joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e840
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440da3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x458504]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
call fcn.00439f20
push 0x2c
mov dword [ebp - 4], 0
mov dword [ebx], vtable.AlibabaCloud::OSS::CurlHttpClient.0
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x42e8e3
mov esi, dword [ebp + 8]
mov ecx, eax
mov ebx, dword [esi + 0x20]
mov edi, dword [esi + 0x24]
mov esi, dword [esi + 0x1c]
call fcn.0042e7a0
mov eax, dword [ebp - 0x10]
push 2
mov byte [ebp - 4], 2
mov dword [eax + 0x18], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ebx
mov dword [eax + 0x24], 0
add eax, 0x28
push eax
call dword [sym.imp.MSVCP120.dll__Mtx_init]
add esp, 8
test eax, eax
je 0x42e8db
push eax
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Throw_C_error_int_]
add esp, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
jmp 0x42e8e5
xor eax, eax
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x14]
push 0xffffffffffffffff
mov dword [ebx + 0x10], eax
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ebp - 4], 0
mov byte [ecx], 0
call fcn.00403010
mov eax, dword [esi + 0x30]
lea ecx, [ebx + 0x30]
mov dword [ebx + 0x2c], eax
lea eax, [esi + 0x34]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ebp - 4], 3
mov byte [ecx], 0
call fcn.00403010
mov eax, dword [esi + 0x4c]
lea ecx, [ebx + 0x4c]
mov dword [ebx + 0x48], eax
lea eax, [esi + 0x50]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ebp - 4], 4
mov byte [ecx], 0
call fcn.00403010
push 0xffffffffffffffff
lea ecx, [ebx + 0x64]
mov byte [ebp - 4], 5
lea eax, [esi + 0x68]
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00403010
mov al, byte [esi + 0x80]
lea ecx, [ebx + 0x80]
mov byte [ebx + 0x7c], al
lea eax, [esi + 0x84]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ebp - 4], 6
mov byte [ecx], 0
call fcn.00403010
push 0xffffffffffffffff
lea ecx, [ebx + 0x98]
mov byte [ebp - 4], 7
lea eax, [esi + 0x9c]
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00403010
lea ecx, [ebx + 0xb0]
mov byte [ebp - 4], 8
mov dword [ecx + 0x14], 0xf
lea eax, [esi + 0xc8]
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
push 0
push eax
call fcn.00403010
lea ecx, [ebx + 0xc8]
lea eax, [esi + 0xb8]
mov dword [ecx], 0
push eax
mov dword [ecx + 4], 0
call fcn.00430a80
lea ecx, [ebx + 0xd0]
lea eax, [esi + 0xc0]
mov dword [ecx], 0
push eax
mov dword [ecx + 4], 0
call fcn.00430a80
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x430e10
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4410eb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x458504]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov byte [esi], 1
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [esi + 4], 0
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], 0
mov byte [esi + 0x1c], 0
mov dword [esi + 0x48], 0xf
mov dword [esi + 0x44], 0
mov byte [esi + 0x34], 0
mov dword [esi + 0x60], 0xf
mov dword [esi + 0x5c], 0
mov byte [esi + 0x4c], 0
push dword [ebp + 8]
lea ecx, [esi + 0x64]
mov dword [ebp - 4], 0
call fcn.00431530
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x434190
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441a10
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x458504]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.OSS_SDK_LOG_LEVEL
mov dword [0x45a7e0], 0
mov dword [0x45a7e4], 0
call dword [sym.imp.MSVCR120.dll_getenv]
add esp, 4
test eax, eax
je 0x4342a0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004284e0
add esp, 8
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 4], 0
jb 0x434201
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00428400
add esp, 8
cmp dword [ebp - 0x2c], 0x10
jb 0x43421f
push dword [ebp - 0x40]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ebx, dword [ebp - 0x18]
xor edi, edi
mov edx, dword [edi*4 + 0x45831c]
cmp byte [edx], 0
jne 0x434234
xor esi, esi
jmp 0x434249
mov esi, edx
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x434240
sub esi, ecx
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, esi
cmovae ecx, dword [ebp - 0x28]
cmp ebx, esi
cmovb eax, ebx
push eax
push edx
push ecx
call fcn.0040f220
add esp, 0xc
test eax, eax
jne 0x434277
cmp ebx, esi
jb 0x434277
cmp ebx, esi
setne al
test eax, eax
je 0x43427f
inc edi
cmp edi, 8
jb 0x434224
jmp 0x43428f
mov dword [0x45a7e0], edi
mov dword [0x45a7e4], 0x433f30
cmp dword [ebp - 0x14], 0x10
jb 0x4342a0
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043d084
mov esp, ebp
pop ebp
ret
Function at 0x4345d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
jmp 0x4345e0
mov ecx, esi
xor eax, eax
and ecx, 1
mov edx, esi
or ecx, eax
je 0x434600
shrd edx, eax, 1
shr eax, 1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
jmp 0x434606
shrd edx, eax, 1
shr eax, 1
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x434621
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x43463c
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x434657
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x434672
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x43468d
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4346a8
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4346c3
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov dword [edi + esi*8], edx
mov dword [edi + esi*8 + 4], eax
inc esi
cmp esi, 0x100
jb 0x4345e0
lea esi, [edi + 0x1000]
mov ebx, 0x100
jmp 0x4346f0
mov edx, dword [esi - 0x1000]
lea esi, [esi + 8]
mov ecx, dword [esi - 0x1004]
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor ecx, dword [edi + eax*8 + 4]
xor edx, dword [edi + eax*8]
mov dword [esi - 0x804], ecx
mov dword [esi - 0x808], edx
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor ecx, dword [edi + eax*8 + 4]
xor edx, dword [edi + eax*8]
mov dword [esi - 4], ecx
mov dword [esi - 8], edx
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor ecx, dword [edi + eax*8 + 4]
xor edx, dword [edi + eax*8]
mov dword [esi + 0x7fc], ecx
mov dword [esi + 0x7f8], edx
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor ecx, dword [edi + eax*8 + 4]
xor edx, dword [edi + eax*8]
mov dword [esi + 0xffc], ecx
mov dword [esi + 0xff8], edx
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor ecx, dword [edi + eax*8 + 4]
xor edx, dword [edi + eax*8]
mov dword [esi + 0x17fc], ecx
mov dword [esi + 0x17f8], edx
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor ecx, dword [edi + eax*8 + 4]
xor edx, dword [edi + eax*8]
mov dword [esi + 0x1ffc], ecx
mov dword [esi + 0x1ff8], edx
movzx eax, dl
shrd edx, ecx, 8
shr ecx, 8
xor edx, dword [edi + eax*8]
xor ecx, dword [edi + eax*8 + 4]
mov dword [esi + 0x27f8], edx
mov dword [esi + 0x27fc], ecx
dec ebx
jne 0x4346f0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4347d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
not edx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
not ebx
test esi, esi
je 0x43481e
lea ebx, [ebx]
test cl, 7
je 0x434818
movzx eax, byte [ecx]
inc ecx
xor eax, ebx
shrd ebx, edx, 8
and eax, 0xff
shr edx, 8
xor ebx, dword [eax*8 + 0x45a7f8]
xor edx, dword [eax*8 + 0x45a7fc]
dec esi
jne 0x4347f0
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x10], ecx
cmp esi, 8
jb 0x434919
shr esi, 3
mov dword [ebp - 4], esi
push edi
mov edi, edi
xor edx, dword [ecx + 4]
xor ebx, dword [ecx]
mov eax, edx
shr eax, 8
mov ecx, edx
shr ecx, 0x10
and eax, 0xff
and ecx, 0xff
mov dword [ebp + 0xc], edx
mov edi, dword [ecx*8 + 0x45aff8]
xor edi, dword [eax*8 + 0x45b7f8]
mov esi, dword [ecx*8 + 0x45affc]
mov ecx, ebx
xor esi, dword [eax*8 + 0x45b7fc]
movzx eax, dl
xor esi, dword [eax*8 + 0x45bffc]
xor edi, dword [eax*8 + 0x45bff8]
mov eax, edx
shrd ecx, eax, 0x18
and ecx, 0xff
shr eax, 0x18
mov eax, edx
xor esi, dword [ecx*8 + 0x45c7fc]
xor edi, dword [ecx*8 + 0x45c7f8]
mov ecx, ebx
shrd ecx, eax, 0x10
and ecx, 0xff
shr eax, 0x10
mov eax, edx
shr edx, 0x18
xor esi, dword [ecx*8 + 0x45cffc]
xor edi, dword [ecx*8 + 0x45cff8]
mov ecx, ebx
shrd ecx, eax, 8
and ecx, 0xff
shr eax, 8
movzx eax, bl
xor esi, dword [ecx*8 + 0x45d7fc]
xor esi, dword [edx*8 + 0x45a7fc]
xor edi, dword [ecx*8 + 0x45d7f8]
xor esi, dword [eax*8 + 0x45dffc]
xor edi, dword [edx*8 + 0x45a7f8]
mov edx, esi
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
add ecx, 8
xor edi, dword [eax*8 + 0x45dff8]
sub esi, 8
dec dword [ebp - 4]
mov ebx, edi
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0x14], esi
jne 0x434830
pop edi
test esi, esi
je 0x434945
lea ecx, [ecx]
movzx eax, byte [ecx]
lea ecx, [ecx + 1]
xor eax, ebx
shrd ebx, edx, 8
and eax, 0xff
shr edx, 8
xor ebx, dword [eax*8 + 0x45a7f8]
xor edx, dword [eax*8 + 0x45a7fc]
dec esi
jne 0x434920
not ebx
not edx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x439af0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x441ef3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x458504]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0xffffffffffffffff
push 0
push dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
call fcn.00403010
push 0xffffffffffffffff
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0xc]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00403010
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00403010
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43aaa0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442250
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x458504]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
movzx eax, byte [edi + 4]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 5]
xor edx, eax
movzx eax, byte [edi + 6]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
movzx eax, byte [edi + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
mov dword [ebp + 0xc], ecx
cmp dword [ebx + 0x18], ecx
ja 0x43ab28
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov dword [ebp + 0xc], ecx
mov eax, dword [ebx + 8]
mov esi, dword [ebx]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp esi, eax
je 0x43ab66
mov esi, dword [ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x43ab66
nop
mov esi, dword [esi + 4]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [edi + 4]
push dword [edi]
call dword [sym.imp.MSVCP120.dll__Thrd_equal]
add esp, 0x10
test eax, eax
jne 0x43abb1
mov eax, dword [ebx + 8]
mov ecx, dword [ebp + 0xc]
cmp esi, dword [eax + ecx*8]
jne 0x43ab40
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edi]
cmp esi, eax
je 0x43ab97
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov eax, dword [ebx + 8]
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x43ac08
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx*8 + 4], edi
jmp 0x43ac2b
push dword [edi + 4]
push dword [edi]
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.MSVCP120.dll__Thrd_equal]
add esp, 0x10
test eax, eax
jne 0x43abcd
mov esi, dword [esi]
jmp 0x43ab66
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.0043b180
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x43ac10
mov dword [ecx], edi
jmp 0x43ac2b
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x43ac2b
mov eax, dword [ebx + 8]
lea ecx, [eax + edx*8]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
call fcn.0043b0c0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43b580
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 0xc]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 0xd]
xor edx, eax
movzx eax, byte [edi + 0xe]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xf]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x43b5d3
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x43b5ff
cmp dword [ecx], edi
jne 0x43b5f7
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [ecx + edx + 4], eax
jmp 0x43b607
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x43b607
cmp dword [ecx], edi
jne 0x43b60a
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
cmp dword [edi + 0x14], 0
je 0x43b628
call dword [sym.imp.MSVCR120.dll_void___cdecl_terminate_void_]
push edi
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43b760
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx + 4]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 5]
xor edx, eax
movzx eax, byte [ebx + 6]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 7]
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [edi + 0x18], ecx
ja 0x43b7b3
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov esi, dword [edi + 8]
shl ecx, 3
mov dword [ebp + 0xc], ecx
mov esi, dword [ecx + esi]
nop
add ecx, dword [edi + 8]
mov eax, dword [edi]
cmp dword [ecx], eax
je 0x43b7ce
mov eax, dword [ecx + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x43b830
push dword [ebx + 4]
push dword [ebx]
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.MSVCP120.dll__Thrd_equal]
add esp, 0x10
test eax, eax
jne 0x43b7f1
mov esi, dword [esi]
mov ecx, dword [ebp + 0xc]
jmp 0x43b7c0
push dword [esi + 0xc]
push dword [esi + 8]
push dword [ebx + 4]
push dword [ebx]
call dword [sym.imp.MSVCP120.dll__Thrd_equal]
add esp, 0x10
lea ecx, [ebp + 0xc]
test eax, eax
jne 0x43b81f
mov eax, dword [edi]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [ebp + 0xc], esi
mov ecx, dword [ecx]
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov ecx, dword [edi]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
pop ebp
ret 8
Function at 0x43d8e7
Capabilities:
Check for software breakpoints

Disassembly:
imul ebx, eax
jae 0x43d8ef
test ch, 0x74
cmp esi, 0x4ff5
js 0x43d8fc
test dh, 0x63
not ah
jmp 0x43d910
test dl, dh
cmp edx, 0x12a4
inc edi
inc esi
call 0x43d94b
cmp eax, 0xd5e3a4e9
jb 0x43d92c
imul edi, ecx, 0xec8e6cb7
imul ebp, esi, 0x87c990fd
jbe 0x43d93c
mov edi, 0x3edfd199
mov bl, ch
mov edx, eax
neg bh
test ebx, ebx
mov eax, edx
imul edx, edi
add ecx, eax
cmp ah, bh
adc al, ah
cmp ebp, eax
cmp edx, edx
pop ebx
mov eax, ecx
inc ebp
add edi, ecx
mov ah, 0x6d
imul edi, edx, 0xb88b31fc
movzx edx, ah
cmp ebp, 0x813
jne 0x43d973
sbb eax, 0x9e313be3
dec edi
mov dh, 0xf5
lea ebp, [0x6a4]
xor ebp, 0x56f
test ebx, esi
jne 0x43d988
adc eax, 0x35e78b8a
jb 0x43d98b
dec eax
sub ebp, 0xfffe16be
sub ebp, 0x1e943
neg eax
xchg ch, ah
jmp 0x43d9a3
cmp ebp, 0xcc
jae 0x43d97f
movd mm5, ebx
test edi, ebp
xchg dl, cl
sub esi, ecx
test al, dl
movd edi, mm5
xchg ah, bl
not ch
test esi, 0x16868001
add edi, 0x29de0
mov ch, 0x4c
add edi, 0x9f7
add ch, ah
lea ecx, [0x7704e789]
xor dl, dl
dec ecx
cmp eax, ebp
js 0x43d9e7
imul esi, ebx, 0x1cf75115
cmp eax, 0xa215
jb 0x43d9fb
imul ebp, esi, 0x6006f0dc
mov ebx, ebx
mov ecx, 0x36531fc9
jne 0x43d9ff
bswap esi
push edi
mov ah, ah
imul esi, ebx, 0xd186a30c
cmp edx, ebx
imul ebp, eax, 0x277a0620
add eax, 0x3ae66216
bswap ecx
mov ebx, 0x9b5
sbb esi, ebp
sub ebx, 0x9b5
jae 0x43da28
bswap ebp
imul eax, ecx, 0x78042294
sbb dh, bh
push 0x1c6
lea eax, [0x54a148a4]
pop eax
xchg esi, edx
imul eax, eax, 7
mov ch, 0xcd
add ebx, eax
test bh, dh
sub ebx, 0xc69
jmp 0x43da52
sub al, 0x74
dec ecx
cmp ebx, 0x1ab
jb 0x43da24
jmp 0x43da77
ret
Function at 0x43d94b
Capabilities:
Check for software breakpoints

Disassembly:
imul ebx, eax
jae 0x43d8ef
test ch, 0x74
cmp esi, 0x4ff5
js 0x43d8fc
test dh, 0x63
not ah
jmp 0x43d910
test dl, dh
cmp edx, 0x12a4
inc edi
inc esi
call 0x43d94b
cmp eax, 0xd5e3a4e9
jb 0x43d92c
imul edi, ecx, 0xec8e6cb7
imul ebp, esi, 0x87c990fd
jbe 0x43d93c
mov edi, 0x3edfd199
mov bl, ch
mov edx, eax
neg bh
test ebx, ebx
mov eax, edx
imul edx, edi
add ecx, eax
cmp ah, bh
adc al, ah
cmp ebp, eax
cmp edx, edx
pop ebx
mov eax, ecx
inc ebp
add edi, ecx
mov ah, 0x6d
imul edi, edx, 0xb88b31fc
movzx edx, ah
cmp ebp, 0x813
jne 0x43d973
sbb eax, 0x9e313be3
dec edi
mov dh, 0xf5
lea ebp, [0x6a4]
xor ebp, 0x56f
test ebx, esi
jne 0x43d988
adc eax, 0x35e78b8a
jb 0x43d98b
dec eax
sub ebp, 0xfffe16be
sub ebp, 0x1e943
neg eax
xchg ch, ah
jmp 0x43d9a3
cmp ebp, 0xcc
jae 0x43d97f
movd mm5, ebx
test edi, ebp
xchg dl, cl
sub esi, ecx
test al, dl
movd edi, mm5
xchg ah, bl
not ch
test esi, 0x16868001
add edi, 0x29de0
mov ch, 0x4c
add edi, 0x9f7
add ch, ah
lea ecx, [0x7704e789]
xor dl, dl
dec ecx
cmp eax, ebp
js 0x43d9e7
imul esi, ebx, 0x1cf75115
cmp eax, 0xa215
jb 0x43d9fb
imul ebp, esi, 0x6006f0dc
mov ebx, ebx
mov ecx, 0x36531fc9
jne 0x43d9ff
bswap esi
push edi
mov ah, ah
imul esi, ebx, 0xd186a30c
cmp edx, ebx
imul ebp, eax, 0x277a0620
add eax, 0x3ae66216
bswap ecx
mov ebx, 0x9b5
sbb esi, ebp
sub ebx, 0x9b5
jae 0x43da28
bswap ebp
imul eax, ecx, 0x78042294
sbb dh, bh
push 0x1c6
lea eax, [0x54a148a4]
pop eax
xchg esi, edx
imul eax, eax, 7
mov ch, 0xcd
add ebx, eax
test bh, dh
sub ebx, 0xc69
jmp 0x43da52
sub al, 0x74
dec ecx
cmp ebx, 0x1ab
jb 0x43da24
jmp 0x43da77
ret

Function at 0x43daff
Capabilities:
Check for software breakpoints

Disassembly:
ret 0xaf0f
mov edx, 8
call fcn.0043da9d
xor eax, eax
mov edx, SysReAllocString
ret
mov ecx, 5
movsd xmm5, qword [0x44ce58]
movdqa xmm1, xmm0
psrldq xmm1, 4
movd eax, xmm1
and eax, 0x7fffffff
cmp eax, 0x7ff00000
jae 0x43da8b
cmp ecx, 1
je 0x43d943
movdqa xmm1, xmm0
psllq xmm1, 1
psrlq xmm1, 1
movsd xmm2, qword [0x44ce68]
comisd xmm1, xmm2
jbe 0x43db7d
cmp ecx, 4
je 0x43db69
mov edx, 1
call fcn.0043da9d
mov edx, 0x10
call fcn.0043da9d
jmp 0x43db7d
mov edx, 0x10
call fcn.0043da9d
mov edx, 1
call fcn.0043da9d
movsd xmm2, qword [0x44ce70]
comisd xmm1, xmm2
jae 0x43dbb2
xorpd xmm2, xmm2
comisd xmm1, xmm2
je 0x43d9c9
mov edx, 2
call fcn.0043da9d
mov edx, 0x10
call fcn.0043da9d
jmp 0x43d9c9
movdqa xmm3, xmm0
cmp ecx, 4
jne 0x43dbcd
movsd xmm2, qword [0x44ce58]
comisd xmm3, xmm2
jb 0x43dbcd
subpd xmm3, xmm2
movdqa xmm4, xmm3
psllq xmm4, 0x23
psrlq xmm4, 0x23
movd eax, xmm4
or eax, eax
je 0x43dbed
mov edx, 0x10
call fcn.0043da9d
comisd xmm0, xmm5
jae 0x43da8b
movsd xmm2, qword [0x44ce50]
comisd xmm0, xmm2
jb 0x43da8b
jmp 0x43d9c9
Function at 0x1001139d
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x10011430
call fcn.1000ed82
xor edi, edi
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x100265f7
test eax, eax
je 0x10031507
cmp eax, 2
jne 0x100116c7
push dword [0x100de7cc]
call sym.MSVCR120.dll__gmtime64_s
pop ecx
test eax, eax
jne 0x1001141b
push 0x3bc
push 1
call sym.MSVCR120.dll__gmtime64_s
pop ecx
pop ecx
mov esi, eax
test esi, esi
je 0x10031555
push esi
push dword [0x100de7cc]
call sym.MSVCR120.dll__gmtime64_s
pop ecx
pop ecx
test eax, eax
je 0x10050453
push edi
push esi
call sym.MSVCR120.dll__initptd
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
call fcn.10011398
xor eax, eax
inc eax
call fcn.1000edc7
ret
cmp eax, 3
jne 0x1001141b
push edi
call sym.MSVCR120.dll__gmtime64_s
pop ecx
jmp 0x1001141b
call fcn.100261c8
test eax, eax
je 0x10031555
call fcn.10026580
test eax, eax
je 0x100503fe
call fcn.10026f4d
test eax, eax
js 0x10050408
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [sym.MSVCR120.dll__wcmdln], eax
call sym.MSVCR120.dll__gmtime64_s
jmp 0x100268e4
mov dword [0x100dfbbc], eax
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [sym.MSVCR120.dll__acmdln], eax
call fcn.10026c85
call fcn.10026928
test eax, eax
js 0x1003155c
push edi
call sym.MSVCR120.dll__gmtime64_s
pop ecx
test eax, eax
jne 0x1003155c
test edi, edi
jne 0x1005040f
inc dword [0x100dfbb8]
jmp 0x1001141b
mov eax, dword [0x100dfbb8]
test eax, eax
jle 0x10031555
dec eax
mov dword [0x100dfbb8], eax
mov dword [ebp - 4], edi
cmp dword [0x100e0418], 0
je 0x10050416
call fcn.10031219
call fcn.10031260
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10050420
mov dword [ebp - 4], 0xfffffffe
call fcn.1003154c
jmp 0x1001141b
xor eax, eax
jmp 0x10011423
xor edi, edi
inc edi
jmp 0x10026915
call fcn.1009f373
jmp 0x10031555
call fcn.100775db
jmp 0x100503fe
call fcn.1009f9c4
jmp 0x10050408
call sym.MSVCR120.dll__cexit
jmp 0x10031526
call fcn.1009f9c4
call fcn.100775db
call fcn.1009f373
jmp 0x1003153b
push esi
call sym.MSVCR120.dll__gmtime64_s
pop ecx
jmp 0x10031555