joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d68f
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp eax, 2
pushfd
pushfd
pushfd
mov dword [ebp - 4], eax
pushfd
lea esp, [esp + 0x44]
jl 0x4afce8
adc dh, dh
movzx ecx, word [edi]
btc dx, 1
pushfd
movzx edx, word [edi + 2]
cmp esi, 0x19d1bfaf
cmp bl, 0xc8
stc
add ecx, edx
test esi, ebx
mov word [esp], si
sub ebx, ebx
pushfd
test ecx, ecx
pushfd
pushal
lea esp, [esp + 0x2c]
jle 0x493b2c

Function at 0x469624
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [eax + 8], edi
dec ah
jmp 0x4a5d5f
pop edi
mov edi, dword [eax + 0x14]
jmp 0x45aee3

Function at 0x4793c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x30]
jo 0x4989ec
je 0x439d0f
pushal
pop edx
jmp 0x4a3313
pop ecx
mov edx, dword [ebp + 0x14]
seta ch
pushfd
not cl
push 0xcb8961b3
mov ecx, dword [ebp + 0x10]
pushal
push edx
xchg dword [esp + 0x40], edx
pushfd
mov edx, dword [ebp + 0xc]
jmp 0x48c092

Function at 0x479ec0
Capabilities:
Execute anti-debugging instructions

Disassembly:
not edx
rdtsc
movzx ecx, word [edi + ebx*8 + 4]
rdtsc
lea eax, [0x22a3dc2a]
mov eax, dword [ebp + 0x18]
call fcn.004f5ae7
mov di, ax
push 0xf7d8eb64
mov dword [esp], esi
not di
not di
call fcn.00462f7a
bt ax, sp
cmc
stc
jb 0x50b9a9
xor edi, edi
cmp ebx, edx
mov dword [esp + 4], ebx
lea esp, [esp + 8]
jl 0x45d6d7
cwde
push esp
call fcn.004b07a2
mov byte [esp], dh
inc ebx
cmc
add edx, eax
test sp, dx
jmp 0x46a1dd
jmp 0x472b17
pushfd
pushal
cmp si, 0x3978
stc
sub edi, edi
stc
test ebx, 0xffff0000
jmp fcn.004bce01

Function at 0x47e965
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4cb7e1
push 0x50a56d2c
lea esp, [esp + 0xc]
jne 0x46df61
call fcn.0045d2a7

Function at 0x48732f
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx bx, bl
nop
bswap bx
mov bh, dl
not bl
pop ebx
pushal
push 0x8faf946f
call fcn.0045ba8c
add edx, eax
test ebx, esp
mov byte [esp], 0xef
pushal
stc
mov dword [ebp - 8], esi
pushfd
clc
mov dword [ebp - 4], ebx
cmp ah, 0x47
cmc
test edx, edx
mov byte [esp + 4], 0x18
lea esp, [esp + 0x2c]
jle 0x43a4c3
jmp 0x500499
pushal
pushfd
push 0x840bcd54
mov dword [esp + 0x24], edi
mov dword [esp], edi
lea esp, [esp + 0x24]
jmp 0x483003

Function at 0x48cc89
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x44]
jae 0x4a5d8a
sal cx, cl
aam 0xa6
bts ecx, 2
or cx, 0x297e
lea ecx, [edi + edi*2]
xor ax, bp
bts ax, 5
ror al, cl
shld ax, dx, cl
add ecx, ecx
bts edi, 0x14
add ecx, ecx
bsf ax, dx
das
bts di, cx
mov eax, dword [esi + 0x20]
bsr di, si
call fcn.0050dc71

Function at 0x48fd0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x5dd6e6b1
cmc
mov dword [ebp - 8], esi
clc
stc
cmc
mov dword [ebp - 4], ebx
test bh, 0xbf
bt di, 6
stc
call fcn.004c612a
stc
cmp esp, 0x58adf463
pushfd
sub ebx, ebx
clc
add edx, eax
cmp sp, bp
sub esp, 0xfffffff8
jge 0x45936b
mov dword [ebp - 8], esi
cmc
pushfd
mov dword [ebp - 4], ebx
mov dword [esp], edx
cmp ah, 0x7f
pushal
clc
test edx, edx
pushal
pushfd
pushfd
lea esp, [esp + 0x4c]
jle 0x43a4c3
call fcn.0050c82d
Function at 0x494ad0
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x4bce2f
pushal
nop
jmp 0x468fb0

Function at 0x497509
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp], dh
not ah
mov eax, dword [ebp + 0xc]
jmp 0x4b9bd8
mov ebx, dword [esp + 0xc]
cwde
pushal
cwde
mov cl, dh
mov ecx, dword [ebp + 0x14]
jmp 0x4aa617
lea edx, [ebp*8 - 0x275d6df1]
setp al
rdtsc
mov edx, dword [ebp + 0x10]
jmp 0x506ead
jmp 0x46b517

Function at 0x4989f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [ecx - 0x1233a501]
call fcn.00458060
xchg dword [esp + 4], ecx
pushal
mov dword [esp + 0x20], ecx
lea ecx, [ecx + 0x4ffae107]
mov byte [esp], ah
pop ecx
mov ecx, 0x411082
push dword [esp]
pushal
mov ecx, dword [ecx + 0xf2a5c]
mov byte [esp + 0x10], dl
jmp 0x46bb67
Function at 0x49d721
Capabilities:
Execute anti-debugging instructions

Disassembly:
cwde
movzx ax, bl
cwde
mov eax, 0x41977c
jmp 0x468fb5
rdtsc
rdtsc
mov eax, dword [ebp + 0x14]
setg dl
pushal
lea edx, [ebx - 0x28569470]
mov edx, dword [esi + 0x44]
mov word [esp], 0xf48d
pushal
mov dword [esp + 0x3c], eax
lea esp, [esp + 0x3c]
jp 0x4a5a53
push 0xd0a27ba2
mov dword [esp], ecx
pushal
call fcn.004a10e7
jno 0x46a386
pushal
mov eax, dword [eax + 0xb63ae]
lea esp, [esp + 0x20]
jp 0x48cc69
pushfd
pushfd
mov byte [esp + 4], 0xb6
lea eax, [eax - 0x3a7881f1]
call fcn.0047b905
pushal
inc eax
test esp, 0x41706e6e
cmp dx, 0xf4b4
cmp byte [eax], cl
jmp 0x48e174
call fcn.0050e996
pushfd
call fcn.004765ac
push 0xf93f05e1
pushfd
xchg dword [esp + 4], esi
bswap esi
movsx si, bl
mov esi, 0x2365f0c1
jmp 0x48dde9
mov esi, dword [esp + 8]
mov word [esp], 0xcf0b
pushfd
lea esi, [esi + 1]
pushfd
mov dword [esp + 0x10], esi
pushal
not si
mov si, 0xa82e
lea esp, [esp + 0x2c]
jne 0x4fb8c2
mov esi, 0x40a7a8
call fcn.004a3be5
pushal
lea esp, [esp + 0x40]
jne 0x468fde
shl ch, 4
dec edx
cmc
push ebx
or bx, 0xeea1
sal bx, cl
sbb bl, bh
pushfd
mov ebx, dword [ebp + 0xc]
cmc
bts ecx, 0x17
xchg dword [esp], esi
bts edx, 0x1a
pushal
clc
mov esi, dword [eax + 1]
pushfd
shrd ecx, ebx, 0x12
xadd ecx, edx
add dl, al
sub esi, 0x13a5b738
sar dh, 7
xor esi, dword [eax + 0x11]
pushal
movsx dx, dl
xchg dx, ax
mov dword [esp + 4], 0xe232e073
mov dword [esp + 0x40], edi
lahf
bswap dx
setp al
mov edi, dword [ebp + 8]
lahf
movzx cx, al
mov ecx, ebx
setl ah
bswap dx
not dl
rdtsc
mov eax, edi
movsx edx, dl
mov dh, byte [esp]
mov edx, esi
jmp 0x50d88a
not si
movzx si, bl
mov esi, 0x40a7a8
push 0xfa117c75
mov esi, dword [esi + 0xf9336]
pushfd
mov byte [esp + 4], 0x60
lea esi, [esi - 0x1233a501]
pushfd
call fcn.00472aa9
pushfd
mov dword [esp], 0xd71add90
push esp
mov word [esp], cx
mov byte [esp], cl
lea esp, [esp + 4]
jmp fcn.00430b86
lea esp, [esp + 0x30]
jo 0x439ec9
mov dword [esp + 4], eax
jmp 0x437ac0
push 0xb6f12106
pushal
mov byte [esp + 4], 0xd8
mov dword [esp + 0x20], ecx
call fcn.0046b49d
push 0xf06ab808
lea esp, [esp + 4]
je 0x4ce3ad
lea edi, [esp + 0x51aadf6c]
mov edx, dword [ebx + 4]
or di, di
mov dword [eax], edx
inc di
shl di, cl
cmp al, 0xde
pop edi
btc bp, dx
pop esi
bswap bx
shl bh, 7
xadd ebx, ebp
clc
sub eax, eax
pushal
mov ebx, dword [esp + 0x20]
movzx ebp, dl
mov ebp, dword [esp + 0x24]
pushfd
mov byte [esp + 0xc], 0xd8
push 0xd961f6e2
push dword [esp + 4]
push dword [esp + 0x34]
ret 0x48
test ecx, ecx
pushfd
lea esp, [esp + 4]
je 0x4cf845
clc
pushal
mov dword [ecx], eax
lea esp, [esp + 0x20]
sal ax, cl
mov eax, dword [ebp + 0x14]
cmc
test eax, eax
jmp 0x4ce38f
jmp 0x49a0a1
lea esp, [esp + 0x40]
call fcn.004860f7
bsf cx, cx
ror ch, 3
cmp al, dh
sub cl, dh
mov ecx, dword [ebp + 0x10]
test ax, dx
test bl, bl
pushal
test eax, eax
push 0xe41ebe8e
pushal
pushfd
pushfd
lea esp, [esp + 0x4c]
je 0x462294
jmp 0x4cf830

Function at 0x49e7e8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov ecx, dword [ecx + 0xb7849]
mov word [esp], 0x4a68
pushfd
lea ecx, [ecx + 0x3eb70bb8]
push dword [esp]
pushfd
pushfd
call fcn.0047c467
Function at 0x49f884
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx esi, bl
pop edi
push dword [esp]
mov word [esp], 0x541d
lea edi, [edi + 0x5cb06f39]
call fcn.0045ac7f
lea esp, [esp + 0x24]
je 0x43a4bf
not ax
lahf
movzx edx, word [esi]
movzx ax, bl
lahf
seto ah
movzx eax, word [esi + 2]
pushfd
inc ebx
push dword [esp]
call fcn.00454461

Function at 0x4a2178
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0xb4
pushal
xchg dword [esp + 0x40], ebp
call fcn.004f31fd
pushal
pop ebp
not ebp
nop
movzx bp, bl
mov ebp, dword [esp + 0x1c]
jmp 0x49e806

Function at 0x4aab50
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x46a019
sub esp, 0xffffffe8
mov dword [esp + 0x20], ebp
lea ebp, [ebp + 0x6da8e004]
sar ebp, 1
lea ebp, [esp + 0x20]
jmp 0x4592e0

Function at 0x4af5d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
not bh
mov ebx, dword [esp + 4]
lea esp, [esp + 8]

Function at 0x4b0e52
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x34], ecx
call fcn.004c71e6

Function at 0x4b0e5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp cl, 0xbb
and al, 0xb3
mov eax, dword [esi + 0x28]
clc
cmp ch, 0x32
cmc
cmp edi, eax
pushal
jmp 0x49e815
push eax
pushfd
pushfd
pushal
mov dword [esp + 0x28], eax
jmp 0x4ac200
lea esp, [esp + 0x20]
jae 0x4a5d90
pushal
dec eax
rcr edx, cl
setno dh
mov edx, edi
push dword [esp]
cmp edi, eax
mov byte [esp + 8], 0x1c
pushal
mov word [esp + 8], ax
lea esp, [esp + 0x44]
jae 0x4a5d8a
shrd ax, bp, 1
sar ah, cl
not cx
lea ecx, [edi + edi*2]
clc
cmc
sub ax, di
setbe al
add ecx, ecx
daa
add ecx, ecx
not edi
aam 0x9c
mov eax, dword [esi + 0x20]
or di, cx
mov edi, dword [eax + ecx + 0xc]
test cl, dh
bt si, 0xb
stc
call fcn.0046751c
inc bx
dec dword [esi + 0x28]
bswap ecx
rdtsc
pushal
cwde
mov byte [ebp - 1], 1
lea esp, [esp + 0x20]
push 0xdfcb2c21
push 0x974b0159
mov dword [esp + 0x2c], ebx
pushfd
pushfd
jmp 0x50325d
pushfd
pushfd
pushfd
lea esp, [esp + 0x50]
je 0x508440
call fcn.0048dcda
call fcn.004a6414
mov byte [esp], cl
mov dword [esp + 0x1c], ebx
jmp 0x4cf901
test ebx, ebx
pushal
lea esp, [esp + 0x40]
je 0x432854
push esp
cwde
pushal
pop eax
mov dword [esp + 0x1c], 0
lea esp, [esp + 0x1c]
js 0x502a5f
movsx eax, dl
push edx
movzx ax, cl
mov dword [esp], edx
not al
lea eax, [edx + ecx + 5]
jbe 0x478dbf
push 0xb689204
pushal
mov byte [esp], 0xcd
mov dword [esp + 0x20], eax
mov byte [esp], 0xc1
jmp 0x4f5365
cwde
movzx ax, dl
movsx ax, cl
push edx
pushal
call fcn.0047e5c4
xchg dword [esp + 0x40], ebp
pushfd
push dword [esp + 0x44]
ret 0x48
lea esp, [esp + 0x34]
call fcn.004ad5bb
pushal
push esp
mov dword [esp + 0x20], eax
pushal
call fcn.004be78d
pushal
jmp 0x500e03
Function at 0x4b5d4a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5016da
cmc
stc
cmp edi, eax
jmp 0x4f8306
mov byte [esp], 0x8f
mov word [esp], 0x7e06
lea esp, [esp + 0x24]
jae 0x4a5d90
pushfd
dec eax
btr dx, ax
mov edx, edi
pushal
jmp 0x4674f0
lea esp, [esp + 0x24]
jae 0x4a5d8a
setae al
lahf
xchg cx, ax
lea ecx, [edi + edi*2]
test al, 0x4c
sub ah, al
sete ah
neg di
add ecx, ecx
call fcn.00473ebe
mov dword [esp + 0x50], ecx
call fcn.004919ff
mov byte [esp], dl
mov dword [esp], 0x4364b6
push 0xb270e587
pushfd
jmp 0x43293c

Function at 0x4c11e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc ebx
push dword [esp]
bt cx, ax
add edx, eax
clc
call fcn.00504eac
movzx eax, word [esi + 2]
jmp 0x4c2f7e
lea esp, [esp + 0x10]
je 0x43a4bf
setnp ah
pushal
movzx edx, word [esi]
pushal
jmp 0x493619
jmp 0x45b098

Function at 0x4c76e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4989c0
mov edi, 0x411c71
jmp 0x431be1

Function at 0x4c7a0c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebx, ebx
cmc
push 0x14759428
mov byte [esp], dl
add edx, eax
clc
mov dword [ebp - 8], esi
jmp 0x4aead3

Function at 0x4d1287
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0xc], 0x9b
lea eax, [eax + 0x34545fb4]
jmp 0x4a86b4
call fcn.004f4974
push 0x18bde7bc
jmp 0x49f87f
pushfd
jmp 0x49c2f8

Function at 0x5066fa
Capabilities:
Encode data using xor

Disassembly:
call fcn.004b9ff6
mov ecx, dword [esp + 0x4c]
jmp 0x48eeaa

Function at 0x516ccf
Capabilities:
Encode data using xor

Disassembly:
clc
cmp al, 0xa4
clc
sub edi, 4
push 0x44d1543
push dword [edi]
pop dword [esp]
cmc
stc
cmc
cmp edi, ebx
push 0x3f2b178f
mov byte [esp], al
lea esp, [esp + 4]
ja 0x523d6a
dec al
rcr al, 7
sub al, 0x64
cmc
sub ebx, edi
bts edi, esp
pushal
add esp, 0x20
add ebx, esp
adc al, 0x96
shl al, 6
rcl di, 0xd
add al, ah
mov edi, ebx
dec al
sal al, cl
cmc
call fcn.005163d6
fidiv word [edx]
dec ebp
mov al, byte [0x589a1402]
invalid
push ecx
sbb al, 0xed
sub byte [edi], cl
fnstenv [0x596bbed5]
mov esi, 0x8e6a30d8
out dx, al
xor al, 0x23
std
mov ah, 0x57
loope 0x516cb2
and al, 0x3f
invalid
test al, 0x7b
push ebp
mov esi, 0x5f1dd61c
aad 0xe6
mov gs, word [edi + 0x66]
cmp dx, bp
cmp dx, bp
pushfd
add esp, 8
jg 0x514def
sub edi, 4
call fcn.00515cab
push ecx
mov eax, 0x9f69ba6d
jne 0x516cc3
js 0x516c9d
out 0x2c, eax
or dword [edx], esp
lds esp, [edi + 0x5bfd2f78]
mov dl, byte [eax - 0x4e]
outsd dx, dword [esi]
mov dh, 0x74
scasb al, byte es:[edi]
jle 0x516ca7
pop esi
xchg byte [edi - 0x6e], cl
dec eax
stosb byte es:[edi], al
push edx
xchg byte [ebx*8 + 0x42ae63b6], dh
stosd dword es:[edi], eax
or eax, ebp
xor byte [edx - 0x6619579d], dh
into
and al, 0x82
or esp, dword [edx]
pop eax
ret 0x3d58
Function at 0x51cc0c
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pop ecx
and eax, 0x39f422fc
pop eax
xor byte [edi - 0x39edd84d], bl
psubb mm0, qword [ebp - 0x1b66ab73]
out dx, eax
sub eax, 0x2ecdcb1c
int 0x2e
pop ebx
mov byte [edi - 0x7773ae83], bl
pop ebp
inc eax
nop
xchg ecx, eax
push ecx
push 0xffffffffffffffbf
jb 0x51cb9d
sbb eax, 0x8988bbf8
insd dword es:[edi], dx
add byte [eax], al
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
inc esi
jb 0x51cc3c
add al, dl
shr byte [edi], 0xf
xchg esi, eax
les edx, [esi + 0x66]
shrd eax, ebp, cl
mov byte [esp + 4], bl
repne scasb al, byte es:[edi]
call fcn.00513088
sub dl, bh
push es
stc
and ah, cl
add ah, byte [eax + 0xcb4ec34]
in eax, 0x49
scasb al, byte es:[edi]
in al, 0x3f
sahf
jl 0x51cbb5
push esp
popfd
inc eax
mov eax, 0x9f60b060
dec esp
mov ecx, 0xdc0bde6c
invalid
sub dword [edx - 0x3e], 0xa44d9b60
xchg edi, eax
inc ebx
xchg ebp, eax
cmp eax, 0xd2c7e248
push cs
jecxz 0x51ccbe
rol dword [esi], cl
imul ebx, dword [ecx - 0x75db31c9], 0x4ce8c413
mov bh, byte [eax + 0x10]
cld
sub ebp, dword [edx - 0x36]
movsb byte es:[edi], byte [esi]
sahf
inc ebp
psubusb mm3, qword [0xc0ae06dc]
inc ebp
mov al, byte [0x4ba425e1]
jmp 0x567da8ac
pop ecx
salc
sbb eax, 0xe395a6ff
cmp byte [eax], al
add byte [edi + 0x65], al
je 0x51cd19
outsd dx, dword [esi]
jne 0x51cd3c
inc esi
imul ebp, dword [ebp + 0x4e], 0x57656d61
invalid

Function at 0x51eccb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
jmp 0x518187
jmp 0x51f22d
stc
cmp dx, bx
or ah, ah
pushal
push dword [esp]
lea esp, [esp + 0x24]
je 0x528a63
pushfd
stc
jmp 0x528a59
add ah, 0x20
test dh, 0xb2
or al, al
lea esp, [esp + 8]
je 0x5122f5
pushfd
pushfd
lea esp, [esp + 8]
je 0x51d3d3
cmp bl, ah
clc
bt bx, 0xd
cmp al, ah
push 0x83294ceb
call fcn.005125a5
jmp 0x527cdd
lea esp, [esp + 4]
je 0x51d3d3
cmp al, 0xd7
cmp al, ah
jmp 0x5299e1
mov byte [esp], bl
cmp ah, 0x2e
lea esp, [esp + 4]
call 0x519464

Function at 0x51ecfd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x20]
je fcn.005143bd
sal si, cl
pushal
mov esi, dword [eax + 0x3c]
pushfd
rcr dh, 3
add esi, eax
dec dl
mov edx, dword [esi + 0x78]
cmp cl, 0x4b
clc
cmp dh, 0x2c
push edi
test edx, edx
pushfd
mov byte [esp], 0x28
pushfd
lea esp, [esp + 0x30]
je fcn.005143bd
bsr cx, cx
shrd cx, bx, 6
and cl, 0xe7
add edx, eax
movzx ecx, al
test cl, 0x1d
shld cx, bx, cl
mov cl, 0x8d
mov ecx, dword [esi + 0x7c]
pushal
push 0x4cbd1fd3
mov byte [esp + 4], 0x26
jmp 0x51ad24
jmp 0x5171f1
add ecx, edx
test bh, dh
call 0x51f97f
rol al, 1
das
setbe ah
push esi
shrd ax, bp, cl
inc al
aam 0xa7
lea eax, [edi*2 + 0x5e4d520f]
push edi
adc ax, bp
not ax
btr ax, cx
sub ah, dh
push ebx
aas
push edx
not ah
mov eax, dword [ebp + 8]
pushal
test eax, eax
jmp 0x519e12
lea ebp, [esp + 4]
and eax, 0x897e5365
adc ax, dx
dec eax
and ax, 0x34e8
sub esp, 0x14
jmp 0x51cbd9
Function at 0x4060fb
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x4061af
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040608b
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x406188
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4061bb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x4061d6
test ebp, ebp
je 0x4061d6
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4061de
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40621e
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40627a
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x406275
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x406260
test dl, dl
je 0x40625c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x406260
add ecx, 2
add eax, 2
test dl, dl
jne 0x406240
xor eax, eax
jmp 0x406265
sbb eax, eax
or eax, 1
test eax, eax
je 0x406284
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40622d
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40629b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.004060fb
test eax, eax
jne 0x4062b3
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.004061bb
mov esi, eax
test esi, esi
jne 0x4062e9
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x406303
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x4063fb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.004060fb
mov esi, eax
test esi, esi
jne 0x406419
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.004061bb
mov dword [esp + 0x18], eax
test eax, eax
je 0x406411
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.004061bb
mov dword [esp + 0x34], eax
test eax, eax
je 0x406411
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.004061bb
mov dword [esp + 0x28], eax
test eax, eax
je 0x406411
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.004061bb
mov dword [esp + 0x30], eax
test eax, eax
je 0x406411
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x4065e0
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x4065e0
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x406543
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x4065c4
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x406566
movzx esi, ax
jmp 0x40656b
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x40658a
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x406599
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x4065ed
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x40655b
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x406520
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x406616
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x406616
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x4065fb
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret