joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416f11
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00428690
push dword [esp + 0x20]
call fcn.0041f380
lea edx, [esp]
push edx
push 0
push 0xb
push 1
push 2
call fcn.004282ce
push 0
push 0
call sub.KERNEL32.dll_GetSystemDirectoryW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x416f7f
mov edx, 0x457024
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004287f0
pop eax
push eax
call fcn.0041f350
pop edx
add eax, edx
jmp 0x416ffb
mov eax, dword [esp + 0x10]
inc eax
lea edx, [esp]
push edx
push eax
call fcn.0042841c
mov ebx, dword [esp + 0x10]
add ebx, ebx
push ebx
mov ebp, dword [esp + 4]
lea eax, [ebp]
push eax
call fcn.00421d80
push dword [esp + 0x10]
lea eax, [ebp]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
mov dword [esp + 0x10], eax
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004286f0
pop edx
push eax
push 0x19
push 0xffffffff
mov ebp, dword [esp + 0x10]
lea eax, [ebp]
push eax
call fcn.00421ec0
mov edx, 0x45717e
push edx
call fcn.004287f0
pop eax
push eax
call fcn.0041f350
pop edx
add eax, edx
jmp 0x416ffb
push eax
push dword [esp + 4]
call fcn.004284ed
pop eax
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x420a32
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x45be4c]
call fcn.004278f8
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x420b32
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x420a88
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x420a80
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x420ac8
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x420b0a
push 0x22
pop edx
cmp cx, dx
je 0x420aba
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x420aaa
xor ecx, ecx
cmp word [eax], cx
je 0x420b0a
mov ecx, eax
add eax, 2
jmp 0x420b0c
test dx, dx
je 0x420b12
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x420aba
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x420b00
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x420b0a
cmp cx, dx
je 0x420afd
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x420aed
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x420ad2
jmp 0x420aba
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x420b14
xor edx, edx
cmp dword [ebp], ebx
jne 0x420b1d
test edi, edi
jne 0x420b3a
test edx, edx
je 0x420b22
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x420a76
test edi, edi
jne 0x420b4b
mov eax, ebx
jmp 0x420b4f
test esi, esi
je 0x420b4b
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x420b4f
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x40303c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov ecx, dword [esp + 8]
movzx edx, word [ecx]
test dx, dx
je 0x40306f
add ecx, 2
mov eax, 0x47
imul esi, eax, 0x3983
movzx eax, dx
imul eax, eax, 0x1177f
xor eax, esi
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x403051
jmp 0x403074
mov eax, 0x47
pop esi
ret
Function at 0x40412c
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push 0x45fb2f
push ecx
call fcn.00447043
add esp, 8
xor esi, esi
test eax, eax
je 0x4041b9
mov edi, eax
push 2
push 0
push eax
call fcn.0044547b
add esp, 0xc
push edi
call fcn.004457ca
add esp, 4
test eax, eax
js 0x4041b0
mov ebp, eax
push edi
call fcn.00448dc3
add esp, 4
lea eax, [ebp + 1]
push eax
call dword [0x46b004]
add esp, 4
test eax, eax
je 0x4041b0
mov ebx, eax
push edi
push ebp
push 1
push eax
call fcn.0044847d
add esp, 0x10
test eax, eax
je 0x40419e
mov ebp, eax
push edi
call fcn.00447dd7
add esp, 4
test eax, eax
je 0x4041c0
push edi
call fcn.00447c52
add esp, 4
push ebx
call dword [section..data]
jmp 0x4041b6
push edi
call fcn.00447c52
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.00447c52
add esp, 4
mov byte [ebx + ebp], 0
mov esi, ebx
jmp 0x4041b9

Function at 0x40572c
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
test edx, edx
je 0x405754
mov edi, 0x1505
xor esi, esi
movzx ebx, byte [ecx + esi]
test ebx, ebx
je 0x40575b
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp edx, esi
jne 0x40573a
jmp 0x40575d
mov eax, 0x1505
jmp 0x40575d
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x410d0c
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x410e0b
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x410e04
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebp, esi
sub ebp, eax
xor edx, edx
cmp ebp, 8
mov dword [esp], esi
jb 0x410db5
xor esi, esi
mov eax, esi
movzx edx, byte [ebx + esi]
add edx, edi
add ecx, edx
movzx esi, byte [ebx + esi + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebx + eax + 7]
add edi, edx
add ecx, edi
lea esi, [eax + 8]
add eax, 0xf
cmp eax, ebp
jb 0x410d55
mov edx, ebp
and edx, 0x1ff8
add ebx, esi
mov esi, dword [esp]
mov eax, ebp
sub eax, edx
jbe 0x410dcf
xor edx, edx
movzx esi, byte [ebx + edx]
add edi, esi
add ecx, edi
inc edx
cmp eax, edx
jne 0x410dbd
add ebx, eax
mov esi, dword [esp]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, ecx
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, ebp
mov ebp, 0x15b0
jne 0x410d49
shl ecx, 0x10
or ecx, edi
jmp 0x410e0e
xor ecx, ecx
inc ecx
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x410e18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
not ebx
cmp ecx, 4
jb 0x410e8d
mov eax, 0xff
mov esi, ebx
shr esi, 8
movzx edi, byte [edx]
and ebx, eax
xor ebx, edi
xor esi, dword [ebx*4 + 0x45fdac]
mov edi, esi
shr edi, 8
movzx ebx, byte [edx + 1]
and esi, eax
xor esi, ebx
xor edi, dword [esi*4 + 0x45fdac]
mov esi, edi
shr esi, 8
movzx ebx, byte [edx + 2]
and edi, eax
xor edi, ebx
xor esi, dword [edi*4 + 0x45fdac]
mov ebx, esi
shr ebx, 8
movzx edi, byte [edx + 3]
and esi, eax
xor esi, edi
xor ebx, dword [esi*4 + 0x45fdac]
add edx, 4
add ecx, 0xfffffffc
cmp ecx, 3
ja 0x410e33
test ecx, ecx
je 0x410eb1
xor esi, esi
mov eax, ebx
shr eax, 8
movzx edi, byte [edx + esi]
movzx ebx, bl
xor ebx, edi
xor eax, dword [ebx*4 + 0x45fdac]
inc esi
mov ebx, eax
cmp ecx, esi
jne 0x410e95
jmp 0x410eb3
mov eax, ebx
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x414e99
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x48]
push dword [eax + 0x3c]
call fcn.004457fa
add esp, 4
mov ecx, dword [esi + 0x48]
mov edi, dword [ecx + 0x40]
add edi, dword [esp + 0x14]
mov ebx, dword [ecx + 0x44]
adc ebx, dword [esp + 0x18]
js 0x414edc
xor eax, edi
xor edx, ebx
or edx, eax
je 0x414ee3
push 0
push ebx
push edi
push dword [ecx + 0x3c]
call fcn.004454b5
add esp, 0x10
test eax, eax
je 0x414ee0
xor eax, eax
jmp 0x414ef8
mov ecx, dword [esi + 0x48]
push dword [ecx + 0x3c]
push dword [esp + 0x24]
push 1
push dword [esp + 0x28]
call fcn.0044847d
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x419ec7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x2040
call fcn.0043d420
cmp dword [ebp + 8], 0
je 0x419f6c
mov esi, dword [ebp + 0xc]
lea ebx, [esp + 0x3c]
push 0x2000
push 0
push ebx
call fcn.00440700
add esp, 0xc
mov edx, esp
xor eax, eax
mov ecx, 0xe
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, esi
call fcn.004195e7
mov edi, 0xfffffffd
test eax, eax
jne 0x419f83
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edi, dword [ebp + 8]
mov dword [edi + 0x4e010], eax
mov dword [edi + 0x4e014], ecx
mov ecx, esi
mov edx, 0x460e31
call fcn.00414e55
test eax, eax
je 0x419f71
mov esi, eax
push esi
push 0x2000
push 1
push ebx
call fcn.0044847d
add esp, 0x10
test eax, eax
je 0x419f78
push eax
push ebx
push edi
call fcn.00419e39
add esp, 0xc
test eax, eax
jns 0x419f41
mov edi, 0xfffffff8
jmp 0x419f7a
xor edi, edi
dec edi
jmp 0x419f83
mov edi, 0xfffffff0
jmp 0x419f83
xor edi, edi
push esi
call fcn.00447c52
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x422aeb
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov dword [ebp - 0x10], 0x4db0de1a
mov eax, 0x4db0de1a
mov esi, dword [ebp - 0x14]
cmp eax, 0xecff42cb
jle 0x422b44
cmp eax, 0x1d8e3b54
jle 0x422b86
cmp eax, 0x4db0de19
jle 0x422beb
cmp eax, 0x7881584c
je 0x422c88
cmp eax, 0x5a6fe9fd
je 0x422ca1
cmp eax, 0x4db0de1a
jne 0x422b01
push eax
mov eax, esp
mov dword [ebp - 0xc], eax
mov eax, 0xed2997ed
jmp 0x422b01
cmp eax, 0xcf793941
jg 0x422bb1
cmp eax, 0xa4dc8e0d
jle 0x422c17
cmp eax, 0xa4dc8e0e
je 0x422cab
cmp eax, 0xb64030a4
jne 0x422d52
mov eax, dword [ebp - 0x28]
push 0
push 4
push dword [ebp - 0xc]
push 7
push 0xffffffffffffffff
call eax
mov eax, 0xdcc61de5
jmp 0x422b01
cmp eax, 0xd500857
jg 0x422c40
cmp eax, 0xecff42cc
je 0x422cb5
cmp eax, 0xed2997ed
jne 0x422b01
mov eax, 0xecff42cc
jmp 0x422b01
cmp eax, 0xdc74d401
jg 0x422c68
cmp eax, 0xcf793942
je 0x422ccb
cmp eax, 0xd33e74dc
jne 0x422b01
imul eax, dword [ebp - 8], 0xab00
add eax, 0x6fa380
mov dword [ebp - 8], eax
mov eax, 0x1d8e3b55
jmp 0x422b01
cmp eax, 0x1d8e3b55
je 0x422cfa
cmp eax, 0x3ec7d908
jne 0x422b01
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1c]
add eax, 8
mov dword [ebp - 0x1c], eax
mov eax, 0x7881584c
jmp 0x422b01
cmp eax, 0x860a8d9b
je 0x422d07
cmp eax, 0x93023fc1
jne 0x422b01
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, 0xb64030a4
jmp 0x422b01
cmp eax, 0xd500858
je 0x422d23
cmp eax, 0xe1588a9
jne 0x422b01
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, 0xdc74d402
jmp 0x422b01
cmp eax, 0xdc74d402
je 0x422d42
cmp eax, 0xdcc61de5
jne 0x422b01
mov eax, 0xb61ed71c
jmp 0x422b01
imul eax, dword [ebp - 8], 0x10c2
add eax, 0xfffffecc
mov dword [ebp - 8], eax
mov eax, 0xe1588a9
jmp 0x422b01
mov eax, 0xd500858
jmp 0x422b01
mov eax, 0x5a6fe9fd
jmp 0x422b01
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
mov eax, 0x3ec7d908
jmp 0x422b01
mov ecx, dword [ebp - 8]
add ecx, 0xffffffba
mov eax, ecx
shl eax, 4
imul ecx, ecx
imul edx, ecx, 0x410b
dec edx
mov dword [ebp - 8], eax
mov eax, 0x3ec7d908
cmp edx, ecx
je 0x422b01
mov eax, 0xa4dc8e0e
jmp 0x422b01
mov eax, dword [ebp - 0xc]
mov eax, 0x93023fc1
jmp 0x422b01
and esi, 0xfffffffc
shl esi, 8
imul esi, esi, 0xbf
add esi, 0xfffff15e
mov eax, 0xe1588a9
jmp 0x422b01
push 0x512d126e
push 0x10eadba5
push dword [ebp - 0x24]
call fcn.004285e0
mov dword [ebp - 0x28], eax
mov eax, 0xd33e74dc
jmp 0x422b01
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, 0xcf793942
jmp 0x422b01
cmp eax, 0xb61ed71c
jne 0x422b01
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp dword [ecx], 0
setne al
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x423417
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov ebp, dword [eax + 8]
push 0x92d66e1f
push 0x74ec8bbf
push ebp
call fcn.004285e0
mov edi, eax
push 0xc5b1ad71
push 0x53cd3e2f
push ebp
call fcn.004285e0
mov esi, eax
lea eax, [esp + 4]
mov dword [eax], 0x18
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ecx, esp
push ebx
push eax
push 0x1f000f
push ecx
call edi
test eax, eax
js 0x4234c5
push 0x98ef17af
push 0x1423832d
push ebp
call fcn.004285e0
mov ebx, eax
mov ebp, 0x160
push ebp
call fcn.00448a24
add esp, 4
mov edi, eax
push 0
push ebp
push eax
push 2
push dword [esp + 0x10]
call ebx
xor ebx, ebx
test eax, eax
js 0x4234b7
cmp dword [edi + 8], 1
setne bl
push edi
call fcn.00448680
add esp, 4
push dword [esp]
call esi
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4250e4
Capabilities:
Access peb ldr_data

Disassembly:
push esi
sub esp, 0x18
mov eax, dword fs:[0x30]
mov dword [esp + 0xc], eax
mov dword [esp], 0xadd08cb5
mov eax, 0xadd08cb5
mov esi, dword [esp + 8]
cmp eax, 0xe7db50a1
jg 0x42514e
cmp eax, 0x9fb88899
je 0x42516c
cmp eax, 0xadd08cb5
je 0x42518b
cmp eax, 0xb43a59eb
jne 0x425102
mov eax, dword [esp + 4]
imul ecx, eax, 0x27
imul ecx, ecx
imul edx, ecx, 0x503
dec edx
imul eax, eax, 0x27000
add eax, 0x28000
mov dword [esp + 4], eax
mov eax, 0x9fb88899
cmp ecx, edx
je 0x425102
mov eax, 0x64287d00
jmp 0x425102
cmp eax, 0xe7db50a2
je 0x4251a3
cmp eax, 0x4290a59d
jne 0x4251c7
shr esi, 3
and esi, 0xfffff
mov eax, 0xe7db50a2
jmp 0x425102
add esi, esi
add esi, 0x1f5
mov eax, 0xe7db50a2
cmp esi, 0xf5
jge 0x425102
mov eax, 0x4290a59d
jmp 0x425102
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x10], eax
mov eax, 0xe7db50a2
jmp 0x425102
mov eax, dword [esp + 0x10]
push 0x326481d8
push 0x7808e87a
push dword [eax + 8]
call fcn.004285e0
mov dword [esp + 0x14], eax
mov eax, 0xb43a59eb
jmp 0x425102
cmp eax, 0x64287d00
jne 0x425102
mov dword [esp], eax
mov dword [esp + 8], esi
mov eax, dword [esp + 0x14]
xor ecx, ecx
push ecx
push ecx
push 0x11
push 0xfffffffffffffffe
call eax
add esp, 0x18
pop esi
ret
Function at 0x425595
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword fs:[0x30]
mov esi, dword [eax + 8]
mov edi, dword [esi + 0x3c]
movzx ebx, word [esi + edi + 6]
movzx eax, word [esi + edi + 0x14]
mov dword [esp], eax
lea ebp, [ebx*8]
push ebp
call fcn.00448a24
add esp, 4
mov dword [0x46bb44], eax
mov dword [0x46bb48], 0
test ebx, ebx
je 0x425644
add esi, edi
mov eax, dword [esp]
add eax, esi
add eax, 0x20
lea ecx, [ebp*4]
add ecx, ebp
xor edx, edx
xor edi, edi
test byte [eax + edx + 0x1f], 0x20
je 0x42563d
mov ebx, dword [eax + edx + 4]
add ebx, dword [esi + 0x34]
mov ebp, dword [0x46bb44]
mov dword [ebp + edi*8], ebx
mov edi, dword [esi + 0x34]
add edi, dword [eax + edx + 4]
mov ebx, dword [esi + 0x38]
add edi, dword [eax + edx]
add edi, ebx
add edi, 0xffffefff
neg ebx
and ebx, edi
mov edi, dword [0x46bb44]
mov ebp, dword [0x46bb48]
mov dword [edi + ebp*8 + 4], ebx
mov edi, dword [0x46bb48]
inc edi
mov dword [0x46bb48], edi
add edx, 0x28
cmp ecx, edx
jne 0x4255ef
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0x56169c13
push 0xd5ead6c4
push dword [eax + 8]
call fcn.004285e0
mov ebx, eax
xor eax, eax
lea ebp, [esp + 8]
mov dword [ebp], eax
mov esi, 0x400
push esi
call fcn.00448a24
add esp, 4
mov edi, eax
push ebp
push esi
push eax
push 1
mov dword [esp + 0x10], 0
xor eax, eax
push eax
push 0xffffffffffffffff
call ebx
cmp eax, 0xc0000004
jne 0x4256af
add esi, esi
push esi
push edi
call fcn.00448d4e
add esp, 8
mov edi, eax
push ebp
push esi
push eax
push 1
push 0
jmp 0x42568d
test eax, eax
js 0x42570b
mov eax, dword [edi]
mov dword [esp + 4], eax
test eax, eax
je 0x42570b
add edi, 4
mov ecx, dword [0x46bb48]
xor edx, edx
mov esi, dword [0x46bb44]
xor eax, eax
inc eax
mov dword [esp], eax
test ecx, ecx
je 0x4256fa
mov ebx, dword [edi]
mov ebp, ebx
and ebp, 0xfffff000
xor eax, eax
cmp ebp, dword [esi + eax*8]
jb 0x4256f5
bt ebx, 8
jb 0x4256f5
cmp ebp, dword [esi + eax*8 + 4]
jbe 0x42570b
inc eax
cmp ecx, eax
jne 0x4256e4
add edi, 4
inc edx
cmp edx, dword [esp + 4]
jne 0x4256d4
mov dword [esp], 0
push dword [0x46bb44]
call fcn.00448680
add esp, 4
mov eax, dword [esp]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x425724
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x8c
lea esi, [ebp - 0x1c]
mov dword [esi - 8], esp
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 8], 0x469a24
mov dword [esi + 4], 0x43d610
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
mov eax, dword fs:[0x30]
mov cl, byte [eax + 2]
mov byte [ebp - 0x25], cl
mov dword [ebp - 0x2c], eax
mov byte [eax + 2], 1
xor ebx, ebx
lea edi, [ebp - 0x98]
push 0x68
push ebx
push edi
call fcn.00440700
add esp, 0xc
mov eax, 0x40000000
mov dword [edi + 0xc], eax
mov dword [edi + 0x40], eax
mov dword [esi + 0xc], ebx
push edi
call dword [0x469098]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x2c]
mov cl, byte [ebp - 0x25]
mov byte [eax + 2], cl
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword fs:[0], eax
mov eax, edx
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4257ed
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push edi
push esi
sub esp, 0x404
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
lea edi, [esp + 2]
push 0x200
push edi
push dword [eax + 8]
call dword [str.ms_my]
xor esi, esi
push esi
push esi
push 3
push esi
push esi
push 0x80000000
push edi
call dword [0x468fe0]
cmp eax, 0xffffffff
je 0x425836
push eax
call dword [0x468fd8]
jmp 0x425839
xor esi, esi
inc esi
mov eax, esi
add esp, 0x404
pop esi
pop edi
ret
Function at 0x4275e4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0xa5b5aa68
push 0xf9f77cc3
push dword [eax + 8]
call fcn.004285e0
push 0
push 0xffffffffffffffff
call eax
ret

Function at 0x427642
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 4]
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
mov edx, dword [ecx + 0xc]
mov ecx, dword [edx + 0x18]
mov edx, dword [edx + 0x20]
add edx, ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], esp
mov esi, dword [ebp - 0x10]
sub eax, esi
add eax, 0xfffffff8
cmp eax, 4
jae 0x4276e1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
lea ecx, [eax + edx]
movzx esi, word [eax + edx + 0x14]
add ecx, esi
add ecx, 0x18
movzx edx, word [eax + edx + 6]
test edx, edx
je 0x4276b9
lea esi, [edx + edx*4]
lea esi, [ecx + esi*8]
test byte [ecx + 0x27], 0x20
jne 0x4276b9
add ecx, 0x28
dec edx
jne 0x4276ab
mov ecx, esi
add eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
add ecx, eax
push ecx
push eax
call fcn.0042ab65
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
sub esp, 0xa0
jmp edx
shr eax, 2
dec eax
xor edi, edi
mov ebx, dword [esi + edi*4]
cmp ebx, ecx
jbe 0x4276f9
cmp ebx, edx
ja 0x4276f9
mov dword [esi + edi*4], 0
cmp eax, edi
je 0x427683
mov esi, dword [ebp - 0x10]
inc edi
jmp 0x4276e7
Function at 0x42aaf7
Capabilities:
Access peb ldr_data

Disassembly:
cmp byte [0x46bb5c], 0
jne 0x42ab31
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0x67b0735f
push 0x80d4b146
push dword [eax + 8]
call fcn.004285e0
mov dword [0x46bb64], eax
rdtsc
mov dword [0x46bb60], eax
mov byte [0x46bb5c], 1
push 0x46bb60
call dword [0x46bb64]
xor dword [0x46bb60], eax
ret
Function at 0x42fe65
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 8]
ret
Function at 0x433e3b
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x20], 0x35ed8cbd
mov eax, 0x35ed8cbd
mov edi, dword [ebp - 0x24]
cmp eax, 0x35ed8cbc
jle 0x433e98
cmp eax, 0x558f6da8
jg 0x433ed3
cmp eax, 0x4baa127b
jg 0x433f7e
cmp eax, 0x35ed8cbd
je 0x43401c
cmp eax, 0x4aa05dd8
jne 0x433e53
xor eax, eax
push eax
push eax
push eax
push 0x462c52
call dword [str.smj_no]
mov dword [ebp - 0x18], eax
mov eax, 0xa3449c5d
jmp 0x433e53
cmp eax, 0xc95dbb27
jle 0x433f28
cmp eax, 0xf7d0a49d
jg 0x433fab
cmp eax, 0xc95dbb28
je 0x434048
cmp eax, 0xcf3401e8
jne 0x433e53
shr edi, 1
and edi, 0x1ffff
lea eax, [edi + edi*8]
lea edi, [edi + eax*2]
jmp 0x433fd2
cmp eax, 0x60198ad5
jg 0x433fdc
cmp eax, 0x558f6da9
je 0x434031
cmp eax, 0x5632f778
jne 0x433e53
imul esi, edi, 0x50c00
mov edi, esi
shr edi, 4
push edi
push 0x5929
call fcn.0043410d
add esp, 8
mov eax, 0xbe3335e2
cmp esi, 0xe00
jb 0x433e53
mov eax, 0xcf3401e8
jmp 0x433e53
cmp eax, 0xa3449c5c
jle 0x433ff3
cmp eax, 0xa3449c5d
je 0x434065
cmp eax, 0xbe3335e2
jne 0x433e53
shr edi, 8
imul edi, edi, 0xbe
push 0x38ac
push edi
call fcn.0043410d
add esp, 8
push 0x3022
push edi
call fcn.004344b5
add esp, 8
mov eax, 0x27af8aad
cmp edi, 0x72
jge 0x433e53
jmp 0x433fd2
cmp eax, 0x4baa127c
je 0x43406f
cmp eax, 0x51a02b8c
jne 0x433e53
lea edi, [edi*4 + 0x61]
mov eax, 0x5632f778
cmp edi, 0x62
jae 0x433e53
jmp 0x433fd2
cmp eax, 0xf7d0a49e
je 0x4340aa
cmp eax, 0x27af8aad
jne 0x433e53
push 1
call dword [str.sma_no]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x14], eax
mov eax, 0x60198ad6
jmp 0x433e53
cmp eax, 0x60198ad6
je 0x4340cd
cmp eax, 0x710fb652
je 0x43405b
jmp 0x433e53
cmp eax, 0x852cc541
jne 0x4340e8
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
push dword [ebp - 0x18]
call fcn.00433318
add esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, 0x93ee3c52
jmp 0x433e53
push 0
call dword [str.sma_no]
mov dword [ebp - 0x28], eax
mov eax, 0x27af8aad
jmp 0x433e53
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
cmp eax, 0xcd03
je 0x434048
movzx eax, ax
cmp eax, 0xf0b
jne 0x43405b
mov dword [ebp - 0x1c], edi
popal
jmp 0x43404c
mov eax, 0x4aa05dd8
jmp 0x433e53
mov eax, 0x852cc541
jmp 0x433e53
imul eax, dword [ebp - 0x10], 0x9e
add eax, 0xffff9676
shr eax, 3
lea ecx, [eax + eax]
add ecx, 0xffffffa5
mov edx, eax
imul edx, eax
imul esi, edx, 0x62ef
dec esi
mov dword [ebp - 0x10], ecx
mov eax, 0x27af8aad
cmp esi, edx
je 0x433e53
mov eax, 0x558f6da9
jmp 0x433e53
mov eax, dword [ebp - 0x10]
shl eax, 0x10
add eax, 0x1a80000
and eax, 0x1ff0000
imul eax, eax, 0xd4
mov dword [ebp - 0x10], eax
mov eax, 0xc95dbb28
jmp 0x433e53
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0xcc
mov eax, 0xf7d0a49e
je 0x433e53
mov eax, 0x4baa127c
jmp 0x433e53
cmp eax, 0x93ee3c52
jne 0x433e53
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edi
push dword [ebp - 0x18]
call dword [0x46919c]
mov eax, dword [ebp - 0x30]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43c8a4
Capabilities:
Check for software breakpoints
Get os information via kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], 0xb6b84a9d
lea ecx, [eax + 0xc]
mov dword [ebp - 0x34], ecx
lea ecx, [eax + 4]
mov dword [ebp - 0x30], ecx
add eax, 8
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x3c]

Function at 0x43da3f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x46906c]
test eax, eax
je 0x43da7e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43da7e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43da7e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43da7e
cmp dword [ecx + 0x74], 0xe
jbe 0x43da7e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x44d580
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44d5ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44d5ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x456f6b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00456f76