joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450370
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x47216f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x483c60]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 1
test ecx, ecx
mov dword [esp + 0x14], edi
je 0x4503db
lea edx, [esp + 0x18]
or eax, 0x20019
push edx
push eax
push 0
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x4503dd
mov esi, edi
test esi, esi
je 0x4504a7
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push 0
push ecx
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45049c
mov eax, dword [esp + 0x38]
cmp eax, 1
je 0x45041f
cmp eax, 2
je 0x45041f
cmp eax, 6
je 0x45041f
cmp eax, 7
jne 0x45049c
mov edx, dword [esp + 0x34]
add edx, 2
push edx
call fcn.00457717
mov ebp, eax
mov eax, dword [esp + 0x38]
mov edi, ebp
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x34]
push eax
push ebp
push 0
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebp
jne 0x450482
lea ecx, [esp + 0x14]
call fcn.0045ca46
cmp esi, dword [esp + 0x14]
je 0x450477
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.00457740
add esp, 4
jmp 0x4504b9
call fcn.00457740
add esp, 4
lea ecx, [esp + 0x10]
push 0x475aa8
call fcn.0045ca46
mov edi, dword [esp + 0x14]
cmp esi, edi
je 0x4504a7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4504b9
push eax
lea ecx, [esp + 0x14]
call fcn.0045ca46
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0045c632
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.0045c8bd
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x450600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
je 0x450637
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
or edx, 0x20019
push ecx
push edx
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x45063a
mov esi, dword [ebp + 8]
test esi, esi
je 0x4507eb
call fcn.00452be0
test eax, eax
je 0x450724
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x45065b
mov dword [ebp + 0x10], eax
jmp 0x45068e
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.00412870
mov ecx, dword [ebp + 0x10]
mov ebx, esp
push edi
push ebx
push 0xffffffffffffffff
push ecx
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp + 0x10], ebx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 0x14]
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4507df
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x4506c8
cmp eax, 2
je 0x4506c8
cmp eax, 6
je 0x4506c8
cmp eax, 7
jne 0x4507df
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.00457717
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov edi, ebx
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push ebx
jne 0x4507ca
mov ecx, dword [ebp + 0x18]
call fcn.00441730
cmp esi, dword [ebp + 8]
je 0x4507b4
jmp 0x4507ad
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 0x14]
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4507df
mov eax, dword [ebp + 0x14]
cmp eax, 1
je 0x45075e
cmp eax, 2
je 0x45075e
cmp eax, 6
je 0x45075e
cmp eax, 7
jne 0x4507df
mov edx, dword [ebp + 0xc]
add edx, 2
push edx
call fcn.00457717
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov edi, ebx
add esp, 4
lea ecx, [eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push ebx
push 0
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebx
jne 0x4507ca
mov ecx, dword [ebp + 0x18]
call fcn.00441800
cmp esi, dword [ebp + 8]
je 0x4507b4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.00457740
add esp, 4
mov eax, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.00457740
mov ecx, dword [ebp + 0x18]
add esp, 4
push 0x475aa8
call fcn.00441800
cmp esi, dword [ebp + 8]
je 0x4507eb
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esp, [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x451230
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x472238
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x451286
lea ecx, [ebp + 0x14]
lea edx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 8]
or ecx, 0x20006
push 0
push ecx
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x451289
mov esi, dword [ebp + 8]
test esi, esi
je 0x45136f
call fcn.00452be0
test eax, eax
je 0x45130a
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x4512a5
xor ebx, ebx
jmp 0x4512d5
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.00412870
mov eax, dword [ebp + 0x10]
mov ebx, esp
push edi
push ebx
push 0xffffffffffffffff
push eax
push 0
push 0
mov word [ebx], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, dword [ebp + 0x18]
push edi
call fcn.00410ece
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push edi
push 1
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x451363
cmp esi, dword [ebp + 8]
je 0x451303
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x451371
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0x18]
push edx
call fcn.0043b2d0
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [ebp + 0x10]
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x451354
cmp esi, dword [ebp + 8]
je 0x45133e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.0043bae0
mov eax, 1
jmp 0x451371
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.0043bae0
cmp esi, dword [ebp + 8]
je 0x45136f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452020
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x452198
mov eax, dword [esp + 0x10]
test eax, eax
je 0x452177
mov eax, dword [esp + 0x1c]
cmp eax, 0x104
jae 0x452076
mov eax, 0x104
mov dword [esp + 0x1c], eax
inc eax
push eax
call fcn.00457717
mov esi, eax
add esp, 4
test esi, esi
je 0x452198
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + 1]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x45218f
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x2001f
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45218f
mov edi, dword [esp + 0x20]
test edi, edi
je 0x45218f
push ebp
push edi
call fcn.00452020
add esp, 8
test eax, eax
je 0x452184
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x48b6c4]
test eax, eax
je 0x452121
test ebp, ebp
je 0x452121
push 0
push ebp
push esi
push ebx
call eax
test eax, eax
jne 0x45218f
jmp 0x45212d
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x45218f
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x45216e
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + 1]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x45218f
mov eax, dword [esp + 0x14]
jmp 0x4520ca
push esi
call fcn.00457740
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
test edi, edi
je 0x45218f
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00457740
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x4590dd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x459115
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045cd64
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045cd3c
jmp 0x459121
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45aedf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45af21
call fcn.00467d09
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45af21
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45af18
xor eax, eax
jmp 0x45af29
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045af2f
pop edi
pop esi
pop ebx
ret 4
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x38e85dc1
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data_1
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x53112ff0
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0xf336a0], 1
mov dword [0xf3369c], 1
mov dword [0xf33698], 1
mov dword [0xf33690], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x8c6014], eax
mov eax, dword [0xf336ac]
test eax, eax
je 0x4010b0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0xf336c0]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0xf336a8]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x880924], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060
Function at 0x403e64
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x404002
cmp dword [ebp - 0xc], 1
je 0x403e89
jmp 0x403ffd
mov eax, dword [ebp + 0xac]
mov dword [esp + 0xa4], eax
mov eax, dword [ebp + 0xa8]
mov dword [esp + 0xa0], eax
mov eax, dword [ebp + 0xa4]
mov dword [esp + 0x9c], eax
mov eax, dword [ebp + 0xa0]
mov dword [esp + 0x98], eax
mov eax, dword [ebp + 0x9c]
mov dword [esp + 0x94], eax
mov eax, dword [ebp + 0x98]
mov dword [esp + 0x90], eax
mov eax, dword [ebp + 0x94]
mov dword [esp + 0x8c], eax
mov eax, dword [ebp + 0x90]
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 0x8c]
mov dword [esp + 0x84], eax
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___super_fnc__1527
mov dword [ebp - 0xc], 0
nop
jmp 0x403e74
nop
leave
ret
Function at 0x404680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x4046a5
cmp dword [ebp - 0xc], 1
je 0x40479c
jmp 0x404797
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___super_fnc__3485
mov dword [ebp - 0xc], 1
nop
jmp 0x404690
nop
leave
ret
Function at 0x40a3f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x40a416
cmp dword [ebp - 0xc], 1
jne 0x40a530
jmp 0x40a536
mov eax, dword [ebp + 0x90]
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 0x8c]
mov dword [esp + 0x84], eax
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___super_fnc__1580
mov dword [ebp - 0xc], 1
jmp 0x40a531
nop
jmp 0x40a401
leave
ret
Function at 0x4103e2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xec
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0
je 0x41056b
cmp dword [ebp - 0x1c], 1
je 0x41040a
jmp 0x410566
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x14]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov esi, dword [eax]
mov dword [ebp - 0x30], esi
mov eax, dword [ebp + 0x10]
mov edi, dword [eax]
mov dword [ebp - 0x34], edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp + 0x18]
mov edi, dword [eax]
mov dword [ebp - 0x40], edi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov esi, dword [eax]
mov dword [ebp - 0x48], esi
mov eax, dword [ebp + 0x18]
mov edi, dword [eax]
mov dword [ebp - 0x4c], edi
mov eax, dword [ebp + 0x20]
mov edi, dword [eax]
mov eax, dword [ebp + 0x14]
mov esi, dword [eax]
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x90], 1
mov dword [esp + 0x8c], edx
mov dword [esp + 0x88], 5
mov dword [esp + 0x84], 6
mov dword [esp + 0x80], 2
mov dword [esp + 0x7c], 6
mov dword [esp + 0x78], ecx
mov dword [esp + 0x74], ebx
fldz
fstp qword [esp + 0x6c]
fld qword [0x8895d0]
fstp qword [esp + 0x64]
fld qword [0x8895c8]
fstp qword [esp + 0x5c]
mov dword [esp + 0x58], 4
mov edx, dword [ebp - 0x2c]
mov dword [esp + 0x54], edx
fld1
fstp qword [esp + 0x4c]
mov ecx, dword [ebp - 0x30]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], 3
mov ebx, dword [ebp - 0x34]
mov dword [esp + 0x40], ebx
mov edx, dword [ebp - 0x38]
mov dword [esp + 0x3c], edx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], 3
mov ebx, dword [ebp - 0x40]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 8
mov dword [esp + 0x28], 5
mov edx, dword [ebp - 0x44]
mov dword [esp + 0x24], edx
mov ecx, dword [ebp - 0x48]
mov dword [esp + 0x20], ecx
mov ebx, dword [ebp - 0x4c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
fld qword [0x8895f0]
fstp qword [esp + 8]
fld qword [0x8895c0]
fstp qword [esp]
call sym._ByteFree
mov dword [ebp - 0x1c], 0
nop
jmp 0x4103f5
nop
add esp, 0xec
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x412ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x412ef5
cmp dword [ebp - 0xc], 1
je 0x413028
jmp 0x413023
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xa4], 6
mov dword [esp + 0xa0], 5
mov dword [esp + 0x9c], 5
fldz
fstp qword [esp + 0x94]
mov dword [esp + 0x90], str.Dogecoin
fld qword [0x8895f8]
fstp qword [esp + 0x88]
mov dword [esp + 0x84], 4
fld qword [0x8895e8]
fstp qword [esp + 0x7c]
mov dword [esp + 0x78], 8
mov dword [esp + 0x74], 8
fld qword [0x8895d0]
fstp qword [esp + 0x6c]
mov dword [esp + 0x68], 1
mov dword [esp + 0x64], 9
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 1
mov dword [esp + 0x58], 0
fld qword [0x8895d8]
fstp qword [esp + 0x50]
fld qword [0x8895f0]
fstp qword [esp + 0x48]
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], eax
fld qword [0x8895d8]
fstp qword [esp + 0x34]
fld1
fstp qword [esp + 0x2c]
mov dword [esp + 0x28], 3
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 6
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 1
fld qword [0x8895e8]
fstp qword [esp + 0x10]
mov dword [esp + 0xc], 2
fld qword [0x8895d0]
fstp qword [esp + 4]
mov dword [esp], 0
call sym._AddDatAndEthFiles
mov dword [ebp - 0xc], 1
nop
jmp 0x412ee0
nop
leave
ret