joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4084e0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x10]
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [eax], 0
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
je 0x408558
mov edi, eax
cmp eax, 2
je 0x408630
xor ecx, ecx
test byte [0x417080], 2
jne 0x408578
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x4085b8
cmp eax, 2
jne 0x40856c
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x4085b8
mov edi, 0x70c
jmp 0x408537
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.Error__ld_while_reading_value__s_n
mov dword [esp + 8], 0x4197f0
mov dword [esp + 4], 0x417080
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
mov ecx, dword [ebp - 0x18]
jmp 0x408542
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x1c], eax
call eax
mov dword [esp + 0xc], esi
mov ecx, eax
lea eax, [ebp - 0x14]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x18]
sub esp, 0x18
test eax, eax
mov edi, eax
jne 0x408539
mov eax, dword [ebp - 0x14]
xor edx, edx
and eax, 0xfffffffe
cmp dword [ebp - 0x10], 2
mov word [ecx + eax], dx
je 0x408640
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor edi, edi
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov dword [esp], ecx
mov esi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call esi
mov ecx, dword [ebp - 0x18]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x14], eax
mov ebx, eax
jne 0x408680
mov eax, dword fs:[0x18]
mov edi, dword [eax + 0x34]
jmp 0x408539
lea eax, [eax + eax]
mov dword [ebp - 0x18], ecx
mov dword [esp], eax
mov eax, dword [ebp - 0x1c]
call eax
mov ecx, dword [ebp - 0x18]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [ebp - 0x1c], eax
call esi
mov ecx, dword [ebp - 0x18]
sub esp, 0xc
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
jmp 0x40854b
Function at 0x4086c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x14]
lea esi, [ebp - 0x10]
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], edi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [ebp - 0x18], eax
call eax
sub esp, 0x18
test eax, eax
je 0x408740
mov ebx, eax
xor edx, edx
cmp eax, 2
je 0x408810
test byte [0x417080], 2
jne 0x408764
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x10]
cmp eax, 7
je 0x4087a0
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x408754
cmp eax, 1
je 0x4087a0
mov ebx, 0x70c
xor edx, edx
test byte [0x417080], 2
je 0x408724
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.Error__ld_while_reading_value__s_n
mov dword [esp + 8], str.load_reg_multisz
mov dword [esp + 4], 0x417080
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
mov edx, dword [ebp - 0x18]
jmp 0x408724
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp + 0x14], edi
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x10], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x18]
call eax
mov edx, dword [ebp - 0x1c]
sub esp, 0x18
test eax, eax
mov ebx, eax
jne 0x40871b
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
xor esi, esi
xor edx, edx
and eax, 0xfffffffe
mov word [ecx + eax], dx
mov word [ecx + eax + 2], si
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 2
xor ebx, ebx
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea edx, [ebp - 0x10]
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], 4
mov dword [eax], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], edx
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
mov ebx, eax
test eax, eax
je 0x4088e8
cmp eax, 2
je 0x408910
test byte [0x417080], 2
jne 0x4088a8
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0_2
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.Error__ld_while_reading_value__s_n
mov dword [esp + 8], str.load_reg_dword
mov dword [esp + 4], 0x417080
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0_2
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp - 0xc]
sub eax, 3
cmp eax, 1
ja 0x4088f9
cmp dword [ebp - 0x10], 4
je 0x40889c
mov ebx, 0x70c
test byte [0x417080], 2
je 0x40889c
jmp 0x4088a8
lea esp, [ebp - 8]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x414d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x414d88
cmp byte [esi + ebx - 1], 0xa
je 0x414d5c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x41b164], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x4153b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x415588
mov edi, dword [0x41b164]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x415497
test byte [0x4171a8], 8
jne 0x415530
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x4171b8], 8
jne 0x4154f0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x415439
cmp esi, 3
jbe 0x4154a8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x41544a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x41a7a8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x415439
mov dword [esp], 0x4171b8
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x415410
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x415410
mov dword [esp], 0x4171a8
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x4153fb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x415403
mov eax, 0xffffffff
jmp 0x415497

Function at 0x415830
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x40a755
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040a755
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0
mov edx, 0x41f930
call fcn.0041d51f
lea ebx, [esp]
call fcn.0041cabb
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041aec4
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x40a7a9
jmp 0x40a98b
push 0
mov edx, str.Leave_the_Autologic_connected__switch_it_off__wait_10_seconds_and_then_switch_it_back_on.
call fcn.0041d51f
lea ebx, [esp]
call fcn.0041cabb
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041aec4
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41f844], eax
push 0
mov edx, 0x41f9ac
call fcn.0041d51f
lea ebx, [esp]
call fcn.0041cabb
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041aec4
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41f848], eax
push 0
mov edx, 0x41f9c4
call fcn.0041d51f
lea ebx, [esp]
call fcn.0041cabb
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041aec4
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41f84c], eax
push 0
mov edx, 0x41f9d4
call fcn.0041d51f
lea ebx, [esp]
call fcn.0041cabb
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041aec4
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41f850], eax
push 0
mov edx, 0x41f9e8
call fcn.0041d51f
lea ebx, [esp]
call fcn.0041cabb
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041aec4
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41f854], eax
push 0
mov edx, 0x41f9f8
call fcn.0041d51f
lea ebx, [esp]
call fcn.0041cabb
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041aec4
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41f858], eax
push 0
mov edx, 0x41fa04
call fcn.0041d51f
lea ebx, [esp]
call fcn.0041cabb
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041aec4
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41f85c], eax
cmp dword [0x41f844], 0
jne 0x40a931
jmp 0x40a98b
cmp dword [0x41f848], 0
jne 0x40a93f
jmp 0x40a98b
cmp dword [0x41f84c], 0
jne 0x40a94d
jmp 0x40a98b
cmp dword [0x41f850], 0
jne 0x40a95b
jmp 0x40a98b
cmp dword [0x41f854], 0
jne 0x40a969
jmp 0x40a98b
cmp dword [0x41f858], 0
jne 0x40a977
jmp 0x40a98b
cmp dword [0x41f85c], 0
jne 0x40a985
jmp 0x40a98b
mov dword [ebp - 0x98], esi
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40ad99
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040ad99
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov byte [0x41f838], 0
mov esi, 0
mov eax, dword [0x41f840]
test eax, eax
je 0x40ae6e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 1
mov ebx, dword [ebp + 0xc]
movsx ecx, word [ebx]
add eax, ecx
push eax
call dword [0x41f85c]
mov byte [ebp - 0xa0], al
mov eax, pe_nt_image_headers32
movzx ecx, byte [ebp - 0xa0]
xor eax, ecx
mov byte [ebp - 0xa0], al
movzx eax, byte [ebp - 0xa0]
mov byte [ebp - 0x9c], al
mov ecx, 7
mov eax, 1
lea ebx, [ebp - 0x9c]
call fcn.0041cbe8
inc esi
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
movzx ecx, byte [ebp - 0x9c]
cmp ecx, eax
je 0x40ae4b
cmp esi, 0x186a0
jle 0x40ade0
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
movzx ecx, byte [ebp - 0x9c]
cmp ecx, eax
je 0x40ae63
mov byte [0x41f838], 1
movzx eax, byte [0x41f838]
test eax, eax
je 0x40ae6e
movzx eax, byte [ebp - 0xa0]
mov byte [ebp - 0x98], al
movzx eax, byte [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40bbe6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040bbe6
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
fild dword [0x421784]
mov eax, dword [ebp + 8]
call fcn.0041c9cb
fcompp
fnstsw ax
sahf
jne 0x40bc29
fild qword [0x421420]
call fcn.0041c9f2
mov dword [ebp + 8], eax
mov edi, dword [ebp + 0x14]
push 0
push 0
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
push 0x20019
push 0
mov edx, dword [ebp + 0xc]
call fcn.0041d508
mov edx, 0x41fa34
call fcn.0041d51f
call fcn.0041b2fb
mov edx, 0x41fa34
call fcn.0041d51f
call fcn.0041b369
lea ebx, [esp + 0xc]
call fcn.0041cabb
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041aec4
pop eax
add esp, 4
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x40bd0a
mov dword [ebp - 0xa4], 4
mov eax, 4
mov dword [ebp - 0xa8], eax
push 0
lea ebx, [ebp - 0xa8]
push ebx
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
lea ebx, [ebp - 0xa4]
push ebx
push 0
mov edx, dword [ebp + 0x10]
call fcn.0041d508
lea ebx, [esp + 0x10]
call fcn.0041cabb
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041aec4
pop eax
add esp, 4
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x98], edi
call fcn.0041d3f9
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x413ba8
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word [0x413b8a], 4
jne 0x413bc3
jmp 0x413ff2
jmp fcn.00413df5
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.00413cf1
mov dword [ebx + 0x3f0], 1
lea eax, [ebx + 0x5c4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x414043
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x3e4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00413d97
mov dword [ebx + 0x3e0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebx + 0x3ec], eax
call fcn.00413bc8
push 0xff
jb 0x4140c2
pop eax
movzx ecx, word [0x413b88]
jecxz 0x41408d
push ecx
push 8
push esp
call dword [sym.imp.COMCTL32.DLL_InitCommonControlsEx]
pop eax
pop eax
call fcn.00413c3d
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0xd8]
call fcn.004140ce
mov ecx, dword [ebx + 0xb4]
jecxz 0x4140b2
push ecx
call dword [0x43b000]
mov edi, dword [ebx + 0x428]
call fcn.00413c42
call fcn.00413c29
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x413bc8
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x413c28
mov dword [ebx + 0x3d0], eax
mov dword [ebx + 0x3d8], 0
mov dword [ebx + 0x3d4], 0
call fcn.00413ed4
jb 0x413c28
mov dword [ebx + 0x3d4], eax
mov word [eax + 0xac], 8
call fcn.00413c17
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x413c31
push ebx
jb 0x413c7e
add byte [esi - 4], bl
mov bl, 0xd0
add eax, dword [eax]
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_TlsFree
ret

Function at 0x4140d8
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
lea esi, [esp + 0x18]
mov ecx, dword [esi - 4]
push ecx
call fcn.0041a67e
jb 0x414128
lea esi, [esi + ecx*4 - 4]
push eax
xor ebx, ebx
mov eax, dword [esi]
mov byte [edi], al
sub esi, 4
inc ebx
cmp eax, 0xffffffff
je 0x414101
dec ebx
inc edi
loop 0x4140f2
pop eax
test ebx, ebx
je 0x414115
pop ecx
push ecx
sub ecx, ebx
mov esi, edx
call fcn.0041a700
jb 0x414128
call fcn.0041d552
pop edx
pop edi
pop esi
pop ecx
pop ebx
shl edx, 2
pop dword [esp + edx]
add esp, edx
ret
call fcn.0041d550
pop edx
pop edi
pop esi
pop ecx
pop ebx
shl edx, 2
pop dword [esp + edx]
add esp, edx
jmp fcn.00413e0c
Function at 0x414512
Capabilities:
Terminate process

Disassembly:
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], edi
pop dword [ebp - 0x6c]
pop edx
pop ax
test byte [ebx + 4], 4
je 0x414534
pop cx
movzx ecx, ch
add esp, 4
add esp, 8
loop 0x41452c
jmp dword [ebp - 0x6c]
mov byte [ebx + 5], 2
mov byte [ebx + 4], al
mov dword [ebx], edx
pop word [ebx + 6]
pop dword [ebx + 0x14]
movzx ecx, byte [ebx + 7]
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
pop dword [ebx + esi + 0x10]
pop dword [ebx + esi + 0xc]
sub esi, 0xc
jne 0x414551
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x4145c6
inc eax
dec ecx
je 0x414589
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x4145c6
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x41456c
je 0x414589
jb 0x4145c6
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x4145c6
test byte [ebx + 4], 1
je 0x41459c
mov dword [ebx + 0xc], eax
jmp 0x4145b9
push eax
call fcn.00413dbd
pop ecx
jb 0x4145c8
mov dword [ebx], eax
mov dword [ebx + 0xc], ecx
mov edi, eax
cld
xor eax, eax
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
or byte [ebx + 4], 4
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp dword [ebp - 0x6c]
mov al, 9
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
push dword [ebp - 0x6c]
jmp fcn.00413e0c
Function at 0x41463c
Capabilities:
Terminate process

Disassembly:
test byte [ebx + 4], 4
jne 0x414647
jmp fcn.00414512
mov dword ds:[ebp - 0x68], esi
mov dword ds:[ebp - 0x64], edi
pop dword ds:[ebp - 0x6c]
pop eax
pop ax
xor ah, ah
pop cx
cmp cl, byte [ebx + 6]
call fcn.00414763
pop edx
cmp edx, dword [ebx + 0x14]
call fcn.00414763
movzx ecx, ch
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
lea edi, [ebx + esi + 0x10]
pop dword ds:[ebp - 0x60]
push dword [edi]
pop edx
cmp edx, dword [ebx + esi + 0x10]
call fcn.00414763
pop edx
cmp edx, dword [ebx + esi + 0xc]
call fcn.00414763
sub esi, 0xc
jne 0x414681
or ah, ah
jne 0x414750
cmp cl, byte [ebx + 7]
jne 0x414750
mov edx, dword ds:[ebp - 0x60]
cmp edx, dword [edi - 4]
jl 0x414750
mov byte [ebx + 4], al
mov ecx, dword [edi]
sub ecx, edx
jle 0x4146e6
cmp byte [ebx + 7], 1
je 0x4146cb
imul ecx, dword [edi - 8]
push edi
mov al, byte [ebx + 6]
mov esi, ecx
mov edi, dword [ebx]
push dword [ebx + 8]
sub dword [esp], ecx
pop ecx
imul ecx, dword [ebx + 0x14]
add edi, ecx
call fcn.00414854
pop edi
push dword [ebx + 8]
push dword [ebx + 0xc]
movzx ecx, byte [ebx + 7]
xor esi, esi
mov dword [edi], edx
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
dec ecx
je 0x414719
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x414700
jb 0x414746
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x414746
mov ecx, eax
xchg dword [ebx + 0xc], eax
mov edx, eax
mov eax, dword [ebx]
call fcn.00414768
jb 0x414748
add esp, 8
mov dword [ebx], eax
or byte [ebx + 4], 4
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
notrack jmp dword ds:[ebp - 0x6c]
mov al, 9
pop dword [ebx + 0xc]
pop dword [ebx + 8]
mov dx, 0x9b0
mov al, 9
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
push dword ds:[ebp - 0x6c]
jmp fcn.00413e0c