joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ab58
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push ecx
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x41adaf
js 0x41adaf
shl eax, 2
push 0x40
push 0x1000
push eax
push 0
call fcn.0042866c
mov dword [ebp - 0xc], eax
or eax, eax
jne 0x41ab91
jmp 0x41adaf
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
push dword [esi + 0x1c]
pop dword [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], 0
jmp 0x41ad92
mov ebx, 0
mov bl, byte [eax]
cmp bl, 0x20
jne 0x41abdb
push dword [ebp - 4]
pop dword [ebp - 0x14]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
je 0x41abdb
mov dword [esi + 0x24], 1
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
shl eax, 2
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
push eax
push dword [ebp - 8]
push dword [ebp - 8]
push dword [esi + 0x10]
call fcn.00428a44
or eax, eax
jne 0x41ac02
jmp 0x41adaf
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x2c]
push dword [ebx]
pop dword [ebp - 0x30]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
lea eax, [eax + eax*2]
shr eax, 1
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 8]
sub eax, dword [ebp - 0x30]
cmp dword [ebp - 0x2c], eax
jbe 0x41ad89
push dword [ebp - 0x18]
pop dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
add eax, dword [ebp + 0xc]
cmp byte [eax], 0x20
je 0x41ac47
cmp byte [eax + 1], 0x20
jne 0x41ac5c
push dword [ebp - 4]
pop dword [ebp - 0x18]
call fcn.0041ac6e
call fcn.0041ace4
jmp 0x41ad6c
cmp dword [ebp - 0x14], 0
jbe 0x41ad43
push dword [ebp - 0x14]
pop dword [ebp - 0x18]
jmp 0x41acce
call fcn.0041ac6e
inc dword [ebp - 0x18]
push dword [ebp - 0x18]
pop dword [ebp - 0x1c]
push dword [ebp - 4]
pop dword [ebp - 0x18]
jmp 0x41ad0b
call fcn.0041ace4
call fcn.0041ac6e
jmp 0x41ad41
jmp 0x41ad6c
push dword [ebp - 4]
pop dword [ebp - 0x18]
cmp dword [esi + 0x24], 1
jne 0x41ad62
call fcn.0041ace4
call fcn.0041ac6e
mov dword [esi + 0x24], 0
jmp 0x41ad6c
call fcn.0041ac6e
call fcn.0041ace4
inc dword [ebp - 0x18]
mov dword [ebp - 0x14], 0
push dword [esi + 0x1c]
pop dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0
jne 0x41ad89
mov dword [esi + 0x24], 0
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, dword [ebp + 0xc]
cmp byte [eax], 0
jne 0x41abba
push dword [ebp - 0x18]
pop dword [ebp - 0x1c]
push dword [ebp - 4]
pop dword [ebp - 0x18]
dec dword [ebp - 0x18]
call fcn.0041ac6e
Function at 0x41b2d9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
push ebx
push esi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0x41b198
push dword [ebp + 0xc]
lea eax, [edi + 0x28]
push eax
call fcn.0041b5aa
or eax, eax
jne 0x41b302
jmp 0x41b49f
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041b52d
or eax, eax
jne 0x41b31f
jmp 0x41b49f
mov ebx, eax
mov dword [ebx + 0x14], 0x23
push 0x40
push 0x1000
push 0x30
push 0
call fcn.0042866c
or eax, eax
jne 0x41b341
jmp 0x41b49f
mov dword [ebx + 0x3c], eax
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [esi + 0x28]
call fcn.0042adc0
mov dword [ebp - 0xc], ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041b52d
or eax, eax
jne 0x41b36f
jmp 0x41b49f
mov ebx, eax
mov dword [ebx + 0x14], 0x64
mov eax, dword [ebx + 0xc]
add eax, dword [edi + 0x5c]
sub eax, dword [ebx + 0x14]
mov dword [ebx + 0xc], eax
push 0x40
push 0x1000
push 0x30
push 0
call fcn.0042866c
or eax, eax
jne 0x41b39d
jmp 0x41b49f
mov dword [ebx + 0x3c], eax
mov dword [ebp - 8], eax
push str.Page
push dword [ebx + 0x3c]
call fcn.0042869c
push str.Page
call fcn.004286a2
add dword [ebp - 8], eax
push dword [ebp - 8]
push dword [esi + 0xc]
call fcn.0042adc0
mov dword [ebx + 0x38], 1
mov dword [ebp - 0x10], ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041b52d
or eax, eax
jne 0x41b3ec
jmp 0x41b49f
mov ebx, eax
push ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0xc]
add eax, dword [ebx + 0x14]
pop ebx
mov dword [ebx + 0xc], eax
push ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0xc]
pop ebx
sub eax, dword [ebx + 0xc]
mov dword [ebx + 0x14], eax
push dword [edi + 0x1c]
pop dword [ebx + 0x44]
push dword [edi + 0x20]
pop dword [ebx + 0x48]
push esi
call fcn.0041b4a6
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], 1
cmp dword [esi + 0x2c], 1
jne 0x41b435
mov dword [ebx + 0x68], 0x8000ff
jmp 0x41b43c
mov dword [ebx + 0x68], 0xff0000
mov dword [ebx + 0x6c], 1
mov dword [ebx + 0x5c], 0x3b8
mov dword [ebx + 0x60], 3
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041b52d
or eax, eax
jne 0x41b468
jmp 0x41b49f
mov ebx, eax
push ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x10]
add eax, dword [ebx + 0x18]
pop ebx
mov dword [ebx + 0x10], eax
push dword [edi + 0x5c]
pop dword [ebx + 0x14]
push dword [edi + 0x64]
pop dword [ebx + 0x18]
mov eax, dword [ebx + 0x10]
add eax, dword [ebx + 0x18]
mov dword [edi + 0x54], eax
push dword [edi + 0x1c]
pop dword [ebx + 0x44]
push dword [edi + 0x20]
pop dword [ebx + 0x48]
push dword [esi + 0x1c]
pop dword [ebx + 0x3c]
pop esi
pop ebx
pop edi
leave
ret 0xc
Function at 0x41b4a6
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], 0
mov eax, dword [edi + 0x20]
sub eax, 0x14
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x20]
add eax, dword [edi + 0x24]
add eax, 0x14
mov dword [ebp - 8], eax
push dword [edi + 0x1c]
call fcn.004286a2
mov dword [ebp - 0xc], eax
push dword [edi + 0x1c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.0041aad0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x41b4f4
jmp 0x41b525
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
inc eax
push 0x40
push 0x1000
push eax
push 0
call fcn.0042866c
or eax, eax
jne 0x41b510
jmp 0x41b525
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x1c]
add eax, dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push eax
call fcn.0042b450
mov eax, dword [ebp - 0x10]
pop edi
leave
ret 4

Function at 0x41b5e1
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
push ebx
push esi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0x41b198
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call fcn.0041b5aa
or eax, eax
jne 0x41b609
jmp 0x41b731
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041b52d
or eax, eax
jne 0x41b626
jmp 0x41b731
mov ebx, eax
mov dword [ebx + 0x14], 0x41
lea eax, str.Previous
mov dword [ebx + 0x3c], eax
mov dword [ebp - 0xc], ebx
mov dword [ebx + 0x68], 0xff0000
mov dword [ebx + 0x6c], 1
push dword [ebp + 0x18]
pop dword [ebx + 0x5c]
mov dword [ebx + 0x60], 1
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041b52d
or eax, eax
jne 0x41b670
jmp 0x41b731
mov ebx, eax
mov dword [ebx + 0x14], 0x3c
mov eax, dword [ebx + 0xc]
add eax, dword [edi + 0x5c]
sub eax, dword [ebx + 0x14]
mov dword [ebx + 0xc], eax
lea eax, str.Next
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x68], 0xff0000
mov dword [ebx + 0x6c], 1
mov dword [ebx + 0x38], 1
mov dword [ebp - 0x10], ebx
push dword [ebp + 0x1c]
pop dword [ebx + 0x5c]
mov dword [ebx + 0x60], 2
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041b52d
or eax, eax
jne 0x41b6ca
jmp 0x41b731
mov ebx, eax
push ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0xc]
add eax, dword [ebx + 0x14]
pop ebx
mov dword [ebx + 0xc], eax
push ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0xc]
pop ebx
sub eax, dword [ebx + 0xc]
mov dword [ebx + 0x14], eax
push 0x40
push 0x1000
push 0x80
push 0
call fcn.0042866c
or eax, eax
jne 0x41b701
jmp 0x41b731
mov dword [ebx + 0x3c], eax
push dword [ebp + 0x20]
push dword [ebx + 0x3c]
call fcn.0042869c
push dword [ebx + 0x3c]
call fcn.004286a2
add eax, dword [ebx + 0x3c]
push eax
push dword [ebp + 0x24]
call fcn.0042adc0
mov dword [ebx + 0x40], 1
mov dword [ebx + 0x38], 2
pop esi
pop ebx
pop edi
leave
ret 0x20
Function at 0x41b958
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0x28]
call fcn.004191d5
push 0xc
lea eax, [edi + 0x28]
push eax
call fcn.00428642
mov dword [edi + 0x44], 0
cmp dword [edi + 0x34], 0
jne 0x41b988
push dword [edi + 8]
pop dword [edi + 0x34]
cmp dword [0x43e0cb], 0
jne 0x41b9cd
lea eax, [ebp - 0x18]
push eax
push dword [edi + 0x48]
call fcn.00428846
mov eax, dword [ebp - 0x18]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0xc], eax
push dword [ebp - 0x10]
pop dword [0x43e0cb]
push dword [ebp - 0x10]
pop dword [0x43e0c3]
push dword [ebp - 0xc]
pop dword [0x43e0cf]
push dword [ebp - 0xc]
pop dword [0x43e0c7]
cmp dword [0x43e0d3], 0
jne 0x41b9e0
mov dword [0x43e0d3], 5
push dword [ebp + 8]
call fcn.0041b738
push dword [edi + 0x40]
push dword [ebp + 8]
call fcn.0041becf
cmp eax, dword [0x43e0c7]
jb 0x41ba02
mov dword [0x43e0c7], eax
jmp 0x41ba36
mov dword [ebp - 4], 0
jmp 0x41ba20
mov dword [ebp - 4], 1
inc dword [edi + 0x40]
push dword [edi + 0x40]
push dword [ebp + 8]
call fcn.0041becf
cmp eax, 0
jbe 0x41ba2d
cmp eax, dword [0x43e0c7]
jbe 0x41ba0b
cmp dword [ebp - 4], 1
jne 0x41ba36
dec dword [edi + 0x40]
push dword [ebp + 8]
call fcn.0041b21a
cmp dword [edi + 0x30], 1
ja 0x41ba56
cmp dword [edi + 0xec], 0
jbe 0x41ba6c
cmp dword [0x43e0d3], 5
jbe 0x41ba6c
push 4
push dword [ebp + 8]
call fcn.0041becf
cmp eax, 0
jbe 0x41baa9
mov dword [0x43e0cf], eax
jmp 0x41baa9
cmp dword [0x43e0d3], 5
ja 0x41ba7b
cmp dword [edi + 0x20], 0
jbe 0x41ba9d
push 1
push dword [ebp + 8]
call fcn.0041becf
cmp eax, 0
jbe 0x41ba8f
mov dword [0x43e0cf], eax
push dword [0x43e0cf]
pop dword [0x43e0c7]
jmp 0x41baa9
push dword [0x43e0cf]
pop dword [0x43e0c7]
push dword [edi + 0x28]
push dword [ebp + 8]
call fcn.0041bb64
push 1
push dword [edi + 0x48]
call fcn.0041c0e0
lea eax, [ebp - 0x18]
push eax
push dword [edi + 0x48]
call fcn.004287a4
push dword [0x43e0d3]
pop dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x10], eax
push dword [0x43e0b3]
pop dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
sub eax, 5
mov dword [ebp - 0xc], eax
push 0x4ed
push dword [edi + 0x48]
call fcn.004287c8
mov dword [ebp - 8], eax
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 8]
call fcn.004288d6
push 5
push dword [ebp - 8]
call fcn.0042898a
mov eax, 5
shr eax, 1
sub eax, dword [ebp - 0xc]
neg eax
add eax, dword [ebp - 0x14]
sub eax, dword [edi + 0x60]
mov dword [edi + 0xfc], eax
cmp dword [edi + 0x30], 0
jbe 0x41bb48
cmp dword [edi + 0x20], 0
ja 0x41bb51
cmp dword [0x43e0d3], 5
jbe 0x41bb5f
push dword [edi + 0xfc]
push dword [edi + 0x2c]
call fcn.0041c453
pop edi
leave
ret 4
Function at 0x41bb9f
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push dword [ebp + 0xc]
pop dword [ebp - 4]
push dword [ebp + 0x10]
pop dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.004286a2
inc eax
push 0x40
push 0x1000
push eax
push 0
call fcn.0042866c
or eax, eax
jne 0x41bbe4
jmp 0x41bc43
mov dword [ebp - 8], eax
push eax
push dword [ebp - 4]
push eax
call fcn.0042868a
pop dword [ebp - 4]
push dword [ebp - 4]
call fcn.004286cc
push dword [ebp - 0xc]
call fcn.004286a2
inc eax
push 0x40
push 0x1000
push eax
push 0
call fcn.0042866c
or eax, eax
jne 0x41bc1a
jmp 0x41bc43
mov dword [ebp - 0x10], eax
push eax
push dword [ebp - 0xc]
push eax
call fcn.0042868a
pop dword [ebp - 0xc]
push dword [ebp - 0xc]
call fcn.004286cc
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0040b6e8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
je 0x41bc58
push 0x8000
push 0
push dword [ebp - 8]
call fcn.00428672
cmp dword [ebp - 0x10], 0
je 0x41bc6d
push 0x8000
push 0
push dword [ebp - 0x10]
call fcn.00428672
mov eax, dword [ebp - 0x14]
leave
ret 0xc
Function at 0x41bf39
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0xfffffffffffffff4
push dword [ebp + 8]
call fcn.00428840
mov dword [ebp - 4], eax
test dword [ebp + 0xc], 1
je 0x41bf92
cmp dword [ebp - 4], 0x44c
jbe 0x41bf92
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00428846
push dword [ebp + 8]
call fcn.00428810
mov dword [ebp - 8], eax
push 1
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push 0
call fcn.004288be
push dword [ebp - 0x18]
push 0xffffffffffffffeb
push dword [ebp + 8]
call fcn.0042896c
test dword [ebp + 0xc], 2
je 0x41bfb7
cmp dword [ebp - 4], 0x44c
jae 0x41bfb7
cmp dword [ebp - 4], 0x384
jb 0x41bfb7
push 0
push dword [ebp + 8]
call fcn.0042898a
test dword [ebp + 0xc], 4
je 0x41bfdc
cmp dword [ebp - 4], 0x44c
jae 0x41bfdc
cmp dword [ebp - 4], 0x384
jb 0x41bfdc
push 5
push dword [ebp + 8]
call fcn.0042898a
test dword [ebp + 0xc], 8
je 0x41c022
cmp dword [ebp - 4], 0x44c
jbe 0x41c00f
cmp dword [ebp - 4], 0x4f1
jne 0x41c003
push 0
push dword [ebp + 8]
call fcn.0042898a
jmp 0x41c022
push 0x10
push dword [ebp + 8]
call fcn.0041bf39
jmp 0x41c022
cmp dword [ebp - 4], 0x384
jb 0x41c022
push 4
push dword [ebp + 8]
call fcn.0041bf39
test dword [ebp + 0xc], 0x20
je 0x41c066
cmp dword [ebp - 4], 0x44c
jbe 0x41c053
cmp dword [ebp - 4], 0x4f1
jne 0x41c047
push 5
push dword [ebp + 8]
call fcn.0042898a
push 0x10
push dword [ebp + 8]
call fcn.0041bf39
jmp 0x41c066
cmp dword [ebp - 4], 0x384
jb 0x41c066
push 2
push dword [ebp + 8]
call fcn.0041bf39
test dword [ebp + 0xc], 0x10
je 0x41c0d7
cmp dword [ebp - 4], 0x44c
jbe 0x41c0d7
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00428846
mov eax, dword [ebp - 0x18]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.00428810
mov dword [ebp - 8], eax
push 1
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push 0
call fcn.004288be
push 0xffffffffffffffeb
push dword [ebp + 8]
call fcn.00428840
add eax, dword [0x43e0d3]
sub eax, 5
mov dword [ebp - 0x18], eax
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.004288d6
mov eax, 1
leave
ret 8
Function at 0x41c491
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
mov esi, dword [ebp + 8]
push 0x18
push esi
call fcn.00428642
mov dword [esi], 9
push dword [ebp + 0xc]
pop dword [esi + 4]
lea eax, [0x41c65a]
mov dword [esi + 8], eax
lea eax, [0x41c75a]
mov dword [esi + 0xc], eax
lea eax, [0x41c803]
mov dword [esi + 0x10], eax
mov eax, 0x34
mov dword [ebp - 4], eax
mul dword [esi]
push 0x40
push 0x1000
push eax
push 0
call fcn.0042866c
or eax, eax
je 0x41c608
mov dword [esi + 0x14], eax
mov edi, dword [esi + 0x14]
mov dword [edi], 0x4ec
mov dword [edi + 0x1c], 0x14
push dword [esi + 4]
push edi
call fcn.0041c612
add edi, dword [ebp - 4]
mov dword [edi], 0x3e8
mov dword [edi + 0x1c], 0x15
push dword [esi + 4]
push edi
call fcn.0041c612
add edi, dword [ebp - 4]
mov dword [edi], 0x4ef
mov dword [edi + 0x1c], 0xc
mov dword [edi + 0x20], 0xd
push dword [esi + 4]
push edi
call fcn.0041c612
add edi, dword [ebp - 4]
mov dword [edi], 0x4ee
mov dword [edi + 0x1c], 0xe
mov dword [edi + 0x20], 0xf
push dword [esi + 4]
push edi
call fcn.0041c612
add edi, dword [ebp - 4]
mov dword [edi], 0x4f1
mov dword [edi + 0x1c], 0xa
mov dword [edi + 0x20], 0xb
push dword [esi + 4]
push edi
call fcn.0041c612
add edi, dword [ebp - 4]
mov dword [edi], 0x3ea
mov dword [edi + 0x1c], 0x10
mov dword [edi + 0x20], 0x11
push dword [esi + 4]
push edi
call fcn.0041c612
add edi, dword [ebp - 4]
mov dword [edi], 0x4f2
mov dword [edi + 0x1c], 0x12
mov dword [edi + 0x20], 0x13
push dword [esi + 4]
push edi
call fcn.0041c612
add edi, dword [ebp - 4]
mov dword [edi], 0x4f3
mov dword [edi + 4], 1
mov dword [edi + 8], 0xcccccc
push dword [esi + 4]
push edi
call fcn.0041c612
add edi, dword [ebp - 4]
mov dword [edi], 0x3eb
mov dword [edi + 0x1c], 0x16
mov dword [edi + 0x20], 0x17
mov dword [edi + 4], 2
push dword [esi + 4]
push edi
call fcn.0041c612
push esi
call dword [esi + 8]
pop edi
pop esi
leave
ret 0xc
Function at 0x41ccfd
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push edi
push edx
push esi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x74], 0
je 0x41ce79
cmp dword [edi + 0x78], 0
je 0x41ce79
push dword [ebp + 8]
call fcn.0041ce80
or eax, eax
je 0x41cd31
jmp 0x41ce79
push 0x40
push 0x1000
push dword [edi + 0x78]
push 0
call fcn.0042866c
or eax, eax
jne 0x41cd4b
jmp 0x41ce79
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
push 0x144
lea eax, [ebp - 0x160]
push eax
call fcn.00428642
mov dword [ebp - 8], 0xc
mov dword [ebp - 4], 1
mov eax, dword [edi + 0xec]
jmp 0x41cdcc
push dword [ebp - 4]
lea eax, [edi + 0xe8]
push eax
call fcn.0040a93d
or eax, eax
je 0x41cdc3
mov dword [ebp - 0xc], eax
mov al, byte [eax]
cmp al, 0x5a
ja 0x41cd9c
cmp al, 0x41
jb 0x41cd9c
sub al, 0x41
jmp 0x41cdaa
cmp al, 0x7a
ja 0x41cda8
cmp al, 0x61
jb 0x41cda8
sub al, 0x61
jmp 0x41cdaa
mov al, 0x1a
and eax, 0xff
mul dword [ebp - 8]
lea edx, [ebp - 0x160]
add eax, edx
push dword [ebp - 0xc]
push eax
call fcn.0040a8ea
inc dword [ebp - 4]
mov eax, dword [edi + 0xec]
cmp dword [ebp - 4], eax
jbe 0x41cd78
mov eax, 0x1b
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
jmp 0x41ce5f
mov eax, dword [ebp - 4]
mul dword [ebp - 8]
lea edx, [ebp - 0x160]
add eax, edx
mov esi, eax
mov dword [ebp - 0x10], 1
mov eax, dword [esi + 4]
jmp 0x41ce42
inc dword [ebp - 0xc]
push dword [ebp - 0x10]
push esi
call fcn.0040a93d
or eax, eax
je 0x41ce3c
mov dword [ebp - 0x1c], eax
push eax
push dword [ebp - 0x18]
call fcn.0042869c
push dword [ebp - 0x18]
push dword [ebp - 0xc]
lea eax, [edi + 0xe8]
push eax
call fcn.0040a8be
push dword [ebp - 0x1c]
call fcn.004286a2
inc eax
add dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
mov eax, dword [esi + 4]
cmp dword [ebp - 0x10], eax
jbe 0x41ce02
push esi
call fcn.0040a82e
mov eax, dword [ebp - 4]
push dword [ebp - 0xc]
pop dword [edi + eax*4 + 0x7c]
inc dword [ebp - 4]
mov eax, 0x1b
cmp dword [ebp - 4], eax
jb 0x41cde6
push 0x8000
push 0
push dword [edi + 0x74]
call fcn.00428672
push dword [ebp - 0x14]
pop dword [edi + 0x74]
pop esi
pop edx
pop edi
leave
ret 4
Function at 0x41e047
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
call fcn.0041dfc6
or eax, eax
je 0x41e170
mov dword [ebp - 0x414], eax
push 0x104
lea eax, [ebp - 0x410]
push eax
call fcn.004285d6
push 0x43c5ad
lea eax, [ebp - 0x410]
push eax
call fcn.0042868a
push dword [0x43e057]
push 0
call fcn.0040a1e8
mov dword [ebp - 0x418], eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x410]
push eax
call fcn.0042868a
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00428588
or eax, eax
jne 0x41e170
push dword [0x44d850]
push 7
call fcn.0040a1e8
mov dword [ebp - 0x41c], eax
inc dword [ebp - 0x414]
push dword [0x43e057]
push dword [ebp - 0x414]
call fcn.0040a1e8
push 4
push dword [ebp - 0x41c]
push eax
push dword [ebp + 8]
call fcn.004288ca
cmp eax, 6
jne 0x41e170
push dword [0x43e05f]
push 3
call fcn.0040a1e8
push dword [0x43e05f]
push dword [ebp + 8]
push eax
call fcn.0041e174
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00428588
or eax, eax
jne 0x41e170
push dword [0x44d850]
push 7
call fcn.0040a1e8
mov dword [ebp - 0x41c], eax
push dword [0x43e05f]
push 9
call fcn.0040a1e8
push 4
push dword [ebp - 0x41c]
push eax
push dword [ebp + 8]
call fcn.004288ca
cmp eax, 6
jne 0x41e170
jmp 0x41e105
leave
ret 4
Function at 0x41e174
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
mov dword [ebp - 0x2b8], 0
lea eax, [ebp - 0x2a5]
push eax
lea eax, [ebp - 0x2b8]
push eax
push str.DWB_Temp_File_Temp_u.tmp
call fcn.00423654
cmp eax, 0xffffffff
je 0x41e257
mov dword [ebp - 0x38], eax
push 0x14
lea eax, [ebp - 0x2c]
push eax
call fcn.00428642
push dword [ebp + 0x10]
push 5
call fcn.0040a1e8
mov dword [ebp - 0x1c], eax
push dword [ebp + 0x10]
push 6
call fcn.0040a1e8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2b0], eax
push dword [ebp + 0xc]
pop dword [ebp - 0x2c]
lea eax, [ebp - 0xa5]
push eax
push 2
push 0
push dword [ebp + 8]
call fcn.00422de6
push eax
or eax, eax
jne 0x41e22f
push dword [ebp + 0x10]
push 7
call fcn.0040a1e8
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x2a5]
mov dword [ebp - 0x2b4], eax
lea eax, [ebp - 0x2b4]
push eax
push 0x41e25b
push dword [ebp + 0xc]
push str.PostPrgsDlg
push dword [0x43c15c]
call fcn.0042872c
lea eax, [ebp - 0x2a5]
push eax
call fcn.00428552
pop eax
or eax, eax
je 0x41e257
push 0
push 0x43cc52
push str.The_DNL_Reader_needs_to_install_extensions_to_properly_run_this_Digital_Web_r_nBook._It_is_unable_to_do_this_at_present._Some_of_the_possible_reasons_are:_r_n_r_n1._This_computer_may_not_be_connected_to_the_Internet_or_you_may_be_r_nexperiencing_network_problems._r_n_r_n2._Your_firewall_software_may_not_be_prompting_you_to_give_you_a_choice_to_r_ndownload_the_extension_the_DNL_reader_requires_to_use_this_Digital_Web_Book._r_n_r_nPossible_solution:_r_nA._Temporarily_switch_off_the_firewall_to_allow_this_program_to_access_the_r_nInternet._r_nB._Configure_your_firewall_to_allow_the_DNL_reader_to_access_the_Internet._r_n_r_n3._If_you_are_using_a_proxy_server_or_external_gateway__please_ensure_that_r_nit_is_correctly_configured._If_you_are_connecting_to_the_internet_using_a_r_ncorporate_network__please_ask_your_network_administrator_for_help._r_n
push dword [0x43c160]
call fcn.004288ca
leave
ret 0xc

Function at 0x41e3a7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp dword [ebp + 0x18], 2
je 0x41e3f4
push 0
push 0x80
push dword [ebp + 0xc]
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call fcn.00428540
cmp eax, 0xffffffff
je 0x41e430
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 3
jne 0x41e3ea
push eax
push dword [ebp - 4]
call fcn.00428528
pop eax
jmp 0x41e430
cmp dword [ebp + 0x18], 4
jne 0x41e3fa
jmp 0x41e430
push dword [ebp + 0xc]
pop dword [ebp - 4]
cmp dword [ebp + 0x18], 1
jne 0x41e40e
push 0
push 0
push 1
push dword [ebp - 4]
call fcn.00428654
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.00428684
cmp dword [ebp + 0x18], 2
je 0x41e430
push dword [ebp - 4]
call fcn.00428528
leave
ret 0x14
Function at 0x41e7c6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.00428642
cmp dword [ebp + 0xc], 0
jne 0x41e80c
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.004285b8
test eax, eax
je 0x41e827
push 0x43c5ad
lea eax, [ebp - 0x104]
push eax
call fcn.0042868a
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.0042868a
lea eax, [ebp - 0x104]
push eax
call fcn.0042861e
leave
ret 8
Function at 0x41f289
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
cmp dword [0x43c903], 0
je 0x41f2e5
mov esi, dword [0x43c903]
mov dword [ebp - 4], 0
mov eax, dword [0x43c8ff]
jmp 0x41f2e0
cmp dword [esi + 0xc], 1
jne 0x41f2d5
cmp dword [esi + 0x38], 0
je 0x41f2d5
push 0x8000
push 0
push dword [esi + 0x38]
call fcn.00428672
mov dword [esi + 0x38], 0
mov dword [esi + 0xc], 0
add esi, 0x54
inc dword [ebp - 4]
mov eax, dword [0x43c8ff]
cmp dword [ebp - 4], eax
jb 0x41f2ac
cmp dword [0x43c90f], 0
je 0x41f32c
mov esi, dword [0x43c90f]
mov dword [ebp - 4], 0
mov eax, dword [0x43c90b]
jmp 0x41f327
cmp dword [esi], 0
je 0x41f31c
push dword [esi]
call fcn.00428552
push 0x8000
push 0
push dword [esi]
call fcn.00428672
lea esi, [esi + 4]
inc dword [ebp - 4]
mov eax, dword [0x43c90b]
cmp dword [ebp - 4], eax
jb 0x41f302
leave
ret