joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438490
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4685fb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x47c5a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00464c38
push 4
mov dword [ebp - 4], 0
call fcn.00440897
mov edi, eax
add esp, 4
test edi, edi
je 0x438510
call fcn.0046474a
mov dword [edi], eax
call fcn.0046448b
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.004642f4
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x438506
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0046431c
jmp 0x438512
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b5f0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468bbb
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x47c5a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push 0x105
lea ecx, [ebp - 0x21c]
push ecx
mov dword [ebp - 0x23c], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec eax
cmp eax, 0x103
ja 0x43b6f1
xor ebx, ebx
lea eax, [ebp - 0x21c]
mov byte [ebp - 0x21b], bl
mov dword [ebp - 0x224], 0xf
mov dword [ebp - 0x228], ebx
mov byte [ebp - 0x238], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x43b670
sub eax, edx
push eax
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x238]
call fcn.00407d70
push 5
push str.:_tmp
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], ebx
call fcn.00413820
cmp dword [ebp - 0x224], 0x10
mov eax, dword [ebp - 0x238]
jae 0x43b6b6
lea eax, [ebp - 0x238]
push eax
call fcn.004365f0
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 4
test eax, eax
jne 0x43b70f
cmp dword [ebp - 0x224], 0x10
mov eax, dword [ebp - 0x238]
jae 0x43b6de
lea eax, [ebp - 0x238]
push ebx
push eax
call esi
test eax, eax
jne 0x43b70f
lea ecx, [ebp - 0x238]
call fcn.00407890
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043fe0a
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [ebp + 0x14], ebx
je 0x43b71c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x224], 0x10
mov ecx, dword [ebp - 0x238]
jae 0x43b731
lea ecx, [ebp - 0x238]
push eax
push edi
push ecx
lea eax, [ebp - 0x114]
push str._s_s_u
push eax
call fcn.00440e5a
lea eax, [ebp - 0x114]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x43b751
sub eax, edx
cmp dword [ebp + 0xc], eax
ja 0x43b77c
cmp dword [ebp - 0x224], 0x10
jb 0x43b6f1
mov ecx, dword [ebp - 0x238]
push ecx
call fcn.00440187
add esp, 4
jmp 0x43b6f1
lea edx, [ebp - 0x114]
push edx
call fcn.004365f0
add esp, 4
test eax, eax
lea eax, [ebp - 0x114]
jne 0x43b7d0
push ebx
push eax
call esi
test eax, eax
je 0x43b6e6
mov edx, dword [ebp - 0x23c]
lea eax, [ebp - 0x114]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x43b7b1
lea ecx, [ebp - 0x238]
call fcn.00407890
mov eax, 1
jmp 0x43b6f3
mov esi, dword [ebp - 0x23c]
mov edx, esi
lea ecx, [ebp - 0x114]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x43b7e0
cmp dword [ebp + 0x18], ebx
je 0x43b7fd
push 0x46cb24
push esi
call fcn.00436bd0
add esp, 8
lea ecx, [ebp - 0x238]
call fcn.00407890
mov eax, 1
jmp 0x43b6f3
Function at 0x43e4e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468dbb
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x47c5a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [ebp - 0x134]
lea esi, [ebp - 0x114]
push ecx
mov edx, esi
push edx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x134], 0x104
call edi
test eax, eax
jne 0x43e5b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x138]
mov dword [ecx], eax
cmp eax, 0x6f
jne 0x43e5ae
mov eax, dword [ebp - 0x134]
inc eax
push eax
mov dword [ebp - 0x134], eax
call fcn.0044239c
mov esi, eax
add esp, 4
test esi, esi
je 0x43e5ae
lea edx, [ebp - 0x134]
push edx
push esi
mov dword [ebp - 0x140], 1
call edi
test eax, eax
jne 0x43e5b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x138]
push esi
mov dword [ecx], eax
call fcn.00442391
add esp, 4
xor eax, eax
jmp 0x43e6ab
mov edx, dword [ebp + 0xc]
push edx
push 0x20
push ebx
call fcn.00440de0
mov eax, esi
add esp, 0xc
mov byte [ebx], 0x33
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43e5d0
sub eax, edx
mov edi, eax
cmp edi, dword [ebp + 0xc]
jb 0x43e672
xor ebx, ebx
push 0xc
push str.getHostId3:
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], ebx
mov byte [ebp - 0x130], bl
call fcn.00407d70
mov eax, esi
mov dword [ebp - 4], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43e616
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x130]
call fcn.00413820
mov eax, dword [ebp - 0x130]
mov ebx, 0x10
cmp dword [ebp - 0x11c], ebx
jae 0x43e645
lea eax, [ebp - 0x130]
push 0
push eax
push str.UtlHost
call fcn.0042a600
add esp, 0xc
cmp dword [ebp - 0x11c], ebx
jb 0x43e66c
mov eax, dword [ebp - 0x130]
push eax
call fcn.00440187
add esp, 4
mov ebx, dword [ebp - 0x13c]
mov eax, dword [ebp + 0xc]
dec eax
cmp edi, eax
jae 0x43e67c
mov eax, edi
push eax
push esi
inc ebx
push ebx
call fcn.004401a0
add esp, 0xc
cmp dword [ebp - 0x140], 0
je 0x43e69a
push esi
call fcn.00442391
add esp, 4
mov ecx, dword [ebp - 0x138]
mov dword [ecx], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043fe0a
mov esp, ebp
pop ebp
ret
Function at 0x43fe0a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47c5a8]
jne 0x43fe14
repz ret
jmp fcn.00443db8

Function at 0x45f5a7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47c5a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00445966
and dword [ebp - 0x14], 0
cmp dword [0x546ffc], 0
mov dword [ebp - 0x18], eax
jne 0x45f65a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x45f702
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x45f702
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x546ffc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x547000], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x547004], eax
call edi
push eax
call esi
mov dword [0x54700c], eax
test eax, eax
je 0x45f65a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x547008], eax
mov eax, dword [0x547008]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x45f6b3
cmp dword [0x54700c], ecx
je 0x45f6b3
push eax
call esi
push dword [0x54700c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x45f6b3
test ebx, ebx
je 0x45f6b3
call edi
test eax, eax
je 0x45f6aa
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x45f6aa
test byte [ebp - 8], 1
jne 0x45f6b3
or dword [ebp + 0x10], 0x200000
jmp 0x45f6e6
mov eax, dword [0x547000]
cmp eax, dword [ebp - 0x18]
je 0x45f6e6
push eax
call esi
test eax, eax
je 0x45f6e6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x45f6e6
mov eax, dword [0x547004]
cmp eax, dword [ebp - 0x18]
je 0x45f6e6
push eax
call esi
test eax, eax
je 0x45f6e6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x546ffc]
call esi
test eax, eax
je 0x45f702
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x45f704
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043fe0a
leave
ret
Function at 0x4011d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0x104
push 0x40de00
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40de00
call fcn.00401d65
push 0x5c
push 0x40de00
call fcn.004018f9
add esp, 0xc
mov dword [0x40df04], eax
test eax, eax
je 0x40120a
inc eax
jmp 0x40120f
mov eax, str._NULL_
push esi
push edi
push eax
push 0x40de00
call fcn.00401000
mov eax, dword [ebp + 8]
push eax
call fcn.00401000
mov esi, dword [ebp + 0xc]
add esp, 0xc
push esi
push 0x401040
push eax
call dword [sym.imp.USER32.dll_EnumThreadWindows]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40124d
call edi
push eax
call fcn.00401000
add esp, 4
call fcn.00401000
push esi
push 0x4010c0
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x40126d
call edi
push eax
call fcn.00401000
add esp, 4
pop edi
pop esi
pop ebp
ret
Function at 0x401eb5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401ebf
repz ret
jmp fcn.00403729

Function at 0x40736c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402bdb
and dword [ebp - 0x14], 0
cmp dword [0x40ec04], 0
mov dword [ebp - 0x18], eax
jne 0x40741f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4074c7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4074c7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40ec04], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40ec08], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40ec0c], eax
call edi
push eax
call esi
mov dword [0x40ec14], eax
test eax, eax
je 0x40741f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40ec10], eax
mov eax, dword [0x40ec10]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407478
cmp dword [0x40ec14], ecx
je 0x407478
push eax
call esi
push dword [0x40ec14]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407478
test ebx, ebx
je 0x407478
call edi
test eax, eax
je 0x40746f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40746f
test byte [ebp - 8], 1
jne 0x407478
or dword [ebp + 0x10], 0x200000
jmp 0x4074ab
mov eax, dword [0x40ec08]
cmp eax, dword [ebp - 0x18]
je 0x4074ab
push eax
call esi
test eax, eax
je 0x4074ab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4074ab
mov eax, dword [0x40ec0c]
cmp eax, dword [ebp - 0x18]
je 0x4074ab
push eax
call esi
test eax, eax
je 0x4074ab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40ec04]
call esi
test eax, eax
je 0x4074c7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4074c9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401eb5
leave
ret
Function at 0x402790
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x40279e
call dword [0x49a014]
or eax, eax
je 0x40279f
ret
mov al, 1
jmp fcn.0040281c

Function at 0x4027a8
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4027b6
call dword [0x49a018]
or eax, eax
jne 0x4027b7
ret
mov al, 2
jmp fcn.0040281c

Function at 0x4027c0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [eax]
test ecx, ecx
je 0x4027f8
test edx, edx
je 0x4027e2
push eax
mov eax, ecx
call dword [0x49a01c]
pop ecx
or eax, eax
je 0x4027f1
mov dword [ecx], eax
ret
mov al, 2
jmp fcn.0040281c
mov dword [eax], edx
mov eax, ecx
call dword [0x49a018]
or eax, eax
jne 0x4027db
ret
mov al, 1
jmp fcn.0040281c
test edx, edx
je 0x40280c
push eax
mov eax, edx
call dword [0x49a014]
pop ecx
or eax, eax
je 0x4027f1
mov dword [ecx], eax
ret

Function at 0x40281c
Capabilities:
Terminate process

Disassembly:
and eax, 0x7f
mov ecx, dword [0x49d004]
test ecx, ecx
je 0x40282c
pop edx
call ecx
dec eax
mov al, byte [eax + 0x402845]
jns 0x402840
call fcn.00406adc
mov eax, dword [eax + 4]
jmp fcn.00403b34

Function at 0x4029a4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4029d3
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403c24
jmp 0x4029f1
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.0040292c
mov edi, eax
test ebx, ebx
je 0x4029f1
cmp dword [esi], 0
je 0x4029f1
dec ebx
jmp 0x4029da
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402dc4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402e5c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402e3c
xor eax, eax
push ebp
push 0x402e35
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402e78
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e3c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x4030dc
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4030f6
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, edx
je 0x4030f6
mov ecx, dword [ecx - 0x24]
test ecx, ecx
jne 0x4030e2
mov al, 0xa
jmp fcn.0040281c
ret

Function at 0x403128
Capabilities:
Terminate process

Disassembly:
cmp dword [0x49d018], 0
je 0x402a47
call dword [0x49d018]
mov eax, 0xd2
jmp fcn.00403b34
push eax
push ecx
mov eax, dword [eax]
call fcn.004030f8
pop ecx
pop eax
je 0x403137
jmp ebx
pop ecx
jmp 0x402a38
Function at 0x403140
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
mov eax, dword [eax]
call fcn.004030f8
mov eax, ebx
pop ebx
jne 0x403155
pop ecx
jmp 0x402a38
ret

Function at 0x403a10
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x49d4a0
mov esi, 0x49d034
mov edi, 0x49d038
cmp byte [ebx + 0x24], 0
jne 0x403a3f
cmp dword [edi], 0
je 0x403a3f
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x403a2e
cmp dword [0x49d03c], 0
je 0x403a86
call fcn.0040398c
cmp byte [0x49d044], 0
je 0x403a6c
mov edx, 0x49a024
mov eax, 0x49d218
call fcn.00406378
call fcn.004062fb
jmp 0x403a7f
push 0
push 0x49a044
push 0x49a024
push 0
call sub.user32.dll_MessageBoxA
xor eax, eax
mov dword [0x49d03c], eax
cmp byte [ebx + 0x24], 2
jne 0x403a96
cmp dword [esi], 0
jne 0x403a96
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00403860
cmp byte [ebx + 0x24], 1
jbe 0x403aa6
cmp dword [esi], 0
je 0x403ac3
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x403ac3
call fcn.00405d7c
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 0x10]
cmp edx, dword [eax + 4]
je 0x403ac3
push edx
call sub.kernel32.dll_FreeLibrary
call fcn.00403838
cmp byte [ebx + 0x24], 1
jne 0x403ad1
call dword [ebx + 0x28]
cmp byte [ebx + 0x24], 0
je 0x403adc
call fcn.004039dc
cmp dword [ebx], 0
jne 0x403ae9
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x403a86

Function at 0x4041a4
Capabilities:
Terminate process

Disassembly:
test edx, edx
je fcn.00404168
mov ecx, dword [edx - 4]
shr ecx, 1
je fcn.00404168
push ecx
push edx
push eax
call sub.oleaut32.dll_SysReAllocStringLen
test eax, eax
je 0x404150
ret

Function at 0x40424c
Capabilities:
Terminate process

Disassembly:
mov al, 1
jmp fcn.0040281c
test ecx, ecx
je fcn.00404168
push eax
push ecx
push edx
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
je 0x404150
pop edx
push dword [edx]
mov dword [edx], eax
call sub.oleaut32.dll_SysFreeString
ret

Function at 0x404314
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
xor ecx, ecx
cmp al, 0xa
je 0x404353
cmp al, 0xb
je 0x404353
cmp al, 0xc
je 0x40435d
cmp al, 0xd
je 0x404370
cmp al, 0xe
je 0x40438e
cmp al, 0xf
je 0x404353
cmp al, 0x11
je 0x404353
mov al, 2
pop edi
pop esi
pop ebx
jmp fcn.0040281c
mov dword [ebx], ecx
add ebx, 4
dec edi
jg 0x404353
jmp 0x4043a2
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
add ebx, 0x10
dec edi
jg 0x40435d
jmp 0x4043a2
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.00404314
dec edi
jg 0x404373
pop ebp
jmp 0x4043a2
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004042e8
dec edi
jg 0x404391
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4043a8
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.00404314

Function at 0x4043e0
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x404427
cmp al, 0xb
je 0x404441
cmp al, 0xc
je 0x404458
cmp al, 0xd
je 0x404467
cmp al, 0xe
je 0x404485
cmp al, 0xf
je 0x40449b
cmp al, 0x11
je 0x4044aa
pop edi
pop esi
pop ebx
pop eax
mov al, 2
jmp fcn.0040281c
cmp ecx, 1
mov eax, ebx
jg 0x404438
call fcn.00403b40
jmp 0x4044b9
mov edx, ecx
call fcn.00403b64
jmp 0x4044b9
cmp ecx, 1
mov eax, ebx
jg 0x40444f
call fcn.00404168
jmp 0x4044b9
mov edx, ecx
call fcn.00404180
jmp 0x4044b9
mov eax, ebx
add ebx, 0x10
call fcn.00405128
dec edi
jg 0x404458
jmp 0x4044b9
push ebp
mov ebp, edx
mov edx, dword [esi + ebp + 0xa]
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov ecx, dword [esi + ebp + 6]
mov edx, dword [edx]
call fcn.004043e0
dec edi
jg 0x40446a
pop ebp
jmp 0x4044b9
push ebp
mov ebp, edx
mov eax, ebx
add ebx, dword [esi + ebp + 2]
mov edx, esi
call fcn.004043b4
dec edi
jg 0x404488
pop ebp
jmp 0x4044b9
mov eax, ebx
add ebx, 4
call fcn.00405e44
dec edi
jg 0x40449b
jmp 0x4044b9
mov eax, ebx
mov edx, esi
add ebx, 4
call fcn.004059d8
dec edi
jg 0x4044aa
pop edi
pop esi
pop ebx
pop eax
ret

Function at 0x4044c0
Capabilities:
Terminate process

Disassembly:
mov ecx, 1
jmp fcn.004043e0

Function at 0x4044cc
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [ecx + eax + 0xa]
mov ebp, dword [edi - 4]
xor eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x4044f8
mov edx, eax
add eax, esi
add edx, ebx
call fcn.004028ec
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x404537
cmp cl, 0xb
je 0x404548
cmp cl, 0xc
je 0x404559
cmp cl, 0xd
je 0x40456a
cmp cl, 0xe
je 0x40458a
cmp cl, 0xf
je 0x4045a3
cmp cl, 0x11
je 0x4045b4
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.0040281c
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00403b94
mov eax, 4
jmp 0x4045c5
mov edx, dword [esi + eax]
add eax, ebx
call fcn.004041a4
mov eax, 4
jmp 0x4045c5
lea edx, [esi + eax]
add eax, ebx
call fcn.00404888
mov eax, 0x10
jmp 0x4045c5
xor ecx, ecx
mov cl, byte [edx + 1]
push dword [edx + ecx + 2]
push dword [edx + ecx + 6]
mov ecx, dword [edx + ecx + 0xa]
mov ecx, dword [ecx]
lea edx, [esi + eax]
add eax, ebx
call fcn.004045e8
pop eax
jmp 0x4045c5
xor ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [edx + ecx + 2]
push ecx
mov ecx, edx
lea edx, [esi + eax]
add eax, ebx
call fcn.004044cc
pop eax
jmp 0x4045c5
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405e5c
mov eax, 4
jmp 0x4045c5
mov ecx, edx
mov edx, dword [esi + eax]
add eax, ebx
call fcn.00405a14
mov eax, 4
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x4044e6
pop ecx
sub ecx, eax
jle 0x4045e1
lea edx, [ebx + eax]
add eax, esi
call fcn.004028ec
pop ebp
pop edi
pop esi
pop ebx
ret