joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413f10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
or ecx, 0x15c00
pop ecx
push esi
sub esi, 0x623e
pop esi
push ecx
sub ecx, 0xcffe
pop ecx
push edx
xor edx, 0xb8e7
pop edx
push edx
push edi
add esp, 4
add edx, 0x55a7
and edx, 0x85a1
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
push ebx
add esp, 4
sub edx, 0xbe29
or edx, 0x16a46
or edx, 0x6abf
xor edx, 0xb09c
pop edx
push edx
xor edx, 0xd53
xor edx, 0xf043
or edx, 0xc931
pop edx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push ebx
and ebx, 0x13cc7
pop ebx
push ebx
push edi
add esp, 4
sub ebx, 0x440a
pop ebx
push edx
push eax
add esp, 4
or edx, 0x13b16
xor edx, 0x22a4
add edx, 0x6ca6
xor edx, 0x79c8
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x413f5e
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x413fb8
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x413e86
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x413e86
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x413fa2
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x413fac
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x414001
push edx
push eax
add esp, 4
add edx, 0x4ab3
pop edx
push ecx
push edx
add esp, 4
jmp 0x413fd7
pop ecx
push esi
push edi
add esp, 4
or esi, 0xa183
call 0x413fef
add byte [ebx + eax*2 + 0x33], al
cmp dword [eax + 0x48], ecx
add esp, 4
pop esi
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x414069
push esi
call 0x414010
add byte [esi + 0x3d], cl
inc ecx
inc esp
dec edi
xor eax, 0x4c48341
pop esi
push edi
push edx
add esp, 4
call 0x414029
add byte [esp + ecx*2 + 0x39], al
dec esi
inc esi
inc edi
dec ebp
inc ebp
inc esi
cmp eax, dword [ebx - 0x387efb3c]
shl dword [esi], cl
add byte [eax], al
pop edi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x41405f
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x413e2a
mov dword [ebp - 0x31c], 0
push ebx
push edx
add esp, 4
add ebx, 0xcb34
xor al, 0xcb
add byte [eax], al
call fcn.00414080
add byte [edx + 0x35], cl
xor bh, byte [eax]
inc edx
cmp al, byte [ebx + 0x3eb04c4]
add esp, 4
jmp 0x414088
dec ebx
cmp al, 0x3c
pop ebx
push esi
push eax
add esp, 4
add esi, 0x152fe
add esi, 0x16988
pop esi
invalid
test esp, esp
cld
invalid
Function at 0x413fef
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
or ecx, 0x15c00
pop ecx
push esi
sub esi, 0x623e
pop esi
push ecx
sub ecx, 0xcffe
pop ecx
push edx
xor edx, 0xb8e7
pop edx
push edx
push edi
add esp, 4
add edx, 0x55a7
and edx, 0x85a1
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
push ebx
add esp, 4
sub edx, 0xbe29
or edx, 0x16a46
or edx, 0x6abf
xor edx, 0xb09c
pop edx
push edx
xor edx, 0xd53
xor edx, 0xf043
or edx, 0xc931
pop edx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push ebx
and ebx, 0x13cc7
pop ebx
push ebx
push edi
add esp, 4
sub ebx, 0x440a
pop ebx
push edx
push eax
add esp, 4
or edx, 0x13b16
xor edx, 0x22a4
add edx, 0x6ca6
xor edx, 0x79c8
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x413f5e
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x413fb8
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x413e86
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x413e86
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x413fa2
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x413fac
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x414001
push edx
push eax
add esp, 4
add edx, 0x4ab3
pop edx
push ecx
push edx
add esp, 4
jmp 0x413fd7
pop ecx
push esi
push edi
add esp, 4
or esi, 0xa183
call 0x413fef
add byte [ebx + eax*2 + 0x33], al
cmp dword [eax + 0x48], ecx
add esp, 4
pop esi
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x414069
push esi
call 0x414010
add byte [esi + 0x3d], cl
inc ecx
inc esp
dec edi
xor eax, 0x4c48341
pop esi
push edi
push edx
add esp, 4
call 0x414029
add byte [esp + ecx*2 + 0x39], al
dec esi
inc esi
inc edi
dec ebp
inc ebp
inc esi
cmp eax, dword [ebx - 0x387efb3c]
shl dword [esi], cl
add byte [eax], al
pop edi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x41405f
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x413e2a
mov dword [ebp - 0x31c], 0
push ebx
push edx
add esp, 4
add ebx, 0xcb34
xor al, 0xcb
add byte [eax], al
call fcn.00414080
add byte [edx + 0x35], cl
xor bh, byte [eax]
inc edx
cmp al, byte [ebx + 0x3eb04c4]
add esp, 4
jmp 0x414088
dec ebx
cmp al, 0x3c
pop ebx
push esi
push eax
add esp, 4
add esi, 0x152fe
add esi, 0x16988
pop esi
invalid
test esp, esp
cld
invalid
Function at 0x414010
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
or ecx, 0x15c00
pop ecx
push esi
sub esi, 0x623e
pop esi
push ecx
sub ecx, 0xcffe
pop ecx
push edx
xor edx, 0xb8e7
pop edx
push edx
push edi
add esp, 4
add edx, 0x55a7
and edx, 0x85a1
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
push ebx
add esp, 4
sub edx, 0xbe29
or edx, 0x16a46
or edx, 0x6abf
xor edx, 0xb09c
pop edx
push edx
xor edx, 0xd53
xor edx, 0xf043
or edx, 0xc931
pop edx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push ebx
and ebx, 0x13cc7
pop ebx
push ebx
push edi
add esp, 4
sub ebx, 0x440a
pop ebx
push edx
push eax
add esp, 4
or edx, 0x13b16
xor edx, 0x22a4
add edx, 0x6ca6
xor edx, 0x79c8
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x413f5e
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x413fb8
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x413e86
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x413e86
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x413fa2
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x413fac
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x414001
push edx
push eax
add esp, 4
add edx, 0x4ab3
pop edx
push ecx
push edx
add esp, 4
jmp 0x413fd7
pop ecx
push esi
push edi
add esp, 4
or esi, 0xa183
call 0x413fef
add byte [ebx + eax*2 + 0x33], al
cmp dword [eax + 0x48], ecx
add esp, 4
pop esi
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x414069
push esi
call 0x414010
add byte [esi + 0x3d], cl
inc ecx
inc esp
dec edi
xor eax, 0x4c48341
pop esi
push edi
push edx
add esp, 4
call 0x414029
add byte [esp + ecx*2 + 0x39], al
dec esi
inc esi
inc edi
dec ebp
inc ebp
inc esi
cmp eax, dword [ebx - 0x387efb3c]
shl dword [esi], cl
add byte [eax], al
pop edi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x41405f
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x413e2a
mov dword [ebp - 0x31c], 0
push ebx
push edx
add esp, 4
add ebx, 0xcb34
xor al, 0xcb
add byte [eax], al
call fcn.00414080
add byte [edx + 0x35], cl
xor bh, byte [eax]
inc edx
cmp al, byte [ebx + 0x3eb04c4]
add esp, 4
jmp 0x414088
dec ebx
cmp al, 0x3c
pop ebx
push esi
push eax
add esp, 4
add esi, 0x152fe
add esi, 0x16988
pop esi
invalid
test esp, esp
cld
invalid
Function at 0x414029
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
or ecx, 0x15c00
pop ecx
push esi
sub esi, 0x623e
pop esi
push ecx
sub ecx, 0xcffe
pop ecx
push edx
xor edx, 0xb8e7
pop edx
push edx
push edi
add esp, 4
add edx, 0x55a7
and edx, 0x85a1
pop edx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
push ebx
add esp, 4
sub edx, 0xbe29
or edx, 0x16a46
or edx, 0x6abf
xor edx, 0xb09c
pop edx
push edx
xor edx, 0xd53
xor edx, 0xf043
or edx, 0xc931
pop edx
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103c]
mov word [ebp - 0x34], dx
push ebx
and ebx, 0x13cc7
pop ebx
push ebx
push edi
add esp, 4
sub ebx, 0x440a
pop ebx
push edx
push eax
add esp, 4
or edx, 0x13b16
xor edx, 0x22a4
add edx, 0x6ca6
xor edx, 0x79c8
pop edx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x413f5e
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x413fb8
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x413e86
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x413e86
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x413fa2
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x413fac
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x414001
push edx
push eax
add esp, 4
add edx, 0x4ab3
pop edx
push ecx
push edx
add esp, 4
jmp 0x413fd7
pop ecx
push esi
push edi
add esp, 4
or esi, 0xa183
call 0x413fef
add byte [ebx + eax*2 + 0x33], al
cmp dword [eax + 0x48], ecx
add esp, 4
pop esi
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x414069
push esi
call 0x414010
add byte [esi + 0x3d], cl
inc ecx
inc esp
dec edi
xor eax, 0x4c48341
pop esi
push edi
push edx
add esp, 4
call 0x414029
add byte [esp + ecx*2 + 0x39], al
dec esi
inc esi
inc edi
dec ebp
inc ebp
inc esi
cmp eax, dword [ebx - 0x387efb3c]
shl dword [esi], cl
add byte [eax], al
pop edi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xcb4]
je 0x41405f
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x413e2a
mov dword [ebp - 0x31c], 0
push ebx
push edx
add esp, 4
add ebx, 0xcb34
xor al, 0xcb
add byte [eax], al
call fcn.00414080
add byte [edx + 0x35], cl
xor bh, byte [eax]
inc edx
cmp al, byte [ebx + 0x3eb04c4]
add esp, 4
jmp 0x414088
dec ebx
cmp al, 0x3c
pop ebx
push esi
push eax
add esp, 4
add esi, 0x152fe
add esi, 0x16988
pop esi
invalid
test esp, esp
cld
invalid
Function at 0x4140a0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx - 0x7276e7b8]
fdiv st(4), st(0)
invalid
Function at 0x414aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx - 0x199f73]
dec dword [ecx - 0x161f73]
call dword [ecx - 0x7f]
leave
Function at 0x414d05
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x414d18
add byte [edi + ecx*2], dh
cmp ecx, dword [edx + edi + 0x42]
dec ebx
cmp esi, dword [edx]
cmp eax, 0x8104c483
ljmp 0xe281

Function at 0x414d18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x414d18
add byte [edi + ecx*2], dh
cmp ecx, dword [edx + edi + 0x42]
dec ebx
cmp esi, dword [edx]
cmp eax, 0x8104c483
ljmp 0xe281
Function at 0x4153ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
jmp 0x41537a
pop esi
push ecx
sub ecx, 0x14aff
add ecx, 0x17db1
jmp 0x41538e
or ecx, 0x840
pop ecx
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push esi
or esi, 0xaad2
xor esi, 0xa400
and esi, 0xe5f6
pop esi
push edi
push edx
add esp, 4
and edi, 0xa3de
pop edi
push edi
call 0x4153ed
add byte [edi], bh
dec ebx
xor edi, dword [edi]
xor eax, 0xc4833f42
add al, 0x5f
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push eax
push esi
add esp, 4
xor eax, 0x10ace
sub eax, 0xfe3
xor eax, 0x2838
pop eax
push edx
push edi
add esp, 4
xor edx, 0xa592
xor edx, 0x5d98
pop edx
push eax
sub eax, 0x150d4
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x415497
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x4154f1
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4153bf
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4153bf
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4154db
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x4154e5
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x41553a
push esi
xor esi, 0x10a9
and esi, 0x16b62
pop esi
push esi
push esi
add esp, 4
sub esi, 0x800
pop esi
push edi
push eax
add esp, 4
or edi, 0x16dd6
and edi, 0x17a26
and edi, 0x3ecb
pop edi
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x4155a2
push edi
call 0x415547
add byte [ecx + 0x4c], al
cmp byte [ecx + 0x50], al
add esp, 4
jmp 0x415551
pop edi
push eax
push eax
add esp, 4
add eax, 0xe5df
and eax, 0x484b
jmp 0x41556b
pop eax
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x415598
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x415363
mov dword [ebp - 0x2fc], 0
Function at 0x415547
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
jmp 0x41537a
pop esi
push ecx
sub ecx, 0x14aff
add ecx, 0x17db1
jmp 0x41538e
or ecx, 0x840
pop ecx
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push esi
or esi, 0xaad2
xor esi, 0xa400
and esi, 0xe5f6
pop esi
push edi
push edx
add esp, 4
and edi, 0xa3de
pop edi
push edi
call 0x4153ed
add byte [edi], bh
dec ebx
xor edi, dword [edi]
xor eax, 0xc4833f42
add al, 0x5f
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push eax
push esi
add esp, 4
xor eax, 0x10ace
sub eax, 0xfe3
xor eax, 0x2838
pop eax
push edx
push edi
add esp, 4
xor edx, 0xa592
xor edx, 0x5d98
pop edx
push eax
sub eax, 0x150d4
pop eax
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x415497
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x4154f1
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x4153bf
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x4153bf
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x4154db
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x4154e5
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x41553a
push esi
xor esi, 0x10a9
and esi, 0x16b62
pop esi
push esi
push esi
add esp, 4
sub esi, 0x800
pop esi
push edi
push eax
add esp, 4
or edi, 0x16dd6
and edi, 0x17a26
and edi, 0x3ecb
pop edi
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x4155a2
push edi
call 0x415547
add byte [ecx + 0x4c], al
cmp byte [ecx + 0x50], al
add esp, 4
jmp 0x415551
pop edi
push eax
push eax
add esp, 4
add eax, 0xe5df
and eax, 0x484b
jmp 0x41556b
pop eax
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x415598
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
jne 0x415363
mov dword [ebp - 0x2fc], 0
Function at 0x433fe0
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x14
mov eax, dword [0x5a53f4]
xor eax, esp
mov dword [esp + 0x10], eax
push ebp
push esi
mov ebp, dword [esp + 0x20]
xor esi, esi
lea eax, [esp + 8]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x38]
push ecx
mov byte [esp + 0x3c], 0
mov byte [esp + 0x3d], 0
mov byte [esp + 0x3e], 0
mov byte [esp + 0x3f], 0
mov byte [esp + 0x40], 0
mov byte [esp + 0x41], 5
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x43404e
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005308cb
add esp, 0x14
ret
mov eax, dword [esp + 8]
push ebx
push edi
mov dword [esp + 0x14], eax
cmp dword [ebp], esi
jbe 0x434081
mov ebx, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea edi, [ebp + 4]
mov edx, dword [edi]
mov eax, dword [esp + 0x10]
push edx
push eax
call ebx
test eax, eax
jne 0x4340a1
inc esi
add edi, 8
cmp esi, dword [ebp]
jb 0x434066
mov eax, dword [esp + 0x14]
test eax, eax
je 0x43408c
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop edi
pop ebx
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005308cb
add esp, 0x14
ret
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4340b0
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [esp + 0x20]
pop edi
pop ebx
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.005308cb
add esp, 0x14
ret
Function at 0x437ca0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x56702b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5a53f4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0052fff5
push 4
mov dword [esp + 0x20], 0
call fcn.00534241
mov edi, eax
add esp, 4
test edi, edi
je 0x437d1e
call fcn.0052f63f
mov dword [edi], eax
call fcn.0052f443
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0052f2bc
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x437d13
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0052f2e4
jmp 0x437d20
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x438330
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x568c30
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
mov eax, dword [0x5a53f4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x10], esi
or ebp, 0xffffffff
mov edi, edi
push 0x585ea8
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0040a650
mov dword [esp + 0x28], 0
mov ecx, dword [esi + 0x5a7700]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
call fcn.0040a650
add esp, 0x18
mov byte [esp + 0x1c], 2
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4383b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebp
jne 0x4383cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jmp 0x4383d0
shr eax, 4
test al, 1
je 0x438425
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4383f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 4
cmp esi, 8
jb 0x438360
mov esi, dword [esp + 0x24]
push 0x585ea4
mov ecx, esi
call fcn.00403220
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.00404cb0
mov esi, dword [esp + 0x28]
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x438411
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x14
ret