joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46259a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
mov edx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x4626e0
mov eax, 0x83e0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x4626bb
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x462603
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x4625da
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x4626e9
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x462833
mov edx, 0xf0f0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x46280e
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x462752
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x462729
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x46283c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x105c]
push edi
mov edi, dword [edx + 0x1050]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x462972
push ebx
mov edx, dword [edx + 0x1058]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x46294d
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0x1c
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 8]
mov ecx, eax
and ecx, 0xffff00e3
mov ebx, ebp
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00e3
shr edx, 2
lea ecx, [ecx + ebx + 0x42]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xe3
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0x1c
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x42]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x46289b
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1050]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1050]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x462877
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x462a16
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1050]
push edi
mov edi, dword [edx + 0x105c]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x462b5a
push ebx
push esi
mov esi, 0xff1c
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1058]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x462b34
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xe3
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 0x42]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x208]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x208]
shr eax, 2
and edx, 0xffff00e3
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x462a7f
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1050]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1050]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x462a56
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x462c83
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1050]
push edi
mov edi, dword [edx + 0x105c]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x462dc7
push ebx
push esi
mov esi, 0xff00
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1058]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x462da1
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xff
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 2]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x200]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x200]
shr eax, 2
and edx, 0xffff00ff
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x462cec
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1050]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1050]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x462cc3
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x462dcf
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x105c]
push edi
mov edi, dword [edx + 0x1050]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x462f05
push ebx
mov edx, dword [edx + 0x1058]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x462ee0
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0xf
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 2]
mov ecx, eax
and ecx, 0xffff00f0
mov ebx, ebp
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00f0
shr edx, 2
lea ecx, [ecx + ebx + 0x20]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xf0
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0xf
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x20]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x462e2e
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1050]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1050]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x462e0a
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret

Function at 0x46dcbd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x46dd15
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x46dd15
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x46dd15
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x46dd3e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x46ddac
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46dda3
cmp dword [ebp - 0xc], 4
jne 0x46dda3
cmp dword [ebp - 0x10], edi
je 0x46dda3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x4a4e34], edi
xor eax, eax
jmp 0x46ddd4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4a4e34], edi
jge 0x46ddcf
mov dword [0x4a4e34], edi
call fcn.0046dd19
test eax, eax
je 0x46ddcf
emms
mov dword [0x4a4e34], 1
mov eax, dword [0x4a4e34]
pop edi
leave
ret

Function at 0x46deb4
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x46deeb
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x46df0d
cmp dword [ebp - 0x20], 4
ja 0x46df17
jne 0x46df07
cmp dword [ebp - 0x1c], 0xa
jb 0x46df07
cmp word [ebp - 0x18], 0x55d
jae 0x46df17
mov byte [ebp + 0x73], 1
jmp 0x46df17
cmp dword [ebp - 0x14], 2
jne 0x46df2d
test bl, bl
je 0x46df48
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x46df38
dec eax
je 0x46df31
sub eax, 3
jne 0x46df2d
cmp byte [ebp + 0x73], 0
je 0x46df59
xor eax, eax
jmp 0x46df61
call fcn.0046ddd7
jmp 0x46df61
cmp byte [ebp + 0x73], 0
jne 0x46df2d
call fcn.0046de0f
and eax, 4
jmp 0x46df61
cmp dword [ebp + 0x7c], 0xa
je 0x46df59
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x46df61
call fcn.0046de0f
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x47bad0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x47bb70
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x47bb22
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4a79e4]
xor eax, edx
inc esi
cmp esi, edi
jl 0x47bb03
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x47bb4b
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4a79e4]
xor eax, edx
inc esi
cmp esi, edi
jl 0x47bb2e
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x490179
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x490199
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00490ceb
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4901ba
test byte [esp + 8], 2
je 0x4901ba
mov dword [0x5fd248], 0xd
mov dword [0x5fd24c], 5
jmp 0x490195
xor eax, eax
ret
Function at 0x4014f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov ebx, dword [esp + 0x1c]
mov eax, dword [sym.imp.libLLVM_17.dll_vtable_for_llvm::cl::Option]
add eax, 8
mov dword [ecx], eax
mov word [ecx + 4], 0
movzx eax, word [ecx + 6]
and eax, 0xffff8000
or eax, 1
mov word [ecx + 6], ax
lea ebp, [ecx + 0x30]
xorps xmm0, xmm0
movups xmmword [ecx + 8], xmm0
movups xmmword [ecx + 0x14], xmm0
mov dword [ecx + 0x24], ebp
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 1
lea eax, [ecx + 0x48]
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], 1
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
call fcn.0040dcb2
mov edi, eax
mov ecx, dword [esi + 0x28]
lea eax, [ecx + 1]
cmp eax, dword [esi + 0x2c]
ja 0x40160a
mov eax, dword [esi + 0x24]
mov dword [eax + ecx*4], edi
inc dword [esi + 0x28]
xorps xmm0, xmm0
movups xmmword [esi + 0x4c], xmm0
movups xmmword [esi + 0x55], xmm0
mov dword [esi], 0x40ee84
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov eax, dword [sym.imp.libLLVM_17.dll_vtable_for_llvm::cl::parser_unsigned_int_]
add eax, 8
mov dword [esi + 0x74], eax
lea eax, [esi + 0x78]
mov dword [esi + 0x78], 0x40f53c
mov dword [esi + 0x88], eax
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
mov dword [esp], ebx
mov dword [esp + 4], eax
sub esp, 8
movsd xmm0, qword [esp + 8]
movsd qword [esp], xmm0
mov ecx, esi
call fcn.0040dce2
mov eax, dword [esp + 0x20]
movsd xmm0, qword [eax]
movsd qword [esi + 0x14], xmm0
mov ecx, esi
mov eax, dword [esp + 0x24]
push dword [eax]
call fcn.0040dcca
mov ecx, esi
call fcn.0040dcc4
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea ecx, [esi + 0x24]
push 4
push eax
push ebp
call fcn.0040dc7c
mov ecx, dword [esi + 0x28]
jmp 0x401570
Function at 0x401820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov ebx, dword [esp + 0x1c]
mov eax, dword [sym.imp.libLLVM_17.dll_vtable_for_llvm::cl::Option]
add eax, 8
mov dword [ecx], eax
mov word [ecx + 4], 0
movzx eax, word [ecx + 6]
and eax, 0xffff8000
or eax, 1
mov word [ecx + 6], ax
lea ebp, [ecx + 0x30]
xorps xmm0, xmm0
movups xmmword [ecx + 8], xmm0
movups xmmword [ecx + 0x14], xmm0
mov dword [ecx + 0x24], ebp
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 1
lea eax, [ecx + 0x48]
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], 1
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
call fcn.0040dcb2
mov edi, eax
mov ecx, dword [esi + 0x28]
lea eax, [ecx + 1]
cmp eax, dword [esi + 0x2c]
ja 0x40193a
mov eax, dword [esi + 0x24]
mov dword [eax + ecx*4], edi
inc dword [esi + 0x28]
xorps xmm0, xmm0
movups xmmword [esi + 0x4c], xmm0
movups xmmword [esi + 0x55], xmm0
mov dword [esi], 0x40ef90
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov eax, dword [sym.imp.libLLVM_17.dll_vtable_for_llvm::cl::parser_std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char_____]
add eax, 8
mov dword [esi + 0x74], eax
lea eax, [esi + 0x78]
mov dword [esi + 0x78], 0x40f560
mov dword [esi + 0x88], eax
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
mov dword [esp], ebx
mov dword [esp + 4], eax
sub esp, 8
movsd xmm0, qword [esp + 8]
movsd qword [esp], xmm0
mov ecx, esi
call fcn.0040dce2
mov eax, dword [esp + 0x20]
movsd xmm0, qword [eax]
movsd qword [esi + 0x14], xmm0
mov ecx, esi
mov eax, dword [esp + 0x24]
push dword [eax]
call fcn.0040dcca
mov ecx, esi
call fcn.0040dcc4
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea ecx, [esi + 0x24]
push 4
push eax
push ebp
call fcn.0040dc7c
mov ecx, dword [esi + 0x28]
jmp 0x4018a0
Function at 0x403ad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [esp + 0x14]
mov eax, dword [sym.imp.libLLVM_17.dll_vtable_for_llvm::cl::Option]
add eax, 8
mov dword [ecx], eax
mov word [ecx + 4], 0
movzx eax, word [ecx + 6]
and eax, 0xffff8000
or eax, 1
mov word [ecx + 6], ax
lea ebp, [ecx + 0x30]
xorps xmm0, xmm0
movups xmmword [ecx + 8], xmm0
movups xmmword [ecx + 0x14], xmm0
mov dword [ecx + 0x24], ebp
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 1
lea eax, [ecx + 0x48]
mov dword [ecx + 0x34], eax
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], 1
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
call fcn.0040dcb2
mov edi, eax
mov ecx, dword [esi + 0x28]
lea eax, [ecx + 1]
cmp eax, dword [esi + 0x2c]
ja 0x403bd7
mov eax, dword [esi + 0x24]
mov dword [eax + ecx*4], edi
inc dword [esi + 0x28]
xorps xmm0, xmm0
movups xmmword [esi + 0x4c], xmm0
movups xmmword [esi + 0x55], xmm0
mov dword [esi], 0x40ef90
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov eax, dword [sym.imp.libLLVM_17.dll_vtable_for_llvm::cl::parser_std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char_____]
add eax, 8
mov dword [esi + 0x74], eax
lea eax, [esi + 0x78]
mov dword [esi + 0x78], 0x40f560
mov dword [esi + 0x88], eax
mov eax, dword [ebx]
movzx ecx, word [esi + 6]
and eax, 3
shl eax, 7
and ecx, 0xfffffe7f
or ecx, eax
mov word [esi + 6], cx
mov eax, dword [esp + 0x18]
movsd xmm0, qword [eax]
movsd qword [esi + 0x14], xmm0
mov ecx, esi
mov eax, dword [esp + 0x1c]
push dword [eax]
call fcn.0040dcca
mov ecx, esi
call fcn.0040dcc4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea ecx, [esi + 0x24]
push 4
push eax
push ebp
call fcn.0040dc7c
mov ecx, dword [esi + 0x28]
jmp 0x403b4d
Function at 0x408700
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
cmp dword [ecx + 0x40], 0
je 0x40889e
mov esi, ecx
mov ecx, dword [ecx + 0x44]
test ecx, ecx
je 0x4088b0
mov dword [esp], 0
mov eax, dword [esi + 0x54]
test al, 0x10
jne 0x408757
test al, 8
je 0x4088a5
mov eax, dword [esi + 0x4c]
mov dword [esp + 4], eax
cmp byte [esi + 0x5a], 0
je 0x4087e0
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, ecx
sar eax, 0x1f
xor ebx, ebx
jmp 0x40884c
mov eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x14]
je 0x408771
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0x34]
cmp eax, 0xffffffff
je 0x408865
lea ebp, [esi + 0x48]
nop word cs:[eax + eax]
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x34]
add edx, eax
mov edi, dword [ecx]
lea ebx, [esp + 8]
push ebx
push edx
push eax
push ebp
call dword [edi + 0x14]
mov ebx, eax
mov edi, dword [esp + 8]
mov eax, dword [esi + 0x20]
sub edi, eax
push dword [esi + 0x40]
push edi
push 1
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp eax, edi
jne 0x408865
cmp ebx, 1
je 0x408780
cmp ebx, 2
je 0x408865
push dword [esi + 0x40]
call sub.msvcrt.dll_fflush
add esp, 4
test eax, eax
jne 0x408865
jmp 0x4088a5
mov eax, dword [ecx]
call dword [eax + 0x18]
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
sub edi, edx
test eax, eax
jle 0x40880c
mov edx, edi
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
sar edx, 0x1f
imul ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, edi
adc eax, edx
xor ebx, ebx
jmp 0x40884c
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x408843
mov ebx, edi
sar ebx, 0x1f
mov ecx, dword [esi + 0x44]
sub eax, dword [esi + 8]
mov ebp, dword [ecx]
push eax
push edx
push dword [esi + 0x20]
lea eax, [esp + 0x10]
push eax
call dword [ebp + 0x20]
add eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
sub ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, edi
adc eax, ebx
mov bl, 1
jmp 0x40884c
mov eax, edi
sar eax, 0x1f
xor ebx, ebx
mov ecx, edi
xor edx, edx
neg ecx
sbb edx, eax
push 1
push edx
push ecx
push dword [esi + 0x40]
call fcn.0040d440
add esp, 0x10
test eax, eax
je 0x40886e
mov dword [esp], 0xffffffff
jmp 0x4088a5
test bl, bl
je 0x408879
mov eax, dword [esp + 4]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x54], 0
mov dword [esp], 0
mov eax, dword [esp]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00408cd0
int3