joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018e2
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435458
push 0x430050
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x20], bl
mov dword [ebp - 0x1c], ebx
push 0x8625ffff
movsx eax, byte [0x43bbce]
push eax
call fcn.00411d1f
mov word [0x43bbe4], ax
push 0x83ffff
movsx eax, ax
push eax
call fcn.00411e04
mov word [0x43bbd8], ax
push 0xa005ffff
push 0x894dffff
call fcn.00411d1f
add esp, 0x18
add word [0x43bbe4], ax
mov dword [ebp - 4], ebx
movsx eax, byte [0x43bbcd]
and eax, 0xc28dffff
mov dword [0x43bbf4], eax
movsx eax, word [0x43bbda]
push eax
push 0xefc9ffff
call fcn.00411dc3
mov byte [0x43bbcd], al
push 0x4e
call fcn.004163e0
add esp, 0xc
call eax
test eax, 0x80000000
je 0x4019cd
mov al, byte [0x43bbd8]
mov byte [0x43bbcf], al
mov eax, dword fs:[0x20]
mov dword [ebp - 0x1c], eax
movsx eax, byte [0x43bbd0]
or eax, 0x96d3ffff
mov word [0x43bbe0], ax
movsx ax, byte [0x43bbcb]
dec eax
add word [0x43bbd2], ax
jmp 0x401b0e
push 0xc79bffff
push 0x7493ffff
call fcn.00411e04
add dword [0x43bbfc], eax
mov al, byte [0x43bbcc]
imul eax, eax, 0x849dffff
mov byte [0x43bbcc], al
movsx eax, word [0x43bbd6]
push eax
movsx eax, word [0x43bbe0]
push eax
call fcn.00411d58
add esp, 0x10
mov word [0x43bbd4], ax
push edx
push ecx
push eax
add eax, 0xe71bffff
nop
imul eax, eax, 0x8e25ffff
or ecx, edx
dec eax
pop eax
pop ecx
pop edx
mov ebx, dword fs:[0x30]
push ecx
push ebx
push eax
or ebx, 0x152dffff
nop
add ecx, 0x63f3ffff
dec eax
mov ecx, 0xd13bffff
pop eax
pop ebx
pop ecx
mov bl, byte [ebx + 2]
push ebx
push eax
or ebx, ebx
and eax, 0xc1cdffff
dec ebx
inc eax
add ebx, 0x4623ffff
pop eax
pop ebx
movzx ebx, bl
push edx
push ecx
push ebx
push eax
xor ebx, edx
sub ebx, 0x1093ffff
sub ecx, 0x226fffff
or ecx, eax
dec edx
pop eax
pop ebx
pop ecx
pop edx
mov dword [ebp - 0x1c], ebx
push ecx
push ebx
push eax
inc ecx
dec ebx
or ecx, eax
xor ecx, 0x1fd7ffff
pop eax
pop ebx
pop ecx
movsx eax, word [0x43bbd2]
push eax
movsx eax, byte [0x43bbcc]
push eax
call fcn.00411d1f
mov word [0x43bbd6], ax
push 0x9d0bffff
movsx eax, byte [0x43bbce]
push eax
call fcn.00411cd8
add esp, 0x10
add byte [0x43bbd1], al
mov dword [0x43bbf4], 0xcf77ffff
jmp 0x401b0e
or dword [ebp - 4], 0xffffffff
sub dword [0x43bc04], 0xc000001
push 0x4ce5ffff
push 0x9177ffff
call fcn.00411d1f
add byte [0x43bbd0], al
push 0xc101ffff
push 0x21fbffff
call fcn.00411dc3
add esp, 0x10
add byte [0x43bbcf], al
cmp dword [ebp - 0x1c], 0
je 0x401b53
mov byte [ebp - 0x20], 1
mov al, byte [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40701e
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 4
push 0x40
mov dword [ebp - 8], eax
call fcn.004163e0
pop ecx
call eax
mov edi, eax
cmp edi, 0xffffffff
je 0x4070c7
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x4070c0
push esi
cmp dword [ebp - 0x24], 0x10
jb 0x4070aa
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
jne 0x4070aa
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], eax
je 0x4070aa
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x4070aa
cmp byte [ebp + 8], 0
push esi
je 0x407099
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x40709f
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
push 0x37
call fcn.004163e0
pop ecx
call eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x407062
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
leave
ret
Function at 0x4088a4
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x430bf1
call fcn.00430000
push ecx
push ecx
mov al, byte [ebp - 0xd]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], esi
push ebx
mov byte [esi], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x10]
push ebx
mov dword [ebp - 4], ebx
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x20]
push ebx
mov byte [ebp - 4], 1
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x30]
push ebx
mov byte [ebp - 4], 2
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x40]
push ebx
mov byte [ebp - 4], 3
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x50]
push ebx
mov byte [ebp - 4], 4
mov byte [ecx], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], 0x64
mov byte [esi + 0x7c], bl
mov byte [esi + 0x7d], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40958f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [0x43bbe8]
mov byte [0x43bbc9], 1
push 0xf367ffff
call fcn.00411d90
add word [0x43bbdc], ax
movsx eax, byte [0x43bbc8]
push eax
movsx eax, byte [0x43bbd1]
push eax
call fcn.00411c25
add byte [0x43bbc8], al
movsx eax, byte [0x43bbc9]
push eax
movsx eax, word [0x43bbd6]
push eax
call fcn.00411d90
add dword [0x43bbec], eax
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push dword [0x43bc00]
mov dword [0x43bbf8], eax
push 0x5d1fffff
call fcn.00411d58
cmp byte [0x43b9b8], 0
pop ecx
pop ecx
mov word [0x43bbe4], ax
jne 0x4096da
mov al, byte [0x43bbfc]
mov esi, dword [0x43b974]
mov byte [0x43bbc9], al
movsx eax, word [0x43bbd4]
and eax, 0xdfedffff
mov dword [0x43bc0c], eax
mov al, byte [esi]
add al, 0x79
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.00430020
mov ecx, esp
push 0x40
mov edx, esi
call fcn.0042c1e6
push eax
push 0x43b978
call sub.MSVCRT.dll_memcpy
mov ax, word [0x43bbd8]
push 0x4a27ffff
add word [0x43bbd4], ax
mov byte [0x43b9b8], 1
movsx eax, byte [0x43bbca]
movsx ecx, word [0x43bbd2]
movsx edx, byte [0x43bbd0]
imul ecx, eax
add edx, dword [0x43bc0c]
push eax
lea ecx, [edx + ecx - 0x5e35ffff]
mov dword [0x43bc0c], ecx
call fcn.00411cac
mov word [0x43bbda], ax
push 0x7ae1ffff
movsx ax, byte [0x43bbcf]
sub word [0x43bbde], ax
push 0x209dffff
call fcn.00411cd8
add esp, 0x1c
add byte [0x43bbca], al
push dword [0x43bbf4]
or byte [0x43bbce], 0xff
dec word [0x43bbe2]
push 0x52b9ffff
call fcn.00411dc3
mov esi, dword [ebp + 8]
add byte [0x43bbc8], al
push 0x9f13ffff
mov eax, dword [esi]
shr eax, 0x1a
mov bl, byte [eax + 0x43b978]
movsx eax, byte [0x43bbcd]
push eax
call fcn.00411d58
cmp dword [0x43bbe8], 0
mov word [0x43bbe0], ax
mov ecx, 0x72f3ffff
push 0x70c7ffff
setne al
mov byte [0x43bbcb], al
push 0x2977ffff
movsx eax, word [0x43bbd6]
sub ecx, eax
add dword [0x43bbec], ecx
shl dword [esi], 6
call fcn.00411e04
add esp, 0x18
mov word [0x43bbda], ax
lea esp, [ebp - 8]
mov al, bl
pop esi
pop ebx
pop ebp
ret
Function at 0x4125df
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
push ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
push 0x3a
call fcn.004163e0
pop ecx
call eax
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_GetFocus]
cmp dword [ebp + 8], 0xffffffff
mov byte [0x43bbcf], al
je 0x4127f5
push esi
push edi
push 0x5e81ffff
push 0x7c9dffff
mov dword [ebp - 0xc], ebx
call fcn.00411d90
add byte [0x43bbce], al
push 0x2e27ffff
push 0xf1f1ffff
call fcn.00411dc3
add byte [0x43bbc9], al
mov edi, 0x93
push edi
lea eax, [ebp - 0xa0]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x703fffff
mov dword [ebp - 0xa0], ebx
push dword [0x43bc04]
call fcn.00411e4a
mov word [0x43bbd8], ax
push 0x8625ffff
movsx eax, byte [0x43bbce]
push eax
mov dword [ebp - 0x9c], ebx
call fcn.00411d1f
mov word [0x43bbe4], ax
push 0x83ffff
movsx eax, ax
push eax
call fcn.00411e04
push 0xa005ffff
push 0x894dffff
mov word [0x43bbd8], ax
call fcn.00411d1f
add word [0x43bbe4], ax
mov esi, 0x487
push esi
lea eax, [ebp - 0x528]
push ebx
push eax
call sub.MSVCRT.dll_memset
movsx eax, byte [0x43bbcd]
and eax, 0xc28dffff
add esp, 0x48
mov dword [0x43bbf4], eax
movsx eax, word [0x43bbda]
push eax
push 0xefc9ffff
call fcn.00411dc3
mov byte [0x43bbcd], al
mov al, byte [0x43bbd8]
pop ecx
mov byte [0x43bbcf], al
pop ecx
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x528]
push esi
push eax
lea eax, [ebp - 0xa0]
push edi
push eax
push 0x2d1400
push dword [ebp + 8]
push 0x63
call fcn.004163e0
pop ecx
call eax
pop edi
pop esi
test eax, eax
je 0x412769
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x528]
push eax
call fcn.004120b1
movsx ax, byte [0x43bbcb]
or word [0x43bbe0], 0xffff
dec eax
add word [0x43bbd2], ax
mov dword [ebp - 4], 1
push 0xc79bffff
push 0x7493ffff
call fcn.00411e04
add dword [0x43bbfc], eax
mov al, byte [0x43bbcc]
neg al
mov byte [0x43bbcc], al
movsx eax, word [0x43bbd6]
push eax
movsx eax, word [0x43bbe0]
push eax
call fcn.00411d58
add esp, 0x10
mov word [0x43bbd4], ax
push dword [ebp + 8]
push 0x37
call fcn.004163e0
pop ecx
call eax
movsx eax, word [0x43bbd2]
push eax
movsx eax, byte [0x43bbcc]
push eax
call fcn.00411d1f
mov word [0x43bbd6], ax
push 0x9d0bffff
movsx eax, byte [0x43bbce]
push eax
call fcn.00411cd8
add esp, 0x10
add byte [0x43bbd1], al
mov dword [0x43bbf4], 0xcf77ffff
movsx eax, byte [0x43bbc8]
push eax
push dword [0x43bc0c]
call fcn.00411d1f
cmp dword [0x43bbe8], ebx
pop ecx
pop ecx
mov dword [0x43bbec], eax
jne 0x412826
cmp byte [0x43bbd0], bl
mov word [0x43bbe2], bx
je 0x41282f
mov word [0x43bbe2], 1
mov eax, dword [ebp - 4]
pop ebx
leave
ret 4
Function at 0x412af4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [0x43bc04]
push 0x62b7ffff
call fcn.00411e04
mov byte [0x43bbca], al
movsx eax, word [0x43bbde]
push eax
push 0xfa2fffff
call fcn.00411d1f
add esp, 0x10
lea ecx, [ebp - 8]
mov word [0x43bbde], ax
call fcn.0040927e
mov esi, dword [ebp + 8]
lea ecx, [ebp - 8]
movsx ax, byte [0x43bbc9]
mov edi, dword [esi + 8]
sub word [0x43bbde], ax
push edi
call fcn.004092b8
push dword [0x43bc00]
mov ebx, eax
push 0x5619ffff
call fcn.00411d90
add dword [0x43bbe8], eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
add byte [0x43bbc8], al
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [esp], 0x7ef3ffff
push 0x4a9ffff
mov dword [ebp - 4], eax
call fcn.00411e04
add word [0x43bbd6], ax
mov esi, dword [esi + 4]
pop ecx
test esi, esi
pop ecx
jne 0x412ba8
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push edi
push esi
push dword [ebp - 4]
call sub.MSVCRT.dll_memcpy
movsx eax, byte [0x43bbce]
push 0x2bc9ffff
push eax
call fcn.00411d58
add word [0x43bbe4], ax
push edi
push dword [ebp - 4]
call fcn.00412837
mov eax, dword [0x43bbe8]
dec word [0x43bbda]
imul eax, eax, 0x8583ffff
mov dword [0x43bc00], eax
lea eax, [ebx + 1]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x20
cmp byte [0x43bbcc], 0
mov esi, eax
je 0x412c10
cmp byte [0x43bbd1], 0
je 0x412c10
push 1
pop eax
jmp 0x412c12
xor eax, eax
add dword [0x43bc0c], eax
movsx eax, byte [0x43bbcd]
push eax
push 0xee67ffff
call fcn.00411d90
push dword [0x43bc08]
add word [0x43bbd6], ax
push 0xc03dffff
call fcn.00411cac
add esp, 0x10
lea ecx, [ebp - 8]
mov dword [0x43bbf0], eax
push esi
push edi
push dword [ebp - 4]
call fcn.00409d1e
push dword [0x43bbe8]
mov byte [0x43bbc9], 1
push 0xf367ffff
call fcn.00411d90
add word [0x43bbdc], ax
and byte [esi + ebx], 0
movsx eax, byte [0x43bbc8]
push eax
movsx eax, byte [0x43bbd1]
push eax
call fcn.00411c25
add byte [0x43bbc8], al
movsx eax, byte [0x43bbc9]
push eax
movsx eax, word [0x43bbd6]
push eax
call fcn.00411d90
add dword [0x43bbec], eax
push esi
call sub.MSVCRT.dll_strlen
mov ecx, dword [ebp + 8]
add esp, 0x1c
push eax
push esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push dword [0x43bc00]
mov dword [0x43bbf8], eax
push 0x5d1fffff
call fcn.00411d58
push dword [ebp - 4]
mov word [0x43bbe4], ax
call fcn.0042ff5a
push esi
call fcn.0042ff5a
mov al, byte [0x43bbfc]
add esp, 0x10
mov byte [0x43bbc9], al
movsx eax, word [0x43bbd4]
and eax, 0xdfedffff
pop edi
pop esi
mov dword [0x43bc0c], eax
pop ebx
leave
ret
Function at 0x417a41
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push 0xc
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
xor ecx, ecx
cmp eax, ecx
je 0x417a66
mov edx, dword [ebp + 8]
mov dword [eax], esi
mov dword [eax + 4], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 8], edx
jmp 0x417a68
xor eax, eax
lea edx, [ebp - 4]
push edx
push ecx
push eax
push 0x417a11
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
push 0x37
call fcn.004163e0
pop ecx
call eax
pop esi
leave
ret 8
Function at 0x41f8fc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movsx ax, byte [0x43bbc9]
sub word [0x43bbde], ax
push esi
push edi
push dword [0x43bc00]
push 0x5619ffff
call fcn.00411d90
add dword [0x43bbe8], eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
add byte [0x43bbc8], al
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x7ef3ffff
push 0x4a9ffff
call fcn.00411e04
mov esi, dword [ebp + 8]
add word [0x43bbd6], ax
mov eax, esi
xor edx, edx
div dword [ebp - 0x24]
movsx eax, byte [0x43bbce]
push 0x2bc9ffff
push eax
mov edi, edx
call fcn.00411d58
add word [0x43bbe4], ax
mov eax, dword [0x43bbe8]
imul eax, eax, 0x8583ffff
mov dword [0x43bc00], eax
add esp, 0x10
sub esi, edi
dec word [0x43bbda]
xor eax, eax
cmp byte [0x43bbcc], al
je 0x41f9ad
cmp byte [0x43bbd1], al
je 0x41f9ad
push 1
pop eax
add dword [0x43bc0c], eax
movsx eax, byte [0x43bbcd]
push eax
push 0xee67ffff
call fcn.00411d90
push dword [0x43bc08]
add word [0x43bbd6], ax
push 0xc03dffff
call fcn.00411cac
add esp, 0x10
mov dword [0x43bbf0], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
add edi, eax
push 0x40
push edi
push esi
push 0x5f
call fcn.004163e0
pop ecx
call eax
pop edi
pop esi
leave
ret
Function at 0x425e93
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0xbc81ffff
mov esi, ecx
push 0x2da9ffff
call fcn.00411e4a
add word [0x43bbde], ax
push 8
lea eax, [esi + 0x10]
push 0
push eax
call sub.MSVCRT.dll_memset
mov dword [esi], 0x67452301
push dword [0x43bc04]
push 0x62b7ffff
call fcn.00411e04
mov byte [0x43bbca], al
movsx eax, word [0x43bbde]
push eax
push 0xfa2fffff
call fcn.00411d1f
mov word [0x43bbde], ax
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
movsx ax, byte [0x43bbc9]
sub word [0x43bbde], ax
mov dword [esi + 0xc], 0x10325476
push dword [0x43bc00]
push 0x5619ffff
call fcn.00411d90
add dword [0x43bbe8], eax
add esp, 0x2c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
add byte [0x43bbc8], al
pop esi
ret
Function at 0x425f37
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x7ef3ffff
mov esi, ecx
push 0x4a9ffff
call fcn.00411e04
add word [0x43bbd6], ax
mov ebx, dword [esi + 0x10]
movsx eax, byte [0x43bbce]
shr ebx, 3
push 0x2bc9ffff
push eax
and ebx, 0x3f
call fcn.00411d58
add word [0x43bbe4], ax
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov edx, eax
shl ecx, 3
add dword [esi + 0x10], ecx
mov ecx, dword [esi + 0x10]
shl edx, 3
add esp, 0x10
cmp ecx, edx
jae 0x425f94
inc dword [esi + 0x14]
mov ecx, dword [0x43bbe8]
dec word [0x43bbda]
imul ecx, ecx, 0x8583ffff
shr eax, 0x1d
mov dword [0x43bc00], ecx
add dword [esi + 0x14], eax
cmp byte [0x43bbcc], 0
je 0x425fca
cmp byte [0x43bbd1], 0
je 0x425fca
push 1
pop eax
jmp 0x425fcc
xor eax, eax
add dword [0x43bc0c], eax
movsx eax, byte [0x43bbcd]
push eax
push 0xee67ffff
call fcn.00411d90
push dword [0x43bc08]
add word [0x43bbd6], ax
push 0xc03dffff
call fcn.00411cac
push 0x40
mov dword [0x43bbf0], eax
pop edi
mov byte [0x43bbc9], 1
push dword [0x43bbe8]
sub edi, ebx
push 0xf367ffff
call fcn.00411d90
add word [0x43bbdc], ax
add esp, 0x18
cmp dword [ebp + 0xc], edi
jb 0x426120
movsx eax, byte [0x43bbc8]
push eax
movsx eax, byte [0x43bbd1]
push eax
call fcn.00411c25
add byte [0x43bbc8], al
movsx eax, byte [0x43bbc9]
push eax
movsx eax, word [0x43bbd6]
push eax
call fcn.00411d90
add dword [0x43bbec], eax
push edi
push dword [ebp + 8]
lea eax, [ebx + esi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push dword [0x43bc00]
mov dword [0x43bbf8], eax
push 0x5d1fffff
call fcn.00411d58
pop ecx
mov word [0x43bbe4], ax
pop ecx
lea eax, [esi + 0x18]
push eax
mov ecx, esi
call fcn.00426370
mov al, byte [0x43bbfc]
lea ecx, [edi + 0x3f]
mov byte [0x43bbc9], al
movsx eax, word [0x43bbd4]
and eax, 0xdfedffff
cmp ecx, dword [ebp + 0xc]
mov dword [0x43bc0c], eax
jae 0x4260e8
mov ebx, ecx
mov eax, dword [ebp + 8]
mov ecx, esi
lea eax, [eax + ebx - 0x3f]
push eax
call fcn.00426370
add ebx, 0x40
add edi, 0x40
cmp ebx, dword [ebp + 0xc]
jb 0x4260c9
mov eax, dword [0x43bc0c]
mov cx, word [0x43bbd8]
add word [0x43bbd4], cx
movsx ecx, word [0x43bbd2]
movsx edx, byte [0x43bbca]
imul ecx, edx
movsx edx, byte [0x43bbd0]
add edx, eax
xor ebx, ebx
lea eax, [edx + ecx - 0x5e35ffff]
mov dword [0x43bc0c], eax
jmp 0x426122
xor edi, edi
movsx eax, byte [0x43bbca]
push 0x4a27ffff
push eax
call fcn.00411cac
mov word [0x43bbda], ax
push 0x7ae1ffff
movsx ax, byte [0x43bbcf]
sub word [0x43bbde], ax
push 0x209dffff
call fcn.00411cd8
add byte [0x43bbca], al
mov eax, dword [ebp + 0xc]
sub eax, edi
push eax
mov eax, dword [ebp + 8]
add edi, eax
lea eax, [ebx + esi + 0x18]
push edi
push eax
call sub.MSVCRT.dll_memcpy
or byte [0x43bbce], 0xff
add esp, 0x1c
dec word [0x43bbe2]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42878c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movsx eax, byte [0x43bbd0]
push ebx
push esi
push edi
push 0xc917ffff
mov esi, ecx
push eax
call fcn.00411e4a
mov byte [0x43bbce], al
movsx eax, byte [0x43bbcd]
push eax
push 0xc37bffff
call fcn.00411e04
add byte [0x43bbca], al
xor ebx, ebx
add esp, 0x10
cmp dword [esi + 4], ebx
jne 0x428917
push 0xd82bffff
push 0x66fbffff
call fcn.00411d1f
mov eax, dword [0x43bbf4]
pop ecx
neg eax
mov word [0x43bbe4], ax
mov eax, dword [esi]
cmp eax, ebx
pop ecx
jne 0x4287fb
xor edi, edi
jmp 0x428804
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov edi, eax
dec byte [0x43bbd0]
push 0xb1d5ffff
push dword [0x43bc04]
call fcn.00411c63
mov dword [0x43bc00], eax
push 0x4387ffff
movsx eax, word [0x43bbd6]
push eax
call fcn.00411cac
add byte [0x43bbcf], al
inc edi
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x14
mov dword [esi + 4], eax
cmp byte [0x43bbca], bl
jne 0x42885a
cmp dword [0x43bbf8], ebx
mov byte [0x43bbc9], bl
je 0x428861
mov byte [0x43bbc9], 1
push 0xb115ffff
push dword [0x43bbf0]
call fcn.00411cd8
pop ecx
mov dword [0x43bbe8], eax
cmp dword [esi], ebx
pop ecx
je 0x428912
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add dword [0x43bc04], eax
push 0x27fffff
movsx eax, byte [0x43bbd1]
push eax
call fcn.00411cac
pop ecx
mov word [0x43bbd2], ax
pop ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov byte [0x43bbcf], al
mov eax, dword [esi]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x4288be
xor edi, edi
jmp 0x4288ed
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 4], eax
add eax, 3
and al, 0xfc
call fcn.00430020
mov edi, esp
push ebx
push ebx
push dword [ebp - 4]
mov byte [edi], bl
push edi
push 0xffffffffffffffff
push dword [ebp - 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
push dword [esi + 4]
call sub.MSVCRT.dll_strcpy
movsx eax, word [0x43bbda]
push eax
push 0x27a3ffff
call fcn.00411d1f
add esp, 0x10
mov dword [0x43bbf4], eax
jmp 0x428917
mov eax, dword [esi + 4]
mov byte [eax], bl
movsx eax, word [0x43bbd8]
push 0x294bffff
push eax
call fcn.00411c25
add byte [0x43bbcb], al
mov eax, dword [0x43bc00]
and eax, dword [0x43bbf4]
pop ecx
pop ecx
mov word [0x43bbd8], ax
mov al, byte [0x43bc08]
lea esp, [ebp - 0x14]
mov byte [0x43bbd0], al
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42c030
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [0x43bc00]
push 0x5619ffff
call fcn.00411d90
add dword [0x43bbe8], eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov esi, dword [ebp + 8]
add byte [0x43bbc8], al
push 0x7ef3ffff
push 0x4a9ffff
mov eax, dword [esi + 4]
mov ebx, dword [esi]
mov dword [ebp + 8], eax
call fcn.00411e04
add word [0x43bbd6], ax
push 0x2bc9ffff
movsx eax, byte [0x43bbce]
push eax
call fcn.00411d58
add word [0x43bbe4], ax
and dword [ebp - 4], 0
add esp, 0x10
cmp dword [ebp + 0x10], 0
jle 0x42c17e
push edi
inc bl
mov edx, dword [0x43bbe8]
movzx eax, bl
imul edx, edx, 0x8583ffff
mov ecx, dword [esi + eax*4 + 8]
mov dword [ebp - 8], eax
lea eax, [esi + eax*4 + 8]
mov dword [ebp - 0xc], ecx
add cl, byte [ebp + 8]
dec word [0x43bbda]
mov dword [0x43bc00], edx
movzx ecx, cl
mov ebx, dword [esi + ecx*4 + 8]
mov dword [ebp + 8], ecx
lea edi, [esi + ecx*4 + 8]
mov dword [eax], ebx
cmp byte [0x43bbcc], 0
je 0x42c0fe
cmp byte [0x43bbd1], 0
je 0x42c0fe
push 1
pop eax
jmp 0x42c100
xor eax, eax
add dword [0x43bc0c], eax
movsx eax, byte [0x43bbcd]
push eax
push 0xee67ffff
call fcn.00411d90
push dword [0x43bc08]
add word [0x43bbd6], ax
push 0xc03dffff
call fcn.00411cac
mov ecx, dword [ebp - 0xc]
mov dword [0x43bbf0], eax
mov eax, dword [ebp + 0xc]
add bl, cl
mov dword [edi], ecx
mov edi, dword [ebp - 4]
movzx ecx, bl
add eax, edi
mov cl, byte [esi + ecx*4 + 8]
xor byte [eax], cl
push dword [0x43bbe8]
mov byte [0x43bbc9], 1
push 0xf367ffff
call fcn.00411d90
add word [0x43bbdc], ax
mov ebx, dword [ebp - 8]
add esp, 0x18
inc edi
cmp edi, dword [ebp + 0x10]
mov dword [ebp - 4], edi
jl 0x42c0a8
pop edi
movsx eax, byte [0x43bbc8]
push eax
movsx eax, byte [0x43bbd1]
push eax
call fcn.00411c25
add byte [0x43bbc8], al
movsx eax, byte [0x43bbc9]
push eax
movsx eax, word [0x43bbd6]
push eax
call fcn.00411d90
add dword [0x43bbec], eax
add esp, 0x10
mov dword [esi], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push dword [0x43bc00]
mov dword [0x43bbf8], eax
push 0x5d1fffff
call fcn.00411d58
mov word [0x43bbe4], ax
mov eax, dword [ebp + 8]
pop ecx
mov dword [esi + 4], eax
pop ecx
pop esi
pop ebx
leave
ret