn.00404414
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x4043fc
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x40454c
Capabilities:
Terminate process

Disassembly:
xor ecx, ecx
test edx, edx
je 0x40457f
push edx
cmp cx, word [edx]
je 0x404578
cmp cx, word [edx + 2]
je 0x404575
cmp cx, word [edx + 4]
je 0x404572
cmp cx, word [edx + 6]
je 0x40456f
add edx, 8
jmp 0x404553
add edx, 2
add edx, 2
add edx, 2
mov ecx, edx
pop edx
sub ecx, edx
shr ecx, 1
jmp fcn.004044f8

Function at 0x404744
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x404758
push eax
push 0
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x4043fc
ret

Function at 0x40483c
Capabilities:
Terminate process

Disassembly:
mov edx, dword [eax]
test edx, edx
je 0x40485a
push eax
mov ecx, dword [edx - 4]
shr ecx, 1
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
pop edx
test eax, eax
je 0x4043fc
mov dword [edx], eax
ret

Function at 0x404888
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x4048c7
cmp al, 0xb
je 0x4048c7
cmp al, 0xc
je 0x4048d1
cmp al, 0xd
je 0x4048e4
cmp al, 0xe
je 0x404902
cmp al, 0xf
je 0x4048c7
cmp al, 0x11
je 0x4048c7
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.004028a4
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x4048c7
jmp 0x404916
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4048d1
jmp 0x404916
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404888
dec edi
jg 0x4048e7
pop ebp
jmp 0x404916
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.0040485c
dec edi
jg 0x404905
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40491c
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404888
Function at 0x404954
Capabilities:
Terminate process

Disassembly:
cmp ecx, 0
je 0x404a3a
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x4049a4
cmp al, 0xb
je 0x4049be
cmp al, 0xc
je 0x4049d5
cmp al, 0xd
je 0x4049e4
cmp al, 0xe
je 0x404a02
cmp al, 0xf
je 0x404a18
cmp al, 0x11
je 0x404a27
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.004028a4
cmp ecx, 1
mov eax, ebx
jg 0x4049b5
call fcn.00403de4
jmp 0x404a36
mov edx, ecx
call fcn.00403e08
jmp 0x404a36
cmp ecx, 1
mov eax, ebx
jg 0x4049cc
call fcn.00404414
jmp 0x404a36
mov edx, ecx
call fcn.0040442c
jmp 0x404a36
mov eax, ebx
add ebx, 0x10
call fcn.00405c14
dec edi
jg 0x4049d5
jmp 0x404a36
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404954
dec edi
jg 0x4049e7
pop ebp
jmp 0x404a36
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404928
dec edi
jg 0x404a05
pop ebp
jmp 0x404a36
mov eax, ebx
add ebx, 4
call fcn.00406b7c
dec edi
jg 0x404a18
jmp 0x404a36
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.0040653c
dec edi
jg 0x404a27
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x404a3c
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404954

Function at 0x404a48
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x404a74
mov edx, eax
add eax, esi
add edx, ebx
call fcn.0040299c
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x404ab3
cmp cl, 0xb
je 0x404ac4
cmp cl, 0xc
je 0x404ad5
cmp cl, 0xd
je 0x404ae6
cmp cl, 0xe
je 0x404b06
cmp cl, 0xf
je 0x404b1f
cmp cl, 0x11
je 0x404b30
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.004028a4
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403e38
mov eax, 4
jmp 0x404b41
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404450
mov eax, 4
jmp 0x404b41
lea edx, [esi + eax]
add eax, ebx
call fcn.00404e14
mov eax, 0x10
jmp 0x404b41
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.00404b64
pop eax
jmp 0x404b41
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.00404a48
pop eax
jmp 0x404b41
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00406b94
mov eax, 4
jmp 0x404b41
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00406578
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x404a62
pop ecx
sub ecx, eax
jle 0x404b5d
lea edx, [ebx + eax]
add eax, esi
call fcn.0040299c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x404b64
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x404baa
cmp cl, 0xb
je 0x404bc1
cmp cl, 0xc
je 0x404bd5
cmp cl, 0xd
je 0x404be9
cmp cl, 0xe
je 0x404c0a
cmp cl, 0xf
je 0x404c27
cmp cl, 0x11
je 0x404c3b
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.004028a4
mov eax, ebx
mov edx, dword [esi]
call fcn.00403e38
add ebx, 4
add esi, 4
dec ebp
jne 0x404baa
jmp 0x404c4f
mov eax, ebx
mov edx, dword [esi]
call fcn.00404450
add ebx, 4
add esi, 4
dec ebp
jne 0x404bc1
jmp 0x404c4f
mov eax, ebx
mov edx, esi
call fcn.00404e14
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x404bd5
jmp 0x404c4f
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.00404b64
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x404bf2
jmp 0x404c4f
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.00404a48
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x404c0a
jmp 0x404c4f
mov eax, ebx
mov edx, dword [esi]
call fcn.00406b94
add ebx, 4
add esi, 4
dec ebp
jne 0x404c27
jmp 0x404c4f
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00406578
add ebx, 4
add esi, 4
dec ebp
jne 0x404c3b
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x404e14
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.004028a4
cmp eax, edx
je 0x404eac
cmp word [eax], 8
jb 0x404e4c
push eax
push edx
cmp word [eax], 0x100
je 0x404e42
cmp word [eax], 0x101
je 0x404e3a
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x404e4a
call dword [0x58d3e8]
jmp 0x404e4a
add eax, 8
call fcn.00403de4
pop edx
pop eax
cmp word [edx], 8
jae 0x404e63
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x404e7e
cmp word [edx], 0x101
jne 0x404e98
push eax
call 0x404e52
pop eax
jmp dword [0x58d3f0]
mov edx, dword [edx + 8]
or edx, edx
je 0x404e8f
mov ecx, dword [edx - 8]
inc ecx
jle 0x404e8f
lock inc dword [edx - 8]
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x404dc8
ret

Function at 0x4052b0
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 8
jne 0x4052be
mov edx, dword [edx + 8]
jmp fcn.00404450
push ebx
mov ebx, eax
sub esp, 0x10
mov word [esp], 0
mov eax, esp
mov ecx, 8
call fcn.00405028
mov eax, ebx
mov edx, dword [esp + 8]
call fcn.00404404
add esp, 0x10
pop ebx
ret

Function at 0x405358
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 0
je fcn.00406b7c
cmp word [edx], 0xd
je 0x4053a3
cmp word [edx], 9
je 0x4053a3
cmp word [edx], 0x400d
je 0x405399
cmp word [edx], 0x4009
je 0x405399
cmp word [edx], 0x101
jne fcn.00404dc0
jmp fcn.004052e8
mov edx, dword [edx + 8]
mov edx, dword [edx]
jmp fcn.00406b94
mov edx, dword [edx + 8]
jmp fcn.00406b94
Function at 0x4053ac
Capabilities:
Terminate process

Disassembly:
cmp word [edx], 0
je fcn.00406b7c
cmp word [edx], 9
je 0x4053d1
cmp word [edx], 0x4009
jne fcn.00404dc0
mov edx, dword [edx + 8]
mov edx, dword [edx]
jmp fcn.00406b94
mov edx, dword [edx + 8]
jmp fcn.00406b94

Function at 0x4054ec
Capabilities:
Terminate process

Disassembly:
push eax
cmp word [eax], 8
jb 0x4054fa
push edx
call fcn.00404dd0
pop edx
xor eax, eax
test edx, edx
je 0x405516
mov eax, dword [edx - 4]
shr eax, 1
je 0x405516
push eax
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x4043fc
pop edx
mov word [edx], 8
mov dword [edx + 8], eax
ret

Function at 0x4055f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
lea eax, [ebp - 0x10]
call fcn.00405c1c
xor eax, eax
push ebp
push 0x4055e2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call dword [0x58d3ec]
mov eax, ebx
lea edx, [ebp - 0x10]
call fcn.004055f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4055e9
lea eax, [ebp - 0x10]
call fcn.00405c14
ret
cmp word [edx], 0x101
je 0x40558c
cmp word [edx], 0x100
jne fcn.00404e14
cmp word [eax], 8
jb 0x405615
push eax
push edx
call fcn.00404dd0
pop edx
pop eax
mov word [eax], 8
add eax, 8
add edx, 8
xor ecx, ecx
mov edx, dword [edx]
mov dword [eax], ecx
jmp fcn.00404588

Function at 0x405764
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov esi, edx
mov ebx, ecx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x40578d
cmp eax, 0x100
jne 0x4057c0
mov eax, 8
cmp edx, 0x11
jbe 0x40579f
cmp edx, 0x100
jne 0x4057be
mov edx, 8
mov al, byte [eax + 0x58906c]
mov dl, byte [edx + 0x58906c]
movzx ecx, byte [edx + eax*8 + 0x589080]
call dword [ecx*4 + 0x4057cf]
pop edi
pop esi
pop ebx
ret
mov eax, edx
cmp eax, 0x101
jne 0x4057f0
pop edi
pop esi
pop ebx
jmp fcn.004056e0
pop edi
pop esi
pop ebx
jmp 0x404dc8

Function at 0x4059c4
Capabilities:
Terminate process

Disassembly:
mov ecx, 0
jmp fcn.00405764
Function at 0x405b04
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov esi, edx
mov eax, dword [edi]
mov edx, dword [esi]
and eax, 0xfff
and edx, 0xfff
cmp eax, 0x11
jbe 0x405b2a
cmp eax, 0x100
jne 0x405b59
mov eax, 8
cmp edx, 0x11
jbe 0x405b3c
cmp edx, 0x100
jne case.default.0x405b50
mov edx, 8
mov al, byte [eax + 0x58906c]
mov dl, byte [edx + 0x58906c]
movzx ecx, byte [edx + eax*8 + 0x589080]
jmp dword [ecx*4 + 0x405b6b]
mov eax, edx
cmp eax, 0x101
jne case.0x405b50.0
pop edi
pop esi
call fcn.00405a68
push eax
popf
ret
pop edi
pop esi
jmp 0x404dc8
cmp al, dl
pop edi
pop esi
ret
mov eax, esi
call fcn.0040511c
xchg edi, eax
call fcn.0040511c
cmp eax, edi
pop edi
pop esi
ret
mov eax, edi
call fcn.004051bc
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.004051bc
fld xword [esp]
add esp, 0xc
fcompp
fnstsw ax
mov al, ah
and ax, 0x4001
ror al, 1
or ah, al
sahf
pop edi
pop esi
ret
mov eax, edi
call fcn.00405218
sub esp, 0xc
fstp xword [esp]
mov eax, esi
call fcn.00405218
fld xword [esp]
add esp, 0xc
jmp 0x405bc3
mov eax, edi
mov edx, esi
call fcn.00405a00
cmp eax, 0
pop edi
pop esi
ret
mov eax, esi
call fcn.00405188
xchg edi, eax
call fcn.00405188
mov edx, edi
cmp al, dl
pop edi
pop esi
ret