joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e18
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
test edx, edx
je 0x405e40
mov edi, 0x1505
xor esi, esi
movzx ebx, byte [ecx + esi]
test ebx, ebx
je 0x405e47
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp edx, esi
jne 0x405e26
jmp 0x405e49
mov eax, 0x1505
jmp 0x405e49
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x40619a
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
xor edi, edi
lea esi, [ebp - 0x3c]
mov dword [esi], edi
lea ebx, [ebp - 0x38]
mov dword [ebx], edi
call fcn.00403a5a
push ebx
push esi
push dword [ebp + 8]
call fcn.00408f28
add esp, 0xc
call fcn.00403a5a
push dword [esi]
call fcn.00404ecd
add esp, 4
mov esi, eax
call fcn.00403a5a
push esi
call fcn.0040509e
add esp, 4
mov esi, eax
call fcn.00403a5a
push 0x4410dc
call fcn.0041f084
add esp, 4
push eax
push esi
call fcn.0040514d
add esp, 8
mov esi, eax
mov eax, 0x200
lea ebx, [ebp - 0x24]
mov dword [ebx], eax
push eax
call fcn.0042c9f4
add esp, 4
mov dword [ebp - 0x14], eax
call fcn.00403a5a
push 0x441100
push 0xe8ff1073
call fcn.004204d4
add esp, 8
push edi
push edi
push ebx
push dword [ebp - 0x14]
push 1
push edi
push esi
call eax
call fcn.00403a5a
mov eax, dword [ebp + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0xd], al
mov dword [ebp - 0x20], 0xec1ae820
mov eax, 0xec1ae820
mov edi, dword [ebp - 0x2c]
cmp eax, 0x25e6dbdd
jg 0x40629b
cmp eax, 0xec1ae81f
jle 0x4062f8
cmp eax, 0xec1ae820
je 0x406330
cmp eax, 0xf9b8cbef
jne 0x40625b
shl edi, 0x11
add edi, 0xffffff20
push edi
push 0x60b
call fcn.00405202
add esp, 8
jmp 0x406341
cmp eax, 0x25e6dbde
je 0x4062e0
cmp eax, 0x6bc14ec9
je 0x4062cd
cmp eax, 0x74d3974c
jne 0x40625b
mov ecx, dword [ebp - 0x18]
movzx ecx, word [ecx]
cmp ecx, 0xcd03
je 0x4062e0
movzx ecx, cx
cmp ecx, 0xf0b
jne 0x406356
mov dword [ebp - 0x1c], edi
popal
jmp 0x4062d1
mov eax, dword [ebp - 0x28]
shl eax, 0x14
add eax, 0xfff820a8
mov dword [ebp - 0x28], eax
mov eax, 0x6bc14ec9
jmp 0x40625b
cmp eax, 0xdbb36fbb
jne 0x40634b
shr edi, 3
and edi, 0xfffffffc
mov esi, edi
shl esi, 8
sub esi, edi
push 0x37bf
push esi
push 0x2087
push 0x1d67
call fcn.00405f88
add esp, 0x10
mov eax, 0xf9b8cbef
mov edi, esi
jmp 0x40625b
mov cl, byte [ebp - 0xd]
mov eax, 0x6bc14ec9
cmp cl, 0xcc
je 0x40625b
mov eax, 0x74d3974c
jmp 0x40625b
cmp eax, 0xb9a360cd
jne 0x40625b
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], edi
push 0x200
call fcn.0042c9f4
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x14]
add eax, 5
mov edi, dword [ebp - 0x24]
add edi, 0xfffffffb
push edi
push eax
push esi
call fcn.00424800
add esp, 0xc
lea eax, [ebp - 0x34]
mov dword [eax], edi
mov dword [eax + 4], esi
xor ebx, ebx
lea edi, [ebp - 0x44]
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.00403a5a
push 0x441100
push 0x864087d1
call fcn.004204d4
add esp, 8
push edi
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x34]
push ecx
call eax
call fcn.00403a5a
mov eax, dword [edi + 4]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [edi]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push esi
call fcn.0042c64b
add esp, 4
push dword [ebp - 0x14]
call fcn.0042c64b
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4063e4
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], 0x30dfb435
mov eax, 0x30dfb435
cmp eax, 0x525c5813
jg 0x40648f
cmp eax, 0x143681b
jle 0x4064ad
cmp eax, 0x143681c
je 0x4064c4
cmp eax, 0x30dfb435
jne 0x4063f9
push 2
push 0x104
call fcn.0042bc6e
add esp, 8
mov dword [ebp - 0x14], eax
call fcn.00403a5a
mov eax, dword [ebp + 8]
push dword [eax + 4]
push dword [ebp - 0x14]
mov esi, dword [0x44c104]
call esi
call fcn.00403a5a
push 0x441118
call fcn.0041f8d0
add esp, 4
push eax
push dword [ebp - 0x14]
call esi
call fcn.00403a5a
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0xcc
mov eax, 0x5de49fb8
je 0x4063f9
mov eax, 0x143681c
jmp 0x4063f9
cmp eax, 0x525c5814
je 0x406539
cmp eax, 0x5de49fb8
je 0x4064db
cmp eax, 0x6cf13131
je 0x406504
jmp 0x4063f9
cmp eax, 0xafff14e8
je 0x4064e8
cmp eax, 0x8172cf31
jne 0x4063f9
jmp 0x40654f
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
cmp eax, 0xf0b
je 0x4064e8
movzx eax, ax
cmp eax, 0xcd03
jne 0x406504
popal
jmp 0x4064dc
mov eax, dword [ebp - 0x10]
mov ecx, 0x7ffffe0
and eax, ecx
add eax, eax
add eax, 0x7e
mov dword [ebp - 0x10], eax
mov eax, 0x5de49fb8
jmp 0x4063f9
mov eax, dword [ebp - 0x10]
lea edx, [eax - 0x52]
mov ecx, edx
imul ecx, edx
imul esi, ecx, 0x6d87
shl edx, 6
lea eax, [edx + eax*2]
add eax, 0xffffff5c
dec esi
shr eax, 8
and eax, 0xffffffc0
mov dword [ebp - 0x10], eax
mov eax, 0x143681c
cmp esi, ecx
je 0x4063f9
jmp 0x406545
mov eax, dword [ebp - 0x10]
shl eax, 0xf
or eax, 0x23
mov dword [ebp - 0x10], eax
mov eax, 0x8172cf31
jmp 0x4063f9
mov dword [ebp - 0x1c], eax
push 2
push 0x104
call fcn.0042bc6e
add esp, 8
mov esi, eax
mov ebx, dword [ebp + 8]
push dword [ebx]
push eax
mov edi, dword [0x44c104]
call edi
push 0x441172
push esi
call edi
call fcn.00403a5a
push dword [ebx + 8]
push esi
call edi
push 0x441176
call fcn.0041f8d0
add esp, 4
push eax
push esi
call edi
call fcn.00403a5a
push dword [ebp + 0x10]
push esi
call edi
call fcn.00403a5a
push 0x4411a8
call fcn.0041f8d0
add esp, 4
push dword [ebp + 0x14]
push 0
push esi
push eax
push dword [ebp - 0x14]
call fcn.0040a90b
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408f28
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], 0x30dfb435
mov eax, 0x30dfb435
cmp eax, 0x30dfb434
jg 0x408f80
cmp eax, 0xafff14e8
je 0x409014
cmp eax, 0x143681c
jne 0x40904c
mov ecx, dword [ebp - 0x18]
movzx ecx, word [ecx]
cmp ecx, 0xf0b
je 0x409014
movzx ecx, cx
cmp ecx, 0xcd03
je 0x40903f
jmp 0x409057
cmp eax, 0x5de49fb8
je 0x40903f
cmp eax, 0x30dfb435
jne 0x408f3d
push dword [ebp + 8]
call fcn.00408a8c
add esp, 4
mov dword [ebp - 0x10], eax
push 1
push 8
call fcn.0042bc6e
add esp, 8
mov dword [ebp - 0x14], eax
mov edi, 0x18
push edi
call fcn.0042c9f4
add esp, 4
mov esi, eax
push 0x442dbe
push 0x8e2e05fe
call fcn.004204d4
add esp, 8
push 5
push edi
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call eax
mov eax, dword [esi + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push eax
call fcn.0042c9f4
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0xcc
mov eax, 0x5de49fb8
je 0x408f3d
mov eax, 0x143681c
jmp 0x408f3d
mov eax, dword [ebp - 0x20]
shr eax, 1
mov dword [ebp - 0x20], eax
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x7bbf
dec edx
mov eax, 0x143681c
cmp edx, ecx
je 0x408f3d
mov eax, 0x5de49fb8
jmp 0x408f3d
popal
jmp 0x409040
cmp eax, 0x8172cf31
jne 0x408f3d
mov dword [ebp - 0x1c], eax
mov esi, 0x442dbe
push esi
push 0x7c6afafe
call fcn.004204d4
add esp, 8
xor ecx, ecx
push ecx
push ecx
mov edx, dword [ebp + 0x10]
push dword [edx]
mov edx, dword [ebp + 0xc]
push dword [edx]
push dword [ebp - 0x14]
push ecx
push ecx
push ecx
push dword [ebp - 0x10]
call eax
push esi
push 0xee81f141
call fcn.004204d4
add esp, 8
push dword [ebp - 0x10]
call eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b898
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x40b997
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x40b990
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebp, esi
sub ebp, eax
xor edx, edx
cmp ebp, 8
mov dword [esp], esi
jb 0x40b941
xor esi, esi
mov eax, esi
movzx edx, byte [ebx + esi]
add edx, edi
add ecx, edx
movzx esi, byte [ebx + esi + 1]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 2]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 3]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 4]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 5]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 6]
add edx, esi
add ecx, edx
movzx edi, byte [ebx + eax + 7]
add edi, edx
add ecx, edi
lea esi, [eax + 8]
add eax, 0xf
cmp eax, ebp
jb 0x40b8e1
mov edx, ebp
and edx, 0x1ff8
add ebx, esi
mov esi, dword [esp]
mov eax, ebp
sub eax, edx
jbe 0x40b95b
xor edx, edx
movzx esi, byte [ebx + edx]
add edi, esi
add ecx, edi
inc edx
cmp eax, edx
jne 0x40b949
add ebx, eax
mov esi, dword [esp]
mov eax, edi
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov eax, ecx
mov edx, 0x80078071
mul edx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, ebp
mov ebp, 0x15b0
jne 0x40b8d5
shl ecx, 0x10
or ecx, edi
jmp 0x40b99a
xor ecx, ecx
inc ecx
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40b9a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
not ebx
cmp ecx, 4
jb 0x40ba19
mov eax, 0xff
mov esi, ebx
shr esi, 8
movzx edi, byte [edx]
and ebx, eax
xor ebx, edi
xor esi, dword [ebx*4 + 0x442de8]
mov edi, esi
shr edi, 8
movzx ebx, byte [edx + 1]
and esi, eax
xor esi, ebx
xor edi, dword [esi*4 + 0x442de8]
mov esi, edi
shr esi, 8
movzx ebx, byte [edx + 2]
and edi, eax
xor edi, ebx
xor esi, dword [edi*4 + 0x442de8]
mov ebx, esi
shr ebx, 8
movzx edi, byte [edx + 3]
and esi, eax
xor esi, edi
xor ebx, dword [esi*4 + 0x442de8]
add edx, 4
add ecx, 0xfffffffc
cmp ecx, 3
ja 0x40b9bf
test ecx, ecx
je 0x40ba3d
xor esi, esi
mov eax, ebx
shr eax, 8
movzx edi, byte [edx + esi]
movzx ebx, bl
xor ebx, edi
xor eax, dword [ebx*4 + 0x442de8]
inc esi
mov ebx, eax
cmp ecx, esi
jne 0x40ba21
jmp 0x40ba3f
mov eax, ebx
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x4127ea
Capabilities:
Check for software breakpoints
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
movzx eax, word [ebp + 8]
mov word [ebp - 0x12], ax
mov dword [ebp - 0x24], 0x30dfb435
mov eax, 0x30dfb435
mov edi, dword [ebp - 0x28]
cmp eax, 0x39fbe174
jle 0x412836
cmp eax, 0x5de49fb7
jg 0x41289d
cmp eax, 0x39fbe175
je 0x412914
cmp eax, 0x525c5814
je 0x412950
jmp 0x412810
cmp eax, 0x143681b
jle 0x4128ff
cmp eax, 0x143681c
je 0x412926
cmp eax, 0x30dfb435
jne 0x412810
push 0x77
push 6
xor eax, eax
push eax
push eax
call fcn.00412212
add esp, 0x10
mov esi, eax
push 8
call fcn.0042c9f4
add esp, 4
movzx ecx, word [ebp - 0x12]
mov word [eax + 4], cx
mov dword [eax], esi
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], eax
mov dword [ecx], esi
mov eax, dword [ebp + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0xcc
mov eax, 0x5de49fb8
je 0x412810
jmp 0x41291c
cmp eax, 0x5de49fb8
je 0x41293d
cmp eax, 0x6cf13131
jne 0x412810
imul esi, edi, 0x5c0
mov edi, esi
shr edi, 0x13
push 0x2299
push 0x13cd
push dword [ebp - 0x28]
push edi
push 0x47c5
call fcn.00410f14
add esp, 0x14
push edi
push 0x1736
push 0xdf8
call fcn.004103ed
add esp, 0xc
mov eax, 0x39fbe175
cmp esi, 0x5900000
jae 0x412810
jmp 0x41291c
cmp eax, 0x8172cf31
jne 0x41296e
imul eax, dword [ebp - 0x10], 0x58a400
add eax, 0xfffffee9
jmp 0x412961
shr edi, 1
imul edi, edi, 0x9e34
mov eax, 0x143681c
jmp 0x412810
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
cmp eax, 0xf0b
je 0x41293d
movzx eax, ax
cmp eax, 0xcd03
jne 0x412950
mov dword [ebp - 0x20], edi
popal
jmp 0x412941
imul eax, dword [ebp - 0x10], 0x1f00
add eax, 0xfff8f99f
shr eax, 1
add eax, 0x11
mov dword [ebp - 0x10], eax
mov eax, 0xafff14e8
jmp 0x412810
cmp eax, 0xafff14e8
jne 0x412810
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00416cc4
Function at 0x41298b
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x20], 0x8df67443
mov dword [ebp - 0x14], 0x927b6d05
cmp dword [ebp + 0x14], 0
je 0x4129af
mov dword [ebp - 0x14], 0xa64c72d2
mov eax, 0x8df67443
mov edi, dword [ebp - 0x24]
cmp eax, 0xde8dcad0
jg 0x4129e8
cmp eax, 0xbc090d01
jle 0x412a2d
cmp eax, 0xda35ffc2
jg 0x412a75
cmp eax, 0xbc090d02
je 0x412b88
cmp eax, 0xcc362a7d
je 0x412af8
jmp 0x4129b7
cmp eax, 0x2752c168
jle 0x412a4f
cmp eax, 0x5df9003b
jg 0x412ac4
cmp eax, 0x2752c169
je 0x412b9b
cmp eax, 0x3eb92da4
jne 0x4129b7
imul edi, edi, 0x2166
add edi, 0xffffff5d
push 0x2e7d
push edi
call fcn.00411ee5
add esp, 8
mov eax, 0xa64c72d2
jmp 0x4129b7
cmp eax, 0x927b6d04
jg 0x412b5c
cmp eax, 0x8df67443
je 0x412bbc
cmp eax, 0x901d2ac4
je 0x412aa6
jmp 0x4129b7
cmp eax, 0xde8dcad1
je 0x412bd2
cmp eax, 0x5ec6b79
je 0x412c00
cmp eax, 0x25574862
je 0x412b28
jmp 0x4129b7
cmp eax, 0xda35ffc3
je 0x412c13
cmp eax, 0xdcf2ba7d
jne 0x4129b7
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
cmp eax, 0xcd03
je 0x412af8
movzx eax, ax
cmp eax, 0xf0b
jne 0x412b28
mov eax, dword [ebp - 0x10]
shl eax, 5
and eax, 0xfffffe0
imul eax, eax, 0x9c
add eax, 0x114a8
mov dword [ebp - 0x10], eax
jmp 0x412c09
cmp eax, 0x5df9003c
je 0x412c26
cmp eax, 0x600ad2e7
jne 0x4129b7
imul edi, edi, 0x8eca0000
mov eax, 0xda35ffc3
cmp edi, 0x1f
jge 0x4129b7
mov eax, 0x3eb92da4
jmp 0x4129b7
mov eax, dword [ebp - 0x10]
shr eax, 0xa
lea ecx, [eax + eax*2]
add ecx, 0x81
mov edx, eax
imul edx, eax
imul esi, edx, 0x6a8f
dec esi
mov dword [ebp - 0x10], ecx
mov eax, 0x2752c169
cmp edx, esi
je 0x4129b7
jmp 0x412c09
push dword [ebp - 0x28]
mov esi, dword [ebp + 8]
push dword [esi]
call fcn.00411aa3
add esp, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [esi]
call fcn.00412184
add esp, 0xc
push dword [esi]
call fcn.00411f31
add esp, 4
mov eax, 0x927b6d05
jmp 0x4129b7
cmp eax, 0xa64c72d2
jne 0x412c5f
mov eax, dword [ebp + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0xcc
mov eax, 0xbc090d02
je 0x4129b7
mov eax, 0xde8dcad1
jmp 0x4129b7
mov dword [ebp - 0x1c], edi
popal
jmp 0x412b8c
shl edi, 7
or edi, 0x6d
mov eax, 0xa64c72d2
cmp edi, 0x83
jae 0x4129b7
mov eax, 0x600ad2e7
jmp 0x4129b7
push dword [ebp + 0xc]
call fcn.0041231b
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
jmp 0x4129b7
mov eax, dword [ebp - 0x10]
mov ecx, 0xb7
add eax, ecx
mov ecx, eax
imul ecx, eax
imul edx, ecx, 0x4a5f
shr eax, 2
dec edx
add eax, 0xd
mov dword [ebp - 0x10], eax
mov eax, 0xa64c72d2
cmp edx, ecx
je 0x4129b7
jmp 0x412c1c
shr edi, 2
and edi, 0x3ffffe00
mov eax, 0xbc090d02
jmp 0x4129b7
shl edi, 2
and edi, 0x1ffffc
mov eax, 0xdcf2ba7d
jmp 0x4129b7
mov eax, dword [ebp - 0x10]
mov ecx, 0xc7
add ecx, eax
imul ecx, ecx
imul edx, ecx, 0x8733
imul eax, eax, 0xc7
dec edx
add eax, 0x983c
mov dword [ebp - 0x10], eax
mov eax, 0xd7ffe92d
cmp ecx, edx
je 0x4129b7
mov eax, 0x25574862
jmp 0x4129b7
cmp eax, 0x927b6d05
jne 0x4129b7
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4156f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push esi
sub esp, 0x2cc
mov esi, esp
mov dword [esi], 0x10010
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0x97baff8d
push 0x5451bdca
push dword [eax + 8]
call fcn.00418f7c
push esi
push 0xfffffffffffffffe
call eax
test byte [esi + 0x18], 0x55
setne cl
test eax, eax
setns al
and al, cl
movzx eax, al
add esp, 0x2cc
pop esi
ret
Function at 0x415802
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2e8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 8]
mov dword [esp + 8], eax
lea edi, [esp + 0x1c]
mov dword [edi], 0x10010
mov al, byte [0x44eb30]
mov byte [esp + 3], al
mov dword [esp + 0x10], 0x30dfb435
mov ecx, 0x30dfb435
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov ebp, 0xff00ff00
cmp ecx, 0x39fbe174
jg 0x415891
cmp ecx, 0xe417845b
jle 0x4158e8
cmp ecx, 0xe417845c
je 0x415940
cmp ecx, 0x143681c
je 0x41595f
cmp ecx, 0x30dfb435
jne 0x41584c
cmp byte [esp + 3], 0
mov ecx, 0x143681c
je 0x41584c
jmp 0x415955
cmp ecx, 0x6cf13130
jg 0x415905
cmp ecx, 0x39fbe175
je 0x415998
cmp ecx, 0x5de49fb8
jne 0x415a31
mov dword [esp + 0x1c], 0x10010
push 0x97baff8d
push 0x5451bdca
push dword [esp + 0x10]
call fcn.00418f7c
push edi
push 0xfffffffffffffffe
call eax
mov ecx, 0x8172cf31
test eax, eax
jns 0x41584c
mov ecx, 0x39fbe175
jmp 0x41584c
cmp ecx, 0x8172cf31
je 0x4159cc
cmp ecx, 0xafff14e8
je 0x415a3f
jmp 0x41584c
cmp ecx, 0x6cf13131
je 0x4159fd
cmp ecx, 0x73e5f87a
jne 0x41584c
add ebx, 0xfffffe64
call fcn.00416c0c
mov ecx, 0x5de49fb8
cmp ebx, 0x4a
jge 0x41584c
mov ecx, 0x8172cf31
jmp 0x41584c
shl ebx, 9
or ebx, 2
imul eax, ebx, 0x628
shr eax, 0xf
imul ebx, eax, 0xe2
mov ecx, 0x5de49fb8
jmp 0x41584c
push 0x30a1d552
push 0x1bf1bb26
push dword [esp + 0x10]
call fcn.00418f7c
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
push edi
push 0xfffffffffffffffe
call eax
mov byte [0x44eb30], 1
mov ecx, 0xafff14e8
jmp 0x41584c
mov eax, dword [esp + 4]
shr eax, 0xc
lea edx, [eax + 0x70]
imul edx, edx
add eax, 0x146
imul esi, edx, 0x37f3
shr eax, 1
dec esi
mov dword [esp + 4], eax
mov ecx, 0x5de49fb8
cmp esi, edx
je 0x4159c5
mov ecx, 0x525c5814
xor esi, esi
jmp 0x41584c
mov eax, dword [esp + 0x20]
xor eax, ebp
mov ecx, dword [esp + 0x24]
xor ecx, ebp
or ecx, eax
mov eax, dword [esp + 0x28]
xor eax, ebp
or eax, ecx
mov ecx, dword [esp + 0x2c]
xor ecx, ebp
xor edx, edx
or ecx, eax
setne dl
mov dword [esp + 0x18], edx
mov ecx, 0x6cf13131
jmp 0x41584c
mov eax, dword [esp + 4]
lea edx, [eax - 0x51]
imul edx, edx
imul esi, edx, 0x2449
add eax, 0xfffffe38
dec esi
shr eax, 0xf
mov dword [esp + 4], eax
mov ecx, 0xe417845c
cmp esi, edx
je 0x415a28
mov ecx, 0x525c5814
mov esi, dword [esp + 0x18]
jmp 0x41584c
cmp ecx, 0x525c5814
jne 0x41584c
jmp 0x415a7b
mov ebp, esi
mov esi, edi
mov eax, dword [esp + 4]
lea edx, [eax + 0x43]
imul edx, edx
imul edi, edx, 0x1947
dec edi
mov ecx, eax
shl ecx, 6
add eax, ecx
add eax, 0x555
mov dword [esp + 4], eax
mov ecx, 0x143681c
cmp edi, edx
je 0x415a72
mov ecx, 0x5de49fb8
mov edi, esi
mov esi, ebp
jmp 0x415847
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], esi
mov eax, esi
add esp, 0x2e8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x416b50
Capabilities:
Access peb ldr_data

Disassembly:
push edi
push esi
push eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0x512d126e
push 0x10eadba5
push dword [eax + 8]
call fcn.00418f7c
xor esi, esi
mov edi, esp
mov dword [edi], esi
push esi
push 4
push edi
push 7
push 0xffffffffffffffff
call eax
xor eax, eax
cmp dword [edi], esi
setne al
add esp, 4
pop esi
pop edi
ret

Function at 0x416b8e
Capabilities:
Access peb ldr_data

Disassembly:
push edi
push esi
push eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0x5bbee42f
push 0x3460fc94
push dword [eax + 8]
call fcn.00418f7c
xor esi, esi
mov edi, esp
mov dword [edi], esi
push esi
push 4
push edi
push 0x1e
push 0xffffffffffffffff
call eax
xor eax, eax
cmp dword [edi], esi
setne al
add esp, 4
pop esi
pop edi
ret

Function at 0x416bcc
Capabilities:
Access peb ldr_data

Disassembly:
push esi
push eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0x6089eda1
push 0x1df9c959
push dword [eax + 8]
call fcn.00418f7c
mov esi, esp
mov dword [esi], 1
push 0
push 4
push esi
push 0x1f
push 0xffffffffffffffff
call eax
xor eax, eax
cmp dword [esi], 0
sete al
add esp, 4
pop esi
ret

Function at 0x416c0c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov ebp, dword [eax + 8]
push 0x92d66e1f
push 0x74ec8bbf
push ebp
call fcn.00418f7c
mov edi, eax
push 0xc5b1ad71
push 0x53cd3e2f
push ebp
call fcn.00418f7c
mov esi, eax
lea eax, [esp + 4]
mov dword [eax], 0x18
xor ebx, ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ecx, esp
push ebx
push eax
push 0x1f000f
push ecx
call edi
test eax, eax
js 0x416cba
push 0x98ef17af
push 0x1423832d
push ebp
call fcn.00418f7c
mov ebx, eax
mov ebp, 0x160
push ebp
call fcn.0042c9f4
add esp, 4
mov edi, eax
push 0
push ebp
push eax
push 2
push dword [esp + 0x10]
call ebx
xor ebx, ebx
test eax, eax
js 0x416cac
cmp dword [edi + 8], 1
setne bl
push edi
call fcn.0042c64b
add esp, 4
push dword [esp]
call esi
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x417aef
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0x326481d8
push 0x7808e87a
push dword [eax + 8]
call fcn.00418f7c
xor ecx, ecx
push ecx
push ecx
push 0x11
push 0xfffffffffffffffe
call eax
ret

Function at 0x417b18
Capabilities:
Access peb ldr_data

Disassembly:
push esi
push eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0x82e3364f
push 0xd2040c32
push dword [eax + 8]
call fcn.00418f7c
mov esi, esp
mov word [esi], 0
push 0
push 2
push esi
push 0x23
call eax
xor eax, eax
cmp byte [esi + 1], 0
sete al
add esp, 4
pop esi
ret

Function at 0x417b56
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword fs:[0x30]
mov esi, dword [eax + 8]
mov edi, dword [esi + 0x3c]
movzx ebx, word [esi + edi + 6]
movzx eax, word [esi + edi + 0x14]
mov dword [esp], eax
lea ebp, [ebx*8]
push ebp
call fcn.0042c9f4
add esp, 4
mov dword [0x44eb34], eax
mov dword [0x44eb38], 0
test ebx, ebx
je 0x417c05
add esi, edi
mov eax, dword [esp]
add eax, esi
add eax, 0x20
lea ecx, [ebp*4]
add ecx, ebp
xor edx, edx
xor edi, edi
test byte [eax + edx + 0x1f], 0x20
je 0x417bfe
mov ebx, dword [eax + edx + 4]
add ebx, dword [esi + 0x34]
mov ebp, dword [0x44eb34]
mov dword [ebp + edi*8], ebx
mov edi, dword [esi + 0x34]
add edi, dword [eax + edx + 4]
mov ebx, dword [esi + 0x38]
add edi, dword [eax + edx]
add edi, ebx
add edi, 0xffffefff
neg ebx
and ebx, edi
mov edi, dword [0x44eb34]
mov ebp, dword [0x44eb38]
mov dword [edi + ebp*8 + 4], ebx
mov edi, dword [0x44eb38]
inc edi
mov dword [0x44eb38], edi
add edx, 0x28
cmp ecx, edx
jne 0x417bb0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0x56169c13
push 0xd5ead6c4
push dword [eax + 8]
call fcn.00418f7c
mov ebx, eax
xor eax, eax
lea ebp, [esp + 8]
mov dword [ebp], eax
mov esi, 0x400
push esi
call fcn.0042c9f4
add esp, 4
mov edi, eax
push ebp
push esi
push eax
push 1
mov dword [esp + 0x10], 0
xor eax, eax
push eax
push 0xffffffffffffffff
call ebx
cmp eax, 0xc0000004
jne 0x417c70
add esi, esi
push esi
push edi
call fcn.0042cd1e
add esp, 8
mov edi, eax
push ebp
push esi
push eax
push 1
push 0
jmp 0x417c4e
test eax, eax
js 0x417ccc
mov eax, dword [edi]
mov dword [esp + 4], eax
test eax, eax
je 0x417ccc
add edi, 4
mov ecx, dword [0x44eb38]
xor edx, edx
mov esi, dword [0x44eb34]
xor eax, eax
inc eax
mov dword [esp], eax
test ecx, ecx
je 0x417cbb
mov ebx, dword [edi]
mov ebp, ebx
and ebp, 0xfffff000
xor eax, eax
cmp ebp, dword [esi + eax*8]
jb 0x417cb6
bt ebx, 8
jb 0x417cb6
cmp ebp, dword [esi + eax*8 + 4]
jbe 0x417ccc
inc eax
cmp ecx, eax
jne 0x417ca5
add edi, 4
inc edx
cmp edx, dword [esp + 4]
jne 0x417c95
mov dword [esp], 0
push dword [0x44eb34]
call fcn.0042c64b
add esp, 4
mov eax, dword [esp]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret