joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100209fc
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
cmp byte [0x10036ee8], 0
je 0x10020a21
push str.TabProcGrowth
call fcn.100260e7
mov dword [esp], str.TabShutdownDelay
call fcn.100260e7
pop ecx
jmp fcn.10020ba4
ret

Function at 0x10020ba4
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100361bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x11
pop ecx
and dword [ebp - 0x8c], 0
lea edi, [ebp - 0x88]
mov esi, str.SoftwarePoliciesMicrosoftWindowsCurrentVersionInternet_Settings
lea eax, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x88]
movsb byte es:[edi], byte [esi]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10020c56
and dword [ebp - 0x90], eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], 4
push eax
lea eax, [ebp - 0x98]
push eax
push 0
push str.SecureProtocols
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x8c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10020c56
cmp byte [0x10036ee8], 0
je 0x10020cfe
push str._ACTWinBrowser__DumpTLSReg_GPO_settings_applied
jmp 0x10020ce0
push 0xf
pop ecx
lea eax, [ebp - 0x8c]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push eax
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
push 0x20019
xor esi, esi
lea eax, [ebp - 0x40]
push esi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10020d0a
lea eax, [ebp - 0x94]
mov dword [ebp - 0x90], esi
push eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], 4
push eax
lea eax, [ebp - 0x98]
push eax
push esi
push str.SecureProtocols
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x8c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10020d0a
cmp byte [0x10036ee8], 0
je 0x10020cfe
push str._ACTWinBrowser__IE_Internet_Options_applied
mov esi, 0x100382a0
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
cmp byte [0x10036ee8], 0
pop ecx
pop ecx
je 0x10020cfe
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push dword [ebp - 0x90]
call fcn.100260e7
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002652e
mov esp, ebp
pop ebp
ret
Function at 0x10022a53
Capabilities:
Print debug messages

Disassembly:
push 0xac4
mov eax, 0x10028ecf
call fcn.100265a9
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xad0], eax
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xac8]
call fcn.10022a36
test esi, esi
lea eax, [ebp - 0xac8]
cmovne eax, esi
mov dword [ebp - 0xacc], eax
test edi, edi
je 0x10022be6
cmp dword [edi + 0x400], ebx
jne 0x10022ad1
push ebx
push ebx
push ebx
push ebx
call fcn.1001fc73
add esp, 0x10
test eax, eax
je 0x10022be6
push dword [edi + 0x400]
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.AcroSBL
push str._s__lu__lu
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.MSVCR120.dll_swprintf_s]
add esp, 0x18
test eax, eax
jle 0x10022be6
lea ecx, [ebp - 0x6bc]
call fcn.10022a16
push dword [ebp + 0x14]
lea eax, [ebp - 0x6bc]
push dword [ebp - 0xad0]
push 1
push 1
push dword [ebp + 0xc]
push eax
call fcn.100260e7
add esp, 0x18
test eax, eax
jne 0x10022bbc
push ebx
lea eax, [ebp - 0x218]
push eax
push 1
lea ecx, [ebp - 0x2ac]
call fcn.10025ba0
push dword [edi + 0x400]
mov esi, dword [ebp - 0xacc]
lea eax, [ebp - 0x6bc]
push 0x1388
push esi
push eax
lea ecx, [ebp - 0x2ac]
mov dword [ebp - 4], ebx
call fcn.10025dd8
test eax, eax
jne 0x10022b7f
cmp dword [esi + 4], ebx
sete bl
jmp 0x10022bab
cmp byte [0x10036ee8], 0
je 0x10022bab
push str.IPC_Error:_AIPC_ERR
mov esi, 0x100382a0
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
cmp byte [0x10036ee8], 0
pop ecx
pop ecx
je 0x10022bab
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2ac]
call fcn.10025c9a
jmp 0x10022be6
cmp byte [0x10036ee8], bl
je 0x10022be6
push str.IPC_CreateMessage_Error:_CreateMessage_failed
mov esi, 0x100382a0
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
pop ecx
pop ecx
cmp byte [0x10036ee8], bl
je 0x10022be6
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, bl
call fcn.10026558
ret
Function at 0x10024586
Capabilities:
Print debug messages

Disassembly:
push ebx
push 8
call dword [sym.imp.MSVCR120.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x100245a3
push 8
push 0
push ebx
call sub.MSVCR120.dll_memset
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024692
push esi
mov esi, dword [sym.imp.MSVCR120.dll_sprintf]
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x100386f8
push edi
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push edi
mov edi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_Uns32____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_HANDLE____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_Handle32____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
cmp byte [0x10036ee8], 0
je 0x10024690
push 4
push str.sizeof_void____d
push 0x100386f8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024690
push 0x100386f8
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x10024713
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x10028feb
call fcn.100265a9
cmp byte [0x10036ee8], 0
mov esi, dword [ebp + 8]
je 0x10024753
lea eax, [esi + 4]
mov edi, 0x100386f8
push eax
push str.ASM_Release__s
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10024753
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.100260e7
push dword [esi + 0x48]
lea eax, [ebp - 0x28]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.1000229e
pop ecx
pop ecx
test eax, eax
je 0x1002477e
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.100260e7
mov dword [esi + 0x4c], edi
mov dword [esi + 0x44], edi
call fcn.10026558
ret
Function at 0x10024795
Capabilities:
Print debug messages

Disassembly:
push 0x28
mov eax, 0x10029018
call fcn.100265a9
cmp byte [0x10036ee8], 0
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCR120.dll_sprintf]
mov dword [ebp - 0x30], esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], esi
mov esi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
je 0x100247f9
call fcn.100260e7
test al, al
mov edx, 0x1002a665
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x100386f8
call edi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x100247f9
push 0x100386f8
call esi
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
and dword [eax], 0
mov eax, dword [ebp - 0x30]
and dword [eax], 0
lea eax, [ebx + 4]
push eax
call fcn.100260e7
push dword [ebx + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000229e
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], eax
call fcn.100260e7
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x10024862
cmp byte [0x10036ee8], cl
je 0x100248ae
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x100386f8
push ebx
call edi
cmp byte [0x10036ee8], 0
pop ecx
pop ecx
je 0x100248ae
push ebx
call esi
jmp 0x100248ae
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [ebx + 0x44], eax
test eax, eax
jne 0x1002487d
cmp byte [0x10036ee8], al
je 0x100248ae
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x1002484a
mov ecx, dword [ebp - 0x34]
push dword [ebx + 0x48]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebx + 0x4c], eax
test eax, eax
jne 0x1002489e
cmp byte [0x10036ee8], al
je 0x100248ae
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x1002484a
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebx + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebx + 0x4c]
mov dword [ecx], eax
call fcn.10026558
ret
Function at 0x100260e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x100260f6
pop dword [ebp - 0x34]
mov eax, 0x100260f6
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x238ec1f9
sub dword [ebp - 0x44], 0xd53c7cae
mov dword [ebp - 0x40], 0xe2d4a74
sub dword [ebp - 0x40], 0xdbf9fe2f
mov dword [ebp - 0x3c], 0xee06d852
sub dword [ebp - 0x3c], 0xa1ba9424
mov dword [ebp - 0x38], 0xb964b36
sub dword [ebp - 0x38], 0xb964b36
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x457f8d08
add dword [ebp - 0x44], 0x2ef2dc4e
mov dword [ebp - 0x40], 0x9a1cd6c5
add dword [ebp - 0x40], 0xa74f8ab0
mov dword [ebp - 0x3c], 0x4ea46c23
add dword [ebp - 0x3c], 0x14cb0049
mov dword [ebp - 0x38], 0x40703c67
add dword [ebp - 0x38], 0xbf8fc399
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x3db31683
sub eax, 0x2db0761b
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x40a42
push 0
call eax
mov ecx, 0xee9e482b
add ecx, 0x1161fc79
mov edi, eax
mov ebx, 0x1003ee00
add ebx, dword [ebp - 0x34]
mov edx, 0xace92f9c
add edx, 0x37c3c6dc
mov dword [ebp - 0x28], 0x4e3a5028
mov esi, dword [ebx]
sub dword [ebp - 0x1c], 0x31f4fcdd
add esi, edx
xor dword [ebp - 0x20], 0x67572996
mov dword [edi], esi
sub dword [ebp - 8], 0xe6694ce5
add edi, 0xd9cf59ef
add edi, 0x2630a615
add ebx, 4
loop 0x10026208
add eax, 0x2d78581
add eax, 0xfd297fe2
mov ebx, eax
add eax, 0xe6a19c0b
add eax, 0x195e63fa
mov ecx, 0x28f676fa
sub ecx, 0x18f676fa
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10013b94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10013ba3
pop dword [ebp - 0x20]
mov eax, 0xcd575452
sub eax, 0xbd5618af
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x9eb7a34c
add dword [ebp - 0x30], 0xaf9aa1ff
mov dword [ebp - 0x2c], 0x9446cb9b
add dword [ebp - 0x2c], 0x9dec80aa
mov dword [ebp - 0x28], 0xd77b7967
sub dword [ebp - 0x28], 0x8b2f3539
mov dword [ebp - 0x24], 0x91a0f2b8
add dword [ebp - 0x24], 0x6e5f0d48
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xf3ed280e
sub dword [ebp - 0x30], 0x7f7abeb8
mov dword [ebp - 0x2c], 0xa0207667
add dword [ebp - 0x2c], 0xa14beb0e
mov dword [ebp - 0x28], 0x8052f6bc
add dword [ebp - 0x28], 0xe31c75b0
mov dword [ebp - 0x24], 0xe1ba922e
sub dword [ebp - 0x24], 0xe1ba922e
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xbcc4ea6c
add eax, 0x533d6610
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3ac3f
push 0
call eax
mov ecx, 0x4585
mov edi, eax
mov ebx, 0x10030c00
add ebx, dword [ebp - 0x20]
mov edx, 0x3870dcfe
sub edx, 0x93b16fbc
xor dword [ebp - 0x14], 0x7bc28c7f
mov esi, dword [ebx]
add dword [ebp - 0x14], edx
add esi, edx
mov dword [ebp - 0x10], 0x18d3c862
mov dword [edi], esi
add dword [ebp - 0xc], 0x16a5daa7
add edi, 4
add ebx, 4
loop 0x10013cb4
add eax, 0x7c525573
sub eax, 0x7c514c8c
mov ebx, eax
add eax, 0xb54673f9
add eax, 0x4ab98c0c
mov ecx, 0xcf41e56f
add ecx, 0x40be1a91
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x1001c6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c73b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c6f2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c6f2
cmp esi, ebx
jge 0x1001c6f2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c735
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c735
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c74d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x1001c970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001c998
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001c9b2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10013b94
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022650
leave
ret 4

Function at 0x1001cb80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cbb6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cc15
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10013b94
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10013b94
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10013b94
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022650
leave
ret 0x10

Function at 0x1001cc30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cc5c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cc8d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cc8b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10013b94
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cc8d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022650
leave
ret 8
Function at 0x634dafb0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x634db174
pushal
mov esi, 0x634d6015
lea edi, [esi - 0x15015]
push edi
or ebp, 0xffffffff
jmp 0x634dafda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x634dafe1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x634dafd0
mov eax, 1
add ebx, ebx
jne 0x634daff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x634dafe8
jne 0x634db004
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x634dafe8
xor ecx, ecx
sub eax, 3
jb 0x634db018
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x634db08a
mov ebp, eax
add ebx, ebx
jne 0x634db023
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x634db030
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x634db054
inc ecx
add ebx, ebx
jne 0x634db040
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x634db035
jne 0x634db051
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x634db035
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x634db074
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x634db065
jmp 0x634dafd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x634db074
add edi, ecx
jmp 0x634dafd6
pop esi
mov edi, esi
mov ecx, 0x5f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x634db092
cmp byte [edi], 0
jne 0x634db092
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x634db097
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x634db106
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b370]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b3d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x634db0c4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b3d8]
or eax, eax
je 0x634db100
mov dword [ebx], eax
add ebx, 4
jmp 0x634db0e1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x634db137
cmp al, 0xef
ja 0x634db12a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x634db10c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x634db119
mov ebp, dword [esi + 0x1b3dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x634db16b
sub esp, 0xffffff80
jmp 0x634c2410
Function at 0x41388e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x1768], dx
mov eax, 0x32
mov word [ebp - 0x1766], ax
mov ecx, 0x2e
mov word [ebp - 0x1764], cx
mov edx, 0x64
mov word [ebp - 0x1762], dx
mov eax, 0x6c
mov word [ebp - 0x1760], ax
mov ecx, 0x6c
mov word [ebp - 0x175e], cx
xor edx, edx
mov word [ebp - 0x175c], dx
push edi
push ecx
add esp, 4
sub edi, 0xbf8b
and edi, 0x6ac6
pop edi
push ecx
push edx
add esp, 4
sub ecx, 0x9af3
sub ecx, 0x112e9
and ecx, 0x16bad
pop ecx
push edx
or edx, 0x88c6
pop edx
mov byte [ebp - 0x894], 0x4c
mov byte [ebp - 0x893], 0x6f
mov byte [ebp - 0x892], 0x61
mov byte [ebp - 0x891], 0x64
mov byte [ebp - 0x890], 0x4c
mov byte [ebp - 0x88f], 0x69
mov byte [ebp - 0x88e], 0x62
mov byte [ebp - 0x88d], 0x72
mov byte [ebp - 0x88c], 0x61
mov byte [ebp - 0x88b], 0x72
mov byte [ebp - 0x88a], 0x79
mov byte [ebp - 0x889], 0x57
mov byte [ebp - 0x888], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x195c], eax
mov ecx, dword [ebp - 0x195c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1960], edx
mov eax, dword [ebp - 0x1960]
mov dword [ebp - 0x15e4], eax
push edx
jmp 0x413567
pop edx
push eax
add eax, 0x7072
pop eax
push edx
add edx, 0x1499f
or edx, 0x1467b
jmp 0x413583
sub edx, 0x11dc6
pop edx
push ecx
xor ecx, 0xd7de
pop ecx
cmp dword [ebp - 0x15e4], 0
jne 0x4135aa
mov dword [ebp - 0x750], 0
jmp 0x413866
mov ecx, dword [ebp - 0x15e4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xca4], eax
push edi
or edi, 0xd6a7
and edi, 0x1af5
call 0x4135d8
add byte [esi + 0x4d], al
cmp ecx, dword [eax + 0x4e]
cmp byte ds:[eax + 0x4b], al
add esp, 4
call 0x4135ea
add byte [ecx], bh
inc ebx
push eax
aas
dec edi
cmp byte [ebx + 0x3c], al
cmp eax, dword [ebx - 0x7ca0fb3c]
mov ebp, 0xfffff35c
add byte [ebp + 0xf], dh
mov dword [ebp - 0x750], 0
jmp 0x413866
push ecx
push edi
add esp, 4
xor ecx, 0x15cec
jmp 0x413877
sub ecx, 0x80d6
pop ecx
push ebx
call 0x41388e
add byte [edi], bh
aaa
aas
inc edx
aaa
cmp dh, byte [ebx]
dec eax
dec esp
add esp, 4
and ebx, 0x3615
pop ebx
cmp dword [ebp - 0x750], 0
jne 0x4138e2
push edi
push edi
add esp, 4
jmp 0x4138ad
pop edi
push edx
push edi
add esp, 4
xor edx, 0x11f17
call 0x4138c9
add byte [ebx], dh
dec ebp
inc edx
inc esp
xor eax, 0x373a4d37
add esp, 4
jmp 0x4138d2
pop edx
mov dword [ebp - 0x79c], 0
jmp 0x414409
push ecx
push edx
add esp, 4
or ecx, 0x74c2
pop ecx
push eax
and eax, 0x3eb1
or eax, 0x1242e
sub eax, 0x9cfb
xor eax, 0x1b7e
pop eax
push esi
push ecx
add esp, 4
or esi, 0x32b1
xor al, byte [eax]
add byte [esi - 0x75], bl
test dword [eax - 0x74000008], esi
dec eax
sbb byte [ecx - 0x31f73], cl
inc edi
test dword [eax + 0xfffff8], esp
add byte [eax], al
add byte [ebx - 0x31f6b], cl
dec dword [ecx - 0x15ef6b]
inc dword [ebx - 0x15ef43]
inc dword [eax]
Function at 0x413f3d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x413f5e
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x413fb8
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x413e86
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x413e86
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x413fa2
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x413fac
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x414001
push esi
push edi
add esp, 4
and esi, 0xe50d
or esi, 0xb875
pop esi
push ecx
xor ecx, 0xa5fa
or ecx, 0xc375
pop ecx
push edx
push edx
add esp, 4
add edx, 0x14834
or edx, 0xcd6b
pop edx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x414069
push edi
push ebx
add esp, 4
or edi, 0x2a3d
and edi, 0x16081
xor edi, 0x1ae4
pop edi
push eax
or eax, 0xe31c
xor eax, 0x8eb1
or eax, 0x145fc
or eax, 0x12662
pop eax
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x41405f
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x413e2a
mov dword [ebp - 0x31c], 0

Function at 0x414070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
daa
xor byte [eax], al
add byte [ecx + 0x56], bl
pop eax
push edx
push edx
add esp, 4
or edx, 0x626c
xor edx, 0x4c01
xor edx, 0x1683e
push 0xea810001
out 0xc0, al
add byte [eax], al
pop edx
mov dword [ebp - 0x770], 0
mov edx, dword [ebp - 0x324]
mov dword [ebp - 0x1608], edx
cmp dword [ebp - 0x1608], 0
jne 0x41410c
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x510], eax
jmp 0x4143fd
mov ecx, dword [ebp - 0x1608]
mov edx, dword [ebp - 0x324]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x160c], edx
jne 0x414134
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x510], eax
jmp 0x4143fd
leave
add al, byte [eax]
invalid
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x160c]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1610], ecx
cmp dword [ebp - 0x1610], 0
jne 0x414166
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
jmp 0x4143fd
mov eax, dword [ebp - 0x324]
add eax, dword [ebp - 0x1610]
mov dword [ebp - 0x764], eax
jne 0x41418b
mov ecx, dword [ebp - 0x770]
mov dword [ebp - 0x510], ecx
jmp 0x4143fd
mov edx, dword [ebp - 0x764]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1984], eax
mov ecx, dword [ebp - 0x764]
mov edx, dword [ebp - 0x324]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1988], edx
xchg ebp, eax
js 0x414199
invalid
dec dword [ebx - 0x7637b]
dec dword [ebx - 0x32373]
inc dword [ebx]
dec eax
sbb al, 0x89
invalid
invalid
loop 0x4141c8
inc edi
test dword [eax + 0xfffff8], ebx
add byte [eax], al
add bl, ch
invalid

Function at 0x414080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esi, 0xf539
pop esi
push edi
and edi, 0x173ce
and edi, 0x103fc
sub edi, 0xc1b4
pop edi
invalid
test esp, esp
cld
invalid