joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c914
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push 1
call fcn.0042c715
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
je 0x42c96f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov edi, 0x400
jmp 0x42c951
cmp dword [ebp - 4], 0
je 0x42c966
push dword [ebp - 4]
lea eax, [ebp - 0x404]
push eax
call dword [ebp + 8]
pop ecx
pop ecx
push 0
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x404]
push eax
push ebx
call esi
test eax, eax
jne 0x42c93c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42c972
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
call fcn.0042c715
mov esi, eax
cmp esi, 0xffffffff
pop ecx
je 0x42c9a0
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret

Function at 0x43003e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x449e4c], esi
push edi
jne 0x43005e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x449e48], esi
mov byte [0x449e44], al
jne 0x4300c4
mov ecx, dword [0x44a4cc]
test ecx, ecx
je 0x4300a5
mov eax, dword [0x44a4c8]
sub eax, 4
cmp eax, ecx
jmp 0x43009e
mov eax, dword [eax]
test eax, eax
je 0x430090
call eax
mov eax, dword [0x44a4c8]
sub eax, 4
cmp eax, dword [0x44a4cc]
mov dword [0x44a4c8], eax
jae 0x430088
mov eax, 0x448020
mov esi, 0x448028
cmp eax, esi
mov edi, eax
jae 0x4300c4
mov eax, dword [edi]
test eax, eax
je 0x4300bd
call eax
add edi, 4
cmp edi, esi
jb 0x4300b5
mov eax, 0x44802c
mov esi, 0x448030
cmp eax, esi
mov edi, eax
jae 0x4300e3
mov eax, dword [edi]
test eax, eax
je 0x4300dc
call eax
add edi, 4
cmp edi, esi
jb 0x4300d4
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x4300fd
push dword [ebp + 8]
mov dword [0x449e4c], 1
call fcn.0042ffa4
pop ebp
ret
Function at 0x4302c3
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x446b08
call fcn.00431ed4
mov edi, 0x94
mov eax, edi
call fcn.0042fef0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x449e0c], ecx
mov eax, dword [esi + 4]
mov dword [0x449e18], eax
mov edx, dword [esi + 8]
mov dword [0x449e1c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x449e10], esi
cmp ecx, 2
je 0x430323
or esi, 0x8000
mov dword [0x449e10], esi
shl eax, 8
add eax, edx
mov dword [0x449e14], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x43035c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43035c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x430374
cmp eax, 0x20b
je 0x430361
mov dword [ebp - 0x1c], edi
jmp 0x430388
cmp dword [ecx + 0x84], 0xe
jbe 0x43035c
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x430382
cmp dword [ecx + 0x74], 0xe
jbe 0x43035c
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push edi
call fcn.00432741
pop ecx
test eax, eax
jne 0x4303b4
cmp dword [0x449e58], 2
je 0x4303a1
call fcn.004342f6
push 0x1c
call fcn.0043417f
push 0xff
call fcn.0042ffa4
pop ecx
pop ecx
call fcn.0043461d
mov dword [ebp - 4], edi
call fcn.004324a9
test eax, eax
jge 0x4303cd
push 0x1b
call fcn.0043029e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x44a4c0], eax
call fcn.00434c2e
mov dword [0x449e50], eax
call fcn.00434b8c
test eax, eax
jge 0x4303f3
push 8
call fcn.0043029e
pop ecx
call fcn.00434959
test eax, eax
jge 0x430404
push 9
call fcn.0043029e
pop ecx
push 1
call fcn.0042ffd4
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x43041a
push eax
call fcn.0043029e
pop ecx
mov eax, dword [0x449e2c]
mov dword [0x449e30], eax
push eax
push dword [0x449e24]
push dword [0x449e20]
call fcn.0042af8e
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], edi
jne 0x430449
push esi
call fcn.004300ff
call fcn.00430121
jmp 0x43047b
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.00431f0f
ret
Function at 0x430ab3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x449e70], ebx
push esi
push edi
jne 0x430b33
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x430b6e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x449e70], eax
je 0x430b6e
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x449e74], eax
call esi
cmp dword [0x449e0c], 2
mov dword [0x449e78], eax
jne 0x430b33
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x449e80], eax
je 0x430b33
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x449e7c], eax
mov eax, dword [0x449e7c]
test eax, eax
je 0x430b78
call eax
test eax, eax
je 0x430b5f
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x449e80]
test eax, eax
je 0x430b5f
test byte [ebp - 8], 1
jne 0x430b78
cmp dword [0x449e18], 4
jb 0x430b72
or byte [ebp + 0x12], 0x20
jmp 0x430b97
xor eax, eax
jmp 0x430ba7
or byte [ebp + 0x12], 4
jmp 0x430b97
mov eax, dword [0x449e74]
test eax, eax
je 0x430b97
call eax
mov ebx, eax
test ebx, ebx
je 0x430b97
mov eax, dword [0x449e78]
test eax, eax
je 0x430b97
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x449e70]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4318ec
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x44a3a4]
mov eax, dword [0x448ba0]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x431ab2
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x44a3c0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x431ab2
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x431956
xor eax, eax
jmp 0x431ac6
test al, 0x20
je 0x431967
push 2
push edi
push edi
push ecx
call fcn.00435b04
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x431a3c
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x431a83
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x4319c9
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4319ba
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x43199c
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x431a09
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x431a15
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x431990
jmp 0x431a17
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x431aad
cmp dword [ebp + 0x3a4], edi
je 0x431a83
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x431a75
mov dword [0x449e04], eax
jmp 0x431ab9
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x431a67
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x431a17
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x431a17
push dword [ebp + 0x3a4]
call fcn.00434d50
pop ecx
jmp 0x431ac3
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x431a9b
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x43194f
mov dword [0x449e00], 0x1c
mov dword [0x449e04], edi
jmp 0x431ac3
sub eax, dword [ebp - 0x7c]
jmp 0x431ac6
and dword [0x449e04], 0
mov dword [0x449e00], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.00430d86
add ebp, 0x39c
leave
ret
Function at 0x431dee
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0042fef0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x431e89
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x449e0c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x431e89
cmp eax, 1
je 0x431eaa
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x431e89
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x431e56
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x431e85
xor eax, eax
inc eax
jmp 0x431ec9
cmp edi, eax
jae 0x431e8d
xor eax, eax
jmp 0x431ec9
cmp eax, esi
jae 0x431e94
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x449e0c]
jmp 0x431ead
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43417f
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x448ba0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x448c70]
je 0x4341b4
inc eax
cmp eax, 0x13
jb 0x4341a5
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x448c70]
jne 0x4342da
mov eax, dword [0x449e58]
cmp eax, 1
je 0x4342b2
cmp eax, edx
jne 0x4341e4
cmp dword [0x448b94], 1
je 0x4342b2
cmp ecx, 0xfc
je 0x4342da
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43421a
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.0042f020
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.0042d810
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x43424e
mov eax, edi
push eax
call fcn.0042d810
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x446368
push edi
call fcn.0042fb50
add esp, 0x10
push edi
call fcn.0042d810
push dword [esi + 0x448c74]
mov ebx, eax
call fcn.0042d810
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.0042fef0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0042f020
push edi
push ebx
call fcn.0042f030
push 0x446364
push ebx
call fcn.0042f030
push dword [esi + 0x448c74]
push ebx
call fcn.0042f030
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00430ab3
add esp, 0x2c
jmp 0x4342da
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x448c74]
push dword [esi]
call fcn.0042d810
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00430d86
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x43432f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x44a3a4]
push edi
jae 0x434504
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0x44a3c0]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x434504
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x4343da
test dl, 2
jne 0x4343da
test dl, 0x48
je 0x4343a4
cmp byte [eax + 5], 0xa
je 0x4343a4
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4343ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x4343d5
mov dword [0x449e04], ecx
jmp 0x43450b
cmp eax, 0x6d
jne 0x4343e1
xor eax, eax
jmp 0x434518
push eax
call fcn.00434d50
pop ecx
jmp 0x434515
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x4344ff
test eax, eax
je 0x434414
cmp byte [ebx], 0xa
jne 0x434414
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x43441d
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x4344f9
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x4344e9
cmp al, 0xd
je 0x43444f
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x4344db
dec ecx
cmp dword [ebp - 8], ecx
jae 0x434469
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x434464
add dword [ebp - 8], 2
jmp 0x4344bd
mov dword [ebp - 8], eax
jmp 0x4344d7
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x434491
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4344d7
cmp dword [ebp - 0x10], 0
je 0x4344d7
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x4344b2
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x4344bd
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x4344da
cmp ebx, dword [ebp + 0xc]
jne 0x4344c2
cmp byte [ebp - 1], 0xa
jne 0x4344c2
mov byte [ebx], 0xa
jmp 0x4344da
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004357df
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x4344db
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x434433
jmp 0x4344f9
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x4344f9
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x434518
and dword [0x449e04], 0
mov dword [0x449e00], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43586b
Capabilities:
Read file via mapping

Disassembly:
add edx, 0x975c119e
sub edi, ecx
ror ecx, 0x18
xor dword [0x44ba5a], 0x22158900
call fcn.004025a3
xchg eax, esi
xor edx, ebx
or esi, dword [0x44bfd8]
sub ecx, eax
xor eax, 0x1a79090
nop
cmpsd dword [esi], dword es:[edi]
add dword [eax + 0x33], ecx
xor eax, 0x44bb8e
xor eax, 0x1a0767a2
ror eax, 3
xor eax, esp
call fcn.00403e17
call fcn.004014b3
xor eax, esp
rol eax, 3
xor eax, 0x1a0767a2
inc eax
xor eax, 0x1a79090
add ecx, eax
xor edx, ebx
xchg eax, esi
call fcn.00403db5
rol ecx, 0x18
add edi, ecx
sub edx, 0x230bef78
sub ecx, dword [0x44bdfc]
xor edx, esi
sub ebx, esi
ror edx, 0xa
xor edx, dword [0x44bdc4]
xor eax, dword [0x44bb84]
invalid
jnp 0x435924
std

Function at 0x435892
Capabilities:
Read file via mapping

Disassembly:
add edx, 0x975c119e
sub edi, ecx
ror ecx, 0x18
xor dword [0x44ba5a], 0x22158900
call fcn.004025a3
xchg eax, esi
xor edx, ebx
or esi, dword [0x44bfd8]
sub ecx, eax
xor eax, 0x1a79090
nop
cmpsd dword [esi], dword es:[edi]
add dword [eax + 0x33], ecx
xor eax, 0x44bb8e
xor eax, 0x1a0767a2
ror eax, 3
xor eax, esp
call fcn.00403e17
call fcn.004014b3
xor eax, esp
rol eax, 3
xor eax, 0x1a0767a2
inc eax
xor eax, 0x1a79090
add ecx, eax
xor edx, ebx
xchg eax, esi
call fcn.00403db5
rol ecx, 0x18
add edi, ecx
sub edx, 0x230bef78
sub ecx, dword [0x44bdfc]
xor edx, esi
sub ebx, esi
ror edx, 0xa
xor edx, dword [0x44bdc4]
xor eax, dword [0x44bb84]
invalid
jnp 0x435924
std
Function at 0x43593b
Capabilities:
Read file via mapping

Disassembly:
mov bh, 0xb9
inc esp
add byte [ecx], ch
cmp eax, 0x44b88d
xor ecx, 0xced5c7e
not eax
xchg eax, esi
add eax, 0xccbd97c
xchg ecx, eax
sub ebx, eax
xchg eax, esi
dec esi
call fcn.00406dbf
rol edx, 0xa
add ebx, esi
xor edx, esi
push edx
inc eax
ror edx, 0x1c
neg eax
dec esi
xor eax, esi
call fcn.004014b3
xor ebx, edi
xor edi, ebp
inc esi
or dword [0x44b61f], 0xd494000
add eax, 0xea01352
add eax, dword [0x44bfb3]
sub eax, 0xea01352
sub dword [0x44b97e], 0x2ae43d
dec esi
xor edi, ebp
xor ebx, edi
call fcn.00403d8e
xor eax, esi
inc esi
neg eax
rol edx, 0x1c
dec eax
mov ecx, 0x9fcf66b5
call fcn.00402249
dec esi
ror edx, 1
dec esi
xor ecx, eax
or dword [0x44b670], 0x84ca680
call fcn.004049bc
and dword [0x44b67b], eax
or dword [0x44ba44], 0x344e8606
add edi, dword [0x44bf7a]
xor esi, esp
call fcn.00406a1d
ror eax, 0x15
sub dword [0x44b906], edx
xor eax, 0xaa74ecc
ror edx, 0x1b
xor edi, dword [0x44bc63]
xor eax, 0x58bc4b6
xor eax, ecx
xor eax, ecx
xor eax, 0x58bc4b6
rol edx, 0x1b
xor eax, 0xaa74ecc
xor dword [0x44b91e], ebx
rol eax, 0x15
call fcn.004067a6
xor esi, esp
or dword [0x44b652], eax
xor ecx, eax
inc esi
rol edx, 1
inc esi
and ecx, 0x7cb37319
sub eax, dword [0x44bc1a]
or esi, dword [0x44bd9a]
mov dword [0x44b597], edx
add edi, dword [0x44bbb4]
xor edi, ebx
sub dword [0x44b6d6], eax
xor eax, dword [0x44ba82]
xor eax, dword [0x44bb8b]
neg eax
sub ecx, esp
xchg esi, eax
dec esi
call fcn.004046ab
inc ecx
not eax
call fcn.00408300
xor dword [0x44b92e], edx
sub dword [0x44b850], eax
not eax
dec ecx
call fcn.0040162e
inc esi
xchg esi, eax
add ecx, esp
neg eax
xor edi, ebx
mov dword [0x44b754], edi
sub ecx, 0x1c836212
dec eax
add ecx, ebp
inc eax
xchg ecx, eax
not eax
sub edx, dword [0x44bf44]
mov dword [0x44b724], ecx
dec edx
and dword [0x44b91c], 0x4bd9548
rol edx, 7
sub ebx, edx
add ebx, edx
ror edx, 7
inc edx
or dword [0x44ba2c], eax
not eax
xchg ecx, eax
dec eax
sub ecx, ebp
inc eax
push ecx
call fcn.004031d8
xor ebx, esp
ror eax, 3
call fcn.00408474
sub eax, 0x1b10313
xor ebx, eax
xchg esi, eax
not esi
dec esi

Function at 0x435b04
Capabilities:
Read file via mapping

Disassembly:
xor ebx, eax
dec edx
call fcn.00408582
xor edx, ebp
call fcn.00406f8c
xor esi, 0x3e61b82
not esi
call fcn.00408c4b
or dword [0x44b70f], eax
call fcn.004062fb
not esi
xor esi, 0x3e61b82
xor edx, ebp
call fcn.00406070
inc edx
xor ebx, eax
inc esi
not esi
xchg esi, eax
xor ebx, eax
add eax, 0x1b10313
call fcn.00408c4b
rol eax, 3
xor ebx, esp
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
or dword [0x44b602], ebx
sub eax, dword [0x44bbed]
ror ecx, 0x18
not eax
dec eax
xor eax, 0xe9541c3
mov dword [0x44ba0c], eax
xor ebx, eax
dec ebx
ror eax, 0xe
xor esi, esp
call fcn.00405349
call fcn.00408c4b
xor esi, esp
rol eax, 0xe
inc ebx
xor ebx, eax
xor eax, 0xe9541c3
inc eax
not eax
rol ecx, 0x18
mov dword [0x44b932], edi
Function at 0x435ba4
Capabilities:
Read file via mapping

Disassembly:
push ebx
sub edx, dword [0x44bbb8]
or ecx, dword [0x44be0c]
xchg ecx, esi
not eax
xchg esi, eax
xor eax, 0x283b2d4
call fcn.00403973
mov dword [0x44b5ee], 0x9973b54
mov dword [0x44b8fe], 0xc2adc2
sub ebx, dword [0x44bc4a]
sub eax, dword [0x44beb2]
neg esi
inc ecx
or dword [0x44b692], edi
cmp eax, 0x44b692
call fcn.004039fb
xor edi, 0x25b9744
inc eax
xor esi, dword [0x44bbc0]
xchg ecx, edx
xor eax, ebp
xor eax, ebp
xchg ecx, edx
dec eax
xor edi, 0x25b9744
call fcn.00401e0f
dec ecx
neg esi
mov dword [0x44b91d], 0x7c0b844
call fcn.00404a74
xor eax, 0x283b2d4
xchg esi, eax
not eax
xchg ecx, esi
mov ecx, 0x346bd09a
xor eax, esp
ror esi, 0x14
add edx, 0x2bda339c
not eax
sub eax, dword [0x44baa0]
neg edx
call fcn.00406c7e
sub eax, 0x4fc4614
ror edi, 0x1f
sub eax, dword [0x44bdea]
xor eax, dword [0x44bc42]
call fcn.00404767
rol edi, 0x1f
add eax, 0x4fc4614
neg edx
not eax
invalid
invalid
pushfd
xor ebx, edx

Function at 0x435be6
Capabilities:
Read file via mapping

Disassembly:
push ebx
sub edx, dword [0x44bbb8]
or ecx, dword [0x44be0c]
xchg ecx, esi
not eax
xchg esi, eax
xor eax, 0x283b2d4
call fcn.00403973
mov dword [0x44b5ee], 0x9973b54
mov dword [0x44b8fe], 0xc2adc2
sub ebx, dword [0x44bc4a]
sub eax, dword [0x44beb2]
neg esi
inc ecx
or dword [0x44b692], edi
cmp eax, 0x44b692
call fcn.004039fb
xor edi, 0x25b9744
inc eax
xor esi, dword [0x44bbc0]
xchg ecx, edx
xor eax, ebp
xor eax, ebp
xchg ecx, edx
dec eax
xor edi, 0x25b9744
call fcn.00401e0f
dec ecx
neg esi
mov dword [0x44b91d], 0x7c0b844
call fcn.00404a74
xor eax, 0x283b2d4
xchg esi, eax
not eax
xchg ecx, esi
mov ecx, 0x346bd09a
xor eax, esp
ror esi, 0x14
add edx, 0x2bda339c
not eax
sub eax, dword [0x44baa0]
neg edx
call fcn.00406c7e
sub eax, 0x4fc4614
ror edi, 0x1f
sub eax, dword [0x44bdea]
xor eax, dword [0x44bc42]
call fcn.00404767
rol edi, 0x1f
add eax, 0x4fc4614
neg edx
not eax
invalid
invalid
pushfd
xor ebx, edx

Function at 0x435ebb
Capabilities:
Read file via mapping

Disassembly:
xor dword [0x44b960], 0x88cba08
xor esi, dword [0x44bf6b]
xor esi, 0x105dc020
not edi
dec ecx
xor eax, ebx
inc edi
not esi
mov dword [0x44b89b], eax
or dword [0x44b529], edx
add bh, dh
salc
dec edi
xor eax, ebx
inc ecx
not edi
xor esi, 0x105dc020
xor dword [0x44b50c], 0x27db740
xor esi, eax
dec esi
neg esi
push edx
or dword [0x44b814], 0xfd757d
call fcn.00402681
mov dword [0x44b9ae], eax
not eax
and dword [0x44b746], eax
not esi
dec esi
ror edi, 0xe
mov dword [0x44b8b6], 0x292e60c
call fcn.004029a1
add dword [0x44b963], eax
xchg eax, edx
sub esi, dword [0x44bbea]
inc edx
or eax, dword [0x44bbc0]
mov dword [0x44b5d5], 0x1a305aa0
xor esi, dword [0x44be54]
mov dword [0x44b78c], 0x10a8116f
dec edx
xchg eax, edx
mov dword [0x44b7a8], edx
or dword [0x44b652], 0x8153788
rol edi, 0xe
inc esi
not esi
not eax
mov dword [0x44b536], edx
call fcn.00408897
mov esi, 0x87876592
rol edx, 0xa
dec ebx
xor eax, 0x4f64fab
sub dword [0x44b9ce], eax
add edx, esp
call fcn.00403559
rol edx, 0xb
not esi
invalid
Function at 0x435ee4
Capabilities:
Read file via mapping

Disassembly:
xor dword [0x44b960], 0x88cba08
xor esi, dword [0x44bf6b]
xor esi, 0x105dc020
not edi
dec ecx
xor eax, ebx
inc edi
not esi
mov dword [0x44b89b], eax
or dword [0x44b529], edx
add bh, dh
salc
dec edi
xor eax, ebx
inc ecx
not edi
xor esi, 0x105dc020
xor dword [0x44b50c], 0x27db740
xor esi, eax
dec esi
neg esi
push edx
or dword [0x44b814], 0xfd757d
call fcn.00402681
mov dword [0x44b9ae], eax
not eax
and dword [0x44b746], eax
not esi
dec esi
ror edi, 0xe
mov dword [0x44b8b6], 0x292e60c
call fcn.004029a1
add dword [0x44b963], eax
xchg eax, edx
sub esi, dword [0x44bbea]
inc edx
or eax, dword [0x44bbc0]
mov dword [0x44b5d5], 0x1a305aa0
xor esi, dword [0x44be54]
mov dword [0x44b78c], 0x10a8116f
dec edx
xchg eax, edx
mov dword [0x44b7a8], edx
or dword [0x44b652], 0x8153788
rol edi, 0xe
inc esi
not esi
not eax
mov dword [0x44b536], edx
call fcn.00408897
mov esi, 0x87876592
rol edx, 0xa
dec ebx
xor eax, 0x4f64fab
sub dword [0x44b9ce], eax
add edx, esp
call fcn.00403559
rol edx, 0xb
not esi
invalid

Function at 0x435fac
Capabilities:
Read file via mapping

Disassembly:
ret