joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f114
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x52efc0]
lea edx, [ebp - 0x1c]
lea esi, [ebp - 0x14]
lea ecx, [ebp - 0x18]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 4
mov dword [esi], 0
mov dword [ecx], eax
mov dword [edx], eax
push edx
push esi
push ecx
push 0x4e3330
push str.Software360
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [esi], 1
jne 0x40f214
push 0x20
call fcn.004aea96
add esp, 4
movsd xmm0, qword [0x4e34ae]
movsd xmm2, qword [0x4e34a6]
movsd xmm1, qword [0x4e349e]
lea esi, [ebp - 0x28]
mov edi, 5
mov ebx, 0x4e335e
mov dword [ebp - 0x2c], 0
mov dword [esi], eax
mov dword [esi + 8], 0x80000010
mov dword [esi + 4], 0xc
movsd qword [eax + 0x10], xmm0
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm1
mov word [eax + 0x18], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40f1de
mov ecx, esi
push ebx
call fcn.004288d4
mov ecx, esi
push 0x4e34b8
call fcn.004288d4
mov al, 1
mov dword [ebp - 0x2c], eax
add ebx, 0x40
dec edi
jne 0x40f1ba
test byte [ebp - 0x2c], 1
je 0x40f203
cmp byte [ebp - 0x1d], 0
jns 0x40f1f3
mov esi, dword [ebp - 0x28]
xor eax, eax
push eax
push 0x4e34bc
push esi
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [ebp - 0x1d], 0
jns 0x40f214
push dword [ebp - 0x28]
call fcn.004aeac6
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40f226
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x22c
mov eax, dword [0x52efc0]
lea esi, [ebp - 0x11c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [esi], 0x114
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esi + 4]
cmp eax, 6
jne 0x40f29c
cmp dword [ebp - 0x114], 3
ja 0x40f2a1
push 0x4e34e0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f296
lea esi, [ebp - 0x230]
push esi
call eax
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x118], eax
jmp 0x40f29c
mov eax, dword [ebp - 0x118]
cmp eax, 0xa
je 0x40f2aa
cmp dword [ebp - 0x114], 4
jne 0x40f2b4
mov dword [0x530114], 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004aeb01
add esp, 0x22c
pop esi
pop ebp
ret
Function at 0x40f2c7
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x258
mov eax, dword [0x52efc0]
lea ecx, [esp + 0x38]
xor eax, ebp
mov dword [esp + 0x250], eax
mov dword [esp + 0x44], 0xffffffff
call fcn.00456da0
xor ebx, ebx
lea edi, [esp + 0x48]
push 0x208
push ebx
push edi
call fcn.004b81d0
add esp, 0xc
push ebx
push 0x26
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.internet_exploreriexplore.exe
push edi
call fcn.004cf6f0
add esp, 8
cmp word [edi], 0
je 0x40f336
xor ebx, ebx
cmp word [esp + ebx*2 + 0x4a], 0
lea ebx, [ebx + 1]
jne 0x40f32b
lea esi, [esp + 0x28]
mov ecx, esi
push ebx
push edi
call fcn.0042cb30
lea edi, [esp + 0x34]
push esi
push edi
call fcn.00430390
add esp, 8
mov ecx, esi
call fcn.0042cba0
mov ecx, dword [edi]
test ecx, ecx
je 0x40f475
mov eax, dword [ecx]
push esi
call dword [eax + 0x28]
movzx eax, byte [esp + 0x33]
test al, al
jns 0x40f379
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x1c]
push eax
push esi
push ecx
call fcn.00448430
add esp, 0xc
mov edi, esp
xor ebx, ebx
lea esi, [esp + 0x10]
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [edi + 4], ebx
mov dword [edi], 0x2e
mov dword [edi + 8], 0x1000000
push esi
push edi
push 1
push 0x4e34d0
lea eax, [esp + 0x2c]
push eax
call fcn.00445f20
add esp, 0x14
cmp byte [edi + 0xb], bl
jns 0x40f3ce
push dword [esp]
call fcn.004aeac6
add esp, 4
movzx eax, byte [esp + 0x1b]
test al, al
jns 0x40f3df
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
xor ecx, ecx
inc ecx
push 0
push ecx
push ecx
push 0x4e34ce
push eax
push esi
push edi
call fcn.004441b0
add esp, 0x1c
mov eax, dword [esp]
cmp dword [esp + 4], eax
je 0x40f41b
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x40f40c
mov ecx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0x44]
push edx
push ecx
push eax
call fcn.00443cd0
add esp, 0xc
mov esi, dword [esp + 0x44]
mov ecx, esp
call fcn.00403a7c
cmp byte [esp + 0x1b], 0
jns 0x40f439
push dword [esp + 0x10]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x27], 0
jns 0x40f44c
push dword [esp + 0x1c]
call fcn.004aeac6
add esp, 4
cmp byte [esp + 0x33], 0
jns 0x40f45f
push dword [esp + 0x28]
call fcn.004aeac6
add esp, 4
mov ecx, dword [esp + 0x34]
xor eax, eax
mov dword [esp + 0x34], eax
test ecx, ecx
je 0x40f480
mov eax, dword [ecx]
push 1
call dword [eax]
jmp 0x40f480
xor esi, esi
mov dword [esp + 0x34], 0
dec esi
lea ecx, [esp + 0x38]
call fcn.00456e80
mov ecx, dword [esp + 0x250]
xor ecx, ebp
call fcn.004aeb01
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41004c
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov edx, ecx
add edi, esi
add edx, eax
test cl, cl
mov ecx, 4
cmovs edx, edi
cmovs eax, esi
sub edx, eax
cmp edx, ecx
jb 0x4100c2
mov esi, 0xfffffffc
mov ebx, eax
lea ecx, [edx + esi]
and esi, ecx
mov dword [ebp - 0x14], ecx
mov ecx, edx
mov dword [ebp - 0x10], esi
imul edi, dword [ebx], 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
add edx, 0xfffffffc
add ebx, 4
mov esi, edi
shr esi, 0x18
xor esi, edi
imul esi, esi, 0x5bd1e995
xor ecx, esi
cmp edx, 3
ja 0x41008e
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
lea eax, [esi + eax + 4]
sub edx, esi
jmp 0x4100c4
mov ecx, edx
cmp edx, 1
je 0x4100e5
cmp edx, 2
je 0x4100dc
cmp edx, 3
jne 0x4100f0
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4136f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
xor eax, eax
lea edi, [ebp - 0x1c]
mov ebx, 4
mov esi, ecx
dec eax
mov dword [edi], esp
mov dword [edi + 0xc], eax
mov dword [edi + 8], 0x4143d0
mov eax, dword fs:[0]
mov dword [edi + 4], eax
lea eax, [edi + ebx]
mov dword fs:[0], eax
call fcn.004118b6
mov eax, dword [ebp + 8]
mov dword [esi], vtable.std::__1::__stdinbuf_char_.0
lea ecx, [ebp - 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x28], eax
xor eax, eax
add ebx, esi
dec eax
mov dword [esi + 0x30], eax
mov byte [esi + 0x34], 0
push ebx
call fcn.00422d04
mov eax, dword [esi]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [edi + 0xc], 0
push edx
call eax
lea ecx, [ebp - 0x20]
call fcn.004148a2
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x24]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4137a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
lea edi, [ebp - 0x1c]
mov ebx, 4
mov esi, ecx
mov dword [edi], esp
mov dword [edi + 0xc], 0xffffffff
mov dword [edi + 8], 0x4143e0
mov eax, dword fs:[0]
mov dword [edi + 4], eax
lea eax, [edi + ebx]
mov dword fs:[0], eax
call fcn.00411ab8
mov eax, dword [ebp + 8]
mov dword [esi], vtable.std::__1::__stdinbuf_wchar_t_.0
add ebx, esi
lea ecx, [ebp - 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x28], eax
mov word [esi + 0x30], 0xffff
mov byte [esi + 0x32], 0
push ebx
call fcn.00422d04
mov eax, dword [esi]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [edi + 0xc], 0
push edx
call eax
lea ecx, [ebp - 0x20]
call fcn.004148a2
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x24]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x414030
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov eax, dword [0x52efc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x20]
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x1c]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
push dword [edi + 0x28]
call dword [eax + 0x10]
mov esi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004cd89a
add esp, 0x10
cmp eax, esi
jne 0x4140a0
cmp ebx, 1
je 0x414049
cmp ebx, 2
mov esi, 0xffffffff
je 0x4140a3
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call fcn.004cd43e
add esp, 4
neg eax
sbb esi, esi
jmp 0x4140a3
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4140c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x4140e4
push dword [ecx + 0x20]
push esi
push 1
push eax
call fcn.004cd89a
add esp, 0x14
jmp 0x414113
test esi, esi
jle 0x41410c
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, byte [eax + edi]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp eax, 0xffffffff
je 0x41410e
inc edi
mov eax, ebx
cmp esi, edi
jne 0x4140ed
mov edi, esi
jmp 0x41410e
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x414120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x52efc0]
mov ebx, dword [ebp + 8]
xor eax, ebp
cmp ebx, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x4141e0
mov byte [ebp - 0x19], bl
mov esi, ecx
cmp byte [ecx + 0x2c], 0
je 0x414167
xor edi, edi
lea eax, [ebp - 0x19]
inc edi
push dword [esi + 0x20]
push edi
push edi
push eax
call fcn.004cd89a
add esp, 0x10
cmp eax, edi
je 0x4141e0
jmp 0x4141ea
lea ebx, [ebp - 0x19]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [esi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push ebx
push dword [esi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], ebx
je 0x4141ea
mov edi, eax
cmp eax, 3
je 0x4141c8
cmp edi, 1
ja 0x4141ea
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub ebx, eax
push dword [esi + 0x20]
push ebx
push 1
push eax
call fcn.004cd89a
add esp, 0x10
cmp eax, ebx
jne 0x4141ea
mov ebx, dword [ebp - 0x24]
cmp edi, 1
je 0x414172
jmp 0x4141dd
xor edi, edi
inc edi
push dword [esi + 0x20]
push edi
push edi
push ebx
call fcn.004cd89a
add esp, 0x10
cmp eax, edi
jne 0x4141ea
mov ebx, dword [ebp + 8]
xor esi, esi
cmp ebx, 0xffffffff
cmovne esi, ebx
jmp 0x4141ed
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x414240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
je 0x414264
push dword [ecx + 0x20]
push esi
push 2
push eax
call fcn.004cd89a
add esp, 0x14
jmp 0x414294
test esi, esi
jle 0x41428d
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov ebx, eax
movzx eax, word [eax + edi*2]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp ax, 0xffff
je 0x41428f
inc edi
mov eax, ebx
cmp esi, edi
jne 0x41426d
mov edi, esi
jmp 0x41428f
xor edi, edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4142a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x52efc0]
movzx ebx, word [ebp + 8]
xor eax, ebp
cmp bx, 0xffff
mov dword [ebp - 0x10], eax
je 0x414365
mov word [ebp - 0x1a], bx
mov edi, ecx
cmp byte [ecx + 0x2c], 0
je 0x4142eb
xor esi, esi
lea eax, [ebp - 0x1a]
inc esi
push dword [edi + 0x20]
push esi
push 2
push eax
call fcn.004cd89a
add esp, 0x10
cmp eax, esi
je 0x414365
jmp 0x414370
lea esi, [ebp - 0x1a]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov dword [ecx], eax
mov ecx, dword [edi + 0x24]
lea edx, [ebp - 0x20]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0x18]
push edx
push esi
push dword [edi + 0x28]
call dword [eax + 8]
cmp dword [ebp - 0x24], esi
je 0x414370
mov ebx, eax
cmp eax, 3
je 0x41434c
cmp ebx, 1
ja 0x414370
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
sub esi, eax
push dword [edi + 0x20]
push esi
push 1
push eax
call fcn.004cd89a
add esp, 0x10
cmp eax, esi
jne 0x414370
mov esi, dword [ebp - 0x24]
cmp ebx, 1
je 0x4142f6
jmp 0x414361
xor ebx, ebx
inc ebx
push dword [edi + 0x20]
push ebx
push ebx
push esi
call fcn.004cd89a
add esp, 0x10
cmp eax, ebx
jne 0x414370
movzx ebx, word [ebp + 8]
xor eax, eax
cmp bx, 0xffff
cmove ebx, eax
jmp 0x414373
xor ebx, ebx
dec ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4144f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x41451f
movsx esi, byte [edx]
shl eax, 4
inc edx
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x414501
pop esi
pop edi
pop ebp
ret 8

Function at 0x414620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x414651
movzx esi, word [edx]
shl eax, 4
add edx, 2
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
cmp ecx, edx
jne 0x414631
pop esi
pop edi
pop ebp
ret 8
Function at 0x419650
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x426e60
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor eax, eax
lea ecx, [esi + 0x20]
xor edi, edi
mov dword [ecx + 4], eax
mov dword [ecx], 0x25
mov eax, ecx
mov ecx, dword [ebp + 0x10]
inc edi
or eax, edi
push dword [ecx + 4]
mov ebx, ecx
push edi
push 0x4e45a2
push eax
call fcn.0041930c
add esp, 0x10
mov ebx, dword [ebx + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, edi
lea eax, [ebx + 0x17]
mov dword [esi + 4], eax
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.00416390
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.00429835
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.00419376
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx + ebx + 0x2e]
and eax, 0xfffffffc
call fcn.004aeed0
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.00411d40
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.004193d0
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x41976b
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movsx edx, dl
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.00403830
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x419930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x426e80
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
xor edx, edx
lea eax, [esi + 0x20]
inc edx
mov dword [eax + 4], ecx
mov dword [eax], 0x25
or eax, edx
mov edx, dword [ebp + 0x10]
push dword [edx + 4]
mov edi, edx
push ecx
push 0x4e45a2
push eax
call fcn.0041930c
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x10], esp
shr ebx, 9
xor eax, eax
inc eax
and ebx, eax
lea edi, [ebx + 0x16]
inc edi
sub esp, 0x18
lea eax, [esi + 0x28]
mov dword [esi + 8], esp
push eax
call fcn.00416390
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push edi
mov edi, dword [esi + 8]
push edi
call fcn.00429835
add esp, 0x1c
mov ecx, edi
add eax, edi
push dword [ebp + 0x10]
push eax
mov edi, eax
push ecx
call fcn.00419376
add esp, 0xc
mov dword [esi + 0x14], eax
lea eax, [ebx + ebx + 0x2e]
and eax, 0xfffffffc
call fcn.004aeed0
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 4]
mov ebx, esp
push eax
call fcn.00411d40
lea edx, [esi + 4]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0xc], ebx
push ebx
push edi
push dword [esi + 0x14]
push dword [esi + 8]
call fcn.004193d0
add esp, 0x1c
mov ecx, dword [esi + 4]
xor eax, eax
mov edi, dword [ebp + 8]
mov dl, byte [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x419a48
mov eax, dword [ecx]
call dword [eax + 4]
mov dl, byte [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movsx edx, dl
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0xc]
push ebx
push edi
call fcn.00403830
add esp, 0x1c
mov esp, dword [esi + 0x10]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x41af40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x426f10
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor eax, eax
lea ecx, [esi + 0x20]
xor edi, edi
mov dword [ecx + 4], eax
mov dword [ecx], 0x25
mov eax, ecx
mov ecx, dword [ebp + 0x10]
inc edi
or eax, edi
push dword [ecx + 4]
mov ebx, ecx
push edi
push 0x4e45a2
push eax
call fcn.0041930c
add esp, 0x10
mov ebx, dword [ebx + 4]
mov dword [esi + 0x14], esp
shr ebx, 9
and ebx, edi
lea eax, [ebx + 0x17]
mov dword [esi + 4], eax
sub esp, 0x18
mov edi, esp
lea eax, [esi + 0x28]
mov dword [esi + 0xc], edi
push eax
call fcn.00416390
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push edi
call fcn.00429835
add esp, 0x1c
mov edi, eax
mov eax, dword [esi + 0xc]
add edi, eax
push dword [ebp + 0x10]
push edi
push eax
call fcn.00419376
add esp, 0xc
mov dword [esi + 4], eax
lea eax, [ebx*4 + 0x58]
call fcn.004aeed0
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 8]
mov ebx, esp
push eax
call fcn.00411d40
lea edx, [esi + 8]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0x10], ebx
push ebx
push edi
push dword [esi + 4]
push dword [esi + 0xc]
call fcn.0041aaf0
add esp, 0x1c
mov ecx, dword [esi + 8]
xor eax, eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x41b05d
mov eax, dword [ecx]
call dword [eax + 4]
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movzx edx, dx
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0x10]
push ebx
push edi
call fcn.0041ad80
add esp, 0x1c
mov esp, dword [esi + 0x14]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x41b240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
lea ecx, [esi + 0x38]
mov dword [ecx - 4], esp
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x426f30
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor ecx, ecx
xor edx, edx
lea eax, [esi + 0x20]
inc edx
mov dword [eax + 4], ecx
mov dword [eax], 0x25
or eax, edx
mov edx, dword [ebp + 0x10]
push dword [edx + 4]
mov edi, edx
push ecx
push 0x4e45a2
push eax
call fcn.0041930c
add esp, 0x10
mov ebx, dword [edi + 4]
mov dword [esi + 0x10], esp
shr ebx, 9
xor eax, eax
inc eax
and ebx, eax
lea edi, [ebx + 0x16]
inc edi
sub esp, 0x18
lea eax, [esi + 0x28]
mov dword [esi + 8], esp
push eax
call fcn.00416390
add esp, 4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x28]
push dword [eax + 4]
push dword [eax]
push edi
mov edi, dword [esi + 8]
push edi
call fcn.00429835
add esp, 0x1c
mov ecx, edi
add eax, edi
push dword [ebp + 0x10]
push eax
mov edi, eax
push ecx
call fcn.00419376
add esp, 0xc
mov dword [esi + 0x14], eax
lea eax, [ebx*4 + 0x58]
call fcn.004aeed0
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 4]
mov ebx, esp
push eax
call fcn.00411d40
lea edx, [esi + 4]
lea eax, [esi + 0x38]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0x18]
lea ecx, [esi + 0x1c]
push edx
push eax
push ecx
mov dword [esi + 0xc], ebx
push ebx
push edi
push dword [esi + 0x14]
push dword [esi + 8]
call fcn.0041aaf0
add esp, 0x1c
mov ecx, dword [esi + 4]
xor eax, eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
dec eax
lock xadd dword [ecx + 4], eax
test eax, eax
jne 0x41b35a
mov eax, dword [ecx]
call dword [eax + 4]
movzx edx, word [ebp + 0x14]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
movzx edx, dx
mov dword [esi + 0x40], 0xffffffff
push edx
push dword [ebp + 0x10]
push eax
push ecx
push dword [esi + 0xc]
push ebx
push edi
call fcn.0041ad80
add esp, 0x1c
mov esp, dword [esi + 0x10]
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18