joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4151c0
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041a6da
or ecx, ecx
je 0x415296
mov ebx, esi
mov edx, 3
mov al, byte [ebx]
cmp al, 0x22
jne 0x4151f7
inc ebx
dec ecx
je 0x415214
cmp byte [ebx], 0x22
jne 0x4151e9
inc ebx
loop 0x4151e3
jmp 0x415214
cmp al, 0x5c
jne 0x415204
inc ebx
dec ecx
je 0x415214
inc ebx
loop 0x4151e3
jmp 0x415214
cmp al, 0x3b
je 0x41520d
inc ebx
loop 0x4151e3
jmp 0x415214
push ebx
dec edx
je 0x415218
inc ebx
loop 0x4151e3
push ebx
dec edx
jne 0x415214
pop edx
pop ecx
pop ebx
ftst
wait
fnstsw ax
sahf
jb 0x415238
jne 0x415234
cmp ecx, edx
je 0x415234
inc ecx
cmp ecx, edx
je 0x415234
mov eax, edx
mov esi, ecx
jmp 0x415247
mov eax, ebx
jmp 0x415247
cmp ebx, ecx
je 0x415234
inc ebx
cmp ebx, edx
je 0x415234
mov eax, ecx
mov esi, ebx
fchs
cmp eax, esi
jbe 0x415296
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x415250
push esp
push esi
push esi
push eax
mov ecx, eax
sub ecx, esi
call fcn.004152be
call fcn.0041da96
pop ecx
mov esi, esp
push ecx
call fcn.0041d599
jb 0x415284
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
mov edx, eax
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.00413e01
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x41529b
mov esi, esp
call fcn.0041d782
call fcn.0041da96
dec edx
cmp byte [esi], 0x20
jne 0x4152ba
dec edx
inc esi
mov ecx, edx
jmp 0x415271

Function at 0x416019
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.0041a6da
jecxz 0x41605b
call fcn.0041a67e
jb 0x4160a7
cld
test eax, eax
je 0x416046
lodsb al, byte [esi]
call fcn.00416172
stosb byte es:[edi], al
loop 0x416039
mov esi, edx
jmp 0x416053
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharLowerBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.0041a6b2
pop ebp
pop edi
pop esi
pop ecx
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
jmp fcn.00413e01

Function at 0x416060
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.0041a6da
jecxz 0x4160a2
call fcn.0041a67e
jb 0x4160a7
cld
test eax, eax
je 0x41608d
lodsb al, byte [esi]
call fcn.004161ae
stosb byte es:[edi], al
loop 0x416080
mov esi, edx
jmp 0x41609a
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharUpperBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.0041a6b2
pop ebp
pop edi
pop esi
pop ecx
ret
Function at 0x416489
Capabilities:
Get socket status
Send data
Send data on socket
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x104
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041a6da
call fcn.0041a790
jb 0x416535
test byte [edi + 0xc], 0x40
je 0x416539
add esp, 0x104
mov ebx, ecx
mov eax, dword [edi + 6]
mov ecx, 0x40
push eax
loop 0x4164c9
push 0x40
mov edx, esp
mov eax, dword [edi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push edx
push 0
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x416526
test eax, eax
je 0x416545
push 0
push ebx
push esi
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_send]
cmp eax, 0xffffffff
je 0x416526
add esi, eax
sub ebx, eax
jg 0x4164ce
and word [edi + 0x2c], 0xfffd
call fcn.0041da96
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x41653d
jmp 0x416541
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0041da96
add esp, 0x104
pop edi
pop esi
jmp fcn.00413e0c
Function at 0x416559
Capabilities:
Get socket status
Receive data
Receive data on socket
Terminate process

Disassembly:
push esi
push edi
mov dword [ebp - 0x6c], 0
sub esp, 0x104
mov ecx, eax
call fcn.0041a67e
mov ebx, ecx
jb 0x4166ca
mov dword [ebp - 0x6c], edi
mov ax, word [ebp - 0x46]
call fcn.0041a752
jb 0x4166b0
test byte [esi + 0xc], 0x40
je 0x4166b4
and word [esi + 0x2c], 0xfff5
add esp, 0x104
mov eax, dword [esi + 6]
mov ecx, 0x40
push eax
loop 0x4165a6
push 0x40
mov ecx, dword [esi + 0x28]
jecxz 0x4165ff
cmp ebx, ecx
ja 0x4165b6
mov ecx, ebx
sub dword [esi + 0x28], ecx
sub ebx, ecx
push esi
push dword [esi + 0x28]
cld
lea edx, [esi + 0x44]
mov esi, edx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop ecx
xchg edi, edx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
pop esi
test dword [esi + 0x28], 0xffffffff
jne 0x416675
test word [esi + 0x2c], 8
je 0x4165ff
or word [esi + 0x2c], 2
jmp 0x416675
test ebx, ebx
je 0x41668c
mov edx, esp
mov eax, dword [esi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push 0
push edx
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x41669d
test eax, eax
jne 0x416640
mov ecx, edi
sub ecx, dword [ebp - 0x6c]
jne 0x416659
jmp 0x4166c0
lea edx, [esi + 0x44]
push 0
push 0x10000
push edx
push dword [esi + 6]
call dword [sym.imp.WSOCK32.DLL_recv]
cmp eax, 0xffffffff
je 0x41669d
mov dword [esi + 0x28], eax
cmp eax, 0x10000
je 0x416668
or word [esi + 0x2c], 8
test eax, eax
jne 0x4165ab
or word [esi + 0x2c], 2
test ebx, ebx
je 0x41668c
push esi
mov ecx, edi
mov esi, dword [ebp - 0x6c]
sub ecx, esi
call fcn.0041a700
pop esi
jb 0x4166cf
mov dword [ebp - 0x6c], edx
mov edx, dword [ebp - 0x6c]
call fcn.0041d552
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x4166b8
jmp 0x4166bc
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
mov esi, dword [ebp - 0x6c]
call fcn.0041a6b2
call fcn.0041d550
add esp, 0x104
pop edi
pop esi
jmp fcn.00413e0c
Function at 0x416b03
Capabilities:
Create udp socket
Get hostname
Initialize winsock library
Set socket configuration
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x228
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], 0
xchg ch, cl
mov ebx, ecx
sub esp, 0x190
push esp
push 2
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
mov cl, byte [esp]
add esp, 0x190
test eax, eax
jne 0x416c91
cmp cl, 2
jne 0x416c91
mov ax, word [ebp - 0x46]
test ax, ax
js 0x416c8d
call fcn.0041a790
jae 0x416c89
mov ecx, 0x10044
call fcn.0041a67e
jb 0x416c93
mov dword [ebp - 0x64], edx
call fcn.0041a7ce
jb 0x416c93
cld
xor eax, eax
mov ecx, 0x20
push edi
add edi, 4
rep stosw word es:[edi], ax
pop edi
mov ax, word [ebp - 0x46]
mov ecx, dword [ebp - 0x6c]
mov word [edi + 4], ax
mov word [edi + 0xa], 2
mov word [edi + 0xc], pe_nt_image_headers32
mov word [edi + 0xe], 0xc0
mov dword [edi + 0x1c], 0x10000
mov dword [edi + 0x30], ebx
mov dword [edi + 0x38], ecx
push 0
push 2
push 2
call dword [sym.imp.WSOCK32.DLL_socket]
cmp eax, 0xffffffff
je 0x416c6d
mov dword [edi + 6], eax
push 0x100
lea eax, [esp + 8]
push eax
call dword [sym.imp.WSOCK32.DLL_gethostname]
test eax, eax
jne 0x416c6d
lea eax, [esp + 3]
lea edx, [eax + 1]
inc eax
test byte [eax], 0xff
jne 0x416be9
sub eax, edx
cmp eax, 0x100
jb 0x416bfd
mov eax, 0x100
mov dword [esp], eax
cmp dword [edi + 0x30], 0xffffffff
je 0x416c28
push 0
push 0
push 0
push word [edi + 0x30]
push 2
mov eax, esp
push 0x10
push eax
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_bind]
add esp, 0x10
test eax, eax
jne 0x416c6d
mov ebx, edi
mov ecx, dword [esp]
call fcn.0041a67e
jb 0x416c93
mov dword [ebx + 0x10], edx
cld
lea esi, [esp + 4]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
mov edx, esp
push 4
push edx
push 0x20
push 0xffff
push dword [ebx + 6]
call dword [sym.imp.WSOCK32.DLL_setsockopt]
pop edx
test eax, eax
jne 0x416c6d
add esp, 0x228
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
jne 0x416c7e
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
push eax
call fcn.004166dc
pop eax
mov dx, 0x37b0
mov al, 0x37
mov dx, 0x34b0
mov al, 0x34
mov dx, 0x44b0
mov al, 0x44
mov edx, dword [ebp - 0x64]
test edx, edx
je 0x416ca8
push eax
mov esi, edx
call fcn.0041a819
call fcn.0041a6b2
pop eax
add esp, 0x228
pop edi
pop esi
jmp fcn.00413e0c
Function at 0x416cb5
Capabilities:
Get socket status
Receive data
Receive data on socket
Terminate process

Disassembly:
push esi
push edi
mov dword [ebp - 0x6c], 0
sub esp, 0x104
mov ax, word [ebp - 0x46]
call fcn.0041a752
jb 0x416dae
test byte [esi + 0xc], 0x80
je 0x416db2
and word [esi + 0x2c], 0xfffd
add esp, 0x104
mov eax, dword [esi + 6]
mov ecx, 0x40
push eax
loop 0x416cf0
push 0x40
mov edx, esp
mov eax, dword [esi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push 0
push edx
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x416d9f
test eax, eax
je 0x416dbe
lea ecx, [esi + 0x34]
lea edx, [esi + 0x44]
push 0
push 0
push dword [esi + 0x34]
push word [esi + 0x30]
push 2
mov ecx, esp
lea edx, [esi + 0x44]
push 0x10
push esp
push ecx
push 0
push 0x10000
push edx
push dword [esi + 6]
call dword [sym.imp.WSOCK32.DLL_recvfrom]
add esp, 4
mov ebx, dword [esp + 4]
movzx ecx, word [esp + 2]
add esp, 0x10
cmp eax, 0xffffffff
je 0x416d9f
test eax, eax
jne 0x416d75
or word [esi + 0x2c], 2
xchg ecx, eax
call fcn.0041a67e
jb 0x416dc0
add esi, 0x44
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041d552
mov ecx, ebx
xchg ah, al
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x416db6
jmp 0x416dba
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0041d550
add esp, 0x104
pop edi
pop esi
jmp fcn.00413e0c

Function at 0x416dd2
Capabilities:
Get socket status
Send data
Send data on socket
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x104
mov ebx, ecx
push eax
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041a6da
call fcn.0041a790
pop eax
jb 0x416e8b
test byte [edi + 0xc], 0x80
je 0x416e8f
xchg ah, al
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ebx
add esp, 0x104
mov ebx, ecx
mov eax, dword [edi + 6]
mov ecx, 0x40
push eax
loop 0x416e1e
push 0x40
mov edx, esp
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.WSOCK32.DLL_select]
cmp eax, 0xffffffff
je 0x416e7c
test eax, eax
je 0x416e9b
push 0
push 0
push dword [edi + 0x34]
push word [edi + 0x30]
push 2
mov ecx, esp
push 0x10
push ecx
push 0
push ebx
push esi
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_sendto]
add esp, 0x10
cmp eax, 0xffffffff
je 0x416e7c
cmp eax, ebx
jb 0x416e97
and word [edi + 0x2c], 0xfffd
call fcn.0041da96
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x416e93
jmp 0x416e97
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0041da96
add esp, 0x104
pop edi
pop esi
jmp fcn.00413e0c
Function at 0x4171ca
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041a6da
test eax, eax
jns 0x4171e3
add eax, ecx
test edx, edx
je 0x417223
jns 0x4171ee
add edx, ecx
js 0x417223
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x4171f7
xor ecx, ecx
cmp ecx, eax
jb 0x4171fd
mov ecx, eax
call fcn.0041a67e
jb 0x417227
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041aeb2
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x417211
pop edi
pop esi
jmp fcn.00413e0c

Function at 0x41722e
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041a6da
test eax, eax
jns 0x417246
add eax, ecx
cmp eax, ecx
jae 0x417272
xchg ecx, eax
call fcn.0041a67e
jb 0x417276
sub eax, ecx
add esi, eax
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041aeb2
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
ret
pop edi
pop esi
pop ecx
jmp fcn.00413e0c

Function at 0x41a334
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, eax
call fcn.0041a67e
jb 0x41a357
mov eax, 0x20202020
cld
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
call fcn.0041d552
pop edi
pop ecx
ret
pop edi
pop ecx
call fcn.0041d550
jmp fcn.00413e0c

Function at 0x41a363
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, 1
call fcn.0041a67e
jb 0x41a357
mov byte [edi], 0x20
call fcn.0041d552
pop edi
pop ecx
ret

Function at 0x41a395
Capabilities:
Terminate process

Disassembly:
push edi
xchg ecx, ebx
call fcn.0041a67e
jb 0x41a3b5
call fcn.0041d552
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
ret
call fcn.0041d550
pop edi
jmp fcn.00413e0c

Function at 0x41a3c0
Capabilities:
Terminate process

Disassembly:
push eax
push esi
push edi
xchg ecx, ebx
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x6c]
call fcn.0041a6ed
mov al, 0
je 0x41a3da
mov al, byte [edi]
call fcn.0041aeb2
call fcn.0041a67e
jb 0x41a3fd
mov dword [ebp + esi - 0x6c], edx
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
pop esi
pop eax
ret
mov dword [ebp + esi - 0x6c], 0
mov edx, eax
pop edi
pop esi
pop eax
jmp fcn.00413e01

Function at 0x41af58
Capabilities:
Terminate process

Disassembly:
call fcn.0041d644
jb 0x41af60
ret
jmp fcn.00413e0c
Function at 0x41afbf
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [0x41f3e0]
mov ecx, eax
jecxz 0x41b019
cld
lodsb al, byte [esi]
test al, al
je 0x41b015
cmp al, 0x20
je 0x41afcd
cmp al, 0x22
je 0x41aff5
lea edi, [esi - 1]
lodsb al, byte [esi]
test al, al
je 0x41afea
cmp al, 0x20
jne 0x41afdd
loop 0x41afcd
jmp 0x41afec
loop 0x41b015
lea ecx, [esi - 1]
mov esi, edi
sub ecx, esi
jmp 0x41b028
mov edi, esi
lodsb al, byte [esi]
test al, al
je 0x41b00a
cmp al, 0x22
jne 0x41aff7
cmp byte [esi - 2], 0x22
je 0x41afcd
loop 0x41afcd
jmp 0x41b00c
loop 0x41b015
lea ecx, [esi - 1]
mov esi, edi
sub ecx, esi
jmp 0x41b028
xor ecx, ecx
jmp 0x41b028
push esi
mov ecx, 0xffffffff
dec esi
inc ecx
inc esi
test byte [esi], 0xff
jne 0x41b020
pop esi
call fcn.0041d599
pop edi
pop esi
pop ecx
jb 0x41b033
ret
jmp fcn.00413e0c

Function at 0x41b0c7
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0041a6ed
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041a6da
jecxz 0x41b0e7
jmp 0x41b0ec
jmp 0x41b181
test eax, eax
je 0x41b10f
jns 0x41b0f5
add eax, edx
inc eax
dec eax
sub edx, eax
jbe 0x41b10f
push eax
add edi, eax
push edi
call fcn.0041b85d
pop eax
pop edx
jae 0x41b10b
test edx, edx
je 0x41b181
mov ecx, edi
jmp 0x41b150
xor edx, edx
jmp 0x41b168
mov esi, eax
sub ecx, eax
call fcn.0041a67e
jb 0x41b188
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041da96
call fcn.0041aeb2
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0041da96
jmp 0x41b17c
call fcn.0041da96
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.00413e01

Function at 0x41b198
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0041a6ed
je 0x41b1dd
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041a6da
je 0x41b1dd
test eax, eax
je 0x41b1dd
jns 0x41b1c1
add eax, edx
inc eax
dec eax
sub edx, eax
jbe 0x41b1dd
add edi, eax
push ecx
call fcn.0041b85d
pop ecx
jb 0x41b1dd
mov esi, edi
sub edx, ecx
add esi, ecx
mov ecx, edx
jecxz 0x41b1dd
jmp 0x41b21b
xor edx, edx
jmp 0x41b22f
call fcn.0041a67e
jb 0x41b248
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041da96
call fcn.0041aeb2
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0041da96
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.00413e01
Function at 0x41b279
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041a6da
je 0x41b2c0
mov al, 0x20
cmp byte [esi], al
je 0x41b29a
jmp 0x41b2c0
cmp byte [esi], al
jne 0x41b29d
inc esi
loop 0x41b296
call fcn.0041a67e
jb 0x41b2c5
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041aeb2
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
pop eax
ret
mov edx, eax
pop edi
pop esi
pop ecx
pop eax
jmp fcn.00413e01

Function at 0x41b2d0
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041a6da
je 0x41b2c0
lea edi, [esi - 1]
add edi, ecx
mov al, 0x20
cmp byte [edi], al
je 0x41b2f6
jmp 0x41b2c0
cmp byte [edi], al
jne 0x41b29d
dec edi
loop 0x41b2f2
jmp 0x41b29d

Function at 0x41b2fb
Capabilities:
Terminate process

Disassembly:
push eax
call fcn.0041b3dd
jb 0x41b355
cmp ecx, edx
ja 0x41b355
mov eax, esi
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x41b31d
mov eax, esi
sub edx, ebx
jl 0x41b31d
mov ecx, ebx
mov edi, ebp
jmp 0x41b30d
or edx, edx
jns 0x41b323
xor edx, edx
mov esi, eax
mov ecx, edx
pop ebp
call fcn.0041a67e
jb 0x41b35d
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041da96
call fcn.0041aeb2
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
pop ebp
call fcn.0041da96
jmp 0x41b34f
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.00413e01

Function at 0x41b369
Capabilities:
Terminate process

Disassembly:
push eax
call fcn.0041b3dd
jb 0x41b355
cmp ecx, edx
ja 0x41b355
mov eax, esi
add esi, edx
sub esi, ecx
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x41b31d
sub esi, ebx
sub esi, ebx
sub edx, ebx
jl 0x41b31d
mov ecx, ebx
mov edi, ebp
jmp 0x41b37f
Function at 0x41b407
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0041a6ed
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edx
push dword [ebp + esi - 0x6c]
mov esi, dword [ebp + esi - 0x64]
call fcn.0041a6da
pop edi
call fcn.0041a6ed
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x64], edx
jecxz 0x41b43b
jne 0x41b48e
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
call fcn.0041a67e
jb 0x41b473
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041da96
call fcn.0041da96
call fcn.0041aeb2
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
ret
mov al, 5
pop edi
pop esi
call fcn.0041da96
call fcn.0041da96
call fcn.0041da96
call fcn.0041d550
jmp fcn.00413e0c
mov ebx, edi
mov dword [ebp - 0x54], ecx
sub edx, ecx
jb 0x41b43b
add ebx, edx
inc ebx
mov edx, esi
mov dword [ebp - 0x58], 0
cld
call fcn.0041b54a
jb 0x41b4b7
inc dword [ebp - 0x58]
add edi, dword [ebp - 0x54]
mov esi, edx
cmp edi, ebx
jb 0x41b4a4
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0x41b43b
mov esi, edx
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x54]
imul ecx
jno 0x41b4d0
jmp 0x41b471
mov ecx, dword [ebp - 0x64]
add ecx, eax
js 0x41b4ce
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x64], eax
call fcn.0041a67e
jb 0x41b473
mov dword [ebp - 0x68], edi
push edx
mov edi, dword [ebp - 0x6c]
mov edx, esi
call fcn.0041b54a
jb 0x41b52d
mov esi, dword [ebp - 0x6c]
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push esi
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x68], edi
mov edi, dword [ebp - 0x54]
add edi, esi
mov dword [ebp - 0x6c], edi
mov esi, edx
jmp 0x41b4ed
mov ecx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x6c]
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edx
jmp 0x41b455

Function at 0x41b5e1
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 7
xor edx, edx
call fcn.0041b64f
pop ecx
jb 0x41b64a
ret

Function at 0x41b5f2
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
xor edx, edx
call fcn.0041b64f
pop ecx
jb 0x41b64a
ret
jmp fcn.00413e01

Function at 0x41b625
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
mov edx, 0x80000000
call fcn.0041b64f
pop ecx
jb 0x41b64a
ret
Function at 0x41bbfc
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov ebx, eax
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0041a6ed
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041a6da
jecxz 0x41bc37
test ebx, ebx
jns 0x41bc30
push edx
push edi
push ebx
call fcn.0041b834
pop ebx
add ebx, eax
add ebx, 2
pop edi
pop edx
call fcn.0041bd34
jmp 0x41bc8d
test ebx, ebx
jns 0x41bc4b
push ecx
push edi
push ebx
call fcn.0041bbd2
pop eax
add ebx, eax
add ebx, 2
pop edi
pop ecx
call fcn.0041bcd4
jmp 0x41bc8d
call fcn.0041a67e
jb 0x41bcc4
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041da96
call fcn.0041aeb2
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0041da96
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.00413e01

Function at 0x41c61e
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0041a6ed
je 0x41c6f0
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041a6da
je 0x41c6f0
cmp edx, ecx
jb 0x41c6f0
push edx
push edi
call fcn.0041b834
pop edi
pop edx
mov ebx, eax
test ebx, ebx
je 0x41c6f0
push edx
mov dword [ebp - 0x60], edx
mov eax, ecx
mul ebx
mov ebx, ecx
pop ecx
sub ecx, eax
push edi
push dword [ebp - 0x60]
call fcn.0041a67e
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edx
pop edx
pop edi
jb 0x41c6fb
mov dword [ebp - 0x64], edi
mov ecx, ebx
push ebx
push esi
push edi
call fcn.0041b85d
pop eax
pop esi
pop ebx
jae 0x41c69e
mov edx, dword [ebp - 0x64]
add edx, dword [ebp - 0x60]
sub edx, eax
jmp 0x41c6c4
push esi
push edi
mov esi, eax
mov ecx, edi
sub ecx, eax
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x6c], edi
pop edi
pop esi
add edi, ebx
sub edx, ebx
cmp edx, ebx
jae 0x41c685
mov eax, edi
mov ecx, edx