joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4096ff
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004096ff
xor esi, esi
xor edi, edi
mov ecx, 0x15
push esi
dec ecx
jne 0x40971b
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xb4], eax
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
je 0x409758
cmp edi, 0xffffffff
jne 0x4097a5
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
fldcw word [ebp - 0x10]
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
mov edx, 0x413554
call fcn.00411750
lea ebx, [esp + 4]
push ebx
call fcn.00410c56
call fcn.004098a1
mov ebx, esp
mov eax, dword [ebx]
call fcn.0040f5cb
add esp, 8
push dword [ebp - 0xb8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
jmp 0x409880
mov eax, dword [ebp + 0x18]
call fcn.00410c28
mov dword [ebp - 0x6c], edi
fild dword [ebp - 0x6c]
fsubrp st(1)
ficomp dword [0x4147ec]
fnstsw ax
sahf
jb 0x40982a
mov dword [ebp - 0xc8], 0
mov eax, dword [ebp + 0x18]
mov ecx, dword [str.:]
add eax, ecx
mov dword [ebp - 0xac], eax
mov eax, dword [ebp + 0x18]
call fcn.00410c28
mov dword [ebp - 0x6c], edi
fild dword [ebp - 0x6c]
fsubrp st(1)
ficomp dword [str.:]
fnstsw ax
sahf
jb 0x40980f
mov eax, dword [str.:]
mov dword [ebp - 0xa8], eax
jmp 0x409825
mov eax, dword [ebp + 0x18]
mov ecx, edi
neg eax
add eax, ecx
mov dword [ebp + 0x1c], eax
mov dword [ebp - 0xc8], 0xffffffff
jmp 0x409845
mov dword [ebp - 0xc8], 0xffffffff
mov eax, dword [ebp + 0x18]
mov ecx, edi
neg eax
add eax, ecx
mov dword [ebp + 0x1c], eax
jmp 0x409880
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0
push 4
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
fldcw word [ebp - 0x10]
mov esi, eax
mov eax, esi
mov dword [ebp - 0xb0], eax
lea ebx, [ebp - 0xd8]
push ebx
push dword [ebp + 0x1c]
mov eax, esi
push eax
push dword [ebp + 8]
call fcn.00407a59
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x409a51
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00409a51
xor esi, esi
mov ecx, 0x48
push esi
dec ecx
jne 0x409a6b
push 0x100
lea ebx, [ebp - 0x19c]
push ebx
call dword [sym.imp.WSOCK32.DLL_gethostname]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409acd
push 0
push 0
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
fldcw word [ebp - 0x10]
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
mov edx, 0x4135c4
call fcn.00411750
lea ebx, [esp + 4]
push ebx
call fcn.00410c56
call fcn.004098a1
mov ebx, esp
mov eax, dword [ebx]
call fcn.0040f5cb
add esp, 8
jmp 0x409ba4
lea ebx, [ebp - 0x19c]
push ebx
call dword [sym.imp.WSOCK32.DLL_gethostbyname]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x9c], eax
fild dword [0x41457c]
mov eax, dword [ebp - 0x9c]
call fcn.00410c28
fcompp
fnstsw ax
sahf
jne 0x409b3d
push 0
push 0
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
fldcw word [ebp - 0x10]
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
mov edx, 0x4135dc
call fcn.00411750
lea ebx, [esp + 4]
push ebx
call fcn.00410c56
call fcn.004098a1
mov ebx, esp
mov eax, dword [ebx]
call fcn.0040f5cb
add esp, 8
jmp 0x409ba4
mov ebx, dword [ebp - 0x9c]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x98], eax
mov ebx, dword [ebp - 0x98]
mov eax, dword [ebx]
mov dword [0x412a59], eax
mov ebx, dword [ebp - 0x98]
push dword [ebx]
call dword [sym.imp.WSOCK32.DLL_inet_ntoa]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1a0], eax
mov ebx, dword [ebp - 0x1a0]
call fcn.0041158b
mov ebx, 0x412a5d
mov ecx, 0x20
call fcn.004115d4
mov edx, 0x4135f8
call fcn.00411750
mov ebx, 0x412a5d
mov ecx, 0x20
call fcn.004115d4
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a718
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word [0x40a6fa], 4
jne 0x40a733
jmp 0x40ab62
jmp fcn.0040a965
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.0040a861
mov dword [ebx + 0x3f0], 1
lea eax, [ebx + 0x5c4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x40abb3
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x3e4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.0040a907
mov dword [ebx + 0x3e0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebx + 0x3ec], eax
call fcn.0040a738
push 0xff
jb 0x40ac32
pop eax
movzx ecx, word [0x40a6f8]
jecxz 0x40abfd
push ecx
push 8
push esp
call dword [sym.imp.COMCTL32.DLL_InitCommonControlsEx]
pop eax
pop eax
call fcn.0040a7ad
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0xd8]
call fcn.0040ac3e
mov ecx, dword [ebx + 0xb4]
jecxz 0x40ac22
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov edi, dword [ebx + 0x428]
call fcn.0040a7b2
call fcn.0040a799
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x40a738
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x40a798
mov dword [ebx + 0x3d0], eax
mov dword [ebx + 0x3d8], 0
mov dword [ebx + 0x3d4], 0
call fcn.0040aa44
jb 0x40a798
mov dword [ebx + 0x3d4], eax
mov word [eax + 0xac], 8
call fcn.0040a787
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x40a7a1
push ebx
jb 0x40a7ee
add byte [esi - 4], bl
mov bl, 0xd0
add eax, dword [eax]
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_TlsFree
ret

Function at 0x40ac48
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
lea esi, [esp + 0x18]
mov ecx, dword [esi - 4]
push ecx
call fcn.0040ed89
jb 0x40ac98
lea esi, [esi + ecx*4 - 4]
push eax
xor ebx, ebx
mov eax, dword [esi]
mov byte [edi], al
sub esi, 4
inc ebx
cmp eax, 0xffffffff
je 0x40ac71
dec ebx
inc edi
loop 0x40ac62
pop eax
test ebx, ebx
je 0x40ac85
pop ecx
push ecx
sub ecx, ebx
mov esi, edx
call fcn.0040ee07
jb 0x40ac98
call fcn.00411783
pop edx
pop edi
pop esi
pop ecx
pop ebx
shl edx, 2
pop dword [esp + edx]
add esp, edx
ret
call fcn.00411781
pop edx
pop edi
pop esi
pop ecx
pop ebx
shl edx, 2
pop dword [esp + edx]
add esp, edx
jmp fcn.0040a97c

Function at 0x40afb2
Capabilities:
Terminate process

Disassembly:
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], edi
pop dword [ebp - 0x6c]
pop edx
pop ax
test byte [ebx + 4], 4
je 0x40afd4
pop cx
movzx ecx, ch
add esp, 4
add esp, 8
loop 0x40afcc
jmp dword [ebp - 0x6c]
mov byte [ebx + 5], 2
mov byte [ebx + 4], al
mov dword [ebx], edx
pop word [ebx + 6]
pop dword [ebx + 0x14]
movzx ecx, byte [ebx + 7]
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
pop dword [ebx + esi + 0x10]
pop dword [ebx + esi + 0xc]
sub esi, 0xc
jne 0x40aff1
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x40b066
inc eax
dec ecx
je 0x40b029
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x40b066
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x40b00c
je 0x40b029
jb 0x40b066
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x40b066
test byte [ebx + 4], 1
je 0x40b03c
mov dword [ebx + 0xc], eax
jmp 0x40b059
push eax
call fcn.0040a92d
pop ecx
jb 0x40b068
mov dword [ebx], eax
mov dword [ebx + 0xc], ecx
mov edi, eax
cld
xor eax, eax
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
or byte [ebx + 4], 4
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp dword [ebp - 0x6c]
mov al, 9
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
push dword [ebp - 0x6c]
jmp fcn.0040a97c

Function at 0x40b0dc
Capabilities:
Terminate process

Disassembly:
call fcn.0040b0e9
jb 0x40b0e4
ret
jmp fcn.0040a97c
Function at 0x40b282
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x258
mov edi, eax
call fcn.0040aa44
mov ebx, eax
lea edx, [ebp - 0x114]
push ebp
mov ebp, dword [ebp]
call fcn.00410ed5
pop ebp
or eax, eax
je 0x40b3b5
xor ecx, ecx
xchg dword [ebx + 0xc], ecx
jecxz 0x40b2c8
push eax
push edx
push ecx
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.00411ce0
pop edx
pop eax
mov esi, edx
add esi, eax
mov al, byte [esi - 1]
and edi, 0x9e
test edi, 0x80
je 0x40b2eb
test edi, 0x16
jne 0x40b2eb
xor edi, 0x80
mov dword [ebx + 0x10], edi
test edi, 8
jne 0x40b32f
cmp al, 0x3a
je 0x40b2fe
cmp al, 0x5c
jne 0x40b309
mov word [esi], 0x2e2a
mov word [esi + 2], 0x2a
lea eax, [ebp - 0x258]
push eax
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
call fcn.00411ce0
cmp eax, 0xffffffff
stc
je 0x40b3e6
mov dword [ebx + 0xc], eax
cmc
jmp 0x40b3e6
push eax
cld
xor al, al
mov ecx, 0x140
lea edi, [ebp - 0x258]
rep stosb byte es:[edi], al
pop eax
cmp word [edx], 0x5c5c
jne 0x40b353
cmp al, 0x5c
je 0x40b35d
mov word [esi], 0x5c
jmp 0x40b35d
mov byte [edx + 1], 0x3a
mov word [edx + 2], 0x5c
push 0
push 0
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x234]
push eax
push 0
push 0x104
lea eax, [ebp - 0x22c]
push eax
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
call fcn.00411ce0
xor ecx, ecx
xor esi, esi
test eax, eax
je 0x40b4b2
lea esi, [ebp - 0x22c]
jmp 0x40b485
xor ecx, ecx
test dword [ebx + 0xc], 0xffffffff
je 0x40b4b2
test dword [ebx + 0x10], 8
jne 0x40b4b2
lea edx, [ebp - 0x258]
push edx
push dword [ebx + 0xc]
mov edx, dword [sym.imp.KERNEL32.DLL_FindNextFileA]
call fcn.00411ce0
mov word [ebp - 0x90], 0
lea esi, [ebp - 0x22c]
jae 0x40b421
cld
xor al, al
mov ecx, 0x140
lea edi, [ebp - 0x258]
rep stosb byte es:[edi], al
xor ecx, ecx
mov byte [esi], cl
mov dword [ebx + 0x10], ecx
xchg dword [ebx + 0xc], ecx
jecxz 0x40b41f
push ecx
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.00411ce0
jmp 0x40b485
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebx + 0x10]
test ecx, 8
je 0x40b43b
test eax, 8
je 0x40b3d1
jmp 0x40b485
and eax, 0x16
je 0x40b475
test eax, 2
je 0x40b44f
test ecx, 2
je 0x40b3d1
test eax, 4
je 0x40b462
test ecx, 4
je 0x40b3d1
test eax, 0x10
je 0x40b475
test ecx, 0x10
je 0x40b3d1
test ecx, 0x80
je 0x40b485
test ecx, eax
je 0x40b3d1
cld
xor al, al
mov ecx, 0x103
mov edi, esi
repne scasb al, byte es:[edi]
lea ecx, [edi - 1]
sub ecx, esi
mov ax, word [esi]
cmp ax, 0x2e
je 0x40b3d1
cmp ax, 0x2e2e
jne 0x40b4b2
cmp ecx, 2
je 0x40b3d1
push ecx
push esi
cld
mov ecx, 0x140
lea esi, [ebp - 0x258]
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x40b4c9
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
push ebp
mov ebp, dword [ebp]
call fcn.004117ca
pop ebp
mov esp, ebp
pop ebp
pop edi
pop esi
pop ecx
pop ebx
jb 0x40b4e0
pop eax
ret
mov edx, eax
pop eax
jmp fcn.0040a971
Function at 0x40ba23
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov ax, word [ebp - 0x46]
call fcn.0040ee59
jb 0x40ba3a
call fcn.004114ac
jb 0x40ba3a
pop edi
pop esi
ret
pop edi
pop esi
jmp fcn.0040a97c

Function at 0x40bad4
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.0040aa44
jb 0x40bae4
ret
jmp fcn.0040a97c

Function at 0x40bae9
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call fcn.0040aa7d
jb 0x40bae4
ret

Function at 0x40bb43
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.0040ede5
jecxz 0x40bb85
call fcn.0040ed89
jb 0x40bbd1
cld
test eax, eax
je 0x40bb70
lodsb al, byte [esi]
call fcn.0040bc9c
stosb byte es:[edi], al
loop 0x40bb63
mov esi, edx
jmp 0x40bb7d
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharLowerBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.0040edbd
pop ebp
pop edi
pop esi
pop ecx
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
jmp fcn.0040a971

Function at 0x40be16
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0040ede5
test eax, eax
jns 0x40be2f
add eax, ecx
test edx, edx
je 0x40be6f
jns 0x40be3a
add edx, ecx
js 0x40be6f
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x40be43
xor ecx, ecx
cmp ecx, eax
jb 0x40be49
mov ecx, eax
call fcn.0040ed89
jb 0x40be73
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040f5b9
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x40be5d
pop edi
pop esi
jmp fcn.0040a97c

Function at 0x40be7a
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0040ede5
test eax, eax
jns 0x40be92
add eax, ecx
cmp eax, ecx
jae 0x40bebe
xchg ecx, eax
call fcn.0040ed89
jb 0x40bec2
sub eax, ecx
add esi, eax
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040f5b9
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
ret
pop edi
pop esi
pop ecx
jmp fcn.0040a97c

Function at 0x40e90c
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, eax
call fcn.0040ed89
jb 0x40e92f
mov eax, 0x20202020
cld
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
call fcn.00411783
pop edi
pop ecx
ret
pop edi
pop ecx
call fcn.00411781
jmp fcn.0040a97c

Function at 0x40e9ae
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov ax, word [ebp - 0x46]
call fcn.0040ee97
jb 0x40e9d3
mov esi, dword [ebp + esi - 0x6c]
call fcn.0040ede5
jecxz 0x40e9d3
mov edx, ecx
call fcn.00411452
pushfd
call fcn.00411cc7
popfd
jb 0x40ea47
pop edi
pop esi
ret
pop edi
pop esi
jmp fcn.0040a97c
Function at 0x40eacb
Capabilities:
Terminate process

Disassembly:
push eax
push esi
push edi
xchg ecx, ebx
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x6c]
call fcn.0040edf6
mov al, 0
je 0x40eae5
mov al, byte [edi]
call fcn.0040f5b9
call fcn.0040ed89
jb 0x40eb08
mov dword [ebp + esi - 0x6c], edx
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
pop esi
pop eax
ret
mov dword [ebp + esi - 0x6c], 0
mov edx, eax
pop edi
pop esi
pop eax
jmp fcn.0040a971

Function at 0x40f65f
Capabilities:
Terminate process

Disassembly:
call fcn.00411875
jb 0x40f667
ret
jmp fcn.0040a97c

Function at 0x40f8aa
Capabilities:
Terminate process

Disassembly:
sub esp, 0x114
mov edx, esp
push ecx
call fcn.0040bd59
or ah, ah
jne 0x40f8d2
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
call fcn.00411ce0
jb 0x40f8d7
pop ecx
add esp, 0x114
ret
mov edx, 0x40
pop ecx
add esp, 0x114
xor eax, eax
jmp fcn.0040a971

Function at 0x40fa24
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0040ede5
je 0x40fa6b
mov al, 0x20
cmp byte [esi], al
je 0x40fa45
jmp 0x40fa6b
cmp byte [esi], al
jne 0x40fa48
inc esi
loop 0x40fa41
call fcn.0040ed89
jb 0x40fa70
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040f5b9
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
pop eax
ret
mov edx, eax
pop edi
pop esi
pop ecx
pop eax
jmp fcn.0040a971

Function at 0x40fa7b
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0040ede5
je 0x40fa6b
lea edi, [esi - 1]
add edi, ecx
mov al, 0x20
cmp byte [edi], al
je 0x40faa1
jmp 0x40fa6b
cmp byte [edi], al
jne 0x40fa48
dec edi
loop 0x40fa9d
jmp 0x40fa48

Function at 0x40fb3c
Capabilities:
Terminate process

Disassembly:
push eax
call fcn.0040fb88
jb 0x40fb5e
mov ebx, edi
mov ebp, ecx
push eax
mov al, byte [esi]
inc esi
repne scasb al, byte es:[edi]
pop eax
jne 0x40fb58
mov edi, ebx
mov ecx, ebp
dec edx
jne 0x40fb48
dec esi
jmp 0x40fad0

Function at 0x40fb60
Capabilities:
Terminate process

Disassembly:
mov ecx, edx
pop ebp
call fcn.0040ed89
jb 0x40fb08
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00411cc7
call fcn.0040f5b9
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
pop ebp
call fcn.00411cc7
jmp 0x40fafa
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.0040a971
jmp 0x40fb00
push eax
call fcn.0040fb88
jb 0x40fb5e
mov ebx, edi
mov ebp, ecx
mov eax, esi
add esi, edx
dec esi
push eax
mov al, byte [esi]
repne scasb al, byte es:[edi]
pop eax
jne 0x40fb81
mov edi, ebx
mov ecx, ebp
dec esi
dec edx
jne 0x40fb71
mov esi, eax
jmp 0x40fad0
Function at 0x40fbb2
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0040edf6
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edx
push dword [ebp + esi - 0x6c]
mov esi, dword [ebp + esi - 0x64]
call fcn.0040ede5
pop edi
call fcn.0040edf6
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x64], edx
jecxz 0x40fbe6
jne 0x40fc39
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
call fcn.0040ed89
jb 0x40fc1e
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00411cc7
call fcn.00411cc7
call fcn.0040f5b9
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
ret
mov al, 5
pop edi
pop esi
call fcn.00411cc7
call fcn.00411cc7
call fcn.00411cc7
call fcn.00411781
jmp fcn.0040a97c
mov ebx, edi
mov dword [ebp - 0x54], ecx
sub edx, ecx
jb 0x40fbe6
add ebx, edx
inc ebx
mov edx, esi
mov dword [ebp - 0x58], 0
cld
call fcn.0040fcf5
jb 0x40fc62
inc dword [ebp - 0x58]
add edi, dword [ebp - 0x54]
mov esi, edx
cmp edi, ebx
jb 0x40fc4f
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0x40fbe6
mov esi, edx
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x54]
imul ecx
jno 0x40fc7b
jmp 0x40fc1c
mov ecx, dword [ebp - 0x64]
add ecx, eax
js 0x40fc79
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x64], eax
call fcn.0040ed89
jb 0x40fc1e
mov dword [ebp - 0x68], edi
push edx
mov edi, dword [ebp - 0x6c]
mov edx, esi
call fcn.0040fcf5
jb 0x40fcd8
mov esi, dword [ebp - 0x6c]
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push esi
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x68], edi
mov edi, dword [ebp - 0x54]
add edi, esi
mov dword [ebp - 0x6c], edi
mov esi, edx
jmp 0x40fc98
mov ecx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x6c]
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edx
jmp 0x40fc00

Function at 0x40fd9d
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
xor edx, edx
call fcn.0040fdfa
pop ecx
jb 0x40fdf5
ret
jmp fcn.0040a971

Function at 0x40fdd0
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
mov edx, 0x80000000
call fcn.0040fdfa
pop ecx
jb 0x40fdf5
ret
Function at 0x410c56
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x410c76
and esi, 0xfffffffe
jne 0x410c80
xchg dword [ebx], esi
call fcn.0040edbd
pop edi
pop esi
ret
call fcn.0040ede5
mov edi, dword [ebx]
or edi, edi
je 0x410c90
cmp ecx, dword [edi - 4]
je 0x410cb0
call fcn.0040ed89
jb 0x410cc0
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.0040edbd
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.0040edbd
pop edi
pop esi
jmp fcn.0040a97c

Function at 0x410cd0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x410ced
mov dword [ebx], eax
ret
push esi
push edi
mov esi, eax
call fcn.0040ede5
call fcn.0040ed89
jb 0x410d0f
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx], edx
pop edi
pop esi
ret
mov dword [ebx], edx
pop edi
pop esi
jmp fcn.0040a97c

Function at 0x410d18
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x410d38
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.0040ede5
call fcn.0040ed89
jb 0x410d5d
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.0040a97c

Function at 0x410f1a
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.0040ede5
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.0040ede5
add ebx, ecx
xchg ecx, ebx
call fcn.0040ed89
jb 0x410f8a
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.0040edbd
mov esi, dword [ebp + edi - 0x6c]
call fcn.0040edbd
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.0040a97c