joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415477
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
imul ebx, edx
or ecx, 0x11
mov dword [0x407c3f], 0x2a4769a5
and ax, 0x3577
shld cx, ax, 3
push dword [ebp + 8]
pop dword [ebp + 0x10]
movzx ebx, ax
movsx ebx, ax
or ebx, 0xffffffaa
dec byte [0x407c73]
push dword [ebp + 8]
push dword [0x407d8c]
push dword [ebp + 0xc]
sbb dword [0x407d48], 0xfffffffa
push edx
xor esi, eax
call fcn.00411baf
inc edi
dec eax
inc ecx
xor dword [0x407e6f], 0x375a034d
jne 0x415567
imul edi, eax
call fcn.004064d2
setbe byte [0x407d2a]
movsx ebx, word [ebp + 8]
mov esi, dword [0x407a73]
sets byte [ebp + 8]
movsx edi, ax
btr edx, eax
inc eax
not word [0x407ab9]
mov byte [0x407bb0], al
and dword [0x407c51], 0x4b
je 0x415567
push dword [ebp + 0xc]
call fcn.004136ca
add esp, 4
mov byte [0x407bbd], 0xc5
sub byte [0x407ef7], 0x81
sbb ecx, 0x7520af5
mov byte [0x407dfb], 0x2a
or ecx, dword [0x407da7]
dec dword [ebp + 0x10]
shrd edi, eax, 2
rol esi, 1
inc esi
shrd dword [0x407b94], edx, 0x12
call fcn.004159ac
add al, 0xae
mov esi, edx
rol bl, 7
add edx, dword [0x407aa9]
sets byte [0x407bfb]
popal
pop ebp
ret

Function at 0x4159ac
Capabilities:
Packed with generic packer

Disassembly:
pushal
shl ebx, 9
and bl, 0xb6
call fcn.00413525
mov dword [0x407bbb], 0x4d6a810e
dec edx
mov edi, edx
push dword [0x407af5]
pop dword [0x407cd0]
movsx edx, word [0x407bd8]
cmc
shr edx, 1
adc byte [0x407a95], 0xb4
and ecx, dword [0x407b62]
sub dword [0x407a97], edx
inc dword [0x407b42]
mov ecx, 0x73079358
xor dword [0x407c76], eax
or ecx, dword [0x407da7]
mov edi, edx
movsx edx, byte [0x407d1c]
call fcn.00415ad5
call fcn.004067e9
rcl edi, 1
setbe byte [0x407b21]
and ah, 0x4f
push dword [0x407c7f]
pop dword [0x407ec4]
sbb ecx, edx
add dword [0x407af9], 0x78
shr dword [0x407d69], 1
bsr edx, eax
ror ebx, 0x1f
push dword [0x407a0d]
pop dword [0x407c76]
inc si
popal
ret

Function at 0x415ad5
Capabilities:
Packed with generic packer

Disassembly:
pushal
push dword [0x407b72]
setge byte [0x407c25]
push eax
mov edi, 0x5779df21
push edx
shl dl, 1
call fcn.004141d0
call fcn.004068be
seto byte [0x407d08]
rcl dword [0x407cb8], 2
not dword [0x407b21]
movzx esi, dx
sub edx, 0x44520b55
ror ecx, 3
rol dx, 1
mov cl, dl
mov eax, edx
mul edx
xor ebx, edx
sub edi, edx
sub dword [0x407de3], edx
xor si, 0x5637
push dword [0x407e4f]
add ax, 5
push edx
shld di, dx, 9
push dword [0x407bc7]
push dword [0x407b9d]
movzx ecx, word [0x4079a8]
setb byte [0x407c73]
push dword [0x407a68]
push dword [0x407ce5]
adc byte [0x407bc5], 0xc1
push dword [0x407c13]
test dword [0x407d4d], 0x2f8aa78d
je 0x415b91
setbe byte [0x407ea3]
xor eax, 0x51
sub dword [0x407ad8], 0x759349e7
push dword [0x407c68]
neg byte [0x407d50]
push eax
sete byte [0x407a45]
call fcn.00406ac1
popal
ret
Function at 0x416248
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
sbb ecx, edx
adc ebx, edx
sbb word [ebp + 8], 0xffad
imul edi, edx, 0x19534cee
add edx, eax
mov dword [ebp + 8], 0x65d5be39
xor esi, 0xffffff98
dec word [ebp + 8]
mul eax
mov edx, eax
sar esi, 1
or byte [0x407a84], al
push dword [0x407e9e]
add dword [0x407c4a], 0x6f
push edx
mov edi, 0x1b
mov esi, 0xb
call fcn.00413642
movsx edx, word [ebp + 8]
mov bh, al
mov eax, 0x3e7815f6
mov byte [ebp + 8], al
ror dl, 1
or eax, dword [0x40794b]
je 0x4162ee
sbb dword [ebp + 8], eax
imul ecx, dword [ebp - 4], 0x3f783e42
shld ebx, edx, 0x17
mul edx
setge byte [0x407c14]
dec edx
call fcn.00406fd6
bsr ebx, eax
test edx, 0x17bca240
jne 0x4162ed
not bh
adc ebx, eax
mov dl, 0xc8
rcr byte [0x407b2a], 3
movsx edx, ax
mov ecx, dword [0x407afa]
dec eax
xor dl, 0x67
imul eax, edx, 0x39f8facf
shrd dword [esi + 0x407c70], edx, 0x17
movzx ecx, byte [esi + 0x407bc0]
sar dh, 1
adc ax, word [0x407ac2]
shld edx, eax, 0x1b
ror eax, 1
sbb dword [esi*4 + 0x407ccb], eax
sar ecx, 0x16
movzx edx, dx
dec esi
jne 0x416292
push dword [0x407be2]
mov edx, 0x3352f804
call fcn.00410d7d
add esp, 0xc
popal
mov esp, ebp
pop ebp
ret 4
Function at 0x404063
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00404d1b
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004041c3
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4041ad
test ebx, ebx
jl 0x404151
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcba4c7
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x404172
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x404164
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00405b33
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00405b33
add esp, 8
mov ebx, 0x80070057
jmp 0x404151
Function at 0x41ae33
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0041baeb
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0041af93
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41af7d
test ebx, ebx
jl 0x41af21
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcd1297
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41af42
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x41af34
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0041c903
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0041c903
add esp, 8
mov ebx, 0x80070057
jmp 0x41af21
Function at 0x431cc3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0043297b
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00431e23
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x431e0d
test ebx, ebx
jl 0x431db1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce8127
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x431dd2
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x431dc4
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00433793
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00433793
add esp, 8
mov ebx, 0x80070057
jmp 0x431db1
Function at 0x448703
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004493bb
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00448863
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x44884d
test ebx, ebx
jl 0x4487f1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcfeb67
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x448812
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x448804
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0044a1d3
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0044a1d3
add esp, 8
mov ebx, 0x80070057
jmp 0x4487f1
Function at 0x45f163
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0045fe1b
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0045f2c3
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x45f2ad
test ebx, ebx
jl 0x45f251
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd155c7
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45f272
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x45f264
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00460c33
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00460c33
add esp, 8
mov ebx, 0x80070057
jmp 0x45f251
Function at 0x475f63
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00476c1b
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004760c3
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4760ad
test ebx, ebx
jl 0x476051
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd2c3c7
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x476072
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x476064
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00477a33
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00477a33
add esp, 8
mov ebx, 0x80070057
jmp 0x476051
Function at 0x48d213
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0048decb
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0048d373
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x48d35d
test ebx, ebx
jl 0x48d301
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd43677
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x48d322
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x48d314
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0048ece3
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0048ece3
add esp, 8
mov ebx, 0x80070057
jmp 0x48d301
Function at 0x4a40d3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004a4d8b
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004a4233
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a421d
test ebx, ebx
jl 0x4a41c1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd5a537
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a41e2
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4a41d4
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004a5ba3
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004a5ba3
add esp, 8
mov ebx, 0x80070057
jmp 0x4a41c1
Function at 0x4b9071
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1340
cmp edx, dword [eax]
je 0x4b9093
add eax, 8
inc ecx
cmp eax, 0x4c13d0
jl 0x4b9084
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1340]
jne 0x4b91c1
mov eax, dword [0x4c5ccc]
cmp eax, 1
je 0x4b919b
test eax, eax
jne 0x4b90c4
cmp dword [0x4c1268], 1
je 0x4b919b
cmp edx, 0xfc
je 0x4b91c1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b90fb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9a50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b9ee0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b913e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b9ee0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be7dc
push edi
call fcn.004bbdb0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9a50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9a60
lea eax, [ebp - 0xa0]
push 0x4be7bc
push eax
call fcn.004b9a60
push dword [esi + 0x4c1344]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9a60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bbd24
add esp, 0x2c
pop edi
jmp 0x4b91c1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c1344]
push 0
push eax
push dword [esi]
call fcn.004b9ee0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret