joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448c80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e3fb
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
push ebx
push esi
push edi
mov eax, dword [0x4b2384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
lea esi, [ebx + 0x14]
push 0x20000
push 0
push esi
call fcn.0044b090
add esp, 0xc
lea eax, [ebx + 0x20014]
push 0
push eax
push 0x20000
push esi
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x448e47
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x10], esi
test eax, eax
je 0x448e04
cmp eax, 0xffffffff
je 0x448e04
call fcn.0041ac20
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x448e04
cmp dword [ebx + 0x2006c], 8
lea eax, [ebx + 0x20058]
mov dword [ebp - 0x14], eax
jb 0x448d35
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonlds_rpclds_rpc_src_rpc_instance_rpc_client_instance.cpp
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
call fcn.0040ab70
push 3
push 0x490f10
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.0040ab70
mov byte [ebp - 4], 1
call fcn.0041ac20
mov edi, eax
lea ecx, [ebp - 0xdc]
push 0x63
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00403b70
mov esi, eax
push str.RecvData_failed__error_code_:
push esi
mov byte [ebp - 4], 2
call fcn.00404c20
add esp, 8
mov ecx, esi
push dword [ebp - 0x10]
call fcn.00404a80
push str.__channel_name:
push esi
call fcn.00404c20
mov ecx, dword [ebp - 0x14]
mov eax, 0x490c54
test ecx, ecx
cmovne eax, ecx
push eax
push esi
call fcn.00402e60
mov eax, dword [edi]
add esp, 0x10
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xdc]
call fcn.00404e80
lea ecx, [ebp - 0x2c]
call fcn.00404530
lea ecx, [ebp - 0x44]
call fcn.00404530
mov esi, dword [ebp - 0x10]
mov dword [ebx + 0xc], 6
cmp esi, 0xe8
je 0x448e25
cmp esi, 0xe9
je 0x448e25
cmp esi, 0x6d
je 0x448e25
cmp esi, 6
jne 0x448e7b
mov dword [ebx + 0xc], 7
mov dword [ebx + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 4]
lea ecx, [edi + 4]
mov dword [ecx + 4], eax
mov dword [edi + 0x10], 0
mov eax, dword [ebx + 0x20014]
test eax, eax
je 0x448e74
test esi, esi
je 0x448e74
push dword [ebp - 0x10]
add eax, esi
push eax
push esi
push dword [ecx + 4]
call fcn.00426c00
mov dword [edi + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4693ab
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046906b
Function at 0x4742ff
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x74c1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0074c140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0074c140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0074c140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0074c140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x74cbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x74cc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x75e87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x74cc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x74cc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x1026f026
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
in eax, dx
mov byte gs:[ebp - 0x12], 0x68
mov byte [ebp - 0x11], 0x42
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 4
call fcn.1026ecd4
push eax
push edi
push dword [ebp + 8]
call fcn.1026ec89
add esp, 0x20
mov dword [ebp - 0xc], eax
call fcn.1026ecc4
fisub word [esi + 0x40]
xor byte [ebp + 0x5d889445], cl
xchg esp, eax
push eax
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xd2
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x7b
mov byte [ebp - 0x67], 0x44
mov byte [ebp - 0x66], 0x5f
mov byte [ebp - 0x65], 0x59
mov byte [ebp - 0x64], 0x58
mov byte [ebp - 0x63], 0x4c
mov byte [ebp - 0x62], 0x41
mov byte [ebp - 0x61], 0x7d
mov byte [ebp - 0x60], 0x5f
mov byte [ebp - 0x5f], 0x42
mov byte [ebp - 0x5e], 0x59
mov byte [ebp - 0x5d], 0x48
mov byte [ebp - 0x5c], 0x4e
mov byte [ebp - 0x5b], 0x59
mov byte [ebp - 0x5a], 0x2d
call fcn.1026ecd4
push eax
push edi
push dword [ebp + 8]
call fcn.1026ec89
mov dword [ebp - 0xc4], eax
mov byte [ebp - 0x44], bl
lea eax, [ebp - 0x44]
mov byte [ebp - 0x43], bl
push eax
mov byte [ebp - 0x42], 0xfd
mov byte [ebp - 0x41], bl
mov byte [ebp - 0x40], 0x4e
mov byte [ebp - 0x3f], 0x6d
mov byte [ebp - 0x3e], 0x63
mov byte [ebp - 0x3d], 0x66
mov byte [ebp - 0x3c], 0x4e
mov byte [ebp - 0x3b], 0x6b
mov byte [ebp - 0x3a], 0x60
mov byte [ebp - 0x39], 0x70
mov byte [ebp - 0x38], 0x63
mov byte [ebp - 0x37], 0x70
mov byte [ebp - 0x36], 0x7b
mov byte [ebp - 0x35], 0x43
mov byte [ebp - 0x34], 2
call fcn.1026ecd4
push eax
push edi
push dword [ebp + 8]
call fcn.1026ec89
add esp, 0x20
mov dword [ebp - 0xc8], eax
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0x7b
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0xc3
mov byte [ebp - 0x7f], 0xe1
mov byte [ebp - 0x7e], 0xf0
mov byte [ebp - 0x7d], 0xc9
mov byte [ebp - 0x7c], 0xeb
mov byte [ebp - 0x7b], 0xe0
mov byte [ebp - 0x7a], 0xf1
mov byte [ebp - 0x79], 0xe8
mov byte [ebp - 0x78], 0xe1
mov byte [ebp - 0x77], 0xcc
mov byte [ebp - 0x76], 0xe5
mov byte [ebp - 0x75], 0xea
mov byte [ebp - 0x74], 0xe0
mov byte [ebp - 0x73], 0xe8
mov byte [ebp - 0x72], 0xe1
mov byte [ebp - 0x71], 0xc5
mov byte [ebp - 0x70], 0x84
call fcn.1026ecc4
mov esi, 0x8d77b02f
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
inc esp
sti
invalid

Function at 0x1026ff00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3f8], 0xd
mov byte [ebp - 0x3f7], 0x3c
mov byte [ebp - 0x3f6], 0x2b
mov byte [ebp - 0x3f5], 0x2f
Function at 0x1027088a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x781], 0x8e
mov byte [ebp - 0x780], 0xc4
mov byte [ebp - 0x77f], 0xcc
mov byte [ebp - 0x77e], 0xcc
mov byte [ebp - 0x77d], 0xa0
call fcn.1026ecc4
dec eax
mul edi
out dx, eax
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.1026ecd4
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.1026ec35
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x10270c36
add byte [eax], al
Function at 0x41d779
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x437d90
call fcn.0041d870
push 1
call fcn.0041d126
pop ecx
test al, al
jne 0x41d630
push 7
call fcn.0041da75
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041d0f1
mov byte [ebp - 0x24], al
mov eax, dword [0x45a99c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x41d629
test eax, eax
jne 0x41d69a
mov dword [0x45a99c], ecx
push 0x4302b4
push 0x430298
call fcn.0042572c
pop ecx
pop ecx
test eax, eax
je 0x41d67d
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41d773
push 0x430294
push 0x430260
call fcn.004256d0
pop ecx
pop ecx
mov dword [0x45a99c], 2
jmp 0x41d69f
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041d280
pop ecx
call fcn.0041dd1a
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41d6cf
push esi
call fcn.0041d1f6
pop ecx
test al, al
je 0x41d6cf
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0041d85c
call esi
call fcn.0041dd20
mov esi, eax
cmp dword [esi], edi
je 0x41d6ed
push esi
call fcn.0041d1f6
pop ecx
test al, al
je 0x41d6ed
push dword [esi]
call fcn.00424b8c
pop ecx
call fcn.0041db90
movzx eax, ax
push eax
call fcn.0042567d
push eax
push edi
push 0x400000
call fcn.0041c131
mov esi, eax
call fcn.00424a9b
test al, al
jne 0x41d718
push esi
call fcn.00424bc4
test bl, bl
jne 0x41d721
call fcn.00424b67
push edi
push 1
call fcn.0041d29d
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41d773
call fcn.0041d8b6
ret
mov edi, edi
push ebp
mov ebp, esp
jmp 0x41d611
Function at 0x411d2e
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x411d4c
mov eax, 0x4d7153
push eax
push 1
mov ebx, 0x422f60
call fcn.00422ac5
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x411d76
mov eax, 0
jmp 0x411dea
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x411dd7
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x411dc0
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x411daf
xor ecx, eax
xor edx, ebx
dec edi
jne 0x411da0
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x41473b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x41475e
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x41475e
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x414768
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4147aa
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x41480c
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x414807
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4147f2
test dl, dl
je 0x4147ee
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4147f2
add ecx, 2
add eax, 2
test dl, dl
jne 0x4147d2
xor eax, eax
jmp 0x4147f7
sbb eax, eax
or eax, 1
test eax, eax
je 0x414818
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4147bf
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x41489d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4148c0
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4148c0
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4148ca
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x41490c
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x41496e
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x414969
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414954
test dl, dl
je 0x414950
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414954
add ecx, 2
add eax, 2
test dl, dl
jne 0x414934
xor eax, eax
jmp 0x414959
sbb eax, eax
or eax, 1
test eax, eax
je 0x41497a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x414921
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x414a0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x414a2f
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x414a2f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x414a39
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x414a7b
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x414add
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x414ad8
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414ac3
test dl, dl
je 0x414abf
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414ac3
add ecx, 2
add eax, 2
test dl, dl
jne 0x414aa3
xor eax, eax
jmp 0x414ac8
sbb eax, eax
or eax, 1
test eax, eax
je 0x414ae9
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x414a90
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x414b76
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x414b99
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x414b99
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x414ba3
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x414be5
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x414c47
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x414c42
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414c2d
test dl, dl
je 0x414c29
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414c2d
add ecx, 2
add eax, 2
test dl, dl
jne 0x414c0d
xor eax, eax
jmp 0x414c32
sbb eax, eax
or eax, 1
test eax, eax
je 0x414c53
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x414bfa
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x414cec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x414d0f
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x414d0f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x414d19
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x414d5b
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x414dbd
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x414db8
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414da3
test dl, dl
je 0x414d9f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414da3
add ecx, 2
add eax, 2
test dl, dl
jne 0x414d83
xor eax, eax
jmp 0x414da8
sbb eax, eax
or eax, 1
test eax, eax
je 0x414dc9
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x414d70
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x414e5d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x414e80
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x414e80
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x414e8a
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x414ecc
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x414f2e
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x414f29
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414f14
test dl, dl
je 0x414f10
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414f14
add ecx, 2
add eax, 2
test dl, dl
jne 0x414ef4
xor eax, eax
jmp 0x414f19
sbb eax, eax
or eax, 1
test eax, eax
je 0x414f3a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x414ee1
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x414fcc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x414fef
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x414fef
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x414ff9
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x41503b
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x41509d
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x415098
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x415083
test dl, dl
je 0x41507f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x415083
add ecx, 2
add eax, 2
test dl, dl
jne 0x415063
xor eax, eax
jmp 0x415088
sbb eax, eax
or eax, 1
test eax, eax
je 0x4150a9
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x415050
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8