joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416b56
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x649474]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x6305c4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x416ccb
push ebx
lea eax, [ebp - 0x110]
xor bl, bl
push eax
push 0x20019
push 0
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416cca
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 4
push eax
xor ecx, ecx
lea eax, [ebp - 0x114]
push eax
push ecx
push ecx
push 0x630600
push dword [ebp - 0x110]
mov dword [ebp - 0x114], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x416c94
push esi
push dword [ebp - 0x114]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x416c93
and dword [ebp - 0x118], 0
lea eax, [ebp - 0x118]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x416c26
cmp dword [ebp - 0x118], 0x103
jne 0x416c26
inc bl
jmp 0x416c28
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x416c93
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push str.SteamClientDll
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x416c93
cmp dword [ebp - 0x10c], 1
jb 0x416c91
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416c76
sub ecx, edx
cmp ecx, 1
jl 0x416c91
lea ecx, [ebp - 0x108]
call fcn.0042d88d
jmp 0x416c93
xor bl, bl
pop esi
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x416cca
push 0xffffffffffffffff
push 0x104
mov edx, str.GameOverlayRenderer.dll
lea ecx, [ebp - 0x108]
call fcn.0042cc5b
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004828de
leave
ret
Function at 0x418792
Capabilities:
Download url
Get common file path
Receive data

Disassembly:
push 8
push 0x240
mov eax, 0x4e6fd3
call fcn.004e34f5
lea eax, [ebp - 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor eax, eax
lea ecx, [ebp - 0x120]
push 0xf
pop edi
mov dword [ebp - 0x138], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], edi
mov byte [ebp - 0x138], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4187db
sub ecx, edx
lea eax, [ebp - 0x120]
push ecx
push eax
lea ecx, [ebp - 0x138]
call fcn.00408b44
and dword [ebp - 4], 0
lea ecx, [ebp - 0x138]
push 0x14
push str.launcher_version.txt
call fcn.0040382e
push eax
lea ecx, [ebp - 0x168]
call fcn.004036f2
push 0x10
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x124]
pop esi
cmp eax, esi
jb 0x41886e
mov ecx, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], ecx
cmp eax, 0x1000
jb 0x418865
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x184]
push eax
call fcn.00403c47
mov eax, dword [ebp - 0x188]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x184]
push eax
push ecx
call fcn.00482b0d
pop ecx
pop ecx
sub esp, 0x18
mov dword [ebp - 0x124], edi
mov ecx, esp
xor eax, eax
mov byte [ebp - 0x184], al
mov dword [ebp - 0x128], eax
push str.6_3xls_tlclbvlerq_____0_411l__6
push dword [ebp - 0x184]
mov byte [ebp - 0x138], al
push 0x26
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edi
call fcn.00408ad5
lea ecx, [ebp - 0x150]
call fcn.0040eeb5
add esp, 0x18
mov byte [ebp - 4], 3
lea eax, [ebp - 0x150]
cmp dword [ebp - 0x13c], esi
cmovae eax, dword [ebp - 0x150]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
cmp dword [ebp - 0x154], esi
lea ecx, [ebp - 0x168]
lea eax, [ebp - 0x150]
cmovae ecx, dword [ebp - 0x168]
cmp dword [ebp - 0x13c], esi
cmovae eax, dword [ebp - 0x150]
xor edx, edx
push edx
push edx
push ecx
push eax
push edx
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x4189e8
cmp dword [ebp - 0x154], esi
lea eax, [ebp - 0x168]
lea ecx, [ebp - 0x250]
cmovae eax, dword [ebp - 0x168]
sub esp, 0xc
push eax
call fcn.00405add
mov byte [ebp - 4], 4
xor edx, edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 4]
cmp dword [ebp + ecx - 0x244], edx
jne 0x4189dd
xor eax, eax
mov byte [ebp - 0x187], dl
inc eax
mov byte [ebp - 0x18f], dl
mov byte [ebp - 0x188], al
push dword [ebp - 0x188]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp + ecx - 0x218]
test eax, eax
push edx
sete byte [ebp - 0x190]
push dword [ebp - 0x190]
push eax
push ecx
lea ecx, [ebp - 0x180]
call fcn.0041e71d
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 5
call fcn.00405a62
push str.del__q__temp_launcher_version.txt
call fcn.004abb4f
lea ecx, [ebp - 0x180]
mov dword [esp], 0x6ae3bc
call fcn.00420ba6
lea ecx, [ebp - 0x180]
test al, al
jne 0x4189d8
call fcn.00403cab
lea ecx, [ebp - 0x250]
call fcn.0040423a
jmp 0x4189ef
call fcn.00403cab
lea ecx, [ebp - 0x250]
call fcn.0040423a
mov byte [ebp - 0x184], 0
lea ecx, [ebp - 0x150]
call fcn.00403cab
lea ecx, [ebp - 0x168]
call fcn.00403cab
mov al, byte [ebp - 0x184]
mov ecx, dword [ebp - 0x14]
call fcn.004e34d3
ret
Function at 0x4199cf
Capabilities:
Set console window title

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
call fcn.00490a9b
push eax
push 0x6309f4
push str.CONIN_
call fcn.004ab6ab
push 1
call fcn.00490a9b
push eax
mov edi, 0x6309f8
mov esi, str.CONOUT_
push edi
push esi
call fcn.004ab6ab
push 2
call fcn.00490a9b
push eax
push edi
push esi
call fcn.004ab6ab
add esp, 0x30
push str.CSO2_Debug_Console___Global_Discord:_https:__discord.gg_NXYypCQ
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov esi, 0xfde9
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
pop edi
pop esi
ret
Function at 0x41a972
Capabilities:
Terminate process

Disassembly:
push 0x54
mov eax, 0x4e74e3
call fcn.00483d44
mov eax, dword [0x6ae3e4]
xor ebx, ebx
mov ecx, dword [0x6ae3e0]
sub eax, ecx
push 0x18
cdq
pop esi
idiv esi
test eax, eax
je 0x41aa4d
xor edi, edi
lea edx, [edi + ecx]
cmp dword [edx + 0x14], 0x10
jb 0x41a9a8
mov edx, dword [edx]
sub esp, 0x18
mov ecx, esp
call fcn.0041a647
call fcn.004185a8
add esp, 0x18
test al, al
je 0x41aa53
cmp byte [0x6ae320], 0
je 0x41aa32
mov eax, dword [0x6ae3e0]
sub esp, 0x18
mov ecx, esp
add eax, edi
push eax
and dword [ecx], 0
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.00408c05
lea ecx, [ebp - 0x44]
call fcn.0040eeb5
mov esi, eax
and dword [ebp - 4], 0
mov edx, str.Ok__file
mov ecx, 0x6ac910
call fcn.00406ccb
mov edx, esi
mov ecx, eax
call fcn.00406e62
mov edx, str._does_exist.
mov ecx, eax
call fcn.00406ccb
push eax
call fcn.0040fce0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
add esp, 0x1c
call fcn.00403cab
push 0x18
pop esi
mov eax, dword [0x6ae3e4]
inc ebx
mov ecx, dword [0x6ae3e0]
add edi, esi
sub eax, ecx
cdq
idiv esi
cmp ebx, eax
jb 0x41a99d
call fcn.00483cf3
ret
imul eax, ebx, 0x18
lea ecx, [ebp - 0x5c]
mov edx, str.File__
add eax, dword [0x6ae3e0]
push eax
call fcn.0040dd7a
pop ecx
push 0x34
push str.__is_not_found._Please_update_or_reinstall_the_game.
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.0040382e
push eax
lea ecx, [ebp - 0x2c]
call fcn.004036f2
lea ecx, [ebp - 0x5c]
call fcn.00403cab
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0x10
cmovae eax, dword [ebp - 0x2c]
push str.Missing_file
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.004aaa8c
int3

Function at 0x41aab4
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x649474]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 2
mov ebx, ecx
mov dword [ebp - 0x130], pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41aaea
xor eax, eax
jmp 0x41ab32
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
lea eax, [ebp - 0x10c]
mov ecx, ebx
push eax
call fcn.00421b5e
test eax, eax
je 0x41ab25
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x41aaf8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41aae6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004828de
leave
ret
Function at 0x41de68
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x649474]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x41dec5
cmp byte [esi + 0x3e], bl
je 0x41dec5
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
cmp di, ax
je 0x41defe
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x41ded6
sub eax, 1
je 0x41ded9
dec eax
sub eax, 1
jne 0x41defe
mov byte [esi + 0x3e], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004828de
leave
ret
mov byte [esi + 0x3e], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x41def6
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004a39b6
add esp, 0x10
cmp edi, eax
jne 0x41defe
cmp byte [esi + 0x3e], bl
sete al
jmp 0x41dec7
xor al, al
jmp 0x41dec7

Function at 0x421f7b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov esi, 0x1000
push esi
mov dword [ebp - 8], ebx
call fcn.00490969
pop ecx
mov ecx, dword [ebx + 4]
mov edi, eax
push esi
push edi
mov ecx, dword [ecx]
push dword [ecx]
mov ecx, dword [ebx]
call fcn.00421d15
mov eax, 0x5a4d
xor ebx, ebx
cmp word [edi], ax
jne 0x421ff6
mov esi, dword [edi + 0x3c]
add esi, edi
cmp dword [esi], 0x4550
jne 0x421ff6
and dword [ebp - 4], 0
lea ebx, [esi + 0xf8]
xor eax, eax
cmp ax, word [esi + 6]
jae 0x421ff4
push str..text
push ebx
call fcn.004ac271
pop ecx
pop ecx
test eax, eax
je 0x422006
mov ecx, dword [ebp - 4]
add ebx, 0x28
movzx eax, word [esi + 6]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, eax
jl 0x421fd1
xor ebx, ebx
push edi
call fcn.0049094e
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 8
mov eax, dword [ebp - 8]
mov ecx, dword [ebx + 0xc]
mov eax, dword [eax + 4]
mov eax, dword [eax]
add ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebx + 8]
mov bl, 1
mov dword [eax], ecx
jmp 0x421ff6
Function at 0x422302
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x649474]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42232d
xor eax, eax
jmp 0x4223a2
push 0x124
lea eax, [ebp - 0x128]
push ebx
push eax
call fcn.004857d0
add esp, 0xc
mov dword [ebp - 0x12c], pe_nt_image_headers32
lea eax, [ebp - 0x12c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x422367
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x422329
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call fcn.00421b5e
test eax, eax
je 0x42238e
lea eax, [ebp - 0x12c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x422367
jmp 0x422390
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test bl, bl
cmovne eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004828de
leave
ret 4

Function at 0x423687
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 0x14], 0
and dword [ecx + 0x18], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
ret
Function at 0x424b1e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov dword [ebp - 4], ecx
je 0x424ba2
push 0x62f5b0
push dword [ebp + 8]
call fcn.004a5e8a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x424ba2
push ebx
push edi
push 0x80200
call fcn.004830c7
mov ebx, eax
pop ecx
mov dword [ebp + 8], ebx
push esi
push 0x80200
push 1
push ebx
call fcn.004a3c1c
mov edi, eax
add esp, 0x10
test edi, edi
je 0x424b74
mov ecx, dword [ebp - 4]
push edi
push ebx
call fcn.00424a74
cmp edi, 0x80200
jae 0x424b53
push esi
call fcn.004ad01b
mov ebx, eax
neg ebx
push esi
sbb bl, bl
and bl, 1
call fcn.004a4218
push dword [ebp + 8]
call fcn.00482b75
add esp, 0xc
mov al, bl
pop edi
pop ebx
jmp 0x424ba4
xor al, al
pop esi
leave
ret 4

Function at 0x42b8ad
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
xor esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp edx, 4
jl 0x42b8ed
push ebx
mov ebx, edx
shr ebx, 2
imul eax, ebx, 0xfffffffc
add edx, eax
imul ecx, dword [edi], 0x5bd1e995
add edi, 4
imul esi, esi, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
xor esi, ecx
sub ebx, 1
jne 0x42b8c9
pop ebx
sub edx, 1
je 0x42b90e
sub edx, 1
je 0x42b905
sub edx, 1
jne 0x42b919
movzx eax, byte [edi + 2]
shl eax, 0x10
xor esi, eax
movzx eax, byte [edi + 1]
shl eax, 8
xor esi, eax
movzx eax, byte [edi]
xor eax, esi
imul esi, eax, 0x5bd1e995
mov eax, esi
shr eax, 0xd
xor eax, esi
imul ecx, eax, 0x5bd1e995
pop edi
pop esi
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop ebp
ret
Function at 0x439010
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
dec eax
cmp eax, 0x1e
ja case.0x4390cb.12
mov esi, dword [ebp + 8]
nop word [eax + eax]
movzx eax, byte [eax + 0x439240]
jmp dword [eax*4 + 0x439214]
mov eax, dword [esi + 0x124]
movzx ebx, byte [ebx + 1]
add eax, 0xffffff6c
lea ebx, [eax + ebx*2]
movzx eax, byte [ebx]
dec eax
cmp eax, 0x1e
jbe 0x439030
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x120]
mov dl, byte [edi + 4]
movzx eax, byte [eax + 0x4fda80]
movzx ecx, dl
inc dl
add ecx, ecx
mov byte [edi + 4], dl
mov byte [edi + ecx*8 + 0x14], 1
mov dword [edi + ecx*8 + 0x18], eax
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
mov bl, byte [esi + 0xf0]
cmp bl, 8
jae case.0x4390cb.12
mov cl, byte [edi + 4]
movzx edx, cl
inc cl
add edx, edx
movzx eax, bl
add eax, 0x5a
mov byte [edi + 4], cl
mov dword [edi + edx*8 + 0x18], eax
xor al, al
mov byte [edi + edx*8 + 0x14], 1
pop edi
pop esi
pop ebx
pop ebp
ret
movzx eax, byte [ebx + 1]
add eax, 0xfffffff8
cmp eax, 0x47
ja case.0x4390cb.12
movzx eax, byte [eax + 0x43926c]
jmp dword [eax*4 + 0x439260]
mov edx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00435940
mov edx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00437830
mov cl, byte [esi + 0xf6]
movzx eax, cl
inc cl
push esi
mov edx, dword [esi + eax*8 + 0xf8]
mov eax, dword [esi + eax*8 + 0xfc]
push eax
mov byte [esi + 0xf6], cl
mov ecx, edi
push edx
mov edx, ebx
call fcn.00434710
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0xb8]
cmp eax, 2
jne 0x43912d
lea edx, [eax + 0x29]
jmp 0x43913f
cmp eax, 1
jne 0x43913a
lea edx, [eax + 0x1c]
lea eax, [edx + 0x10]
jmp 0x439144
mov edx, 0x2d
mov eax, 0x1d
cmp byte [esi + 0xc], 0
mov cl, byte [edi + 4]
cmovne edx, eax
movzx eax, cl
add eax, eax
inc cl
mov byte [edi + 4], cl
mov dword [edi + eax*8 + 0x18], edx
mov byte [edi + eax*8 + 0x14], 1
mov eax, dword [esi + 0x6c]
movzx edx, byte [eax + 0x4fd8b4]
mov cl, byte [edi + 4]
movzx eax, cl
inc cl
shl eax, 4
mov byte [edi + 4], cl
mov byte [eax + edi + 0x14], 1
mov dword [eax + edi + 0x18], edx
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0xb8]
cmp eax, 2
jne 0x4391a7
cmp byte [esi + 0xc], 0
mov edx, 0x27
mov eax, 0x17
cmovne edx, eax
jmp 0x43916b
cmp eax, 1
jne 0x4391bf
cmp byte [esi + 0xc], 0
mov edx, 0x17
mov eax, 0xe
cmovne edx, eax
jmp 0x43916b
cmp byte [esi + 0xc], 0
mov edx, 0xe
mov eax, 0x17
cmovne edx, eax
jmp 0x43916b
mov eax, dword [esi + 0x108]
jmp 0x439066
mov cl, byte [edi + 4]
mov bl, byte [esi + 0xf4]
and bl, 7
movzx edx, cl
add edx, edx
movzx eax, bl
inc cl
add eax, 0x72
mov byte [edi + 4], cl
mov dword [edi + edx*8 + 0x18], eax
xor al, al
mov byte [edi + edx*8 + 0x14], 1
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0xec]
jmp 0x439066
Function at 0x43903e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
dec eax
cmp eax, 0x1e
ja case.0x4390cb.12
mov esi, dword [ebp + 8]
nop word [eax + eax]
movzx eax, byte [eax + 0x439240]
jmp dword [eax*4 + 0x439214]
mov eax, dword [esi + 0x124]
movzx ebx, byte [ebx + 1]
add eax, 0xffffff6c
lea ebx, [eax + ebx*2]
movzx eax, byte [ebx]
dec eax
cmp eax, 0x1e
jbe 0x439030
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x120]
mov dl, byte [edi + 4]
movzx eax, byte [eax + 0x4fda80]
movzx ecx, dl
inc dl
add ecx, ecx
mov byte [edi + 4], dl
mov byte [edi + ecx*8 + 0x14], 1
mov dword [edi + ecx*8 + 0x18], eax
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
mov bl, byte [esi + 0xf0]
cmp bl, 8
jae case.0x4390cb.12
mov cl, byte [edi + 4]
movzx edx, cl
inc cl
add edx, edx
movzx eax, bl
add eax, 0x5a
mov byte [edi + 4], cl
mov dword [edi + edx*8 + 0x18], eax
xor al, al
mov byte [edi + edx*8 + 0x14], 1
pop edi
pop esi
pop ebx
pop ebp
ret
movzx eax, byte [ebx + 1]
add eax, 0xfffffff8
cmp eax, 0x47
ja case.0x4390cb.12
movzx eax, byte [eax + 0x43926c]
jmp dword [eax*4 + 0x439260]
mov edx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00435940
mov edx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00437830
mov cl, byte [esi + 0xf6]
movzx eax, cl
inc cl
push esi
mov edx, dword [esi + eax*8 + 0xf8]
mov eax, dword [esi + eax*8 + 0xfc]
push eax
mov byte [esi + 0xf6], cl
mov ecx, edi
push edx
mov edx, ebx
call fcn.00434710
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0xb8]
cmp eax, 2
jne 0x43912d
lea edx, [eax + 0x29]
jmp 0x43913f
cmp eax, 1
jne 0x43913a
lea edx, [eax + 0x1c]
lea eax, [edx + 0x10]
jmp 0x439144
mov edx, 0x2d
mov eax, 0x1d
cmp byte [esi + 0xc], 0
mov cl, byte [edi + 4]
cmovne edx, eax
movzx eax, cl
add eax, eax
inc cl
mov byte [edi + 4], cl
mov dword [edi + eax*8 + 0x18], edx
mov byte [edi + eax*8 + 0x14], 1
mov eax, dword [esi + 0x6c]
movzx edx, byte [eax + 0x4fd8b4]
mov cl, byte [edi + 4]
movzx eax, cl
inc cl
shl eax, 4
mov byte [edi + 4], cl
mov byte [eax + edi + 0x14], 1
mov dword [eax + edi + 0x18], edx
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0xb8]
cmp eax, 2
jne 0x4391a7
cmp byte [esi + 0xc], 0
mov edx, 0x27
mov eax, 0x17
cmovne edx, eax
jmp 0x43916b
cmp eax, 1
jne 0x4391bf
cmp byte [esi + 0xc], 0
mov edx, 0x17
mov eax, 0xe
cmovne edx, eax
jmp 0x43916b
cmp byte [esi + 0xc], 0
mov edx, 0xe
mov eax, 0x17
cmovne edx, eax
jmp 0x43916b
mov eax, dword [esi + 0x108]
jmp 0x439066
mov cl, byte [edi + 4]
mov bl, byte [esi + 0xf4]
and bl, 7
movzx edx, cl
add edx, edx
movzx eax, bl
inc cl
add eax, 0x72
mov byte [edi + 4], cl
mov dword [edi + edx*8 + 0x18], eax
xor al, al
mov byte [edi + edx*8 + 0x14], 1
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0xec]
jmp 0x439066
Function at 0x4390b8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
dec eax
cmp eax, 0x1e
ja case.0x4390cb.12
mov esi, dword [ebp + 8]
nop word [eax + eax]
movzx eax, byte [eax + 0x439240]
jmp dword [eax*4 + 0x439214]
mov eax, dword [esi + 0x124]
movzx ebx, byte [ebx + 1]
add eax, 0xffffff6c
lea ebx, [eax + ebx*2]
movzx eax, byte [ebx]
dec eax
cmp eax, 0x1e
jbe 0x439030
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x120]
mov dl, byte [edi + 4]
movzx eax, byte [eax + 0x4fda80]
movzx ecx, dl
inc dl
add ecx, ecx
mov byte [edi + 4], dl
mov byte [edi + ecx*8 + 0x14], 1
mov dword [edi + ecx*8 + 0x18], eax
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
mov bl, byte [esi + 0xf0]
cmp bl, 8
jae case.0x4390cb.12
mov cl, byte [edi + 4]
movzx edx, cl
inc cl
add edx, edx
movzx eax, bl
add eax, 0x5a
mov byte [edi + 4], cl
mov dword [edi + edx*8 + 0x18], eax
xor al, al
mov byte [edi + edx*8 + 0x14], 1
pop edi
pop esi
pop ebx
pop ebp
ret
movzx eax, byte [ebx + 1]
add eax, 0xfffffff8
cmp eax, 0x47
ja case.0x4390cb.12
movzx eax, byte [eax + 0x43926c]
jmp dword [eax*4 + 0x439260]
mov edx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00435940
mov edx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00437830
mov cl, byte [esi + 0xf6]
movzx eax, cl
inc cl
push esi
mov edx, dword [esi + eax*8 + 0xf8]
mov eax, dword [esi + eax*8 + 0xfc]
push eax
mov byte [esi + 0xf6], cl
mov ecx, edi
push edx
mov edx, ebx
call fcn.00434710
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0xb8]
cmp eax, 2
jne 0x43912d
lea edx, [eax + 0x29]
jmp 0x43913f
cmp eax, 1
jne 0x43913a
lea edx, [eax + 0x1c]
lea eax, [edx + 0x10]
jmp 0x439144
mov edx, 0x2d
mov eax, 0x1d
cmp byte [esi + 0xc], 0
mov cl, byte [edi + 4]
cmovne edx, eax
movzx eax, cl
add eax, eax
inc cl
mov byte [edi + 4], cl
mov dword [edi + eax*8 + 0x18], edx
mov byte [edi + eax*8 + 0x14], 1
mov eax, dword [esi + 0x6c]
movzx edx, byte [eax + 0x4fd8b4]
mov cl, byte [edi + 4]
movzx eax, cl
inc cl
shl eax, 4
mov byte [edi + 4], cl
mov byte [eax + edi + 0x14], 1
mov dword [eax + edi + 0x18], edx
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0xb8]
cmp eax, 2
jne 0x4391a7
cmp byte [esi + 0xc], 0
mov edx, 0x27
mov eax, 0x17
cmovne edx, eax
jmp 0x43916b
cmp eax, 1
jne 0x4391bf
cmp byte [esi + 0xc], 0
mov edx, 0x17
mov eax, 0xe
cmovne edx, eax
jmp 0x43916b
cmp byte [esi + 0xc], 0
mov edx, 0xe
mov eax, 0x17
cmovne edx, eax
jmp 0x43916b
mov eax, dword [esi + 0x108]
jmp 0x439066
mov cl, byte [edi + 4]
mov bl, byte [esi + 0xf4]
and bl, 7
movzx edx, cl
add edx, edx
movzx eax, bl
inc cl
add eax, 0x72
mov byte [edi + 4], cl
mov dword [edi + edx*8 + 0x18], eax
xor al, al
mov byte [edi + edx*8 + 0x14], 1
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0xec]
jmp 0x439066