joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4d3838ee
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x4a26543f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4b49de
Capabilities:
Encode data using xor

Disassembly:
push esi
pop esi
mov edi, 0x63d96afa
test dword [ebx + 0x37e3294c], edx
sub ebx, esp
aaa
jnp 0x4b4a56
push 0x35
pop ebx
dec ecx
call 0x7451a8a9
int1
xor eax, 0xe864495b
mov ah, 0x5e
push es
je 0x4b49e7
cmpsw word [esi], word es:[edi]
jno 0x4b4a32
pop ecx
adc eax, 0x34866f88
cwde
push ds
test byte ss:[eax], ch
fldcw word [edx - 0x2b28d786]
and dword [ebp - 0x52], edi
sub cl, byte [ecx]
mov ch, 0xf6
and byte [ecx], bl
mov ah, 0x25
jl 0x4b49a8
aad 0x5f
jae 0x4b4a26
imul esp, esp, 0xfd939c36
test eax, 0xedb0cabe
dec esp
out 0x57, al
inc eax
imul ecx, edx, 0x5d90094d
retf 0xedb0
pop ebp
outsb dx, byte [esi]
imul esp, dword [ecx + edi*2 + 0x51deb1a4], 0x61f563f4
and al, 0x8a
test byte [edi - 0x6b], ch
mov bh, 0x90
mov edx, 0xc8373561
sti
mov dword es:[ecx + 0x386d659d], esp
aas
sub al, ch
inc ebp
shr byte [ecx], 0xc2
push 0xaf79c2c6
jle 0x4b49eb
add al, 0x49
invalid
invalid

Function at 0x4f2418
Capabilities:
Encode data using xor

Disassembly:
jae 0x4f23b5
inc edx
arpl si, dx
add eax, 0x3a33d1ec
or cl, ah
ret
and ah, byte [edx - 0x4e]
sub eax, 0x2fc33d27
bnd ret
or eax, 0x910e8423
mov eax, dword [0x8893a341]
jae 0x4f2446
mov bh, 0x9b
inc ecx
jecxz 0x4f235c
xchg ebx, eax
and dword [ebx], edx
sub eax, ecx
mov dword [0x67137c6], eax
xor dl, byte [ecx]
mov bl, 0xaf
jae 0x4f2464
jae 0x4f23db
xlatb
lodsd eax, dword [esi]
dec esp
cwde
aaa
mov byte [ebx - 0x12408351], 0x61
fstp xword [edi + 0x70c72b8e]
mov esp, 0xa40c799f
pushfd
movsd dword es:[edi], dword [esi]
mov eax, 0x2704a503
xchg ebx, eax
scasb al, byte es:[edi]
wait
loope 0x4f240f
or byte [eax + esi*4 - 0x4ad23917], 0x80
invalid
mov al, 0xe9
invalid
and eax, 0xf6ab0bd6
rcr dword [ebp - 0xaf42400], cl
movsb byte es:[edi], byte [esi]
mov esi, 0x9660a2bd
lcall 0x6391, 0xb7bf0455
dec eax
out 0xc9, al
xchg edx, eax
dec esp
xlatb
call 0x743b654f
arpl word [0x577b5810], bp
jae 0x4f24a1
sub eax, 0x577b5810
jg 0x4f23c6
sar ebp, 1
std
jge 0x4f243c
ret 0xb593
or eax, 0xd60e033f
add edi, esp
jae 0x4f24d3
and ebp, edx
movsd dword es:[edi], dword [esi]
mov dword [0x33ffa3ff], eax
stosd dword es:[edi], eax
xor bh, byte [edi + 0x2e0d24ed]
push ebp
sub eax, 0xaf229448
iretd
invalid
scasd eax, dword es:[edi]
Function at 0x4fd731
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
push eax
mov word [0x24622d0], ds
pop ecx
invalid
jne 0x4fd683
push 0xffffffffffffffd5
sub eax, dword [edx - 0x70]
aad 0x2b
inc edx
nop
hlt
sub al, 0x31
jnp 0x4fd6d9
in eax, 0x70
call 0xcd434102
loop 0x4fd6d6
xor dword [esi], 0x87dd235e
stosd dword es:[edi], eax
xchg ebx, eax
push ds
mov edi, 0xc8888ae4
sub al, byte [eax]
outsb dx, byte [esi]
xchg dword [ebx - 0x1b40e16d], ebp
mov cl, byte [eax + 0x6e002ac8]
mov dword [0xb0fbe350], eax
pop ds
shl byte [ecx + 0x584b937c], 7
xor al, 0x59
xchg ebx, eax
stc
add eax, 0x28dafeb2
dec eax
je 0x4fd743
dec edx
imul ecx, dword [ebx - 0x7d], 0xecbabf71
xor ebx, dword [ebp - 0x51d766c6]
add byte [edi + ecx + 0x3f9756d6], 0xbf
mov edx, 0xf2a254ba
fmul qword [ebx + 0x3d4fe7c3]
push ebp
lds esp, [esi + 0x63926982]
add al, byte [ebp + 0x6a]
jne 0x4fd7fd
mov eax, dword [0xdc1cb75f]
sbb al, 0xdc
pop es
cmp eax, ecx
adc ah, bl
hlt
pop ebx
mov eax, dword [0x5badbf93]
jg 0x4fd798
sbb eax, 0x365eab3
int1
add esi, ecx
movhps qword [ebp + 0xb], xmm5
rcr byte [esi], 1
pop esp
adc esi, dword [eax + ebx*2 + 0x67]
push edx
xor edx, dword [edi - 0x6fb0995a]
add ebp, ebp
cmp eax, ebx
dec edi
or al, 0xa3
test dword [0xc3f0e299], 0x63d119c1
push ebp
int 0x35
mov dword [0xe29905f7], eax
invalid
mov esi, 0x4e4b6340
inc ecx
pop es
xor eax, dword [edi - 0x42]
ja 0x4fd827
jno 0x4fd89a
loop 0x4fd87f
adc dword [ebx + 0x3e], eax
and ebx, eax
and esi, esp
pop edi
push edx
mov ebx, 0xd2013425
push edx
mov bl, 3
call 0xdddd944c
sub al, 0x9c
sbb byte [ebp - 0x40], 0xa3
mov cl, 0x8b
xchg edx, eax
bound ebx, qword [edx - 0x24]
inc ebp
inc ebx
aam 0x3c
jecxz 0x4fd8d3
sub eax, 0xc207f8f2
jge 0x4fd7f2
invalid
cmc
int3
mov ah, byte [esi]
lodsd eax, dword [esi]
popfd
jnp 0x4fd865
xchg esp, eax
aaa
mov al, 0x47
das
jg 0x4fd819
add byte [ebx + 0x4a8ae45b], 0x85
cmpsd dword [esi], dword es:[edi]
mov bl, 0xb8
out 0xb8, eax
add eax, dword [edx]
mov eax, 0x203b8e7
add ch, byte [ecx]
dec esi
sub dword [edi + 0x4e], esp
jg 0x4fd91f
rcl byte [ebx + 0x12e21782]
inc edx
popfd
out dx, eax
push esi
push esi
cld
mov al, byte [0x2031a413]
imul byte [ebx - 0x19]
test eax, 0xb8b39747
sbb cl, dh
cli
xor bh, al
jmp 0xa1812b3c
add byte [eax + 0x3d], ah
and esp, 0x2d
outsb dx, byte [esi]
aaa
sbb edx, dword [edi - 0xeeecabf]
bound edx, qword [ebx - 0x2e6c0c7d]
add esp, ebp
xchg edi, eax
inc ecx
xor eax, 0x9362f111
xor ebx, 0xffffff93
rol dword [ecx], 1
in al, dx
adc eax, dword [edx - 0x12]
push cs
adc byte [edx], al
adc byte [edx], dl
xor edx, dword [ebp - 0x62]
in eax, dx
in eax, dx
ja 0x4fd896
outsd dx, dword [esi]
invalid
inc eax
sub eax, 0xed738d8c
and ebp, edi
jge 0x4fd8ca
push ss
cmp eax, 0xaa3c0752
sub al, 0x70
xchg esi, eax
mov edx, 0x18bc6885
in eax, dx
adc cl, ch
Function at 0x53b891
Capabilities:
Encode data using xor

Disassembly:
mov dh, bl
sbb byte [ecx - 0x6021067], 0xf9
xchg ecx, eax
sahf
mov esi, 0x37f53f67
mov bh, 0xb4
pop ebx
pop ss
jnp 0x53b8e8
pop esp
lds edx, [ecx + edi*4]
pop ecx
out 0x7c, al
test byte [edi + 0x5d], al
or dh, byte [ebp - 0x6bfea43e]
push edi
sub dword [eax + 0x31fc8eab], ecx
dec esp
mov edi, 0x358d3e08
add ah, byte [edx + 0x65]
inc esp
aam 8
lahf
sbb al, 0x6d
cmp byte [edi + 0x6448da24], al
xor eax, 0x667810fa
loope 0x53b8ab
inc eax
push ebx
push es
jns 0x53b867
imul eax, ecx, 0xcb8f329
mov esi, 0x547b2600
jnp 0x53b93e
adc al, bh
xchg ebp, eax
fmul dword [ebp - 0x79]
lodsd eax, dword [esi]
in al, 0x28
cld
inc ebp
cmpsd dword [esi], dword es:[edi]
invalid
dec ebp
or byte [edi + 0x4d], dh
out dx, eax
call 0x385c2160
push ebp
imul ebp, dword [esi + 0x157a2869], 0xffffffba
into
lodsb al, byte [esi]
mov ebx, 0x1c905ebc
pop ebp
pop esp
int3
Function at 0x591211
Capabilities:
Encode data using xor

Disassembly:
pop ss
movsd dword es:[edi], dword cs:[esi]
xchg ebx, eax
je 0x591296
movsb byte es:[edi], byte [esi]
sti
hlt
imul eax, dword [edi - 0x399012da], 0xffffff99
mov dh, 7
pushfd
add al, 0x16
sbb edx, ebp
cmc
and dword [esi], ecx
xor al, 0xea
xor al, 0xb2
lodsb al, byte [esi]
adc byte [ebx + 0x6b7ef0dd], 0x6f
or dword [edx + 0x6e99f871], edi
xchg esi, eax
sbb al, 0xa5
das
sbb bh, byte [esi + 0x3a6116a6]
and eax, 0x15cd1532
sub eax, dword [eax - 0x75]
js 0x59129d
adc eax, esi
cmpxchg dword [esp + edi - 0x5c], edx
pop esi
mov ah, 0x4f
cdq
cwde
jecxz 0x591330
rol esp, cl
mov ebp, 0x258a3739
aas
mov cl, 0x4d
xchg dword [edi - 0x4eb068a6], ebp
inc esp
sub eax, dword [esi]
push ebx
mov eax, 0x95fef091
xchg esi, eax
push cs
out 0xdf, al
je 0x59133b
salc
xor dword [esi + ecx*8], edx
call [esi - 0x53cbd29b]
mov ecx, 0x7f55936e
xchg esi, eax
push ebp
lahf
mov bh, 0x7f
pop esp
xchg edx, eax
mov esi, 0x2d8e5486
pop edi
in eax, 0x86
xchg ebp, eax
aas
das
xor dword [ecx - 1], esp
movsd dword es:[edi], dword [esi]
jmp 0xab630184
mov esi, 0x40954498
nop
and dword [ebx - 0x69d9a246], esi
xchg esi, eax
or dword [ecx + 0x6b], esp
add eax, 0x8d49206a
mov eax, dword [0x8f852ac7]
jp 0x5913c0
mov ecx, 0x45ad56ae
mov dl, 0xb5
mov eax, dword [0xf6359ea5]
pop edx
and eax, 0x12cfc46
adc ebx, dword [eax - 0x1ad38611]
xlatb
add dword [ebx], edx
cwde
out dx, eax
jns 0x59138f
in eax, 0xd7
sbb ebx, ebx
adc byte [ecx], ch
jno 0x591365
jnp 0x5912fb
xor al, cl
dec ebx
mov ecx, 0x4f056fff
mov ch, 0x9e
fstp xword [edi]
cmc
mov ah, 0x2b
jl 0x59131e
pushal
out dx, al
js 0x5913a5
in eax, dx
xor eax, 0xd360d91a
mov ecx, 0x5d59e131
inc esp
out dx, eax
xor al, 0x55
arpl word [ebp + 0x11], sp
mov ss, word [esi - 0x594f1bae]
adc dword [ebx], edx
sub byte [esi], cl
stosb byte es:[edi], al
pop ebp
jnp 0x59135d
daa
jns 0x59141c
jbe 0x5913f2
dec ebx
into
push ebx
popal
sub byte [ebx + ecx + 0x7f41ce35], dh
test al, 0x18
push ebp
mov edi, 0x2df54a90
iretd
invalid
sbb byte [ebp + 0x65], dh
outsd dx, dword [esi]
outsd dx, dword [esi]
pop ss
insd dword es:[edi], dx
add eax, 0xc44234ec
into
jbe 0x5913bd
adc al, 0x7b
inc edi
push cs
mov ebp, dword [edi + 0x5b]
lahf
cmc
invalid
xchg esp, eax
push esp
sahf
pop ebp
invalid
add dword [eax - 0x1581e38a], edi
push cs
fsub dword [ecx]
lds ebx, [esi - 0x708a4ea7]
dec ebp
cmp al, 7
scasd eax, dword es:[edi]
jmp 0x591442
jmp dword [edi]
Function at 0x63af2d
Capabilities:
Encode data using xor

Disassembly:
mov word [ebx - 0x45804029], ds
mov ah, 0x54
inc esi
xor bh, byte [ecx]
dec dword [eax - 0x68927b8]
push edi
sbb cl, byte [edi + 0x4eda9644]
push ds
psubusb mm2, qword [eax + ebp*2]
xchg edx, eax
leave
invalid
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x70507cd6
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x6ef205d0
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x4022e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
mov ecx, 0xa
xor edi, edi
pop esi
mov dword [0x4041a8], esi
push edi
dec ecx
jne 0x40230f
lea eax, [ebp - 0x4c]
push eax
mov edx, dword [0x4041a8]
mov dword [ebp - 0x3c], edx
lea ecx, str.contents
mov dword [ebp - 0x28], ecx
lea eax, section..text
mov dword [ebp - 0x48], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor eax, eax
push eax
push dword [0x4041a8]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x4041b8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4041b8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4023c3
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
lea ecx, [ebp - 0x40]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x4023aa
pop ebp
ret 0x10
Function at 0x43534b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0042708b
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x435383
xor eax, eax
jmp 0x4353af
cmp esi, dword [ebp - 4]
je 0x4353ac
cmp dword [ebp + 0xc], 0
je 0x4353ac
push dword [edi + 0x9c]
call fcn.00434f59
push dword [edi + 0x9c]
mov esi, eax
call fcn.00424fcd
pop ecx
pop ecx
cmp esi, eax
je 0x43537f
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x468242f2
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x52cf3406
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402370
Capabilities:
Access the windows event log

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4115cd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x41a040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x30], ecx
push 0x415168
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 0x38], eax
xorps xmm0, xmm0
xor eax, eax
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
push 0x28
push str.Description:_A_.NET_application_failed._n
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], eax
call fcn.00405790
push 0xd
push str.Application:
lea ecx, [ebp - 0x2c]
call fcn.00405790
mov ecx, esi
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x402404
sub ecx, edi
sar ecx, 1
push ecx
push esi
mov ecx, eax
call fcn.00405790
push 1
push 0x415164
mov ecx, eax
call fcn.00405790
push 6
push str.Path:
lea ecx, [ebp - 0x2c]
call fcn.00405790
mov esi, eax
mov eax, dword [ebp - 0x30]
mov edx, eax
lea edi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x402443
sub edx, edi
mov ecx, esi
sar edx, 1
push edx
push eax
call fcn.00405790
push 1
push 0x415164
mov ecx, eax
call fcn.00405790
push 9
push str.Message:
lea ecx, [ebp - 0x2c]
call fcn.00405790
cmp dword [0x41a548], 7
mov ecx, 0x41a534
push dword [0x41a544]
cmova ecx, dword [0x41a534]
push ecx
mov ecx, eax
call fcn.00405790
push 1
push 0x415164
mov ecx, eax
call fcn.00405790
cmp dword [ebp - 0x18], 7
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x38]
cmova eax, dword [ebp - 0x2c]
push 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 1
push 0
push 0x3ff
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x402517
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40250d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40250d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0040e263
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040e255
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x405370
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41185d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x41a040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea eax, [ecx + 4]
mov dword [ecx], 0x414e88
lea ebx, [ecx + 0x24]
mov dword [ebp - 0x14], eax
lea edi, [ecx + 0x28]
mov dword [eax], 0
push 8
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
call fcn.0040e271
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0040db84
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edx, [eax + 8]
lea ecx, [eax + 0x14]
mov dword [eax + 0x34], esi
lea esi, [eax + 4]
mov dword [eax + 0xc], esi
mov esi, eax
mov dword [eax + 0x10], edx
mov dword [eax + 0x1c], ecx
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], edi
mov esi, dword [ebp - 0x14]
mov dword [edx], 0
mov dword [eax], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [ecx], 0
mov dword [ebx], 0
mov dword [ebp - 4], 1
mov eax, 0x41a534
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 0x414e4c
cmp dword [0x41a548], 7
mov edi, dword [0x41a544]
cmova eax, dword [0x41a534]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp edi, 0x7fffffff
ja 0x40550d
test edi, edi
je 0x4054f1
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
call fcn.00405a50
lea ecx, [edi + edi]
mov esi, eax
push ecx
push dword [ebp - 0x18]
push esi
call fcn.0040f550
mov eax, dword [ebx + 0xc]
lea ecx, [esi + edi*2]
mov dword [ebx + 0x38], ecx
add esp, 0xc
mov dword [eax], esi
mov eax, dword [ebx + 0x1c]
mov dword [eax], esi
mov eax, dword [ebx + 0x2c]
mov dword [eax], edi
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x38]
sub ecx, esi
sar ecx, 1
mov dword [eax], esi
mov eax, dword [ebx + 0x20]
mov dword [eax], esi
mov eax, dword [ebx + 0x30]
mov dword [eax], ecx
mov eax, 1
jmp 0x4054f4
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0040d96d
int3
Function at 0x405560
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411898
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x41a040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
push 0
push 0
mov eax, dword [eax + 4]
mov dword [ecx + eax], 0x414e3c
mov eax, dword [ecx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ecx - 4], eax
mov eax, dword [ecx]
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov ebx, dword [eax + 4]
add ebx, ecx
mov ecx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 0x30], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0x201
mov dword [ebx + 0x18], 6
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
call fcn.004021e0
push 8
call fcn.0040e271
add esp, 4
mov esi, eax
push 1
mov dword [ebp - 4], 2
call fcn.0040db84
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
mov ebx, dword [esi + 4]
mov dword [ebp - 0x14], ebx
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4131fc]
mov ecx, ebx
call esi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 3
push eax
call fcn.00405d40
mov edi, eax
add esp, 4
mov ecx, dword [edi]
push 0x20
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x4131fc]
mov ecx, edi
call esi
movzx eax, ax
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebx]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x4131fc]
mov ecx, ebx
call esi
mov edi, eax
test edi, edi
je 0x4056ae
mov ecx, dword [edi]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x4131fc]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp dword [ecx + 0x38], 0
mov word [ecx + 0x40], ax
jne 0x4056cc
mov eax, dword [ecx + 0xc]
push 0
or eax, 4
push eax
call fcn.004021e0
mov esi, dword [ebp - 0x1c]
mov eax, dword [esi + 0x10]
lea edx, [esi + 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [eax + 4]
mov dword [edx + eax], 0x414e48
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], 0x414e44
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + esi - 4], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x406bb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411aa5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x41a040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.00406690
lea ecx, [ebp - 0x1c]
lea esi, [eax + 1]
push esi
call fcn.00406e50
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x1c]
mov edx, esi
push eax
push ecx
push dword [ebp + 8]
push ecx
mov ecx, edi
call fcn.00406650
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 0x10], 0x41b044
xor esi, esi
mov eax, 1
mov ebx, 0x41b044
xchg dword [ebx], eax
test eax, eax
setne al
test al, al
je 0x406c53
mov eax, esi
inc esi
test eax, 0x3ff
jne 0x406c43
call sub.KERNEL32.dll_SwitchToThread
mov eax, 1
xchg dword [ebx], eax
test eax, eax
setne al
test al, al
jne 0x406c34
mov byte [ebp - 4], 1
mov eax, dword fs:[0x2c]
mov ebx, dword [eax]
mov esi, dword [ebx + 4]
test esi, esi
jne 0x406c95
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 0xc
push eax
push 0xa
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
add esp, 8
jmp 0x406ca3
push edi
mov ecx, esi
call dword [0x4131fc]
call esi
add esp, 4
cmp dword [0x41b048], 0
je 0x406ce5
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov esi, dword [0x41b04c]
add esp, 4
cmp esi, eax
jne 0x406cca
cmp dword [ebx + 4], 0
je 0x406ce5
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.00406620
push esi
push 0xa
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
add esp, 0x10
nop
mov dword [0x41b044], 0
test edi, edi
je 0x406d26
mov ecx, dword [ebp - 0x14]
mov eax, edi
sub ecx, edi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x406d1c
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x406d1c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edi
call fcn.0040e263
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret