joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a943
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040a943
xor esi, esi
push esi
push esi
push esi
push esi
push esi
mov eax, dword [0x47c738]
mov ecx, eax
mov eax, 0x65
call fcn.00471dac
call fcn.00471de9
lea ebx, [ebp - 0x98]
call fcn.004779f9
push 0
call fcn.0040a8d0
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x40aa2b
fild dword [0x47c844]
mov edx, 1
call fcn.004780f8
call dword [sym.imp.WINMM.DLL_timeGetTime]
mov ebx, 0x4001
call fcn.004780c0
call fcn.004779cb
fsubrp st(1)
fild dword [0x487680]
fimul dword [0x487654]
fcompp
fnstsw ax
sahf
jb 0x40a9d9
cmp dword [0x47c844], 0
jne 0x40aa2b
xor ecx, ecx
mov edx, 0x47f6a4
call fcn.0047881c
mov edx, 0x47f6d4
call fcn.0047881c
call fcn.00477cbd
mov eax, 1
or eax, 0x8000
call fcn.0046e079
mov edx, 0x47f6e8
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0046d783
call dword [sym.imp.WINMM.DLL_timeGetTime]
fldcw word [ebp - 0x10]
mov dword [0x47c844], eax
push 0
call fcn.0040a7bf
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x40ab10
fild dword [0x47c844]
mov edx, 1
call fcn.004780f8
call dword [sym.imp.WINMM.DLL_timeGetTime]
mov ebx, 0x4001
call fcn.004780c0
call fcn.004779cb
fsubrp st(1)
fild dword [0x487680]
fimul dword [0x487654]
fcompp
fnstsw ax
sahf
jb 0x40aa85
cmp dword [0x47c844], 0
jne 0x40ab10
xor ecx, ecx
mov edx, 0x47f6a4
call fcn.0047881c
mov edx, 0x47f6d4
call fcn.0047881c
call fcn.00477cbd
mov eax, 1
or eax, 0x8000
call fcn.0046e079
mov edx, 0x47f704
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0046d783
mov edx, dword [ebp - 0x98]
call fcn.00478805
mov edx, 0x47f71c
call fcn.0047881c
call fcn.00477cbd
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
call fcn.004786f6
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40d33e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040d33e
xor esi, esi
mov ecx, 0x85
push esi
dec ecx
jne 0x40d358
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
call fcn.00478805
lea ebx, [esp + 0xc]
call fcn.00477abb
push 0x200
lea ebx, [ebp - 0x298]
push ebx
mov edx, dword [ebp + 0x14]
call fcn.00478805
lea ebx, [esp + 0x14]
call fcn.00477abb
mov edx, dword [ebp + 0x10]
call fcn.00478805
lea ebx, [esp + 0x14]
call fcn.00477abb
mov edx, dword [ebp + 0xc]
call fcn.00478805
lea ebx, [esp + 0x14]
call fcn.00477abb
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push eax
mov ebx, esp
mov eax, dword [ebx + 0x10]
call fcn.00474673
mov eax, dword [ebx + 0xc]
call fcn.00474673
mov eax, dword [ebx + 8]
call fcn.00474673
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 0x10
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x298]
call fcn.00478657
lea ebx, [ebp - 0x98]
call fcn.004779f9
call fcn.004786f6
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x412645
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00412645
xor esi, esi
push esi
push esi
push esi
push esi
push 0
call fcn.00407f97
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x41267c
push 2
call fcn.00409928
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x412681
jmp 0x4128b2
push 0
call fcn.0040a099
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x4128ad
push 0
push 0xffffffffffffffff
mov edx, 0x47f5cc
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x412843
push 0
push 0xffffffffffffffff
mov edx, 0x47f5dc
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x412826
push 0
push 0xffffffffffffffff
mov edx, 0x47f5ec
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x412809
push 0
push 0xffffffffffffffff
mov edx, 0x47f5fc
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x4127ec
push 0
push 0xffffffffffffffff
mov edx, 0x47f60c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x4127cf
push 0
push 0xffffffffffffffff
mov edx, 0x47f61c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x4127b2
mov edx, 0x47f62c
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edx, 0x47f61c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
jmp 0x4127e7
mov edx, 0x47f60c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
jmp 0x412804
mov edx, 0x47f5fc
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
jmp 0x412821
mov edx, 0x47f5ec
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
jmp 0x41283e
mov edx, 0x47f5dc
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
jmp 0x41285b
mov edx, 0x47f5cc
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
nop
nop
nop
nop
nop
push 0
mov edx, 0x47fde8
call fcn.0047881c
lea ebx, [esp]
call fcn.00477abb
push dword [0x47c734]
call sym..exe_SendPacket
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 4
mov eax, 0x1f40
call fcn.00473a9b
push 0
call fcn.00409928
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x412860
jmp 0x4128b2
call fcn.0040a39d
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41aa93
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0041aa93
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
mov edx, 0x48021c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
mov edi, eax
cmp edi, 0
jle 0x41abac
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0x3e8
call fcn.00473a9b
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov edx, 0x48021c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040f0cd
mov esi, dword [ebp - 0x98]
test eax, eax
je 0x41ab1a
jmp 0x41ab66
call fcn.0040a39d
mov edx, 0x48021c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov edx, 0x48021c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040f0cd
mov esi, dword [ebp - 0x98]
test eax, eax
je 0x41aae0
call fcn.0040a148
mov eax, 0x7d0
call fcn.00473a9b
cmp edi, 0
jne 0x41aae0
mov edx, 0x48022c
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edx, 0x48022c
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x41abea
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0041abea
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
mov edx, 0x480244
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e6de
mov edi, eax
cmp edi, 0
jle 0x41acfc
nop
nop
nop
nop
mov eax, 0x3e8
call fcn.00473a9b
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov edx, 0x480244
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040f0cd
mov esi, dword [ebp - 0x98]
test eax, eax
je 0x41ac6a
jmp 0x41acb6
call fcn.0040a39d
mov edx, 0x480244
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov edx, 0x480244
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040f0cd
mov esi, dword [ebp - 0x98]
test eax, eax
je 0x41ac30
call fcn.0040a148
mov eax, 0x7d0
call fcn.00473a9b
cmp edi, 0
jne 0x41ac30
mov edx, 0x480254
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edx, 0x480254
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x41b186
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0041b186
xor esi, esi
push esi
push esi
push esi
push esi
push 0
call fcn.00408cbd
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x41b31f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [0x47c77c], 0
jne 0x41b31f
mov eax, 0x7d0
call fcn.00473a9b
call fcn.00408850
call fcn.00478833
mov edx, 0x47f478
call fcn.0047881c
call fcn.00477d52
jne 0x41b235
mov edx, 0x4802c8
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409cd1
mov eax, 0x7d0
call fcn.00473a9b
mov edx, 0x4802e0
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409cd1
jmp 0x41b31a
call fcn.00408850
call fcn.00478833
mov edx, 0x47f480
call fcn.0047881c
call fcn.00477d52
jne 0x41b293
mov edx, 0x4802f8
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409cd1
mov eax, 0x7d0
call fcn.00473a9b
mov edx, 0x480310
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409cd1
jmp 0x41b31a
call fcn.00408850
call fcn.00478833
mov edx, 0x47f488
call fcn.0047881c
call fcn.00477d52
jne 0x41b2f1
mov edx, 0x480328
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409cd1
mov eax, 0x7d0
call fcn.00473a9b
mov edx, 0x480340
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409cd1
jmp 0x41b31a
mov edx, 0x480358
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
jmp 0x41b1c0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41bb73
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0041bb73
xor esi, esi
push esi
push esi
push esi
push esi
fild dword [0x487a80]
sub esp, 4
mov ebx, esp
fstp dword [ebx]
fild dword [0x487ae4]
fchs
sub esp, 4
mov ebx, esp
fstp dword [ebx]
call fcn.004128c7
fild dword [0x4877a4]
sub esp, 4
mov ebx, esp
fstp dword [ebx]
fild dword [0x487ae8]
fchs
sub esp, 4
mov ebx, esp
fstp dword [ebx]
call fcn.004128c7
mov edx, 0x4804f8
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00415606
push 0x37c4
call fcn.004096a4
mov eax, 0x7d0
call fcn.00473a9b
fild dword [0x487af4]
sub esp, 4
mov ebx, esp
fstp dword [ebx]
fild dword [0x487af0]
fchs
sub esp, 4
mov ebx, esp
fstp dword [ebx]
call fcn.004128c7
fild dword [0x487658]
fchs
sub esp, 4
mov ebx, esp
fstp dword [ebx]
fild dword [0x487af8]
fchs
sub esp, 4
mov ebx, esp
fstp dword [ebx]
call fcn.004128c7
mov eax, 0x7d0
call fcn.00473a9b
push 0
mov edx, 0x480514
call fcn.0047881c
lea ebx, [esp]
push ebx
call fcn.004779f9
mov edx, 0x480508
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00411323
mov ebx, esp
mov eax, dword [ebx]
call fcn.00474673
add esp, 4
mov eax, 0x7d0
call fcn.00473a9b
fild dword [0x4875c8]
fchs
sub esp, 4
mov ebx, esp
fstp dword [ebx]
fild dword [0x487afc]
fchs
sub esp, 4
mov ebx, esp
fstp dword [ebx]
call fcn.004128c7
mov edx, 0x48052c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00415424
mov edx, 0x48052c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.004151c4
call fcn.0040a39d
mov edx, 0x48053c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00415424
mov edx, 0x48053c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.004151c4
call fcn.0040a39d
fild dword [0x487b04]
fchs
sub esp, 4
mov ebx, esp
fstp dword [ebx]
fild dword [0x487b00]
fchs
sub esp, 4
mov ebx, esp
fstp dword [ebx]
call fcn.004128c7
mov edx, 0x48054c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00415424
mov edx, 0x48054c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.004151c4
call fcn.0040a39d
fild dword [0x487794]
fchs
sub esp, 4
mov ebx, esp
fstp dword [ebx]
fild dword [0x4878cc]
fchs
sub esp, 4
mov ebx, esp
fstp dword [ebx]
call fcn.004128c7
mov edx, 0x48055c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00415424
mov edx, 0x48055c
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.004151c4
call fcn.0040a39d
mov edx, 0x48056c
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x480578
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x41c852
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0041c852
xor esi, esi
xor edi, edi
mov ecx, 0xd
push esi
dec ecx
jne 0x41c86e
push 0
mov edx, 0x480660
call fcn.0047881c
lea ebx, [esp]
push ebx
call fcn.004779f9
call fcn.0041da3e
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 4
push eax
push 0
mov edx, 0x480660
call fcn.0047881c
lea ebx, [esp]
push ebx
call fcn.004779f9
call fcn.0041da3e
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 4
pop dword [ebp - 0x30]
add eax, dword [ebp - 0x30]
mov edi, eax
push 0
mov edx, 0x480670
call fcn.0047881c
lea ebx, [esp]
push ebx
call fcn.004779f9
call fcn.0041def1
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 4
mov dword [ebp - 0xa0], eax
mov edx, 0x480680
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call fcn.00408760
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x41caa3
cmp edi, 0
jne 0x41c9c6
nop
nop
nop
nop
nop
nop
nop
mov edx, 0x480004
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
mov eax, 0x7d0
call fcn.00473a9b
push 8
call fcn.00408949
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jg 0x41c984
call fcn.00411d6f
mov eax, 0x7d0
call fcn.00473a9b
mov eax, 0x3e8
call fcn.00473a9b
push 0
push 0
mov edx, 0x480660
call fcn.0047881c
lea ebx, [esp]
push ebx
call fcn.004779f9
call fcn.0041da3e
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 4
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jle 0x41c940
cmp dword [ebp - 0xa0], 0
jne 0x41ca66
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, 0x4806a0
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
mov eax, 0x7d0
call fcn.00473a9b
push 8
call fcn.00408949
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jg 0x41ca24
call fcn.00411d6f
mov eax, 0x7d0
call fcn.00473a9b
mov eax, 0x3e8
call fcn.00473a9b
push 0
push 0
mov edx, 0x480670
call fcn.0047881c
lea ebx, [esp]
push ebx
call fcn.004779f9
call fcn.0041def1
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 4
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jle 0x41c9e0
call fcn.00411d6f
mov eax, 0x7d0
call fcn.00473a9b
mov edx, 0x4806b0
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov edx, 0x4806c0
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x41d267
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0041d267
xor esi, esi
push esi
push esi
push esi
push esi
mov eax, 0x3e8
call fcn.00473a9b
push 0
call fcn.00407f97
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x41d2ac
push 6
call fcn.00408d35
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x41d314
push 0
mov edx, 0x4807c8
call fcn.0047881c
lea ebx, [esp]
call fcn.00477abb
push dword [0x47c734]
call sym..exe_SendPacket
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 4
call fcn.0040856d
call fcn.00473a9b
push 0
mov edx, 0x4807d4
call fcn.0047881c
lea ebx, [esp]
call fcn.00477abb
push dword [0x47c734]
call sym..exe_SendPacket
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00474673
pop eax
add esp, 4
push 0
call fcn.00407f97
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x41d336
push 6
call fcn.00408d35
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x41d280
mov edx, 0x4807f0
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x422628
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00422628
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
mov edx, str.76011800000001000000
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040e7f6
mov edi, eax
cmp edi, 0
jle 0x4226e4
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
mov edx, 0x47fe84
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.0040f0cd
mov esi, dword [ebp - 0x98]
test eax, eax
jne 0x4226a8
push 0
push 0x1d
call fcn.00409f55
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x4226ad
jmp 0x42270d
mov edx, str.76011800000001000000
call fcn.0047881c
push 0
mov ebx, esp
call fcn.004779f9
call fcn.00409ba4
mov eax, 0xbb8
call fcn.00473a9b
push dword [0x47c734]
call sym..exe_UNNPCFUNC
jmp 0x42270d
mov edx, 0x48103c
call fcn.0047881c
mov eax, 0x12000
mov edx, 0x47f2c4
call fcn.0047881c
call fcn.0046e9da
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46da28
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word [0x46da0a], 4
jne 0x46da43
jmp 0x46de72
jmp fcn.0046dc75
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.0046db71
mov dword [ebx + 0x3f0], 1
lea eax, [ebx + 0x5c4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x46dec3
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x3e4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.0046dc17
mov dword [ebx + 0x3e0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebx + 0x3ec], eax
call fcn.0046da48
push 0xff
jb 0x46df42
pop eax
movzx ecx, word [0x46da08]
jecxz 0x46df0d
push ecx
push 8
push esp
call dword [sym.imp.COMCTL32.DLL_InitCommonControlsEx]
pop eax
pop eax
call fcn.0046dabd
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0xd8]
call fcn.0046df4e
mov ecx, dword [ebx + 0xb4]
jecxz 0x46df32
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov edi, dword [ebx + 0x428]
call fcn.0046dac2
call fcn.0046daa9
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x46da48
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x46daa8
mov dword [ebx + 0x3d0], eax
mov dword [ebx + 0x3d8], 0
mov dword [ebx + 0x3d4], 0
call fcn.0046dd54
jb 0x46daa8
mov dword [ebx + 0x3d4], eax
mov word [eax + 0xac], 8
call fcn.0046da97
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x46dab1
push ebx
jb 0x46dafe
add byte [esi - 4], bl
mov bl, 0xd0
add eax, dword [eax]
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_TlsFree
ret

Function at 0x46df8a
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
sub esp, 0x20
call fcn.0046e071
mov edi, esp
mov cl, 4
call fcn.0046dfab
call fcn.0046dfab
mov edx, 8
jmp 0x46e004
or esi, esi
jne 0x46e00c
mov byte [edi], 0x30
inc esi
mov ecx, dword [esp + 0x2c]
jecxz 0x46e01a
cmp ecx, edx
jbe 0x46e01c
mov ecx, edx
jmp 0x46e01c
mov ecx, esi
cmp ecx, esi
ja 0x46e026
add esi, esp
sub esi, ecx
jmp 0x46e044
mov edx, esi
lea edi, [esp + ecx - 1]
lea esi, [esp + esi - 1]
push ecx
mov ebx, ecx
sub ebx, edx
mov ecx, edx
std
rep movsb byte es:[edi], byte [esi]
mov al, 0x30
mov ecx, ebx
rep stosb byte es:[edi], al
cld
pop ecx
mov esi, esp
call fcn.004788e0
jb 0x46e053
add esp, 0x20
pop edi
pop esi
pop ebx
pop eax
ret
add esp, 0x20
pop edi
pop esi
pop ebx
pop edx
jmp fcn.0046dc8c
Function at 0x46e079
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
sub esp, 0x170
mov dword [esp], eax
mov dword [esp + 4], ecx
and eax, 0x7fff
mov esi, eax
cld
xor eax, eax
mov ecx, 4
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x5c]
call fcn.00477c78
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x44], 1
mov word [esp + 0x48], si
lea eax, [esp + 8]
lea ebx, [esp + 0x18]
mov edi, dword [esp + 4]
push edi
push 0
push 0xc
mov ecx, esp
push eax
push ebx
push 0
push 0
push 0x20
push edi
push ecx
push ecx
push edx
push 0
mov edx, dword [sym.imp.KERNEL32.DLL_CreateProcessA]
call fcn.00478df6
pop ecx
pop ecx
pop ecx
jae 0x46e0fc
test eax, eax
je 0x46e143
mov ebx, dword [esp + 0x10]
test dword [esp], 0x8000
je 0x46e123
push 0xffffffffffffffff
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [esp + 8]
push eax
push esp
push eax
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
pop ebx
push dword [esp + 8]
call dword [sym.imp.KERNEL32_CloseHandle]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32_CloseHandle]
mov eax, ebx
add esp, 0x170
pop edi
pop esi
pop ebx
ret
add esp, 0x170
pop edi
pop esi
pop ebx
xor eax, eax
jmp fcn.0046dc81

Function at 0x46e153
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
lea esi, [esp + 0x18]
mov ecx, dword [esi - 4]
push ecx
call fcn.00473c1b
jb 0x46e189
jecxz 0x46e176
lea esi, [esi + ecx*4 - 4]
mov eax, dword [esi]
mov byte [edi], al
sub esi, 4
inc edi
loop 0x46e16c
call fcn.00478899
pop edx
pop edi
pop esi
pop ecx
pop eax
shl edx, 2
pop dword [esp + edx]
add esp, edx
ret
call fcn.00478897
pop edx
pop edi
pop esi
pop ecx
add esp, 4
shl edx, 2
pop dword [esp + edx]
add esp, edx
jmp fcn.0046dc8c
Function at 0x46e4aa
Capabilities:
Terminate process

Disassembly:
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], edi
pop dword [ebp - 0x6c]
pop edx
pop ax
test byte [ebx + 4], 4
je 0x46e4cc
pop cx
movzx ecx, ch
add esp, 4
add esp, 8
loop 0x46e4c4
jmp dword [ebp - 0x6c]
mov byte [ebx + 5], 2
mov byte [ebx + 4], al
mov dword [ebx], edx
pop word [ebx + 6]
pop dword [ebx + 0x14]
movzx ecx, byte [ebx + 7]
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
pop dword [ebx + esi + 0x10]
pop dword [ebx + esi + 0xc]
sub esi, 0xc
jne 0x46e4e9
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x46e55e
inc eax
dec ecx
je 0x46e521
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x46e55e
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x46e504
je 0x46e521
jb 0x46e55e
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x46e55e
test byte [ebx + 4], 1
je 0x46e534
mov dword [ebx + 0xc], eax
jmp 0x46e551
push eax
call fcn.0046dc3d
pop ecx
jb 0x46e560
mov dword [ebx], eax
mov dword [ebx + 0xc], ecx
mov edi, eax
cld
xor eax, eax
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
or byte [ebx + 4], 4
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp dword [ebp - 0x6c]
mov al, 9
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
push dword [ebp - 0x6c]
jmp fcn.0046dc8c