joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415fa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x415fcb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00416980
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x415fed
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x415fef
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x41608e
jg 0x41600c
test esi, esi
je 0x41608e
test ecx, ecx
jl 0x416059
jg 0x416016
test eax, eax
je 0x416059
cmp ebx, ecx
jg 0x41602a
jl 0x416020
cmp esi, eax
jae 0x41602a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.004fee20
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x416060
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x41608e
jg 0x41606a
test esi, esi
je 0x41608e
cmp dword [edi + 0x4c], 0
je 0x41608e
mov ecx, edi
call fcn.004171b0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.00511282
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4178e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d080
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x57a438]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004ac6d6
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0042c783
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41ee00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x57a438]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x110], 0x740068
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x110]
mov eax, 0x587c08
mov dword [ebp - 0x10c], 0x700074
push edi
mov dword [ebp - 0x108], 0x2f003a
mov edx, 0x85
mov dword [ebp - 0x104], 0x73002f
sub esi, eax
mov dword [ebp - 0x100], 0x39002e
mov dword [ebp - 0xfc], 0x740031
mov dword [ebp - 0xf8], 0x6f006f
mov dword [ebp - 0xf4], 0x62006c
mov dword [ebp - 0xf0], 0x78006f
mov dword [ebp - 0xec], 0x63002e
mov dword [ebp - 0xe8], 0x6d006f
mov dword [ebp - 0xe4], 0x77002f
mov dword [ebp - 0xe0], 0x6e0069
mov dword [ebp - 0xdc], 0x70006f
mov dword [ebp - 0xd8], 0x3f0074
mov dword [ebp - 0xd4], 0x700061
mov dword [ebp - 0xd0], 0x3d0070
mov dword [ebp - 0xcc], 0x690077
mov dword [ebp - 0xc8], 0x6f006e
mov dword [ebp - 0xc4], 0x740070
mov dword [ebp - 0xc0], 0x700026
mov dword [ebp - 0xbc], 0x640069
mov dword [ebp - 0xb8], 0x7b003d
mov dword [ebp - 0xb4], 0x690070
mov dword [ebp - 0xb0], 0x7d0064
mov dword [ebp - 0xac], 0x6d0026
mov dword [ebp - 0xa8], 0x640069
mov dword [ebp - 0xa4], 0x7b003d
mov dword [ebp - 0xa0], 0x69006d
mov dword [ebp - 0x9c], 0x7d0064
mov dword [ebp - 0x98], 0x6d0026
mov dword [ebp - 0x94], 0x640069
mov dword [ebp - 0x90], 0x3d0032
mov dword [ebp - 0x8c], 0x6d007b
mov dword [ebp - 0x88], 0x640069
mov dword [ebp - 0x84], 0x7d0032
mov dword [ebp - 0x80], 0x610026
mov dword [ebp - 0x7c], 0x700070
mov dword [ebp - 0x78], 0x650076
mov dword [ebp - 0x74], 0x3d0072
mov dword [ebp - 0x70], 0x61007b
mov dword [ebp - 0x6c], 0x700070
mov dword [ebp - 0x68], 0x650076
mov dword [ebp - 0x64], 0x7d0072
mov dword [ebp - 0x60], 0x6d0026
mov dword [ebp - 0x5c], 0x64006f
mov dword [ebp - 0x58], 0x650076
mov dword [ebp - 0x54], 0x3d0072
mov dword [ebp - 0x50], 0x6d007b
mov dword [ebp - 0x4c], 0x64006f
mov dword [ebp - 0x48], 0x650076
mov dword [ebp - 0x44], 0x7d0072
mov dword [ebp - 0x40], 0x740026
mov dword [ebp - 0x3c], 0x700079
mov dword [ebp - 0x38], 0x3d0065
mov dword [ebp - 0x34], 0x74007b
mov dword [ebp - 0x30], 0x700079
mov dword [ebp - 0x2c], 0x7d0065
mov dword [ebp - 0x28], 0x610026
mov dword [ebp - 0x24], 0x740063
mov dword [ebp - 0x20], 0x6f0069
mov dword [ebp - 0x1c], 0x3d006e
mov dword [ebp - 0x18], 0x61007b
mov dword [ebp - 0x14], 0x740063
mov dword [ebp - 0x10], 0x6f0069
mov dword [ebp - 0xc], 0x7d006e
nop dword [eax + eax]
lea ecx, [edx + 0x7fffff79]
test ecx, ecx
je 0x41f08e
movzx ecx, word [esi + eax]
test cx, cx
je 0x41f08e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x41f070
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ac694
mov esp, ebp
pop ebp
ret
Function at 0x420060
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c0
mov eax, dword [0x57a438]
xor eax, esp
mov dword [esp + 0x4bc], eax
push esi
push edi
call fcn.0040d740
mov edx, 0x560abc
test eax, eax
je 0x420091
push 0x100
jmp 0x420093
push 0
push str.7D0018B7_A788_9AEF_194C_BF625648C610
call fcn.0041fda0
add esp, 8
lea eax, [esp + 0x268]
push 0x258
push 0
push eax
call fcn.004fecc0
add esp, 0xc
lea eax, [esp + 0x12]
push 0x256
push 0
push eax
call fcn.004fecc0
add esp, 0xc
lea esi, [esp + 0x10]
mov edx, str.0Uninstaller
mov cl, byte [edx]
lea edx, [edx + 1]
movzx eax, cl
lea esi, [esi + 2]
mov word [esi - 2], ax
test cl, cl
jne 0x4200d4
xor edi, edi
nop dword [eax]
mov edx, dword [edi + 0x560af4]
lea esi, [esp + 0x268]
nop dword [eax]
mov cl, byte [edx]
lea edx, [edx + 1]
movzx eax, cl
lea esi, [esi + 2]
mov word [esi - 2], ax
test cl, cl
jne 0x420100
call fcn.0040d740
test eax, eax
lea edx, [esp + 0x268]
lea eax, [esp + 0x10]
je 0x42012e
push 0x100
jmp 0x420130
push 0
push eax
call fcn.0041fda0
add edi, 4
add esp, 8
cmp edi, 0xc
jb 0x4200f0
call fcn.0040d740
test eax, eax
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
je 0x42015e
push 0x1010b
jmp 0x420163
push 0x1000b
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420193
push str.7D0018B7_A788_9AEF_194C_BF625648C610
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x4c4]
pop edi
pop esi
xor ecx, esp
call fcn.004ac694
mov esp, ebp
pop ebp
ret

Function at 0x4201b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f170
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x57a438]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], 0x690057
mov dword [ebp - 0x2c], 0x4f006e
mov dword [ebp - 0x28], 0x740070
mov dword [ebp - 0x24], 0x6d0069
mov dword [ebp - 0x20], 0x7a0069
mov dword [ebp - 0x1c], 0x720065
mov word [ebp - 0x18], ax
call fcn.00407b40
push eax
push 0xc
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x14]
call fcn.004070e0
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x14]
push esi
push dword [ebp + 8]
call fcn.004202a0
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edi, eax
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x42025c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x42027b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac694
mov esp, ebp
pop ebp
ret 4
Function at 0x420bd0
Capabilities:
Contain obfuscated stackstrings
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f2b6
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x57a438]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push dword [ebx + 0xc]
call fcn.004064d0
lea ecx, [ebp - 0x1c]
call fcn.00426ed0
sub esp, 8
mov dword [ebp - 4], 0
mov esi, dword [eax]
lea ecx, [ebp - 0xd8]
call fcn.004093f0
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 1
push str.Delete_IsAutoRun:_d__err:_u
push eax
call fcn.00407550
mov eax, dword [esi]
lea ecx, [ebp - 0xd8]
add esp, 8
push ecx
mov ecx, esi
call dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0xd8]
call fcn.0040a3e0
mov dword [ebp - 4], 2
or edi, 0xffffffff
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x420c8e
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x420c8e
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x420c8e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
push dword [ebx + 0xc]
call fcn.00406aa0
lea ecx, [ebp - 0x1c]
call fcn.00426ed0
sub esp, 8
mov dword [ebp - 4], 3
mov esi, dword [eax]
lea ecx, [ebp - 0xd8]
call fcn.004093f0
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 4
push str.Delete_AutoRun:_d__err:_u
push eax
call fcn.00407550
mov eax, dword [esi]
lea ecx, [ebp - 0xd8]
add esp, 8
push ecx
mov ecx, esi
call dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0xd8]
call fcn.0040a3e0
mov dword [ebp - 4], 5
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x420d20
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x420d20
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x420d20
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
push eax
push 0x20106
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420db8
mov dword [ebp - 0x40], 0x690057
mov dword [ebp - 0x3c], 0x4f006e
mov dword [ebp - 0x38], 0x740070
mov dword [ebp - 0x34], 0x6d0069
mov dword [ebp - 0x30], 0x7a0069
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x720054
mov dword [ebp - 0x24], 0x790061
mov word [ebp - 0x20], ax
call fcn.00407b40
push eax
push 0x10
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x18]
call fcn.004070e0
mov esi, dword [ebp - 0x18]
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x420db8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac694
mov esp, ebp
pop ebp
ret
Function at 0x421e70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f42b
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
push ebx
push esi
push edi
mov eax, dword [0x57a438]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebp - 0x38]
call fcn.00426ed0
mov dword [ebp - 4], 0
mov edi, dword [eax]
mov dword [ebp - 0x2c], 0x6e0075
mov dword [ebp - 0x28], 0x6e0069
mov dword [ebp - 0x24], 0x740073
mov dword [ebp - 0x20], 0x6c0061
mov dword [ebp - 0x1c], 0x20006c
mov dword [ebp - 0x18], 0x650062
mov dword [ebp - 0x14], 0x690067
mov dword [ebp - 0x10], 0x6e
call fcn.00407b40
push eax
push 0xf
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004070e0
sub esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd0]
call fcn.004093f0
mov byte [ebp - 4], 2
mov eax, 0x55fc20
mov esi, dword [ebp - 0x30]
test esi, esi
cmovne eax, esi
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.00407550
mov eax, dword [edi]
lea ecx, [ebp - 0xd0]
add esp, 8
push ecx
mov ecx, edi
call dword [eax + 0xc]
lea ecx, [ebp - 0xd0]
call fcn.0040a3e0
or edi, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x421f64
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 3
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x421f90
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x421f90
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x421f90
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebx + 8]
test eax, eax
je 0x421fa7
push 0
push 0
push 0x429
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421fc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f46b
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
push esi
push edi
mov eax, dword [0x57a438]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x44]
call fcn.00426ed0
mov dword [ebp - 4], 0
mov edi, dword [eax]
mov dword [ebp - 0x34], 0x6e0075
mov dword [ebp - 0x30], 0x6e0069
mov dword [ebp - 0x2c], 0x740073
mov dword [ebp - 0x28], 0x6c0061
mov dword [ebp - 0x24], 0x20006c
mov dword [ebp - 0x20], 0x720070
mov dword [ebp - 0x1c], 0x67006f
mov dword [ebp - 0x18], 0x650072
mov dword [ebp - 0x14], 0x730073
mov dword [ebp - 0x10], 0x3a
call fcn.00407b40
push eax
push 0x13
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x38]
call fcn.004070e0
sub esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdc]
call fcn.004093f0
mov byte [ebp - 4], 2
mov eax, 0x55fc20
mov esi, dword [ebp - 0x38]
test esi, esi
cmovne eax, esi
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.00407550
add esp, 8
lea ecx, [ebp - 0xdc]
push dword [ebp + 8]
call fcn.004192c0
mov eax, dword [edi]
lea ecx, [ebp - 0xdc]
push ecx
mov ecx, edi
call dword [eax + 0xc]
lea ecx, [ebp - 0xdc]
call fcn.0040a3e0
or edi, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4220d0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 3
mov esi, dword [ebp - 0x40]
test esi, esi
je 0x4220fc
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4220fc
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4220fc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
test eax, eax
je 0x422117
push 0
push dword [ebp + 8]
push 0x42a
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x422130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f4ab
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
push esi
push edi
mov eax, dword [0x57a438]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebp - 0x34]
call fcn.00426ed0
mov dword [ebp - 4], 0
mov edi, dword [eax]
mov dword [ebp - 0x28], 0x6e0075
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x740073
mov dword [ebp - 0x1c], 0x6c0061
mov dword [ebp - 0x18], 0x20006c
mov dword [ebp - 0x14], 0x6e0065
mov dword [ebp - 0x10], 0x64
call fcn.00407b40
push eax
push 0xd
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004070e0
sub esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcc]
call fcn.004093f0
mov byte [ebp - 4], 2
mov eax, 0x55fc20
mov esi, dword [ebp - 0x2c]
test esi, esi
cmovne eax, esi
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.00407550
mov eax, dword [edi]
lea ecx, [ebp - 0xcc]
add esp, 8
push ecx
mov ecx, edi
call dword [eax + 0xc]
lea ecx, [ebp - 0xcc]
call fcn.0040a3e0
or edi, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42221d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 3
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x422249
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x422249
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x422249
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebx + 8]
test eax, eax
je 0x422260
push 0
push 0
push 0x42b
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426340
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52fad9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x57a438]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], 0
cmp byte [esi + 8], 0
je 0x426383
call fcn.004264e0
mov byte [esi + 8], 0
cmp dword [esi + 4], 0x40000000
jle 0x4263bf
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
je 0x4263a4
push eax
call fcn.0051834f
add esp, 4
mov dword [esi + 0x24], 0xffffffff
cmp dword [esi + 0x20], 8
lea eax, [esi + 0xc]
jb 0x4263af
mov eax, dword [eax]
push eax
call fcn.0051851a
add esp, 4
mov ecx, esi
call fcn.004264e0
mov dword [ebp - 4], 0
xor ecx, ecx
mov eax, dword [edi + 0x10]
mov edx, 2
mul edx
push 0
mov dword [ebp - 0x14], 0
seto cl
mov dword [ebp - 0x10], 0xf
neg ecx
mov byte [ebp - 0x24], 0
or ecx, eax
push ecx
lea ecx, [ebp - 0x24]
call fcn.004273f0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], 1
test eax, eax
je 0x42643e
cmp dword [ebp - 0x10], 0x10
lea ecx, [ebp - 0x24]
mov edx, edi
cmovae ecx, dword [ebp - 0x24]
cmp dword [edi + 0x14], 8
jb 0x426419
mov edx, dword [edi]
push 0
push 0
push eax
push ecx
push dword [edi + 0x10]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push eax
lea ecx, [ebp - 0x24]
call fcn.0041c030
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
lea ebx, [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
cmp edx, 0x10
cmovae ebx, ecx
cmp dword [esi + 0x24], 0xffffffff
je 0x42646a
push eax
push ebx
push dword [esi + 0x24]
call fcn.00517ac8
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov ecx, dword [ebp - 0x24]
mov ebx, eax
jmp 0x42646d
or ebx, 0xffffffff
cmp edx, 0x10
jb 0x426497
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42648d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4264d5
push edx
push ecx
call fcn.004ac6c8
add esp, 8
test ebx, ebx
jle 0x4264b2
add dword [esi + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x14], 8
jb 0x4264ba
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.005026a0
int3
Function at 0x4264e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52fb0b
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x57a438]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x20], 8
lea esi, [edi + 0xc]
jb 0x42651b
mov esi, dword [esi]
push 0x180
push 0x40
push 0x8101
lea ebx, [edi + 0x24]
push esi
push ebx
call fcn.00517306
add esp, 0x14
mov dword [ebp - 0xc4], eax
test eax, eax
je 0x426648
push 0x98
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.004fecc0
add esp, 4
lea ecx, [ebp - 0xa8]
call fcn.004093f0
push 0x560fe0
push ecx
push dword [ebp - 0xc4]
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 0
push ecx
push str._error.__
push ecx
push esi
push ecx
push str.open
push eax
call fcn.00407550
add esp, 0xc
push eax
call fcn.00407550
add esp, 0xc
push eax
call fcn.00407550
add esp, 0xc
mov ecx, eax
call fcn.004192c0
add esp, 4
push eax
call fcn.00407550
add esp, 8
lea eax, [ebp - 0xc0]
lea ecx, [ebp - 0xa8]
push eax
call fcn.00427050
cmp dword [eax + 0x14], 8
jb 0x4265d2
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0xac]
cmp edx, 8
jb 0x426619
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42660f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x426723
push edx
push ecx
call fcn.004ac6c8
add esp, 8
xor eax, eax
mov dword [ebp - 0xb0], 0
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xac], 7
mov word [ebp - 0xc0], ax
mov dword [ebp - 4], 0xffffffff
call fcn.0040a3e0
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x42665e
push 2
push 0
push eax
call fcn.005181cb
add esp, 0xc
jmp 0x426661
or eax, 0xffffffff
mov dword [edi + 4], eax
test eax, eax
jne 0x426707
push 3
push 0x561008
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], 0xf
mov byte [ebp - 0xc0], al
call fcn.00408dd0
mov edx, dword [ebp - 0xac]
lea eax, [ebp - 0xc0]
mov ecx, dword [ebp - 0xc0]
cmp edx, 0x10
mov esi, dword [ebx]
cmovae eax, ecx
cmp esi, 0xffffffff
je 0x4266d3
push dword [ebp - 0xb0]
push eax
push esi
call fcn.00517ac8
mov edx, dword [ebp - 0xac]
add esp, 0xc
mov ecx, dword [ebp - 0xc0]
mov esi, eax
jmp 0x4266d6
or esi, 0xffffffff
cmp edx, 0x10
jb 0x426700
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4266f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x426728
push edx
push ecx
call fcn.004ac6c8
add esp, 8
test esi, esi
jle 0x426707
add dword [edi + 4], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac694
mov esp, ebp
pop ebp
ret
call fcn.005026a0
call fcn.005026a0
int3