joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4411bb
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp eax, dword [ebp + 0x38]
jmp 0x4411b1
add edi, 0x15cd8
xor edi, 0xa1c0
pop edi
push edi
invalid
invalid

Function at 0x441203
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
call 0x441211
add byte [0x4d493941], bh
dec esp
inc esp
add esp, 4
pop esi
push edx
sub edx, 0x143bd
add bl, ch
invalid
pop edx
push eax
push edx
add esp, 4
add al, 0x81
enter 0xffffffffffffa336, 0
add byte [ecx + 0x16210f0], al
add byte [eax - 0x39], bl
test dword [eax + 0xeffffe1], edi
add byte [eax], al
invalid

Function at 0x441211
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
call 0x441211
add byte [0x4d493941], bh
dec esp
inc esp
add esp, 4
pop esi
push edx
sub edx, 0x143bd
add bl, ch
invalid
pop edx
push eax
push edx
add esp, 4
add al, 0x81
enter 0xffffffffffffa336, 0
add byte [ecx + 0x16210f0], al
add byte [eax - 0x39], bl
test dword [eax + 0xeffffe1], edi
add byte [eax], al
invalid

Function at 0x44121b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
call 0x441211
add byte [0x4d493941], bh
dec esp
inc esp
add esp, 4
pop esi
push edx
sub edx, 0x143bd
add bl, ch
invalid
pop edx
push eax
push edx
add esp, 4
add al, 0x81
enter 0xffffffffffffa336, 0
add byte [ecx + 0x16210f0], al
add byte [eax - 0x39], bl
test dword [eax + 0xeffffe1], edi
add byte [eax], al
invalid

Function at 0x441227
Capabilities:
Authenticate hmac
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add al, 0x81
enter 0xffffffffffffa336, 0
add byte [ecx + 0x16210f0], al
add byte [eax - 0x39], bl
test dword [eax + 0xeffffe1], edi
add byte [eax], al
add byte [esi - 0x7f], dl
push esi
invalid
invalid

Function at 0x44123f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add al, 0x81
enter 0xffffffffffffa336, 0
add byte [ecx + 0x16210f0], al
add byte [eax - 0x39], bl
test dword [eax + 0xeffffe1], edi
add byte [eax], al
add byte [esi - 0x7f], dl
push esi
invalid
invalid

Function at 0x441269
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0x8b73cb], al
add byte [ebx - 0x48], bl
add dword [eax], eax
add byte [eax], al

Function at 0x4412b7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop edi
mov dword [ebp - 0x1e7c], 0xffffffff
push edx

Function at 0x441329
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop edx
push ecx
or ecx, 0x13c47
add dword [eax], eax
call 0x44133f
add byte [esi + 0x47], al
inc eax
cmp dword [esi], esi
inc ecx
cmp byte [ecx - 0x7d], cl
les eax, [ecx + ebx*2]
add al, 0x59
invalid
xchg ebp, eax
or al, 0xfb
Function at 0x44133f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop edx
push ecx
or ecx, 0x13c47
add dword [eax], eax
call 0x44133f
add byte [esi + 0x47], al
inc eax
cmp dword [esi], esi
inc ecx
cmp byte [ecx - 0x7d], cl
les eax, [ecx + ebx*2]
add al, 0x59
invalid
xchg ebp, eax
or al, 0xfb
Function at 0x441413
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push edi
push edx
add esp, 4
sub edi, 0x386e
xor edi, 0x8770
pop edi
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0x15e0], eax
jmp 0x44156b
cmp dword [ebp - 0x15e0], 0
jne 0x4415b4
push esi
jmp 0x44157c
xor esi, 0x1208d
add esi, 0x14eb5
call 0x441594
add byte [esi], bh
inc esi
xor al, 0x35
push eax
dec ecx
add esp, 4
pop esi
push ebx
and ebx, 0x852e
and ebx, 0x6d3
pop ebx
mov edx, dword [ebp - 0x4f4]
mov dword [ebp - 0x3cc], edx
jmp 0x4415f5
jmp 0x441302

Function at 0x441456
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x441460
cmp dword [ebp - 0xcbc], 0
jle 0x44155f
push ebx
call 0x441456
add byte [edi], bh
xor ecx, dword [eax + eax*2 + 0x37]
dec esp
xor eax, 0x4c48349
call 0x441469
add byte [esi + 0x4b], cl
dec ebx
push eax
inc eax
dec ebp
inc esi
inc ebp
inc ebp
aas
dec edi
add esp, 4
pop ebx
push ecx
push eax
add esp, 4
xor ecx, 0x10776
pop ecx
mov ecx, dword [ebp - 0xaec]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xae8]
movzx ecx, byte [eax]
cmp edx, ecx
je 0x4414fb
push eax
add eax, 0x4415
add eax, 0x87f9
pop eax
push ecx
add ecx, 0x170f9
or ecx, 0x3d55
sub ecx, 0x8a18
call 0x4414bd
add byte [ebx + 0x47], al
xor eax, 0x4f334348
add esp, 4
pop ecx
mov edx, dword [ebp - 0xaec]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xae8]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x4414e3
mov dword [ebp - 0x15dc], 1
jmp 0x4414ed
mov dword [ebp - 0x15dc], 0xffffffff
mov eax, dword [ebp - 0x15dc]
mov dword [ebp - 0xcc0], eax
jmp 0x44155f
push edx
add edx, 0x177f4
pop edx
push esi
push eax
add esp, 4
and esi, 0xf2aa
xor esi, 0xbf7b
pop esi
push eax
push esi
add esp, 4
and eax, 0x1373a
pop eax
push edx
push edx
add esp, 4
and edx, 0x16fae
pop edx
mov ecx, dword [ebp - 0xcbc]
sub ecx, 1
mov dword [ebp - 0xcbc], ecx
mov edx, dword [ebp - 0xaec]
add edx, 1
mov dword [ebp - 0xaec], edx
mov eax, dword [ebp - 0xae8]
add eax, 1
mov dword [ebp - 0xae8], eax
jmp 0x44143a
mov ecx, dword [ebp - 0xcc0]
mov dword [ebp - 0x15e0], ecx
Function at 0x441469
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x441460
cmp dword [ebp - 0xcbc], 0
jle 0x44155f
push ebx
call 0x441456
add byte [edi], bh
xor ecx, dword [eax + eax*2 + 0x37]
dec esp
xor eax, 0x4c48349
call 0x441469
add byte [esi + 0x4b], cl
dec ebx
push eax
inc eax
dec ebp
inc esi
inc ebp
inc ebp
aas
dec edi
add esp, 4
pop ebx
push ecx
push eax
add esp, 4
xor ecx, 0x10776
pop ecx
mov ecx, dword [ebp - 0xaec]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xae8]
movzx ecx, byte [eax]
cmp edx, ecx
je 0x4414fb
push eax
add eax, 0x4415
add eax, 0x87f9
pop eax
push ecx
add ecx, 0x170f9
or ecx, 0x3d55
sub ecx, 0x8a18
call 0x4414bd
add byte [ebx + 0x47], al
xor eax, 0x4f334348
add esp, 4
pop ecx
mov edx, dword [ebp - 0xaec]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xae8]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x4414e3
mov dword [ebp - 0x15dc], 1
jmp 0x4414ed
mov dword [ebp - 0x15dc], 0xffffffff
mov eax, dword [ebp - 0x15dc]
mov dword [ebp - 0xcc0], eax
jmp 0x44155f
push edx
add edx, 0x177f4
pop edx
push esi
push eax
add esp, 4
and esi, 0xf2aa
xor esi, 0xbf7b
pop esi
push eax
push esi
add esp, 4
and eax, 0x1373a
pop eax
push edx
push edx
add esp, 4
and edx, 0x16fae
pop edx
mov ecx, dword [ebp - 0xcbc]
sub ecx, 1
mov dword [ebp - 0xcbc], ecx
mov edx, dword [ebp - 0xaec]
add edx, 1
mov dword [ebp - 0xaec], edx
mov eax, dword [ebp - 0xae8]
add eax, 1
mov dword [ebp - 0xae8], eax
jmp 0x44143a
mov ecx, dword [ebp - 0xcc0]
mov dword [ebp - 0x15e0], ecx

Function at 0x4414bd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x441460
cmp dword [ebp - 0xcbc], 0
jle 0x44155f
push ebx
call 0x441456
add byte [edi], bh
xor ecx, dword [eax + eax*2 + 0x37]
dec esp
xor eax, 0x4c48349
call 0x441469
add byte [esi + 0x4b], cl
dec ebx
push eax
inc eax
dec ebp
inc esi
inc ebp
inc ebp
aas
dec edi
add esp, 4
pop ebx
push ecx
push eax
add esp, 4
xor ecx, 0x10776
pop ecx
mov ecx, dword [ebp - 0xaec]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xae8]
movzx ecx, byte [eax]
cmp edx, ecx
je 0x4414fb
push eax
add eax, 0x4415
add eax, 0x87f9
pop eax
push ecx
add ecx, 0x170f9
or ecx, 0x3d55
sub ecx, 0x8a18
call 0x4414bd
add byte [ebx + 0x47], al
xor eax, 0x4f334348
add esp, 4
pop ecx
mov edx, dword [ebp - 0xaec]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0xae8]
movzx edx, byte [ecx]
cmp eax, edx
jle 0x4414e3
mov dword [ebp - 0x15dc], 1
jmp 0x4414ed
mov dword [ebp - 0x15dc], 0xffffffff
mov eax, dword [ebp - 0x15dc]
mov dword [ebp - 0xcc0], eax
jmp 0x44155f
push edx
add edx, 0x177f4
pop edx
push esi
push eax
add esp, 4
and esi, 0xf2aa
xor esi, 0xbf7b
pop esi
push eax
push esi
add esp, 4
and eax, 0x1373a
pop eax
push edx
push edx
add esp, 4
and edx, 0x16fae
pop edx
mov ecx, dword [ebp - 0xcbc]
sub ecx, 1
mov dword [ebp - 0xcbc], ecx
mov edx, dword [ebp - 0xaec]
add edx, 1
mov dword [ebp - 0xaec], edx
mov eax, dword [ebp - 0xae8]
add eax, 1
mov dword [ebp - 0xae8], eax
jmp 0x44143a
mov ecx, dword [ebp - 0xcc0]
mov dword [ebp - 0x15e0], ecx
Function at 0x441594
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop esi
push edi
push edx
add esp, 4
sub edi, 0x386e
xor edi, 0x8770
pop edi
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0x15e0], eax
jmp 0x44156b
cmp dword [ebp - 0x15e0], 0
jne 0x4415b4
push esi
jmp 0x44157c
xor esi, 0x1208d
add esi, 0x14eb5
call 0x441594
add byte [esi], bh
inc esi
xor al, 0x35
push eax
dec ecx
add esp, 4
pop esi
push ebx
and ebx, 0x852e
and ebx, 0x6d3
pop ebx
mov edx, dword [ebp - 0x4f4]
mov dword [ebp - 0x3cc], edx
jmp 0x4415f5
jmp 0x441302
Function at 0x442df6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x798]
add ecx, 1
mov dword [ebp - 0x798], ecx
mov edx, dword [ebp - 0x794]
mov eax, dword [ebp - 0x798]
cmp eax, dword [edx + 0x18]
jae 0x442eca
mov ecx, dword [ebp - 0x798]
mov edx, dword [ebp - 0x1d48]
mov eax, dword [ebp - 0x33c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x79c], eax
mov ecx, dword [ebp - 0x798]
mov edx, dword [ebp - 0x1d4c]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x1d50]
mov edx, dword [ebp - 0x33c]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x1d54], edx
mov dword [ebp - 0x164], 0
jmp 0x442d2e
mov eax, dword [ebp - 0x164]
add eax, 1
mov dword [ebp - 0x164], eax
mov ecx, dword [ebp - 0x79c]
add ecx, dword [ebp - 0x164]
movsx edx, byte [ecx]
test edx, edx
je 0x442de0
mov eax, dword [ebp - 0x164]
movsx ecx, byte [ebp + eax - 0x898]
test ecx, ecx
je 0x442de0
push edx
push ebx
add esp, 4
and edx, 0x7a80
sub edx, 0x28fd
xor edx, 0x1d6a
pop edx
push eax
or eax, 0xdae3
xor eax, 0x684a
sub eax, 0x35d3
or eax, 0x1039e
pop eax
mov edx, dword [ebp - 0x79c]
add edx, dword [ebp - 0x164]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x164]
movsx edx, byte [ebp + ecx - 0x898]
cmp eax, edx
je 0x442dd2
mov eax, dword [ebp - 0x79c]
add eax, dword [ebp - 0x164]
movsx ecx, byte [eax]
xor ecx, 0x20
mov edx, dword [ebp - 0x164]
movsx eax, byte [ebp + edx - 0x898]
cmp ecx, eax
jne 0x442dd9
jmp 0x442d1f
jmp 0x442de0
push esi
jmp 0x442dea
call 0x442df6
add byte [ebx + 0x3d], al
dec eax
xor eax, 0xc483454f
add al, 0x5e
push ecx
push edx
add esp, 4
add ecx, 0x135c3
add ecx, 0xff77
sub ecx, 0x17e85
pop ecx
mov ecx, dword [ebp - 0x79c]
add ecx, dword [ebp - 0x164]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x164]
movsx ecx, byte [ebp + eax - 0x898]
cmp edx, ecx
jne 0x442e3f
mov dword [ebp - 0xcf4], 0
jmp 0x442eae
push eax
push edi
add esp, 4
and eax, 0xece6
pop eax
push ecx
push ecx
add esp, 4
call fcn.00442e5e
add byte [eax], bh
dec edi
inc ebp
dec esp
inc ebx
cmp al, 0x3b
add esp, 4
add esp, 4
add esp, 4
call 0x442e6d
add byte [eax + 0x4e], al
inc ecx
cmp dword [edx], esi
cmp eax, 0x5904c483
mov edx, dword [ebp - 0x79c]
add edx, dword [ebp - 0x164]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x164]
movsx edx, byte [ebp + ecx - 0x898]
or edx, 0x20
cmp eax, edx
jge 0x442ea4
mov dword [ebp - 0xcf4], 0xffffffff
jmp 0x442eae
mov dword [ebp - 0xcf4], 1
cmp dword [ebp - 0xcf4], 0
jne 0x442ec5
mov eax, dword [ebp - 0x1d54]
mov dword [ebp - 0x508], eax
jmp 0x442ed6
jmp 0x442caf
mov ecx, dword [ebp - 0x7a0]
mov dword [ebp - 0x508], ecx
mov edx, dword [ebp - 0x508]
mov dword [ebp - 0x7cc], edx
Function at 0x442e5e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x798]
add ecx, 1
mov dword [ebp - 0x798], ecx
mov edx, dword [ebp - 0x794]
mov eax, dword [ebp - 0x798]
cmp eax, dword [edx + 0x18]
jae 0x442eca
mov ecx, dword [ebp - 0x798]
mov edx, dword [ebp - 0x1d48]
mov eax, dword [ebp - 0x33c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x79c], eax
mov ecx, dword [ebp - 0x798]
mov edx, dword [ebp - 0x1d4c]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x1d50]
mov edx, dword [ebp - 0x33c]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x1d54], edx
mov dword [ebp - 0x164], 0
jmp 0x442d2e
mov eax, dword [ebp - 0x164]
add eax, 1
mov dword [ebp - 0x164], eax
mov ecx, dword [ebp - 0x79c]
add ecx, dword [ebp - 0x164]
movsx edx, byte [ecx]
test edx, edx
je 0x442de0
mov eax, dword [ebp - 0x164]
movsx ecx, byte [ebp + eax - 0x898]
test ecx, ecx
je 0x442de0
push edx
push ebx
add esp, 4
and edx, 0x7a80
sub edx, 0x28fd
xor edx, 0x1d6a
pop edx
push eax
or eax, 0xdae3
xor eax, 0x684a
sub eax, 0x35d3
or eax, 0x1039e
pop eax
mov edx, dword [ebp - 0x79c]
add edx, dword [ebp - 0x164]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x164]
movsx edx, byte [ebp + ecx - 0x898]
cmp eax, edx
je 0x442dd2
mov eax, dword [ebp - 0x79c]
add eax, dword [ebp - 0x164]
movsx ecx, byte [eax]
xor ecx, 0x20
mov edx, dword [ebp - 0x164]
movsx eax, byte [ebp + edx - 0x898]
cmp ecx, eax
jne 0x442dd9
jmp 0x442d1f
jmp 0x442de0
push esi
jmp 0x442dea
call 0x442df6
add byte [ebx + 0x3d], al
dec eax
xor eax, 0xc483454f
add al, 0x5e
push ecx
push edx
add esp, 4
add ecx, 0x135c3
add ecx, 0xff77
sub ecx, 0x17e85
pop ecx
mov ecx, dword [ebp - 0x79c]
add ecx, dword [ebp - 0x164]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x164]
movsx ecx, byte [ebp + eax - 0x898]
cmp edx, ecx
jne 0x442e3f
mov dword [ebp - 0xcf4], 0
jmp 0x442eae
push eax
push edi
add esp, 4
and eax, 0xece6
pop eax
push ecx
push ecx
add esp, 4
call fcn.00442e5e
add byte [eax], bh
dec edi
inc ebp
dec esp
inc ebx
cmp al, 0x3b
add esp, 4
add esp, 4
add esp, 4
call 0x442e6d
add byte [eax + 0x4e], al
inc ecx
cmp dword [edx], esi
cmp eax, 0x5904c483
mov edx, dword [ebp - 0x79c]
add edx, dword [ebp - 0x164]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x164]
movsx edx, byte [ebp + ecx - 0x898]
or edx, 0x20
cmp eax, edx
jge 0x442ea4
mov dword [ebp - 0xcf4], 0xffffffff
jmp 0x442eae
mov dword [ebp - 0xcf4], 1
cmp dword [ebp - 0xcf4], 0
jne 0x442ec5
mov eax, dword [ebp - 0x1d54]
mov dword [ebp - 0x508], eax
jmp 0x442ed6
jmp 0x442caf
mov ecx, dword [ebp - 0x7a0]
mov dword [ebp - 0x508], ecx
mov edx, dword [ebp - 0x508]
mov dword [ebp - 0x7cc], edx
Function at 0x442e6d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x798]
add ecx, 1
mov dword [ebp - 0x798], ecx
mov edx, dword [ebp - 0x794]
mov eax, dword [ebp - 0x798]
cmp eax, dword [edx + 0x18]
jae 0x442eca
mov ecx, dword [ebp - 0x798]
mov edx, dword [ebp - 0x1d48]
mov eax, dword [ebp - 0x33c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x79c], eax
mov ecx, dword [ebp - 0x798]
mov edx, dword [ebp - 0x1d4c]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x1d50]
mov edx, dword [ebp - 0x33c]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x1d54], edx
mov dword [ebp - 0x164], 0
jmp 0x442d2e
mov eax, dword [ebp - 0x164]
add eax, 1
mov dword [ebp - 0x164], eax
mov ecx, dword [ebp - 0x79c]
add ecx, dword [ebp - 0x164]
movsx edx, byte [ecx]
test edx, edx
je 0x442de0
mov eax, dword [ebp - 0x164]
movsx ecx, byte [ebp + eax - 0x898]
test ecx, ecx
je 0x442de0
push edx
push ebx
add esp, 4
and edx, 0x7a80
sub edx, 0x28fd
xor edx, 0x1d6a
pop edx
push eax
or eax, 0xdae3
xor eax, 0x684a
sub eax, 0x35d3
or eax, 0x1039e
pop eax
mov edx, dword [ebp - 0x79c]
add edx, dword [ebp - 0x164]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x164]
movsx edx, byte [ebp + ecx - 0x898]
cmp eax, edx
je 0x442dd2
mov eax, dword [ebp - 0x79c]
add eax, dword [ebp - 0x164]
movsx ecx, byte [eax]
xor ecx, 0x20
mov edx, dword [ebp - 0x164]
movsx eax, byte [ebp + edx - 0x898]
cmp ecx, eax
jne 0x442dd9
jmp 0x442d1f
jmp 0x442de0
push esi
jmp 0x442dea
call 0x442df6
add byte [ebx + 0x3d], al
dec eax
xor eax, 0xc483454f
add al, 0x5e
push ecx
push edx
add esp, 4
add ecx, 0x135c3
add ecx, 0xff77
sub ecx, 0x17e85
pop ecx
mov ecx, dword [ebp - 0x79c]
add ecx, dword [ebp - 0x164]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x164]
movsx ecx, byte [ebp + eax - 0x898]
cmp edx, ecx
jne 0x442e3f
mov dword [ebp - 0xcf4], 0
jmp 0x442eae
push eax
push edi
add esp, 4
and eax, 0xece6
pop eax
push ecx
push ecx
add esp, 4
call fcn.00442e5e
add byte [eax], bh
dec edi
inc ebp
dec esp
inc ebx
cmp al, 0x3b
add esp, 4
add esp, 4
add esp, 4
call 0x442e6d
add byte [eax + 0x4e], al
inc ecx
cmp dword [edx], esi
cmp eax, 0x5904c483
mov edx, dword [ebp - 0x79c]
add edx, dword [ebp - 0x164]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x164]
movsx edx, byte [ebp + ecx - 0x898]
or edx, 0x20
cmp eax, edx
jge 0x442ea4
mov dword [ebp - 0xcf4], 0xffffffff
jmp 0x442eae
mov dword [ebp - 0xcf4], 1
cmp dword [ebp - 0xcf4], 0
jne 0x442ec5
mov eax, dword [ebp - 0x1d54]
mov dword [ebp - 0x508], eax
jmp 0x442ed6
jmp 0x442caf
mov ecx, dword [ebp - 0x7a0]
mov dword [ebp - 0x508], ecx
mov edx, dword [ebp - 0x508]
mov dword [ebp - 0x7cc], edx
Function at 0x443e63
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x13de5
pop ebx
lea edx, [ebp - 0x16c0]
mov dword [ebp - 0xd18], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd14], ecx
xor edx, edx
mov word [ebp - 0x1d4], dx
xor eax, eax
mov word [ebp - 0x34], ax
push ebx
call 0x443ea6
add byte [eax], bh
inc esi
inc eax
aas
xor eax, 0x833a3c49
les eax, [ebx + ebx*2]
push esi
sub esi, 0x8cf6
call 0x443ebf
add byte [0x383b503a], bh
cmp al, byte [esi + edi - 0x7d]
les eax, [ecx + eax*4]
invalid

Function at 0x443ea6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x13de5
pop ebx
lea edx, [ebp - 0x16c0]
mov dword [ebp - 0xd18], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd14], ecx
xor edx, edx
mov word [ebp - 0x1d4], dx
xor eax, eax
mov word [ebp - 0x34], ax
push ebx
call 0x443ea6
add byte [eax], bh
inc esi
inc eax
aas
xor eax, 0x833a3c49
les eax, [ebx + ebx*2]
push esi
sub esi, 0x8cf6
call 0x443ebf
add byte [0x383b503a], bh
cmp al, byte [esi + edi - 0x7d]
les eax, [ecx + eax*4]
invalid

Function at 0x443ebf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x13de5
pop ebx
lea edx, [ebp - 0x16c0]
mov dword [ebp - 0xd18], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd14], ecx
xor edx, edx
mov word [ebp - 0x1d4], dx
xor eax, eax
mov word [ebp - 0x34], ax
push ebx
call 0x443ea6
add byte [eax], bh
inc esi
inc eax
aas
xor eax, 0x833a3c49
les eax, [ebx + ebx*2]
push esi
sub esi, 0x8cf6
call 0x443ebf
add byte [0x383b503a], bh
cmp al, byte [esi + edi - 0x7d]
les eax, [ecx + eax*4]
invalid

Function at 0x443ffa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x443ffa
add byte [edi], dh
inc ebx
cmp dword [0xc4834233], esi
add al, 0x81
iretd
Function at 0x59101983
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0x64]
mov dword [eax + 0x5c], ecx
dec eax
pop esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 4], eax

Function at 0x5910199c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0x64]
mov dword [eax + 0x5c], ecx
dec eax
pop esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 4], eax

Function at 0x591019c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
je 0x59101a03
mov eax, dword [ebp - 4]
cld
mov dword [ebp - 0x14], eax
push 2
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x30]
movzx eax, word [ecx + eax]
push eax
call fcn.59101918
pop ecx
movzx eax, ax
cmp eax, 0x6b
jne 0x591019f9
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x18]
mov dword [eax + 0x1c], ecx
jmp 0x59101a03
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x591019be
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1c], ecx
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x1c]
mov edx, dword [ebp - 0x1c]
add ecx, dword [edx + eax + 0x78]
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x18]
mov dword [eax + 0x64], ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0x20]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x4c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0x1c]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0x24]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x40], eax
mov esp, ebp
pop ebp
ret
Function at 0x5911c55f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x591d4f78]
jne 0x591a3d46
repz ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x591ec518], eax
mov dword [0x591ec514], ecx
mov dword [0x591ec510], edx
mov dword [0x591ec50c], ebx
mov dword [0x591ec508], esi
mov dword [0x591ec504], edi
mov word [0x591ec530], ss
mov word [0x591ec524], cs
mov word [0x591ec500], ds
mov word [0x591ec4fc], es
mov word [0x591ec4f8], fs
mov word [0x591ec4f4], gs
pushfd
pop dword [0x591ec528]
mov eax, dword [ebp]
mov dword [0x591ec51c], eax
mov eax, dword [ebp + 4]
mov dword [0x591ec520], eax
lea eax, [ebp + 8]
mov dword [0x591ec52c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x591ec468], 0x10001
mov eax, dword [0x591ec520]
mov dword [0x591ec41c], eax
mov dword [0x591ec410], 0xc0000409
mov dword [0x591ec414], 1
mov eax, dword [0x591d4f78]
mov dword [ebp - 0x328], eax
mov eax, dword [0x591eb12c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x591ec460], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x591a3e4c
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x591ec460], 0
jne 0x591a3e36
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret