joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67006420
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67151a39
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x30]
mov byte [eax + 0x14], 0
mov ecx, dword [esp + 0x30]
mov ebx, 1
push 0x28
mov dword [esp + 0x28], ebx
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x14], 0
je 0x6700647b
push 0x20
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov edi, dword [esp + 0x34]
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 8]
xor esi, esi
test ecx, ecx
jle 0x6700652f
test esi, esi
je 0x670064e7
push 0xffffffffffffffff
lea edx, [esp + 0x38]
push 0x6716aa2c
push edx
call sym.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromAscii_char_const___int_
add esp, 0xc
mov ecx, dword [esp + 0x30]
push eax
mov byte [esp + 0x28], 2
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___class_QString_const__
mov eax, dword [esp + 0x34]
mov byte [esp + 0x24], bl
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x670064d6
mov edx, dword [esp + 0x34]
push edx
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x14], 0
je 0x670064e7
push 0x20
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov eax, dword [edi]
mov ecx, dword [eax + 8]
add ecx, esi
mov edx, dword [eax + ecx*4 + 0x14]
push edx
push ecx
mov ecx, dword [esp + 0x38]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [esp + 0x38]
add dword [eax + 0xc], ebx
lea edx, [esp + 0x18]
mov dword [esp + 0x20], esp
push edx
call sym.QtCore4.dll_class_QDebug___cdecl_operator___class_QDebug__class_QObject_const__
add esp, 0xc
lea ecx, [esp + 0x10]
call sym.QtCore4.dll_public:_void___thiscall_QDebug::destructor_void_
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 8]
add esi, ebx
cmp esi, ecx
jl 0x67006491
mov ecx, dword [esp + 0x30]
push 0x29
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x14], 0
je 0x6700654f
push 0x20
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov ecx, dword [esp + 0x30]
mov byte [ecx + 0x14], bl
mov ecx, dword [esp + 0x30]
push 0x20
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov dword [esi], eax
add dword [eax + 0xc], ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x24], 0
call sym.QtCore4.dll_public:_void___thiscall_QDebug::destructor_void_
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x67009050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67151e6e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.67007af0
mov dword [esi], vtable.QObjectPrivate.0
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0x1c], eax
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [edi + 0x20]
mov dword [esi + 0x20], edx
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x38]
mov dword [esi + 0x38], edx
mov eax, dword [edi + 0x3c]
lea ecx, [esi + 0x3c]
mov byte [esp + 0x18], 1
mov dword [ecx], eax
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [ecx]
test byte [eax + 0xc], 1
jne 0x670090f5
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
push edx
push eax
call fcn.67004b80
mov eax, dword [edi + 0x40]
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 2
mov dword [ecx], eax
mov edx, 1
lock xadd dword [eax], edx
mov eax, dword [ecx]
test byte [eax + 0x10], 1
jne 0x6700911c
mov eax, dword [eax + 4]
push eax
call fcn.67007a30
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x44], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x44], edx
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x67110c00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x671644b9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, sym.QtCore4.dll_struct_QListData::Data_QListData::shared_null
mov dword [esi], vtable.QObjectData.0
mov dword [esi + 0xc], eax
mov ecx, eax
mov edx, 1
lock xadd dword [ecx], edx
xor edi, edi
mov dword [esi], vtable.QObjectPrivate.0
mov dword [esp + 0x18], edi
mov dword [esi + 0x1c], sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov ecx, sym.QtCore4.dll_struct_QString::Data_QString::shared_null
mov edx, 1
lock xadd dword [ecx], edx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x3c], sym.QtCore4.dll_struct_QVectorData_QVectorData::shared_null
mov ecx, sym.QtCore4.dll_struct_QVectorData_QVectorData::shared_null
mov edx, 1
lock xadd dword [ecx], edx
mov dword [esi + 0x40], eax
mov ecx, 1
lock xadd dword [eax], ecx
mov eax, dword [esp + 0x20]
mov dword [esi + 0x44], edi
mov byte [esp + 0x18], 3
mov dword [esi + 0x48], edi
cmp eax, 0x40805
je 0x67110cb9
push 0x40805
push eax
push str.Cannot_mix_incompatible_Qt_library__version_0x_x__with_this_library__version_0x_x_
call sym.QtCore4.dll_void___cdecl_qFatal_char_const__
add esp, 0xc
mov edx, dword [esi + 0x10]
and edx, 0xfffffcf0
or edx, 0x60
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x6711add0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67151a39
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x672699e0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x30]
mov byte [eax + 0x14], 0
mov ecx, dword [esp + 0x30]
mov ebx, 1
push 0x28
mov dword [esp + 0x28], ebx
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x14], 0
je 0x6711ae2b
push 0x20
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov edi, dword [esp + 0x34]
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 8]
xor esi, esi
test ecx, ecx
jle 0x6711aee3
test esi, esi
je 0x6711ae97
push 0xffffffffffffffff
lea edx, [esp + 0x38]
push 0x6716aa2c
push edx
call sym.QtCore4.dll_public:_static_class_QString___cdecl_QString::fromAscii_char_const___int_
add esp, 0xc
mov ecx, dword [esp + 0x30]
push eax
mov byte [esp + 0x28], 2
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___class_QString_const__
mov eax, dword [esp + 0x34]
mov byte [esp + 0x24], bl
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x6711ae86
mov edx, dword [esp + 0x34]
push edx
call sym.QtCore4.dll_private:_static_void___cdecl_QString::free_struct_QString::Data__
add esp, 4
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x14], 0
je 0x6711ae97
push 0x20
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov eax, dword [edi]
mov ecx, dword [eax + 8]
add ecx, esi
mov edx, dword [eax + ecx*4 + 0x14]
lea eax, [eax + ecx*4 + 0x14]
push edx
push ecx
mov ecx, dword [esp + 0x38]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [esp + 0x38]
add dword [eax + 0xc], ebx
lea edx, [esp + 0x18]
mov dword [esp + 0x20], esp
push edx
call sym.QtCore4.dll_class_QDebug___cdecl_operator___class_QDebug__class_QVariant_const__
add esp, 0xc
lea ecx, [esp + 0x10]
call sym.QtCore4.dll_public:_void___thiscall_QDebug::destructor_void_
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 8]
add esi, ebx
cmp esi, ecx
jl 0x6711ae41
mov ecx, dword [esp + 0x30]
push 0x29
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov ecx, dword [esp + 0x30]
cmp byte [ecx + 0x14], 0
je 0x6711af03
push 0x20
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov ecx, dword [esp + 0x30]
mov byte [ecx + 0x14], bl
mov ecx, dword [esp + 0x30]
push 0x20
call sym.QtCore4.dll_public:_class_QTextStream____thiscall_QTextStream::operator___char_
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov dword [esi], eax
add dword [eax + 0xc], ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x24], 0
call sym.QtCore4.dll_public:_void___thiscall_QDebug::destructor_void_
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x44fece
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x4f23b0
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x51f0d8], 1
jge 0x4f241f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x4f23f5
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x4f23f5
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x4f23d2
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x4f240b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x4f2412
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x4f250f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x4f24e0
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x4f24d5
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x4f24c9
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x4f24d0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x4f250f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x4f250a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x4f24f3
mov eax, dword [ebx + 8]
jmp 0x4f250f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x4f2501
xor eax, eax
jmp 0x4f250f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x4f243f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x4515b2
Capabilities:
Query environment variable

Disassembly:
jmp 0x4cb5c1
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4cb5d5
xor edi, edi
jmp 0x4cb619
push ebx
push esi
call fcn.004cb4bb
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.00451b5c
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4cb606
push ebx
push esi
push edi
call fcn.004516ca
add esp, 0xc
push 2
push 0
call fcn.00452048
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x4589d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
push ebx
push esi
push edi
lea edi, [ebp - 0x394]
mov ecx, 0xe5
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x523041
call fcn.004511ac
mov esi, esp
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, esp
call fcn.0045126a
mov dword [ebp - 8], eax
mov esi, esp
push 5
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
cmp esi, esp
call fcn.0045126a
mov dword [ebp - 8], eax
push 0x200
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0044fdf2
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x458ac4
push 0x200
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0044fdf2
add esp, 0xc
mov esi, esp
push 0x200
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp esi, esp
call fcn.0045126a
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.0044ff37
add esp, 8
test eax, eax
je 0x458aa7
mov esi, esp
push 0
push 0
push 0x10
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
cmp esi, esp
call fcn.0045126a
mov esi, esp
push 2
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
cmp esi, esp
call fcn.0045126a
mov dword [ebp - 8], eax
jmp 0x458a38
push edx
mov ecx, ebp
push eax
lea edx, [0x458aec]
call fcn.004513ff
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x394
cmp ebp, esp
call fcn.0045126a
mov esp, ebp
pop ebp
ret
Function at 0x45e400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
lea edi, [ebp - 0x144]
mov ecx, 0x51
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x52317b
call fcn.004511ac
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + 0x50]
mov dword [ebp - 0x20], ecx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x2c], eax
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx + 0x7c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x5c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x80], 0
jmp 0x45e4b3
mov eax, dword [ebp - 0x80]
add eax, 1
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x44]
jae 0x45e509
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx + eax*4]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0xdc]
cmp dword [ebp - 0x20], ecx
ja 0x45e4d5
jmp 0x45e4aa
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 8]
add edx, dword [ecx + eax*4]
push edx
call fcn.00451c1f
add esp, 4
cmp eax, dword [ebp + 0xc]
jne 0x45e507
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x5c]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x74], ecx
jmp 0x45e509
jmp 0x45e4aa
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x2c]
jb 0x45e523
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x38]
cmp dword [ebp - 0x74], eax
jae 0x45e523
mov dword [ebp - 0x74], 0
mov eax, dword [ebp - 0x74]
pop edi
pop esi
pop ebx
add esp, 0x144
cmp ebp, esp
call fcn.0045126a
mov esp, ebp
pop ebp
ret
Function at 0x414420
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4514c8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
jne 0x414445
push 0x57
jmp 0x4144d2
push 0x1c
lea eax, [ebp - 0x68]
mov dword [ebp - 0x50], 0
push eax
xorps xmm0, xmm0
push esi
push edi
movdqu xmmword [ebp - 0x68], xmm0
movq qword [ebp - 0x58], xmm0
call dword [0x43207c]
test eax, eax
je 0x4144d8
push 0
push 0x40
lea eax, [ebp - 0x4c]
push eax
push esi
push edi
call dword [0x432030]
test eax, eax
je 0x4144d8
mov eax, 0x5a4d
cmp word [ebp - 0x4c], ax
jne 0x4144cd
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x5c]
ja 0x4144cd
cmp eax, 0x40
jb 0x4144cd
push 0
push 0xf8
push ebx
add eax, esi
push eax
push edi
call dword [0x432030]
test eax, eax
je 0x4144d8
cmp dword [ebx], 0x4550
jne 0x4144cd
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041993c
mov esp, ebp
pop ebp
ret 4
push 0xc1
call dword [fcn.00432084]
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041993c
mov esp, ebp
pop ebp
ret 4
Function at 0x415160
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
mov eax, dword [0x4514c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 4
push 0x1000
push 0x1230
mov edi, ecx
mov dword [ebp - 0x1cc], eax
push 0
push edi
call dword [fcn.00432070]
mov esi, eax
mov dword [ebp - 0x1c8], esi
test esi, esi
je 0x4153ca
push 0x40
lea eax, [ebp - 0xc8]
mov dword [ebp - 0x1c4], 0
push 0
push eax
call fcn.0041b500
mov ebx, dword [0x43202c]
add esp, 0xc
mov eax, 0x5a4d
mov dword [ebp - 0x8c], 0x40
mov word [ebp - 0xc8], ax
lea eax, [ebp - 0x1c4]
push eax
push 0x40
lea eax, [ebp - 0xc8]
push eax
push esi
push edi
call ebx
test eax, eax
je 0x4153ca
cmp dword [ebp - 0x1c4], 0x40
jne 0x4153ca
push 0xf8
lea eax, [ebp - 0x1c0]
add esi, 0x40
push 0
push eax
call fcn.0041b500
add esp, 0xc
mov dword [ebp - 0x1c0], 0x4550
mov eax, 1
mov dword [ebp - 0x1ac], 0x200000e0
mov word [ebp - 0x1ba], ax
mov eax, 0x10b
mov word [ebp - 0x1a8], ax
lea eax, [ebp - 0x1c4]
push eax
push 0xf8
lea eax, [ebp - 0x1c0]
push eax
push esi
push edi
call ebx
test eax, eax
je 0x4153ca
cmp dword [ebp - 0x1c4], 0xf8
jne 0x4153ca
mov eax, dword [0x44b2dc]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x44], eax
add esi, 0xf8
mov eax, dword [0x44b2e0]
mov dword [ebp - 0x40], eax
mov eax, esi
sub eax, dword [ebp - 0x1c8]
add eax, 0x28
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x1c4]
push eax
push 0x28
lea eax, [ebp - 0x44]
push eax
push esi
movdqu xmmword [ebp - 0x34], xmm0
push edi
mov dword [ebp - 0x34], 0x10d0
call ebx
test eax, eax
je 0x4153ca
cmp dword [ebp - 0x1c4], 0x28
jne 0x4153ca
push 0x40
lea eax, [ebp - 0x88]
add esi, 0x28
push 0
push eax
call fcn.0041b500
add esp, 0xc
mov dword [ebp - 0x88], 0x40
lea eax, [ebp - 0x1c4]
mov dword [ebp - 0x84], 0x727444
mov dword [ebp - 0x80], 0x40
mov dword [ebp - 0x7c], 0x10d0
push eax
push 0x40
lea eax, [ebp - 0x88]
push eax
push esi
push edi
call ebx
test eax, eax
je 0x4153ca
cmp dword [ebp - 0x1c4], 0x40
jne 0x4153ca
lea eax, [ebp - 0x1c4]
xorps xmm0, xmm0
push eax
push 0x18
movdqu xmmword [ebp - 0x1c], xmm0
lea eax, [ebp - 0x1c]
add esi, 0x40
movq qword [ebp - 0xc], xmm0
movdqu xmm0, xmmword [0x44af5c]
push eax
push esi
push edi
mov dword [ebp - 0x1c], 0x1090
mov dword [ebp - 0x18], 0
movdqu xmmword [ebp - 0x14], xmm0
call ebx
test eax, eax
je 0x4153ca
cmp dword [ebp - 0x1c4], 0x18
jne 0x4153ca
lea eax, [ebp - 0x1c4]
push eax
push 0x1078
push dword [ebp - 0x1cc]
lea ecx, [esi + 0x18]
push ecx
push edi
call ebx
test eax, eax
je 0x4153ca
cmp dword [ebp - 0x1c4], 0x1078
jne 0x4153ca
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041993c
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041993c
mov esp, ebp
pop ebp
ret 8
Function at 0x415500
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x44f4e0
push 0x423e00
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x4514c8]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov edx, ecx
mov dword [ebp - 0x20], edx
test edx, edx
jne 0x41555e
push ecx
call dword [fcn.00432064]
mov edx, eax
mov dword [ebp - 0x20], eax
test edx, edx
jne 0x41555e
push 0xc0
call dword [fcn.00432084]
jmp 0x4156f0
mov dword [ebp - 4], 0
mov eax, 0x5a4d
cmp word [edx], ax
je 0x415579
push 0xc1
jmp 0x4156e3
mov eax, dword [edx + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x41558f
push 0xbf
jmp 0x4156e3
cmp word [eax + edx + 0x14], 0
je 0x4156de
mov eax, dword [eax + edx + 0x80]
test eax, eax
je 0x4156bf
lea ebx, [eax + edx]
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x4156de
jmp 0x4155c0
mov ecx, dword [ebx]
test ecx, ecx
je 0x415684
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4156de
lea esi, [eax + edx]
test esi, esi
je 0x4156de
lea eax, [ecx + edx]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x4155f1
add eax, edx
jmp 0x4155f3
xor eax, eax
mov dword [ebp - 0x24], eax
mov ecx, dword [eax]
call fcn.004153f0
mov ecx, 0x4115e0
test ecx, ecx
je 0x415612
push esi
push eax
push edi
call fcn.004109e0
test eax, eax
je 0x415684
xor esi, esi
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41566d
mov edi, edi
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x41566a
xor eax, eax
test ecx, ecx
js 0x41563b
add ecx, 2
je 0x415639
mov eax, dword [ebp - 0x20]
add eax, ecx
jmp 0x41563b
xor eax, eax
mov ecx, 0x411640
test ecx, ecx
je 0x41567b
mov ecx, dword [ebp - 0x24]
mov ebx, dword [ecx + esi*4]
test edi, edi
je 0x41566a
test eax, eax
je 0x41566a
cmp byte [edi], 0
je 0x41567b
push dword [edi + 0xc]
push eax
call fcn.00419a0c
add esp, 8
test eax, eax
jne 0x41567b
mov dword [edi + 4], ebx
mov ebx, dword [ebp - 0x1c]
add ebx, 0x14
mov dword [ebp - 0x1c], ebx
mov edx, dword [ebp - 0x20]
jmp 0x4155c0
inc esi
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x28]
jmp 0x415620
mov eax, 0x4115e0
test eax, eax
je 0x415697
push 0
push 0
push edi
call fcn.004109e0
push 0
call dword [fcn.00432084]
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x1c], 0
jmp 0x4156de
push 0xc0
call dword [fcn.00432084]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8