joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a3b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x410584], esi
push edi
jne 0x404a5b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x410580], esi
mov byte [0x41057c], al
jne 0x404ac1
mov ecx, dword [0x4109d0]
test ecx, ecx
je 0x404aa2
mov eax, dword [0x4109cc]
sub eax, 4
cmp eax, ecx
jmp 0x404a9b
mov eax, dword [eax]
test eax, eax
je 0x404a8d
call eax
mov eax, dword [0x4109cc]
sub eax, 4
cmp eax, dword [0x4109d0]
mov dword [0x4109cc], eax
jae 0x404a85
mov eax, 0x40f024
mov esi, 0x40f02c
cmp eax, esi
mov edi, eax
jae 0x404ac1
mov eax, dword [edi]
test eax, eax
je 0x404aba
call eax
add edi, 4
cmp edi, esi
jb 0x404ab2
mov eax, 0x40f030
mov esi, 0x40f038
cmp eax, esi
mov edi, eax
jae 0x404ae0
mov eax, dword [edi]
test eax, eax
je 0x404ad9
call eax
add edi, 4
cmp edi, esi
jb 0x404ad1
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x404afa
push dword [ebp + 8]
mov dword [0x410584], 1
call fcn.00404957
pop ebp
ret

Function at 0x404be8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00404f60
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x404c83
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x410544]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x404c83
cmp eax, 1
je 0x404ca4
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x404c83
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x404c50
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x404c7f
xor eax, eax
inc eax
jmp 0x404cc3
cmp edi, eax
jae 0x404c87
xor eax, eax
jmp 0x404cc3
cmp eax, esi
jae 0x404c8e
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x410544]
jmp 0x404ca7
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405c91
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov ecx, dword [ebp + 0x3ac]
cmp ecx, dword [0x4109dc]
mov eax, dword [0x40f040]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x78], edi
jae 0x405e31
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x4109e0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x405e31
and dword [ebp - 0x70], 0
and dword [ebp - 0x7c], 0
cmp dword [ebp + 0x3b4], 0
jne 0x405d05
xor eax, eax
jmp 0x405e45
test al, 0x20
je 0x405d18
push 2
push 0
push 0
push ecx
call fcn.00409343
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x405dad
and dword [ebp - 0x68], 0
cmp dword [ebp + 0x3b4], 0
mov dword [ebp - 0x6c], edi
jbe 0x405e0e
mov ecx, dword [ebp - 0x6c]
xor edi, edi
sub ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x405d72
mov edx, dword [ebp - 0x6c]
inc dword [ebp - 0x6c]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x405d63
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x405d45
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x74]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405dd2
mov eax, dword [ebp - 0x74]
add dword [ebp - 0x70], eax
cmp eax, edi
jl 0x405ddb
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x78]
cmp eax, dword [ebp + 0x3b4]
jb 0x405d3a
jmp 0x405ddb
push 0
lea ecx, [ebp - 0x74]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405dd2
mov eax, dword [ebp - 0x74]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x70], eax
jmp 0x405ddb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x405e2c
cmp dword [ebp - 0x68], eax
je 0x405e0b
push 5
pop eax
cmp dword [ebp - 0x68], eax
jne 0x405e00
mov dword [0x410538], 9
mov dword [0x41053c], eax
jmp 0x405e42
push dword [ebp - 0x68]
call fcn.004092df
pop ecx
jmp 0x405e42
mov edi, dword [ebp - 0x78]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x405e20
cmp byte [edi], 0x1a
je 0x405cfe
mov dword [0x410538], 0x1c
jmp 0x405e3b
sub eax, dword [ebp - 0x7c]
jmp 0x405e45
mov dword [0x410538], 9
and dword [0x41053c], 0
or eax, 0xffffffff
mov ecx, dword [ebp + 0x3a0]
pop edi
pop esi
pop ebx
call fcn.00402b75
add ebp, 0x3a4
leave
ret
Function at 0x405ebc
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x40f040]
mov ecx, dword [ebp + 0x98]
push ebx
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x40f300]
je 0x405ef1
inc eax
cmp eax, 0x13
jb 0x405ee2
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x40f300]
jne 0x406014
mov eax, dword [0x410528]
cmp eax, 1
je 0x405fef
cmp eax, edx
jne 0x405f21
cmp dword [0x40f2dc], 1
je 0x405fef
cmp ecx, 0xfc
je 0x406014
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405f57
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.004078d0
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.00407b00
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x405f8b
mov eax, edi
push eax
call fcn.00407b00
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x40cc9c
push edi
call fcn.004079d0
add esp, 0x10
push edi
call fcn.00407b00
push dword [esi + 0x40f304]
mov ebx, eax
call fcn.00407b00
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00404f60
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004078d0
push edi
push ebx
call fcn.004078e0
push 0x40cc98
push ebx
call fcn.004078e0
push dword [esi + 0x40f304]
push ebx
call fcn.004078e0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.004077c9
add esp, 0x2c
jmp 0x406014
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x40f304]
push dword [esi]
call fcn.00407b00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x8c]
call fcn.00402b75
pop edi
pop esi
pop ebx
add ebp, 0x90
leave
ret
Function at 0x4077c9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4106d4], ebx
push esi
push edi
jne 0x407849
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x407884
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x4106d4], eax
je 0x407884
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x4106d8], eax
call esi
cmp dword [0x410544], 2
mov dword [0x4106dc], eax
jne 0x407849
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x4106e4], eax
je 0x407849
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x4106e0], eax
mov eax, dword [0x4106e0]
test eax, eax
je 0x40788e
call eax
test eax, eax
je 0x407875
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x4106e4]
test eax, eax
je 0x407875
test byte [ebp - 8], 1
jne 0x40788e
cmp dword [0x410550], 4
jb 0x407888
or byte [ebp + 0x12], 0x20
jmp 0x4078ad
xor eax, eax
jmp 0x4078bd
or byte [ebp + 0x12], 4
jmp 0x4078ad
mov eax, dword [0x4106d8]
test eax, eax
je 0x4078ad
call eax
mov ebx, eax
test ebx, ebx
je 0x4078ad
mov eax, dword [0x4106dc]
test eax, eax
je 0x4078ad
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x4106d4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407b90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x407bbe
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x407bc5
cmp ebx, dword [eax + 4]
jae 0x407bc5
xor eax, eax
jmp 0x407db5
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x407bd6
xor eax, eax
inc eax
jmp 0x407db4
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x407bec
cmp ecx, edx
jae 0x407d31
cmp dword [eax + 4], 0
je 0x407bf5
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x407bdd
cmp dword [ebp + 8], 0
je 0x407c17
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x407d31
cmp eax, esi
jae 0x407d31
mov eax, dword [0x4106e8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x407c3c
cmp dword [esi*4 + 0x4106f0], edi
je 0x407d35
inc esi
cmp esi, eax
jl 0x407c2a
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x407db1
cmp dword [ebp - 8], 0x1000000
jne 0x407db1
test byte [ebp - 0xc], 0xcc
je 0x407cba
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x407db1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407db1
cmp word [eax + 0x18], 0x10b
jne 0x407db1
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x407db1
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x407cba
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x407cba
test byte [ecx + 0x27], 0x80
jne 0x407d31
push 1
push 0x410730
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x407bce
mov ecx, dword [0x4106e8]
test ecx, ecx
mov edx, ecx
jle 0x407cee
lea eax, [ecx*4 + 0x4106ec]
cmp dword [eax], edi
je 0x407cee
dec edx
sub eax, 4
test edx, edx
jg 0x407ce2
test edx, edx
jne 0x407d1f
push 0xf
pop ebx
cmp ecx, ebx
jg 0x407cfb
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x407d13
lea eax, [edx*4 + 0x4106f0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x407d01
cmp ecx, 0x10
jge 0x407d1f
inc ecx
mov dword [0x4106e8], ecx
push 0
push 0x410730
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x407bce
xor eax, eax
jmp 0x407db4
test esi, esi
jle 0x407bce
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x410730
call ebx
test eax, eax
jne 0x407bce
cmp dword [esi*4 + 0x4106f0], edi
je 0x407d8b
mov eax, dword [0x4106e8]
lea esi, [eax - 1]
test esi, esi
jl 0x407d79
cmp dword [esi*4 + 0x4106f0], edi
je 0x407d75
dec esi
jns 0x407d69
test esi, esi
jge 0x407d89
cmp eax, 0x10
jge 0x407d84
inc eax
mov dword [0x4106e8], eax
lea esi, [eax - 1]
jmp 0x407d8b
je 0x407da3
xor ecx, ecx
test esi, esi
jl 0x407da3
lea eax, [ecx*4 + 0x4106f0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x407d91
push 0
push 0x410730
call ebx
jmp 0x407bce
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x438ca2
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
and edi, ebx
sub edi, 0xce204526
call fcn.00438cd1
dec edi
mov edi, edi
add ebx, edi
xor dword [esi], edx
sub edi, ebx
inc esi
sub edi, ebx
cmp esi, ecx
jne fcn.00438ca2
and edi, edi
sub edi, ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4060ab
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4060c9
mov eax, 0x6375f2
push eax
push 1
mov ebx, 0x46cc10
call fcn.0046c522
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4060f3
mov eax, 0
jmp 0x406167
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x406154
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40613d
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40612c
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40611d
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x4106ab
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x4108f8
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x4107f5
cmp byte [edx + edi], 0xd
jne 0x4107f5
cmp byte [edx + edi + 1], 0xa
je 0x41082e
mov al, byte [edx + edi]
cmp al, 0xa
je 0x41082e
cmp al, 0x3d
jne 0x41080a
inc ecx
cmp ecx, 2
ja 0x410906
cmp al, 0x7f
ja 0x410906
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x410906
cmp al, 0x40
jae 0x41082d
test ecx, ecx
jne 0x410906
inc esi
inc edx
cmp edx, ebx
jb 0x4107df
test esi, esi
je 0x4108f8
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x410917
cmp dword [ecx], eax
jb 0x410917
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x4108e7
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x4108e3
cmp al, 0xa
je 0x4108e3
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x4108e3
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x4108ce
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x4108db
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x4108e3
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x41087f
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x45541c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x45543f
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x45543f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x455449
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x45548b
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4554ed
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4554e8
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4554d3
test dl, dl
je 0x4554cf
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4554d3
add ecx, 2
add eax, 2
test dl, dl
jne 0x4554b3
xor eax, eax
jmp 0x4554d8
sbb eax, eax
or eax, 1
test eax, eax
je 0x4554f9
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4554a0
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x45557e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4555a1
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4555a1
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4555ab
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4555ed
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x45564f
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x45564a
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x455635
test dl, dl
je 0x455631
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x455635
add ecx, 2
add eax, 2
test dl, dl
jne 0x455615
xor eax, eax
jmp 0x45563a
sbb eax, eax
or eax, 1
test eax, eax
je 0x45565b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x455602
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4556ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x455710
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x455710
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x45571a
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x45575c
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4557be
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4557b9
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4557a4
test dl, dl
je 0x4557a0
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4557a4
add ecx, 2
add eax, 2
test dl, dl
jne 0x455784
xor eax, eax
jmp 0x4557a9
sbb eax, eax
or eax, 1
test eax, eax
je 0x4557ca
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x455771
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x455857
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x45587a
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x45587a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x455884
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4558c6
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x455928
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x455923
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45590e
test dl, dl
je 0x45590a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45590e
add ecx, 2
add eax, 2
test dl, dl
jne 0x4558ee
xor eax, eax
jmp 0x455913
sbb eax, eax
or eax, 1
test eax, eax
je 0x455934
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4558db
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8