joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bdbf6
Capabilities:
Encode data using base64

Disassembly:
jae 0x7351d1
sar byte [edi], 1
into
xchg byte [ebp - 0x11], bh
xlatb
xor ebx, edx
cli
sar byte [eax + ebx*8 - 0x1e0c846e], cl
ret
jae 0x7448fe
dec edi
je 0x735231
add eax, 0x5f6d63ff
add byte [edx - 0x7efad710], ah
fisttp qword [edi]
and al, 0xf9
add ebp, 4
call fcn.005c52cf
mov esi, 0x54a8fa83
lea esi, [esi + esi*8 - 0x1e631648]
lea edx, [esi + esi*8 + 0x2e1c71b2]
mov esi, dword [ebp]
add edx, edx
bt dx, dx
add dl, dl
mov dl, byte [ebp + 4]
call fcn.005efb4e
dec eax
lea esp, [esp + 0x20]
jmp fcn.005d808d
invalid
xor ebx, eax
jmp fcn.005bf199

Function at 0x5f0ede
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp], 0x5cafa312
lea esp, [esp + 0x14]
jne 0x5cc4c3
pop edi
push 0xc133ce2d
not eax
call fcn.0074a8e9
mov ecx, 0x3d3d8c26
shr cx, cl
imul ecx, ecx
movzx ecx, byte [edi]
call fcn.0060150b
adc eax, 0x248e39ee
dec edx
lea eax, fs:[eax - 0x6dd82ccd]
or ah, byte [esi]
adc al, bl
into
insb byte es:[edi], dx
invalid
mov edi, 0x3dade88e
movzx edi, byte [esi + edi*2 - 0x7b5bd11c]
xor edi, eax
dec word [esp + 0x12]
dec ecx
jmp 0x5c1a72

Function at 0x5f1c17
Capabilities:
Encode data using base64

Disassembly:
dec eax
lea esp, [esp + 0x30]
jle fcn.005bc9c2

Function at 0x5f6701
Capabilities:
Encode data using base64

Disassembly:
xor cx, 0xb508
call fcn.00796139
dec eax
mov dword [esp], 0x1128520e
rol cx, 1
add cx, 0xee21
sub dword [esp + 2], 0x810f6a0f
jnp 0x5d3510

Function at 0x7318e1
Capabilities:
Encode data using base64

Disassembly:
jo 0x5e0d4d
push edi
mov dh, 0x4b
std
dec esi
and eax, 0x38f3b47c
popal
xor dword [ebp + 0x5c], 0xb17a9d74
pushfd
je 0x731909
and al, 0xf0
jae 0x7318d5
ficomp word [edi]
cmp edi, edi
ret
inc esp
adc eax, 0x8fbdfee4
adc ebx, dword [ebp - 0x50]
mov eax, 0x5defed4a
xor edx, edx
js 0x73196a
and dword [edx + 0x4a75b3ea], edi
pop ebx
push ecx
dec edx
rcr byte [ecx - 0x51], 9
shr dword [edx - 0x1930269c], 0x8f
xchg dword [eax + edx - 0x1d], ebp
push esp
wait
inc edx
fstp xword [ebp + 0x30001c8f]
mov byte [edx], bl
mov dword [0xc549d2fd], eax
jg 0x731922
cmp dword [ebp - 0x49cdeef7], eax
movsd dword es:[edi], dword [esi]
wait
push cs
mov cl, 0x53
mov dh, 0xc7
out 0x8f, al
enter 0xffffffffffffd9a3, 0xffffffffffffffed
sub dword [ebx], ecx
fisttp word [ebp - 0x50edcd75]
mov edi, 0x61c7d974
dec ebx
cdq
invalid
cdq
sub eax, 0x59a5e48c
loope 0x73194d
ljmp 0x9472:0xa3c59fca

Function at 0x73ece9
Capabilities:
Encode data using base64

Disassembly:
push 0xe26f737
lea esp, [esp + 0x10]
je 0x796a36
Function at 0x796a23
Capabilities:
Encode data using base64

Disassembly:
push 0x412d8787
call fcn.007812e0
ret
je 0x79d4f1
mov cl, dl
setg bl
mov ebx, 0x66b9d208
cmc
rol ebx, cl
xor cl, 0x24
mov cl, byte [ebp - 1]
cmp cx, sp
jmp 0x79d4e9
ret
not ecx
jmp 0x5bafbe
mov esp, ebp
pop ebp
jmp 0x5c457c
sbb eax, eax
neg eax
jmp 0x5e66a2
xor esi, ecx
and esi, 0xff
push 0xb01eef16
mov esi, dword [esi*4 + 0x5ff640]
xor dword [esp], 0x9aa17d23
rol dword [esp], 0x7c
shr ecx, 8
push 0x2a3a0d02
rol byte [esp + 6], 0x23
xor ecx, esi
mov esi, 0xe032f1c
shl esi, 0xe9
imul si, si
movzx esi, byte [eax + esi*8 - 0x32f00000]
jb 0x7334f7
je 0x7971ec
cmp al, cl
jmp 0x7971e6
mov esp, ebp
xchg ebp, ebp
pop ebp
jmp 0x5caf0f
dec edx
mov dword [esp + 8], 0x6e95d0a4
lea esp, [esp + 0xc]
jne 0x73ecf8
jmp 0x5cc9fb
je 0x7a6745
pop edi
pop esi
mov bx, cx
or ebx, 0x8bbff0bf
cmp esi, 0x8c98c29d
pop ebx
cmp cl, al
jmp 0x7a525c
add bl, dl
test bp, ax
xor al, bl
inc edx
test al, al
jmp 0x73ed12
jbe 0x5f97cd
or eax, 0xffffffff
jmp 0x77925c
mov cl, byte [edi]
inc al
mov al, byte [esi]
inc esi
inc edi
cmp byte [ebp + 8], 0
mov byte [ebp - 1], cl
jmp 0x5c7fb3

Function at 0x798013
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xe8114b37
mov dword [ebp - 4], eax
jmp 0x5d34da

Function at 0x79a94e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x10]
je 0x5c1a85
push edi
jmp 0x5cc4b8

Function at 0x79c8c6
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xf380f484
not byte [esp + 1]
mov dword [esp], ebx
Function at 0x7a3ac3
Capabilities:
Encode data using xor

Disassembly:
call fcn.0074117f
jmp 0x736661
mov dword [esp], 0xa5343040
call fcn.007877c4
pop ebx
jns 0x7a3b1f
xor ebp, ebx
js 0x7a3b48
pop esi
add dword [ecx + 0x14948ba4], esp
test dword [eax], eax
add bl, dl
jmp 0x7a3007
sbb dl, byte [edi - 0x23410bee]
call 0x39848c6
not dword [ecx]
pop esp
and bl, 0xc0
xor byte [edx - 0x13a488aa], bh
fistp dword [edi + 0x19]
ret 0xbef9
jle 0x7a3b56
push edi
jge 0x7a3aec
add al, 0x76
and al, 0x87
inc eax
mov ebx, 0xa060898a
lodsb al, byte [esi]
loop 0x7a3b8e
pushal
mov al, byte [0x2733e2ac]
daa
mov ah, 0x18
xor al, 0x2d
dec esp
dec esp
jmp [esi + 0x4f571dac]
scasb al, byte es:[edi]
push esi
jae 0x7a3be2
clc
dec ebx
pop eax
adc al, byte [eax]
scasb al, byte es:[edi]
pop ebx
xor al, 0xff
in al, 0xf0
xchg ecx, eax
arpl word [ecx + 6], bx
sub ah, byte [esi]
mov eax, dword [0xbd10e50c]
scasd eax, dword es:[edi]
xchg ecx, eax
mov fs, word [ebp + 0xe]
push cs
dec esp
lea ecx, [ebx - 0xb]
dec ebx
cmc
inc edi
dec ecx
cmp dword [edx + edi - 0x6c], esi
cmp edx, ebx
sbb edi, dword [ecx - 0x51]
xchg edx, eax
les ebx, [ecx + 0x7c4f05df]
stosd dword es:[edi], eax
sub eax, 0x39257944
in eax, 0xd1
stosd dword es:[edi], eax
sub dword [0xdab82c12], 0xffffff9d
dec edi
ror dl, 1
std
xor eax, 0x6722951c
jge 0x7a3b92
add eax, 0xd0283bd
dec edi
mov cs, word [eax - 0xa]
stc
dec esi
xchg byte [eax + edi*8], cl
cmpsb byte [esi], byte es:[edi]
mov dword [eax - 0x6c4a9a12], edx
jo 0x7a3b70
or bl, byte [ebp + 0x7359f106]
push ebp
jge 0x7a3c00
out 6, al
cmp al, 0xcf
jns 0x7a3bea
daa
imul esi, dword [edx + 0x552c7c53], 0xd649a6cd
mov dl, 0x53
jl 0x7a3c1a
push ebp
int 0xa6
dec ecx
salc
test al, 0x61
sub edx, dword cs:[edx + 0x29ec2265]
clc
jne 0x7a3c6a
dec edx
and eax, 0xfa67cd9b
into
or byte [ebp - 0x3f70f992], dl
hlt
sbb ah, cl
je 0x7a3c68
retf
mov gs, ebx
pop esp
call [ecx]
nop
adc esp, dword [ebp + ebx - 0x1ca30447]
pushal
ret 0x392a
Function at 0x7a5646
Capabilities:
Encode data using base64

Disassembly:
mov byte [esi], al
jmp 0x5d58cc
je 0x5d58e7
inc edx
test edx, esp
cmp edx, 0xffa85731
cmp edx, 0x104
jb 0x7766ac
lea ecx, [ebp - 0x104]
cwde
push ecx
cmovns eax, esp
cbw
mov eax, dword [sym.imp.kernel32.dll_LoadLibraryA]
jmp 0x73b278
call fcn.005d6729
mov esi, 0x290c4cb0
movzx esi, word [esi + edi - 0x290c4cb0]
push 0xd590a402
add edi, 2
jmp 0x776661
ret
inc eax
sbb dh, 0x84
inc esp
xor dl, dh
jmp 0x732d4b
dec eax
lea esi, [esp + esi + 0x10]
push 0x8938f712
call fcn.0072fda0
jmp 0x78d5bc
mov esp, ebp
xchg ebp, ebp
bswap bp
pop ebp
jmp 0x5db8eb
call eax
pop edi
mov si, 0xcf36
pop esi
jmp 0x736666
add al, dl
cmc
cmp ch, dh
stc
xor al, byte [edi + esi]
jmp 0x5ba75b
push 0x42864bb
xor si, bx
inc si
or word [esp + 3], 0xa737
and byte [esp + 3], 0x3a
ror si, 1
sub si, 0x490c
call fcn.0074aff8
push ebp
mov ebp, esp
shl cl, cl
sal cl, cl
lea esp, [esp - 0x104]
push esi
cmp bp, 0x278a
push edi
mov edi, eax
movzx esi, bx
cmc
lea eax, [ebp - 0x104]
mov cl, al
sub edx, edx
sub edi, eax
mov eax, 0x66b9d208
mov cl, dl
rol eax, cl
cmp sp, sp
lea esi, [ebp + edx - 0x104]
cmp bx, 0xf337
jmp 0x743ff8
jmp 0x78f2af
dec eax
sal edx, cl
jmp 0x5d831d
push 0xa13e9c8c
inc eax
not dh
dec eax
rol dword [esp], 0x65
jae 0x732d3f
Function at 0x428c40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xd06fb0]
xor edx, edx
cmp eax, edx
jne 0x428c66
xor eax, eax
mov byte [eax + 0xd06eb0], al
inc eax
cmp eax, 0x100
jl 0x428c4e
mov dword [0xd06fb0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xd06eb0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x428cf7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x428cca
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x428c98
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x428d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x428dc3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x428daa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x42d391
cmp eax, 8
jg 0x42d391
cmp dword [esp + 0x8c], 2
jl 0x42d391
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x42d391
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x42d391
mov eax, dword [esp + 0x80]
test eax, eax
je 0x42d1f7
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x42d37a
mov ebp, dword [0x4a55cc]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x42d229
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x42d361
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x42d249
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [0x4a55b8]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x42d288
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x4a55c0]
lea ecx, [esp + 0x28]
push ecx
call dword [0x4a5600]
test eax, eax
jne 0x42d348
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.0042c780
cmp eax, 1
jne 0x42d372
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.0042d030
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x42d23d
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x42d37a
jmp 0x42d214
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.0042c380
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c
Function at 0x42fe10
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x42ffa8
cmp ebp, ebx
jle 0x42ffa8
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x42fe6e
dec eax
or eax, 0xfffffff8
inc eax
je 0x42fe75
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, 0x80000001
jns 0x42fe84
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x42fe8b
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.00491e65
add esp, 4
cmp eax, ebx
je 0x42feac
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.00491e65
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x42ff9e
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x42ff85
mov al, byte [edx]
cmp al, 0xc0
jbe 0x42ff71
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x42ff66
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x42ff74
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x42ff74
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x42ff10
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x42ff01
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x437c10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4a1da8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x74]
push edi
push eax
mov eax, dword [esp + 0x74]
push ecx
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.00438790
lea edx, [esp + 0x18]
push eax
push edx
call dword [0x4a558c]
mov eax, dword [esp + 0x18]
xor edi, edi
xor ecx, ecx
cmp eax, edi
setl cl
dec ecx
xor edx, edx
and ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, edi
mov dword [esp + 0x18], ecx
setl dl
dec edx
and edx, eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x20], edx
call dword [0x4a5600]
test eax, eax
je 0x437cb9
mov eax, dword [esp + 0x6c]
push ebx
mov ebx, eax
xor ecx, ecx
xor edx, edx
xor esi, esi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004378a0
mov edx, eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push ecx
push eax
lea eax, [esp + 0x20]
push eax
call dword [0x4a55cc]
push edi
lea ecx, [esp + 0x4c]
call fcn.00498c8f
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x70], edi
call fcn.0044e450
mov edx, dword [esp + 0x5c]
add esp, 0xc
lea ecx, [esp + 0x18]
push 2
push ecx
push edx
call dword [0x4a5124]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x38]
push eax
push ecx
call dword [0x4a5628]
lea edx, [esp + 0x38]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
call dword [0x4a55c0]
mov esi, dword [esp + 0x6c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, esi
mov dword [esp + 0x64], 0xffffffff
mov dword [edx], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x48]
call fcn.00498d01
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14
Function at 0x4381f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a1dd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push esi
push edi
mov esi, ecx
call fcn.00435d30
mov ebx, eax
test ebx, ebx
mov dword [esp + 0xc], ebx
jne 0x438249
mov eax, dword [esp + 0x68]
xor ecx, ecx
mov ebx, eax
xor edx, edx
xor esi, esi
xor edi, edi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
push ebp
mov ecx, ebx
call fcn.004330c0
mov ebp, dword [esp + 0x70]
mov edi, eax
add edi, ebp
mov ecx, ebx
mov dword [esp + 0x28], edi
call fcn.004330b0
mov edx, dword [esp + 0x74]
mov ecx, esi
add eax, edx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
call fcn.004378a0
mov ebp, dword [eax]
lea edx, [esp + 0x38]
push edx
mov ecx, dword [eax + 4]
mov eax, dword [esi + 0x1c]
push eax
mov dword [esp + 0x24], ecx
call dword [0x4a5628]
push 0
lea ecx, [esp + 0x4c]
call fcn.00498c8f
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x70], 0
call fcn.0044e450
add esp, 0xc
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x18]
call fcn.00435750
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x38]
push 2
push edx
push eax
mov byte [esp + 0x70], 1
call dword [0x4a5128]
mov ecx, ebx
call fcn.00433030
mov ebx, eax
mov eax, edi
cmp eax, ebx
jge 0x438314
push edi
mov ecx, esi
call fcn.00435860
push eax
push ebp
mov ecx, esi
call fcn.00435a20
cmp eax, dword [esp + 0x40]
jg 0x438310
inc edi
mov ebp, eax
cmp edi, ebx
jl 0x4382ee
mov eax, ebx
jmp 0x43831a
cmp edi, ebx
jl 0x438318
mov eax, ebx
jmp 0x43831a
mov eax, edi
lea ecx, [eax - 1]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jle 0x43832b
mov dword [esp + 0x30], eax
jmp 0x438336
cmp edi, ebx
jl 0x438331
mov edi, ebx
dec edi
mov dword [esp + 0x30], edi
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
call fcn.00432ff0
mov ebp, eax
mov eax, dword [esp + 0x2c]
cmp eax, ebp
mov edi, eax
jge 0x43837d
push edi
mov ecx, esi
call fcn.00435780
push eax
push ebx
mov ecx, esi
call fcn.00435b50
cmp eax, dword [esp + 0x44]
jg 0x438375
inc edi
mov ebx, eax
cmp edi, ebp
jl 0x43834f
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x438387
cmp edi, ebp
jl 0x438381
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x438387
mov eax, dword [esp + 0x2c]
mov ecx, edi
dec ecx
cmp eax, ecx
jle 0x438390
mov ecx, eax
jmp 0x438399
cmp edi, ebp
jl 0x438396
mov edi, ebp
lea ecx, [edi - 1]
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x28]
mov edx, esi
mov dword [edx], edi
mov dword [edx + 4], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x14]
call fcn.00435770
lea ecx, [esp + 0x48]
mov dword [esp + 0x64], 0xffffffff
call fcn.00498d01
mov ecx, dword [esp + 0x5c]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
Function at 0x43e3c0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a2288
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x43e3f9
inc eax
mov dword [esi + 0x10], eax
jmp 0x43e50c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x43e40d
mov eax, 0xffffffc7
jmp 0x43e50e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x43e41e
cmp dword [esi + 8], eax
jne 0x43e40d
cmp dword [esi + 8], eax
jne 0x43e437
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x43e437
mov eax, 0xffffffc7
jmp 0x43e50e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x43e44b
push eax
mov ecx, ebx
call fcn.0043dbf0
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.0040a7a0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x43e47c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.0040a7c0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0043d360
test eax, eax
mov dword [esp + 0x38], eax
je 0x43e4af
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0xcce238
call fcn.0040a9a0
mov eax, dword [esp + 0x38]
jmp 0x43e50e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0043e220
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x43e4f3
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0043e240
mov esi, eax
test esi, esi
jne 0x43e523
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0043e220
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x43e4c5
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0xcce238
call fcn.0040a9a0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0xcce238
call fcn.0040a9a0
mov eax, esi
jmp 0x43e50e