joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e2a5
Capabilities:
Terminate process

Disassembly:
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], edi
pop dword [ebp - 0x6c]
pop edx
pop ax
test byte [ebx + 4], 4
je 0x40e2c7
pop cx
movzx ecx, ch
add esp, 4
add esp, 8
loop 0x40e2bf
jmp dword [ebp - 0x6c]
mov byte [ebx + 5], 2
mov byte [ebx + 4], al
mov dword [ebx], edx
pop word [ebx + 6]
pop dword [ebx + 0x14]
movzx ecx, byte [ebx + 7]
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
pop dword [ebx + esi + 0x10]
pop dword [ebx + esi + 0xc]
sub esi, 0xc
jne 0x40e2e4
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x40e359
inc eax
dec ecx
je 0x40e31c
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x40e359
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x40e2ff
je 0x40e31c
jb 0x40e359
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x40e359
test byte [ebx + 4], 1
je 0x40e32f
mov dword [ebx + 0xc], eax
jmp 0x40e34c
push eax
call fcn.0040dc80
pop ecx
jb 0x40e35b
mov dword [ebx], eax
mov dword [ebx + 0xc], ecx
mov edi, eax
cld
xor eax, eax
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
or byte [ebx + 4], 4
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp dword [ebp - 0x6c]
mov al, 9
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
push dword [ebp - 0x6c]
jmp fcn.0040dccf

Function at 0x40e48b
Capabilities:
Query environment variable
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
sub esp, 0x1000
mov byte [esp], al
sub esp, 0x1000
mov byte [esp], al
lea edx, [esp]
call fcn.00417652
lea eax, [esp + 0x118]
lea ecx, [esp + 4]
push 0x1eec
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov ecx, eax
lea esi, [esp + 0x118]
call fcn.004180bd
jb 0x40e4de
add esp, 0x2000
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
movzx edx, al
add esp, 0x2000
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.0040dcc4

Function at 0x40e4f1
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
call fcn.00412db6
jb 0x40e52e
mov al, byte [esi + 0xc]
test al, 0xa
jne 0x40e522
test al, 1
jne 0x40e50f
test word [esi + 0x2c], 2
jne 0x40e526
jmp 0x40e522
push ecx
call fcn.0040ed5d
mov ebx, ecx
pop ecx
jb 0x40e533
or ebx, ebx
je 0x40e526
cmp al, 0x1a
je 0x40e526
xor eax, eax
jmp 0x40e52b
mov eax, 0xffffffff
pop ebx
pop esi
ret
mov eax, 0x35
mov edx, eax
pop ebx
pop esi
mov eax, 0xffffffff
jmp fcn.0040dcc4

Function at 0x40e56b
Capabilities:
Terminate process

Disassembly:
call fcn.0040e578
jb 0x40e573
ret
jmp fcn.0040dccf
Function at 0x40e711
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x258
mov edi, eax
call fcn.0040dd97
mov ebx, eax
lea edx, [ebp - 0x114]
push ebp
mov ebp, dword [ebp]
call fcn.00417652
pop ebp
or eax, eax
je 0x40e844
xor ecx, ecx
xchg dword [ebx + 0xc], ecx
jecxz 0x40e757
push eax
push edx
push ecx
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.004185d3
pop edx
pop eax
mov esi, edx
add esi, eax
mov al, byte [esi - 1]
and edi, 0x9e
test edi, 0x80
je 0x40e77a
test edi, 0x16
jne 0x40e77a
xor edi, 0x80
mov dword [ebx + 0x10], edi
test edi, 8
jne 0x40e7be
cmp al, 0x3a
je 0x40e78d
cmp al, 0x5c
jne 0x40e798
mov word [esi], 0x2e2a
mov word [esi + 2], 0x2a
lea eax, [ebp - 0x258]
push eax
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
call fcn.004185d3
cmp eax, 0xffffffff
stc
je 0x40e875
mov dword [ebx + 0xc], eax
cmc
jmp 0x40e875
push eax
cld
xor al, al
mov ecx, 0x140
lea edi, [ebp - 0x258]
rep stosb byte es:[edi], al
pop eax
cmp word [edx], 0x5c5c
jne 0x40e7e2
cmp al, 0x5c
je 0x40e7ec
mov word [esi], 0x5c
jmp 0x40e7ec
mov byte [edx + 1], 0x3a
mov word [edx + 2], 0x5c
push 0
push 0
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x234]
push eax
push 0
push 0x104
lea eax, [ebp - 0x22c]
push eax
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
call fcn.004185d3
xor ecx, ecx
xor esi, esi
test eax, eax
je 0x40e941
lea esi, [ebp - 0x22c]
jmp 0x40e914
xor ecx, ecx
test dword [ebx + 0xc], 0xffffffff
je 0x40e941
test dword [ebx + 0x10], 8
jne 0x40e941
lea edx, [ebp - 0x258]
push edx
push dword [ebx + 0xc]
mov edx, dword [sym.imp.KERNEL32.DLL_FindNextFileA]
call fcn.004185d3
mov word [ebp - 0x90], 0
lea esi, [ebp - 0x22c]
jae 0x40e8b0
cld
xor al, al
mov ecx, 0x140
lea edi, [ebp - 0x258]
rep stosb byte es:[edi], al
xor ecx, ecx
mov byte [esi], cl
mov dword [ebx + 0x10], ecx
xchg dword [ebx + 0xc], ecx
jecxz 0x40e8ae
push ecx
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.004185d3
jmp 0x40e914
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebx + 0x10]
test ecx, 8
je 0x40e8ca
test eax, 8
je 0x40e860
jmp 0x40e914
and eax, 0x16
je 0x40e904
test eax, 2
je 0x40e8de
test ecx, 2
je 0x40e860
test eax, 4
je 0x40e8f1
test ecx, 4
je 0x40e860
test eax, 0x10
je 0x40e904
test ecx, 0x10
je 0x40e860
test ecx, 0x80
je 0x40e914
test ecx, eax
je 0x40e860
cld
xor al, al
mov ecx, 0x103
mov edi, esi
repne scasb al, byte es:[edi]
lea ecx, [edi - 1]
sub ecx, esi
mov ax, word [esi]
cmp ax, 0x2e
je 0x40e860
cmp ax, 0x2e2e
jne 0x40e941
cmp ecx, 2
je 0x40e860
push ecx
push esi
cld
mov ecx, 0x140
lea esi, [ebp - 0x258]
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x40e958
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
push ebp
mov ebp, dword [ebp]
call fcn.004180bd
pop ebp
mov esp, ebp
pop ebp
pop edi
pop esi
pop ecx
pop ebx
jb 0x40e96f
pop eax
ret
mov edx, eax
pop eax
jmp fcn.0040dcc4
Function at 0x40eab5
Capabilities:
Terminate process

Disassembly:
push esi
mov ax, word [ebp - 0x46]
call fcn.00412db6
jb 0x40ead9
test word [esi + 0xc], 1
je 0x40ead7
call fcn.0040eae6
jb 0x40ead9
call fcn.00418076
pop esi
ret
mov al, 0x36
xor edx, edx
call fcn.00418076
pop esi
jmp fcn.0040dccf
Function at 0x40f5ea
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov ax, word [ebp - 0x46]
call fcn.00412db6
jb 0x40f601
call fcn.00417d2c
jb 0x40f601
pop edi
pop esi
ret
pop edi
pop esi
jmp fcn.0040dccf

Function at 0x40f69b
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.0040dd97
jb 0x40f6ab
ret
jmp fcn.0040dccf

Function at 0x40f6b0
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call fcn.0040ddd0
jb 0x40f6ab
ret

Function at 0x40f70a
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00412d3e
or ecx, ecx
je 0x40f7e0
mov ebx, esi
mov edx, 3
mov al, byte [ebx]
cmp al, 0x22
jne 0x40f741
inc ebx
dec ecx
je 0x40f75e
cmp byte [ebx], 0x22
jne 0x40f733
inc ebx
loop 0x40f72d
jmp 0x40f75e
cmp al, 0x5c
jne 0x40f74e
inc ebx
dec ecx
je 0x40f75e
inc ebx
loop 0x40f72d
jmp 0x40f75e
cmp al, 0x3b
je 0x40f757
inc ebx
loop 0x40f72d
jmp 0x40f75e
push ebx
dec edx
je 0x40f762
inc ebx
loop 0x40f72d
push ebx
dec edx
jne 0x40f75e
pop edx
pop ecx
pop ebx
ftst
wait
fnstsw ax
sahf
jb 0x40f782
jne 0x40f77e
cmp ecx, edx
je 0x40f77e
inc ecx
cmp ecx, edx
je 0x40f77e
mov eax, edx
mov esi, ecx
jmp 0x40f791
mov eax, ebx
jmp 0x40f791
cmp ebx, ecx
je 0x40f77e
inc ebx
cmp ebx, edx
je 0x40f77e
mov eax, ecx
mov esi, ebx
fchs
cmp eax, esi
jbe 0x40f7e0
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x40f79a
push esp
push esi
push esi
push eax
mov ecx, eax
sub ecx, esi
call fcn.0040f808
call fcn.004185ba
pop ecx
mov esi, esp
push ecx
call fcn.004180bd
jb 0x40f7ce
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
mov edx, eax
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.0040dcc4
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x40f7e5
mov esi, esp
call fcn.004182a6
call fcn.004185ba
dec edx
cmp byte [esi], 0x20
jne 0x40f804
dec edx
inc esi
mov ecx, edx
jmp 0x40f7bb

Function at 0x410eb6
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.00412d3e
jecxz 0x410ef8
call fcn.00412ce2
jb 0x410f44
cld
test eax, eax
je 0x410ee3
lodsb al, byte [esi]
call fcn.0041100f
stosb byte es:[edi], al
loop 0x410ed6
mov esi, edx
jmp 0x410ef0
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharLowerBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00412d16
pop ebp
pop edi
pop esi
pop ecx
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
jmp fcn.0040dcc4
Function at 0x410efd
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.00412d3e
jecxz 0x410f3f
call fcn.00412ce2
jb 0x410f44
cld
test eax, eax
je 0x410f2a
lodsb al, byte [esi]
call fcn.0041104b
stosb byte es:[edi], al
loop 0x410f1d
mov esi, edx
jmp 0x410f37
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharUpperBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00412d16
pop ebp
pop edi
pop esi
pop ecx
ret
Function at 0x411326
Capabilities:
Get socket status
Send data
Send data on socket
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x104
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00412d3e
call fcn.00412df4
jb 0x4113d2
test byte [edi + 0xc], 0x40
je 0x4113d6
add esp, 0x104
mov ebx, ecx
mov eax, dword [edi + 6]
mov ecx, 0x40
push eax
loop 0x411366
push 0x40
mov edx, esp
mov eax, dword [edi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push edx
push 0
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x4113c3
test eax, eax
je 0x4113e2
push 0
push ebx
push esi
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_send]
cmp eax, 0xffffffff
je 0x4113c3
add esi, eax
sub ebx, eax
jg 0x41136b
and word [edi + 0x2c], 0xfffd
call fcn.004185ba
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x4113da
jmp 0x4113de
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.004185ba
add esp, 0x104
pop edi
pop esi
jmp fcn.0040dccf
Function at 0x4113f6
Capabilities:
Get socket status
Receive data
Receive data on socket
Terminate process

Disassembly:
push esi
push edi
mov dword [ebp - 0x6c], 0
sub esp, 0x104
mov ecx, eax
call fcn.00412ce2
mov ebx, ecx
jb 0x411567
mov dword [ebp - 0x6c], edi
mov ax, word [ebp - 0x46]
call fcn.00412db6
jb 0x41154d
test byte [esi + 0xc], 0x40
je 0x411551
and word [esi + 0x2c], 0xfff5
add esp, 0x104
mov eax, dword [esi + 6]
mov ecx, 0x40
push eax
loop 0x411443
push 0x40
mov ecx, dword [esi + 0x28]
jecxz 0x41149c
cmp ebx, ecx
ja 0x411453
mov ecx, ebx
sub dword [esi + 0x28], ecx
sub ebx, ecx
push esi
push dword [esi + 0x28]
cld
lea edx, [esi + 0x44]
mov esi, edx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop ecx
xchg edi, edx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
pop esi
test dword [esi + 0x28], 0xffffffff
jne 0x411512
test word [esi + 0x2c], 8
je 0x41149c
or word [esi + 0x2c], 2
jmp 0x411512
test ebx, ebx
je 0x411529
mov edx, esp
mov eax, dword [esi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push 0
push edx
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x41153a
test eax, eax
jne 0x4114dd
mov ecx, edi
sub ecx, dword [ebp - 0x6c]
jne 0x4114f6
jmp 0x41155d
lea edx, [esi + 0x44]
push 0
push 0x10000
push edx
push dword [esi + 6]
call dword [sym.imp.WSOCK32.DLL_recv]
cmp eax, 0xffffffff
je 0x41153a
mov dword [esi + 0x28], eax
cmp eax, 0x10000
je 0x411505
or word [esi + 0x2c], 8
test eax, eax
jne 0x411448
or word [esi + 0x2c], 2
test ebx, ebx
je 0x411529
push esi
mov ecx, edi
mov esi, dword [ebp - 0x6c]
sub ecx, esi
call fcn.00412d64
pop esi
jb 0x41156c
mov dword [ebp - 0x6c], edx
mov edx, dword [ebp - 0x6c]
call fcn.00418076
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x411555
jmp 0x411559
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
mov esi, dword [ebp - 0x6c]
call fcn.00412d16
call fcn.00418074
add esp, 0x104
pop edi
pop esi
jmp fcn.0040dccf

Function at 0x4118d6
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push esi
push edi
mov ebx, eax
sub esp, 0x190
push esp
push 2
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
mov cl, byte [esp]
add esp, 0x190
test eax, eax
jne 0x41192c
cmp cl, 2
jne 0x41192c
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00412d3e
push esi
call dword [sym.imp.WSOCK32.DLL_gethostbyname]
test eax, eax
je 0x41192c
mov ecx, dword [eax + 0xc]
jecxz 0x41192c
mov eax, dword [ecx]
test eax, eax
je 0x41192c
dec ebx
je 0x411928
add ecx, 4
jmp 0x41191a
mov eax, dword [eax]
jmp 0x41192e
xor eax, eax
push eax
call dword [sym.imp.WSOCK32.DLL_WSACleanup]
call fcn.004185ba
pop eax
pop edi
pop esi
ret
Function at 0x41202a
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00412d3e
test eax, eax
jns 0x412043
add eax, ecx
test edx, edx
je 0x412083
jns 0x41204e
add edx, ecx
js 0x412083
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x412057
xor ecx, ecx
cmp ecx, eax
jb 0x41205d
mov ecx, eax
call fcn.00412ce2
jb 0x412087
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00413516
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x412071
pop edi
pop esi
jmp fcn.0040dccf

Function at 0x41208e
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00412d3e
test eax, eax
jns 0x4120a6
add eax, ecx
cmp eax, ecx
jae 0x4120d2
xchg ecx, eax
call fcn.00412ce2
jb 0x4120d6
sub eax, ecx
add esi, eax
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00413516
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
ret
pop edi
pop esi
pop ecx
jmp fcn.0040dccf

Function at 0x4120f8
Capabilities:
Terminate process

Disassembly:
call fcn.00412182
push 0
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
call fcn.004185d3
jb 0x412114
add esp, 0x114
ret
add esp, 0x114
jmp fcn.0040dcc4

Function at 0x412182
Capabilities:
Terminate process

Disassembly:
pop ecx
sub esp, 0x114
mov edx, esp
call fcn.00411d81
test ah, ah
jne 0x412196
jmp ecx
add esp, 0x114
mov edx, 0x4c
jmp fcn.0040dcc4

Function at 0x4127f1
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, eax
call fcn.00412ce2
jb 0x412814
mov eax, 0x20202020
cld
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
call fcn.00418076
pop edi
pop ecx
ret

Function at 0x412839
Capabilities:
Terminate process

Disassembly:
pop edi
pop ecx
call fcn.00418074
jmp fcn.0040dccf
push ecx
push edi
mov ecx, 1
call fcn.00412ce2
jb 0x412814
mov byte [edi], 0
call fcn.00418076
pop edi
pop ecx
ret

Function at 0x412893
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov ax, word [ebp - 0x46]
call fcn.00412df4
jb 0x4128b8
mov esi, dword [ebp + esi - 0x6c]
call fcn.00412d3e
jecxz 0x4128b8
mov edx, ecx
call fcn.00417cd2
pushfd
call fcn.004185ba
popfd
jb 0x41292c
pop edi
pop esi
ret
pop edi
pop esi
jmp fcn.0040dccf
Function at 0x412af4
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00412d3e
call fcn.00412df4
jb 0x412b50
mov al, byte [edi + 0xc]
test al, 0x20
je 0x412b54
push 0
lea edx, [edi + 0x3c]
push edx
push ecx
push esi
push dword [edi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_WriteFile]
call fcn.004185d3
jb 0x412b4c
test byte [edi + 0xc], 4
jne 0x412b3f
mov eax, dword [edi + 0x3c]
add dword [edi + 0x14], eax
adc dword [edi + 0x18], 0
and word [edi + 0x2c], 0xfffd
call fcn.004185ba
pop edi
pop esi
ret
mov al, dl
mov dx, 0x34b0
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x3db0
mov dx, 0x3fb0
call fcn.004185ba
pop edi
pop esi
jmp fcn.0040dccf

Function at 0x41362c
Capabilities:
Terminate process

Disassembly:
call fcn.00418168
jb 0x413634
ret
jmp fcn.0040dccf

Function at 0x413cb0
Capabilities:
Terminate process

Disassembly:
fldcw word [0x40d9e7]
mov edx, eax
call fcn.0040dd97
jb 0x413cc2
mov dword [eax + 0x38], edx
mov eax, edx
test eax, eax
js 0x413cc9
ret
mov edx, 0x63
jmp fcn.0040dcc4

Function at 0x41479a
Capabilities:
Terminate process

Disassembly:
mov edx, 0x63
push esi
push edi
push ebp
mov ebp, esp
push 0x71d3400
push 0xaa009cb6
push 0x101abab4
push 0xb196b284
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
test dword [eax], 0xffffffff
je 0x414846
mov ecx, dword [ebp + 0x24]
mov ecx, dword [ecx]
jecxz 0x414846
lea eax, [ebp - 0x14]
lea ebx, [ebp - 0x10]
push eax
push ebx
push ecx
mov ecx, dword [ecx]
call dword [ecx]
test dword [ebp - 0x14], 0xffffffff
je 0x414846
lea eax, [ebp - 0x18]
lea ebx, [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
push eax
push ebx
push ecx
mov ecx, dword [ecx]
call dword [ecx + 0x10]
test dword [ebp - 0x18], 0xffffffff
je 0x414846
lea eax, [ebp - 0x1c]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
push eax
push dword [ebx]
push ecx
mov ecx, dword [ecx]
call dword [ecx + 0x14]
mov ecx, dword [ebp - 0x1c]
jecxz 0x414846
mov ebx, dword [ebx]
mov ebx, dword [ebx + 4]
mov dword [ebx + 0x20], ecx
mov ecx, dword [ebp + 0x24]
mov ecx, dword [ecx]
mov dword [ebx + 0x1c], ecx
push ecx
mov ecx, dword [ecx]
call dword [ecx + 4]
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
mov esp, ebp
pop ebp
pop edi
pop esi
ret 0x18
mov ecx, dword [ebp - 0x18]
jecxz 0x414851
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x14]
jecxz 0x41485c
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
mov esp, ebp
pop ebp
pop edi
pop esi
jmp 0x40dcbf
Function at 0x414ac5
Capabilities:
Terminate process

Disassembly:
sub esp, 0x330
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push ebx
push ebp
push esi
push edi
mov ebp, esp
call fcn.00414be7
call fcn.00414e34
test ebx, ebx
je 0x414bc5
lea eax, [ebp + 0x6c]
push eax
push 0x800
mov eax, dword [ebp + 0x64]
inc eax
push eax
lea eax, [ebp + 0x300]
push eax
lea eax, [ebp + 0x20]
push eax
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x14]
call fcn.00414f10
js 0x414bc5
mov eax, 0xfffffffd
xchg dword [ebp + 0x6c], eax
mov dword [ebp + 0x68], eax
cmp dword [ebp + 0x390], 2
jbe 0x414b6f
sub dword [ebp + 0x5c], 4
inc dword [ebp + 0x60]
inc dword [ebp + 0x64]
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x30]
push eax
push 0
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x390]
push 0x800
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x68]
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x18]
dec dword [ebp + 0x64]
dec dword [ebp + 0x60]
jmp 0x414ba2
mov ecx, dword [ebp + 0x388]
jecxz 0x414b7a
lea ecx, [ebp + 0x10]
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x30]
push eax
push ecx
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x390]
push 0x800
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x68]
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x18]
call fcn.00414f10
js 0x414bc5
call fcn.00414d00
call fcn.00414e4c
mov ecx, dword [ebp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x374
pop edx
add esp, ecx
jmp edx
call fcn.00414d00
call fcn.00414e4c
mov al, 0x63
mov ecx, dword [ebp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x374
pop edx
add esp, ecx
push edx
jmp fcn.0040dccf
Function at 0x414f99
Capabilities:
Terminate process

Disassembly:
sub esp, 0x330
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push ebx
push ebp
push esi
push edi
mov ebp, esp
call fcn.00414be7
call fcn.00414e34
test ebx, ebx
je 0x415087
lea eax, [ebp + 0x6c]
push eax
push 0x800
mov eax, dword [ebp + 0x64]
inc eax
push eax
lea eax, [ebp + 0x300]
push eax
lea eax, [ebp + 0x20]
push eax
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x14]
call fcn.00414f10
js 0x415087
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x390]
push 0x800
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x6c]
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x18]
call fcn.00414f10
jns 0x41505d
cmp dword [ebp + 0x390], 2
jne 0x415087
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0x58]
push eax
push 1
push 0x800
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x6c]
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x18]
call fcn.00414f10
js 0x415087
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x18]
cmp dl, 9
jne 0x415087
mov dword [ebp + 0xc], ebx
call fcn.00414d00
call fcn.00414e4c
mov ecx, dword [ebp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x374
pop edx
add esp, ecx
jmp edx
call fcn.00414d00
call fcn.00414e4c
mov al, 0x63
mov ecx, dword [ebp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x374
pop edx
add esp, ecx
xor ebx, ebx
push edx
jmp fcn.0040dccf

Function at 0x41529b
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push ecx
mov esi, edx
mov ecx, dword [esi - 4]
shl ecx, 1
je 0x4152b8
call fcn.00412ce2
jb 0x4152bc
cld
xor eax, eax
shr ecx, 1
lodsb al, byte [esi]
stosw word es:[edi], ax
loop 0x4152b3
pop ecx
pop edi
pop esi
ret
pop ecx
pop edi
pop esi
jmp fcn.0040dccf

Function at 0x415a70
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.00412d51
mov esi, dword [ebp + esi - 0x6c]
call fcn.00412d3e
jecxz 0x415a90
jmp 0x415a95
jmp 0x415b2a
test eax, eax
je 0x415ab8
jns 0x415a9e
add eax, edx
inc eax
dec eax
sub edx, eax
jbe 0x415ab8
push eax
add edi, eax
push edi
call fcn.004164e9
pop eax
pop edx
jae 0x415ab4
test edx, edx
je 0x415b2a
mov ecx, edi
jmp 0x415af9
xor edx, edx
jmp 0x415b11
mov esi, eax
sub ecx, eax
call fcn.00412ce2
jb 0x415b31
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004185ba
call fcn.00413516
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.004185ba
jmp 0x415b25
call fcn.004185ba
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.0040dcc4