joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10124a80
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101f85f3
call fcn.1012921f
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.101246e0
add esp, 4
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10124b5b
mov dword [ebp - 8], 0
jmp 0x10124aec
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x10124b5b
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.101291fc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10124b59
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.101291fc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.10124ee0
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.101291fc
jmp 0x10124ae3
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.101291fc
mov esp, ebp
pop ebp
ret

Function at 0x101250d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101f85f3
call fcn.1012921f
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1012518c
mov dword [ebp - 8], 0
jmp 0x10125113
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x1012516e
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.101291fc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1012516c
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.101291fc
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.101291fc
jmp 0x1012510a
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x101d8488]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.101291fc
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.101291fc
mov esp, ebp
pop ebp
ret
Function at 0x10125330
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101f8694
call fcn.1012921f
mov eax, dword [0x101f7bd4]
mov dword [ebp - 8], eax
jmp 0x10125367
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10125380
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x1012537e
mov eax, dword [ebp - 8]
jmp 0x10125403
jmp 0x1012535f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.101291fc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10125400
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 8]
cmp eax, 0xfe0
jbe 0x101253c3
mov eax, dword [ebp - 8]
mov ecx, dword [0x101f7bd4]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov dword [0x101f7bd4], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.101291fc
mov esp, ebp
pop ebp
ret

Function at 0x10125a90
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101f8748
call fcn.1012921f
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10125af8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x90
je 0x10125af8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0xcc
je 0x10125af8
xor eax, eax
jmp 0x10125b39
mov dword [ebp - 8], 1
jmp 0x10125b0a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x10125b34
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov edx, 1
imul eax, edx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
cmp ecx, eax
je 0x10125b32
xor eax, eax
jmp 0x10125b39
jmp 0x10125b01
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.101291fc
mov esp, ebp
pop ebp
ret
Function at 0x10126f11
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10126eed
pop esi
leave
ret 8

Function at 0x10142cbf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10142b35

Function at 0x10144305
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10144287

Function at 0x1014b8d3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1014b550

Function at 0x10152ad0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10152afd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10152afd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40bd25
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x456c90]
jne 0x40bd2f
repz ret
jmp fcn.004131c5

Function at 0x41a1fb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041063c
and dword [ebp - 4], 0
cmp dword [0x45883c], 0
mov ebx, eax
jne 0x41a2ac
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41a35d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41a35d
push eax
call fcn.004105ca
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45883c], eax
call esi
push eax
call fcn.004105ca
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x458840], eax
call esi
push eax
call fcn.004105ca
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x458844], eax
call esi
push eax
call fcn.004105ca
pop ecx
mov dword [0x45884c], eax
test eax, eax
je 0x41a2ac
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004105ca
pop ecx
mov dword [0x458848], eax
mov eax, dword [0x458848]
cmp eax, ebx
je 0x41a304
cmp dword [0x45884c], ebx
je 0x41a304
push eax
call fcn.00410645
push dword [0x45884c]
mov esi, eax
call fcn.00410645
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41a304
test edi, edi
je 0x41a304
call esi
test eax, eax
je 0x41a2fb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41a2fb
test byte [ebp - 0xc], 1
jne 0x41a304
or dword [ebp + 0x10], 0x200000
jmp 0x41a33d
mov eax, dword [0x458840]
cmp eax, ebx
je 0x41a33d
push eax
call fcn.00410645
pop ecx
test eax, eax
je 0x41a33d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41a33d
mov eax, dword [0x458844]
cmp eax, ebx
je 0x41a33d
push eax
call fcn.00410645
pop ecx
test eax, eax
je 0x41a33d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45883c]
call fcn.00410645
pop ecx
test eax, eax
je 0x41a35d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41a35f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4026ac
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026ba
call dword [0x44d014]
or eax, eax
je 0x4026bb
ret
mov al, 1
jmp fcn.00402738

Function at 0x4026c4
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4026d2
call dword [0x44d018]
or eax, eax
jne 0x4026d3
ret
mov al, 2
jmp fcn.00402738

Function at 0x4026dc
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x402714
test edx, edx
je 0x4026fe
push eax
mov eax, ecx
call dword [0x44d01c]
pop ecx
or eax, eax
je 0x40270d
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.00402738
mov dword [eax], edx
mov eax, ecx
call dword [0x44d018]
or eax, eax
jne 0x4026f7
ret
mov al, 1
jmp fcn.00402738
test edx, edx
je 0x402728
push eax
mov eax, edx
call dword [0x44d014]
pop ecx
or eax, eax
je 0x40270d
mov dword [ecx], eax
ret

Function at 0x402738
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x44e004]
test ecx, ecx
je 0x402748
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402761]
jns 0x40275c
call fcn.00405c48
mov eax, dword [eax + 4]
jmp fcn.004038ac

Function at 0x40287c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4028ab
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040399c
jmp 0x4028c9
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402804
mov edi, eax
test ebx, ebx
je 0x4028c9
cmp dword [esi], 0
je 0x4028c9
dec ebx
jmp 0x4028b2
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402c28
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402c08
xor eax, eax
push ebp
push 0x402c01
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402c44
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c08
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x402ea8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x402ec2
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x402ec2
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x402eae
mov al, 0xa
jmp fcn.00402738
ret

Function at 0x402ef4
Capabilities:
Terminate process

Disassembly:
cmp dword [0x44e018], 0
je 0x4028ff
call dword [0x44e018]
mov eax, 0xd2
jmp fcn.004038ac
push eax
push ecx
mov eax, dword [eax]
call fcn.00402ec4
pop ecx
pop eax
je 0x402f03
jmp ebx
pop ecx
jmp 0x4028f0
Function at 0x402f0c
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.00402ec4
mov eax, ebx
pop ebx
jne 0x402f21
pop ecx
jmp 0x4028f0
ret

Function at 0x403788
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x44e4a0
mov esi, 0x44e034
mov edi, 0x44e038
cmp byte [ebx + 0x24], 0
jne 0x4037b7
cmp dword [edi], 0
je 0x4037b7
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x4037a6
cmp dword [0x44e03c], 0
je 0x4037fe
call fcn.00403704
cmp byte [0x44e044], 0
je 0x4037e4
mov edx, 0x44d020
mov eax, 0x44e218
call fcn.004054e4
call fcn.00405467
jmp 0x4037f7
push 0
push 0x44d040
push 0x44d020
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x44e03c], eax
cmp byte [ebx + 0x24], 2
jne 0x40380e
cmp dword [esi], 0
jne 0x40380e
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.004035d8
cmp byte [ebx + 0x24], 1
jbe 0x40381e
cmp dword [esi], 0
je 0x40383b
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x40383b
call fcn.00404ee8
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x40383b
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.004035b0
cmp byte [ebx + 0x24], 1
jne 0x403849
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403854
call fcn.00403754
cmp dword [ebx], 0
jne 0x403861
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x4037fe

Function at 0x403ec0
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00403e84
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00403e84
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x403e6c
ret

Function at 0x403f68
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.00402738
test ecx, ecx
je fcn.00403e84
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x403e6c
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x404030
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40406f
cmp al, 0xb
je 0x40406f
cmp al, 0xc
je 0x404079
cmp al, 0xd
je 0x40408c
cmp al, 0xe
je 0x4040aa
cmp al, 0xf
je 0x40406f
cmp al, 0x11
je 0x40406f
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402738
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40406f
jmp 0x4040be
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404079
jmp 0x4040be
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x404030
dec edi
jg 0x40408f
pop ebp
jmp 0x4040be
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404004
dec edi
jg 0x4040ad
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x404030
Function at 0x4040c4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x40406f
cmp al, 0xb
je 0x40406f
cmp al, 0xc
je 0x404079
cmp al, 0xd
je 0x40408c
cmp al, 0xe
je 0x4040aa
cmp al, 0xf
je 0x40406f
cmp al, 0x11
je 0x40406f
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.00402738
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x40406f
jmp 0x4040be
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x404079
jmp 0x4040be
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call 0x404030
dec edi
jg 0x40408f
pop ebp
jmp 0x4040be
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.00404004
dec edi
jg 0x4040ad
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 1
jmp 0x404030

Function at 0x4040fc
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404143
cmp al, 0xb
je 0x40415d
cmp al, 0xc
je 0x404174
cmp al, 0xd
je 0x404183
cmp al, 0xe
je 0x4041a1
cmp al, 0xf
je 0x4041b7
cmp al, 0x11
je 0x4041c6
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.00402738
cmp ecx, 1
mov eax, ebx
jg 0x404154
call fcn.004038b8
jmp 0x4041d5
mov edx, ecx
call fcn.004038dc
jmp 0x4041d5
cmp ecx, 1
mov eax, ebx
jg 0x40416b
call fcn.00403e84
jmp 0x4041d5
mov edx, ecx
call fcn.00403e9c
jmp 0x4041d5
mov eax, ebx
add ebx, 0x10
call fcn.00404958
dec edi
jg 0x404174
jmp 0x4041d5
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004040fc
dec edi
jg 0x404186
pop ebp
jmp 0x4041d5
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004040d0
dec edi
jg 0x4041a4
pop ebp
jmp 0x4041d5
mov eax, ebx
add ebx, 4
call fcn.00404fb0
dec edi
jg 0x4041b7
jmp 0x4041d5
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.00404b4c
dec edi
jg 0x4041c6
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x4041dc
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004040fc
Function at 0x4041e8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x404214
mov edx, eax
add eax, esi
add edx, ebx
call fcn.004027c4
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x404253
cmp cl, 0xb
je 0x404264
cmp cl, 0xc
je 0x404275
cmp cl, 0xd
je 0x404286
cmp cl, 0xe
je 0x4042a6
cmp cl, 0xf
je 0x4042bf
cmp cl, 0x11
je 0x4042d0
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402738
mov edx, dword [esi + eax]
add eax, ebx
call fcn.0040390c
mov eax, 4
jmp 0x4042e1
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403ec0
mov eax, 4
jmp 0x4042e1
lea edx, [esi + eax]
add eax, ebx
call fcn.004045a4
mov eax, 0x10
jmp 0x4042e1
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.00404304
pop eax
jmp 0x4042e1
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.004041e8
pop eax
jmp 0x4042e1
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404fc8
mov eax, 4
jmp 0x4042e1
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00404b88
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x404202
pop ecx
sub ecx, eax
jle 0x4042fd
lea edx, [ebx + eax]
add eax, esi
call fcn.004027c4
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x404304
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x40434a
cmp cl, 0xb
je 0x404361
cmp cl, 0xc
je 0x404375
cmp cl, 0xd
je 0x404389
cmp cl, 0xe
je 0x4043aa
cmp cl, 0xf
je 0x4043c7
cmp cl, 0x11
je 0x4043db
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402738
mov eax, ebx
mov edx, dword [esi]
call fcn.0040390c
add ebx, 4
add esi, 4
dec ebp
jne 0x40434a
jmp 0x4043ef
mov eax, ebx
mov edx, dword [esi]
call fcn.00403ec0
add ebx, 4
add esi, 4
dec ebp
jne 0x404361
jmp 0x4043ef
mov eax, ebx
mov edx, esi
call fcn.004045a4
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x404375
jmp 0x4043ef
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [edi + ecx + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.00404304
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x404392
jmp 0x4043ef
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.004041e8
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [edi + eax + 2]
add esi, dword [edi + eax + 2]
dec ebp
jne 0x4043aa
jmp 0x4043ef
mov eax, ebx
mov edx, dword [esi]
call fcn.00404fc8
add ebx, 4
add esi, 4
dec ebp
jne 0x4043c7
jmp 0x4043ef
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.00404b88
add ebx, 4
add esi, 4
dec ebp
jne 0x4043db
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x4045a4
Capabilities:
Terminate process

Disassembly:
mov al, 0x10
jmp fcn.00402738
cmp eax, edx
je 0x40463b
cmp word [eax], 8
jb 0x4045dc
push eax
push edx
cmp word [eax], 0x100
je 0x4045d2
cmp word [eax], 0x101
je 0x4045ca
push eax
call sub.oleaut32.dll_VariantClear
jmp 0x4045da
call dword [0x44e3e4]
jmp 0x4045da
add eax, 8
call fcn.004038b8
pop edx
pop eax
cmp word [edx], 8
jae 0x4045f3
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
ret
cmp word [edx], 0x100
je 0x40460e
cmp word [edx], 0x101
jne 0x404627
push eax
call 0x4045e2
pop eax
jmp dword [0x44e3ec]
mov edx, dword [edx + 8]
or edx, edx
je 0x40461e
mov ecx, dword [edx - 8]
inc ecx
jle 0x40461e
mov dword [edx - 8], ecx
mov word [eax], pe_nt_image_headers32
mov dword [eax + 8], edx
ret
mov word [eax], 0
push edx
push eax
call sub.oleaut32.dll_VariantCopyInd
or eax, eax
jne 0x404558
ret