joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40db08
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x40db11
mov eax, dword [esp + 0x2000]
add esp, 0xfffffb30
mov ebx, edx
mov esi, eax
lea edi, [esp + 0x10b4]
lea eax, [esp + 0xc14]
call fcn.0040638c
lea eax, [esp + 0xc40]
call fcn.0040638c
lea eax, [esp + 0xc6c]
call fcn.0040638c
push 0
lea ecx, [esp + 4]
mov edx, ebx
mov eax, esi
call fcn.0040574c
test al, al
jne 0x40db71
xor eax, eax
jmp 0x40dcbe
cmp byte [esp], 0
je 0x40db81
cmp byte [esp + 0xc98], 0
jne 0x40db88
xor eax, eax
jmp 0x40dcbe
mov eax, esp
call fcn.00405b5c
lea edx, [esp + 0xc98]
call fcn.00406ad8
test eax, eax
je 0x40dbb6
mov eax, esi
call fcn.00405b5c
lea edx, [esp + 0xc98]
call fcn.00406ad8
test eax, eax
je 0x40dbbd
xor eax, eax
jmp 0x40dcbe
xor ebx, ebx
mov eax, edi
mov ecx, 0x400
mov edx, esi
call fcn.0040f1bc
push ebx
push str.rtmp_d
mov eax, edi
call fcn.00405b5c
push eax
call fcn.0040f2a4
add esp, 0xc
mov eax, edi
xor edx, edx
call fcn.00406964
test al, al
je 0x40dbfb
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x40dbbf
mov eax, edi
xor edx, edx
call fcn.00406964
test al, al
je 0x40dc0f
xor eax, eax
jmp 0x40dcbe
lea eax, [esp + 0x14b4]
mov ecx, 0x400
mov edx, esi
call fcn.0040f1bc
mov eax, esp
call fcn.00405b5c
push eax
lea eax, [esp + 0x14b8]
call fcn.00405b5c
pop edx
call fcn.0040f1ac
push edi
lea ecx, [esp + 0x14b8]
push ecx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
jne 0x40dc52
xor eax, eax
jmp 0x40dcbe
lea eax, [esp + 0x18b4]
call fcn.0040dcc8
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.00406964
test al, al
jne 0x40dc7f
lea eax, [esp + 0x18b4]
xor ecx, ecx
mov edx, esi
call fcn.0040deb4
mov ebx, eax
lea eax, [esp + 0x14b4]
push eax
push edi
call sub.KERNEL32.DLL_MoveFileA
test bl, bl
je 0x40dca9
lea eax, [esp + 0x18b4]
call fcn.0040dfb8
lea eax, [esp + 0x18b4]
call fcn.0040e040
mov al, 1
push eax
lea eax, [esp + 0x18b8]
mov edx, 2
call fcn.0040dd1c
pop eax
add esp, 0x24d4
pop edi
pop esi
pop ebx
ret
Function at 0x40dd64
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x40dd87
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x40dd98
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x40dda7
or dword [ebp - 8], 2
cmp byte [ebx + 0x15], 0
je 0x40ddb1
xor eax, eax
jmp 0x40ddb6
mov eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.004052f0
test eax, eax
je 0x40dde3
test esi, esi
je 0x40dde3
cmp word [esi], 0
je 0x40dde3
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x40ddfa
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x40de13
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x40de13
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x40de7d
mov dword [ebx + 4], edi
test esi, esi
je 0x40de48
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.0040f88c
jmp 0x40de51
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x40de64
lea eax, [ebx + 0x17]
mov edx, dword [ebp - 4]
call fcn.0040f1ac
jmp 0x40de73
lea edx, [ebx + 0x17]
mov ecx, 0x10000000
mov eax, esi
call fcn.0040f7d8
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.0040df64
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40e070
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, ecx
test esi, esi
mov edi, eax
mov dword [esp], edx
je 0x40e193
mov eax, dword [edi + 0xc]
test eax, eax
je 0x40e0ab
dec eax
je 0x40e095
dec eax
je 0x40e0a1
jmp 0x40e0ab
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x40e0ab
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x40e0fd
xor ebp, ebp
cmp esi, ebp
jle 0x40e119
push 0
lea eax, [esp + 8]
push eax
mov edx, esi
sub edx, ebp
cmp edx, 0x4000
jge 0x40e0d0
mov ecx, esi
sub ecx, ebp
jmp 0x40e0d5
mov ecx, 0x4000
push ecx
mov eax, dword [esp + 0xc]
add eax, ebp
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x40e119
add ebp, 0x4000
cmp esi, ebp
jg 0x40e0b7
jmp 0x40e119
push 0
lea eax, [esp + 8]
push eax
push esi
push dword [esp + 0xc]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
jne 0x40e18f
cmp byte [edi + 0x14], 0
je 0x40e18f
cmp dword [edi + 0xc], 0
jne 0x40e18f
lea edx, [edi + 0x17]
mov eax, 0x41a484
call fcn.0040c364
test al, al
je 0x40e179
mov ecx, dword [esp + 4]
cmp ecx, esi
jae 0x40e0ab
cmp dword [esp + 4], 0
jbe 0x40e0ab
mov eax, edi
call fcn.0040e3b8
push edx
push eax
mov eax, dword [esp + 0xc]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
xor edx, edx
mov eax, edi
call fcn.0040e300
jmp 0x40e0ab
lea ecx, [edi + 0x17]
mov eax, 0x41a484
xor edx, edx
call fcn.0040c34c
jmp 0x40e18f
mov byte [edi + 8], 1
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40e280
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x40e2a7
cmp esi, 0x4e20
jle 0x40e29d
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40e2f8
mov eax, ebx
call fcn.0040e5c0
test al, al
je 0x40e2df
cmp esi, 0x4e20
jle 0x40e2df
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.0040e280
jmp 0x40e2fb
cmp dword [ebx + 0xc], 1
jne 0x40e2f3
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x40e2f3
xor eax, eax
jmp 0x40e2fb
or eax, 0xffffffff
jmp 0x40e2fb
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40f768
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x414738], 0
jne 0x40f781
call fcn.0040f348
mov dword [0x414734], eax
inc byte [0x414738]
call fcn.0040f348
sub eax, dword [0x414734]
cmp eax, 0x64
jle 0x40f7bd
cmp dword [0x4148b8], 0
je 0x40f7b8
mov eax, 0x41a484
mov edx, 0xff
call fcn.0040c500
mov eax, 0x41a484
mov edx, 0xff
call fcn.0040c4f8
call fcn.004029ac
ret
Function at 0x429c8d
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x429cf1
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x429cda
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x429cc9
xor ecx, eax
xor edx, ebx
dec edi
jne 0x429cba
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x43f0dd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43f100
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43f100
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43f10a
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43f14c
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43f1ae
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43f1a9
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43f194
test dl, dl
je 0x43f190
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43f194
add ecx, 2
add eax, 2
test dl, dl
jne 0x43f174
xor eax, eax
jmp 0x43f199
sbb eax, eax
or eax, 1
test eax, eax
je 0x43f1ba
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43f161
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x43f23f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43f262
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43f262
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43f26c
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43f2ae
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43f310
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43f30b
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43f2f6
test dl, dl
je 0x43f2f2
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43f2f6
add ecx, 2
add eax, 2
test dl, dl
jne 0x43f2d6
xor eax, eax
jmp 0x43f2fb
sbb eax, eax
or eax, 1
test eax, eax
je 0x43f31c
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43f2c3
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x43f3ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43f3d1
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43f3d1
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43f3db
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43f41d
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43f47f
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43f47a
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43f465
test dl, dl
je 0x43f461
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43f465
add ecx, 2
add eax, 2
test dl, dl
jne 0x43f445
xor eax, eax
jmp 0x43f46a
sbb eax, eax
or eax, 1
test eax, eax
je 0x43f48b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43f432
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x43f518
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43f53b
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43f53b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43f545
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43f587
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43f5e9
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43f5e4
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43f5cf
test dl, dl
je 0x43f5cb
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43f5cf
add ecx, 2
add eax, 2
test dl, dl
jne 0x43f5af
xor eax, eax
jmp 0x43f5d4
sbb eax, eax
or eax, 1
test eax, eax
je 0x43f5f5
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43f59c
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x43f68e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43f6b1
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43f6b1
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43f6bb
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43f6fd
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43f75f
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43f75a
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43f745
test dl, dl
je 0x43f741
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43f745
add ecx, 2
add eax, 2
test dl, dl
jne 0x43f725
xor eax, eax
jmp 0x43f74a
sbb eax, eax
or eax, 1
test eax, eax
je 0x43f76b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43f712
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x43f7ff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43f822
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43f822
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43f82c
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43f86e
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43f8d0
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43f8cb
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43f8b6
test dl, dl
je 0x43f8b2
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43f8b6
add ecx, 2
add eax, 2
test dl, dl
jne 0x43f896
xor eax, eax
jmp 0x43f8bb
sbb eax, eax
or eax, 1
test eax, eax
je 0x43f8dc
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43f883
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x43f96e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43f991
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43f991
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43f99b
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43f9dd
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43fa3f
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43fa3a
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43fa25
test dl, dl
je 0x43fa21
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43fa25
add ecx, 2
add eax, 2
test dl, dl
jne 0x43fa05
xor eax, eax
jmp 0x43fa2a
sbb eax, eax
or eax, 1
test eax, eax
je 0x43fa4b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43f9f2
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x43fadd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43fb00
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43fb00
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43fb0a
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43fb4c
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43fbae
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43fba9
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43fb94
test dl, dl
je 0x43fb90
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43fb94
add ecx, 2
add eax, 2
test dl, dl
jne 0x43fb74
xor eax, eax
jmp 0x43fb99
sbb eax, eax
or eax, 1
test eax, eax
je 0x43fbba
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43fb61
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x44f1b3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x44f1d6
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x44f2ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x44f2d1
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44f48a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x44f4ad
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc