joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ab2d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.00411e54
lea ecx, [esp + 0x108]
mov byte [esp + 0x158], 0
mov dword [esp + 0x108], ebx
call 0x411e6f
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], 0x475fd4
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x4c]
push eax
lea edx, [esp + 0x50]
push esp
and al, 0x50
push ecx
push edx
mov byte [esp + 0x164], 3
call dword [0x46f54c]
cmc
inc esi
add byte [ebx - 0x74a7dbbc], cl
dec esp
and al, 0x54
mov edx, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push ecx
push edx
push eax
call 0x4f640f
and dl, byte [eax - 0x73]
dec esp
and al, 0x18
call 0x4706f6
lds ebx, [ebx + 6]
add byte [ebp + 0x5114244c], cl
lea ecx, [esp + 0x60]
call 0x470185
mov ecx, dword [esi + 0x88]
cmp ecx, ebp
je 0x40abac
invalid
cmp dword [esi + 0xbc], ebp
jne 0x40ab7d
mov eax, dword [esi + 0x88]
lea edi, [esi + 0x78]
cmp eax, ebp
jne 0x40ab62
xor eax, eax
jmp 0x40ab65
mov eax, dword [edi + 8]
push ecx
push eax
call fcn.0042d757
cmp eax, ebp
mov dword [esi + 0xbc], eax
jne 0x40ab7d
mov ecx, edi
call fcn.00411f08
lea edx, [esp + 0x14]
lea eax, [esp + 0x4c]
push edx
mov edx, dword [esi + 0xbc]
lea ecx, [esp + 0x30]
push eax
push ecx
mov ecx, dword [esi + 0x8c]
invalid
cmp dword [esi + 0x90], ebp
je 0x40ac8d
mov eax, dword [esi + 0x94]
xor edi, edi
cmp eax, 0xff000000
je 0x40abd0
mov dword [esp + 0x1c], eax
mov edi, 1
mov eax, dword [esi + 0x98]
cmp eax, 0xff000000
je 0x40abe2
mov dword [esp + edi*4 + 0x1c], eax
inc edi
mov eax, dword [esi + 0x9c]
cmp eax, 0xff000000

Function at 0x4138de
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp eax, ebp
mov dword [esp + 0x9c], eax
je 0x413a35
push eax
call dword [0x46f438]
test eax, eax
je 0x413a35
mov eax, dword [esp + 0xec]
mov dword [esp + 0x10], ebp
mov dword [esi + 0xd8], eax
jmp 0x41396d

Function at 0x4156d1
Capabilities:
Packed with generic packer

Disassembly:
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov ecx, dword [esi + 0x1e0]
mov eax, dword [esi + 0x234]
inc ecx
test eax, eax
mov dword [esi + 0x1e0], ecx
je 0x41574c
push ecx
call 0x536c8a
cmp eax, dword [esi + 0x234]
je 0x41574c
mov eax, dword [esi + 0x3f0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x41572e
push eax
call dword [0x46f438]
test eax, eax
je 0x41572e
mov eax, dword [esi + 0x3f0]
push 0
push edi
push 0x83e7
push eax
call dword [0x46f42c]
mov eax, dword [esi + 0x428]
test eax, eax
jne 0x415a4e
push edi
call 0x50f841
test eax, 0x8b5b5e5f
in eax, 0x5d
ret 4
mov ecx, esi
mov dword [esi + 0x428], 1
call fcn.00428bb8
mov edx, dword [esi + 0x104]
lea ecx, [esi + 0x104]
call dword [edx + 8]
mov eax, dword [esi + 0x41c]
test eax, eax
je 0x4157a8
mov al, byte [0x48f63c]
test al, 1
jne 0x415791
or al, 1
mov byte [0x48f63c], al
mov eax, dword [esi + 0x41c]
mov dword [0x48f638], eax
pushal
call dword [0x48f638]
popal
mov ecx, dword [ebp - 4]
mov esi, ecx
mov dword [ecx + 0x41c], 0
mov ebx, dword [esi + 0x130]
xor edi, edi
shr ebx, 2
test ebx, ebx
jle 0x4157da
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x415caa
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, edi
call fcn.00429b8c
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
pop edi
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10

Function at 0x41bb7d
Capabilities:
Packed with generic packer

Disassembly:
push 0
jne 0x41bb96
push 2
push 0xa1
push eax
call 0x52b10a
dec esi
xor eax, eax
jmp 0x437115
mov eax, dword [ebp + 0xdc]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, esi
call fcn.0042b724
cmp eax, 1
jne 0x41bc08
mov ecx, dword [edi]
push 0
push ecx
mov ecx, dword [esp + 0x18]
call fcn.0042bfc7
cmp eax, ebx
je 0x41bc08
add byte [ebx], bh
ret
mov edx, dword [esp + 0x10]
push 0
push 0
push eax
lea ecx, [edx + 0x14]
call 0x42b24c
mov eax, dword [eax]
push eax
push 0x3ea
call 0x4306d9
test eax, eax
je 0x41bc08
test dword [eax + 0x14], 0x4000000
je 0x41bc08
mov ecx, dword [ebp + 0x1c]
push 0
push 2
push 0xa1
mov eax, dword [0x51000000]
call 0x524771
mov dword [0x1b8], eax
add cl, ch
jg 0x41bbbb
add dword [eax], eax
push edi
call fcn.004380f9
add esp, 4
test ax, ax
je 0x41c29e
mov ecx, eax
and ecx, 0xffff
invalid

Function at 0x41bbf3
Capabilities:
Packed with generic packer

Disassembly:
push 0
jne 0x41bb96
push 2
push 0xa1
push eax
call 0x52b10a
dec esi
xor eax, eax
jmp 0x437115
mov eax, dword [ebp + 0xdc]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, esi
call fcn.0042b724
cmp eax, 1
jne 0x41bc08
mov ecx, dword [edi]
push 0
push ecx
mov ecx, dword [esp + 0x18]
call fcn.0042bfc7
cmp eax, ebx
je 0x41bc08
add byte [ebx], bh
ret
mov edx, dword [esp + 0x10]
push 0
push 0
push eax
lea ecx, [edx + 0x14]
call 0x42b24c
mov eax, dword [eax]
push eax
push 0x3ea
call 0x4306d9
test eax, eax
je 0x41bc08
test dword [eax + 0x14], 0x4000000
je 0x41bc08
mov ecx, dword [ebp + 0x1c]
push 0
push 2
push 0xa1
mov eax, dword [0x51000000]
call 0x524771
mov dword [0x1b8], eax
add cl, ch
jg 0x41bbbb
add dword [eax], eax
push edi
call fcn.004380f9
add esp, 4
test ax, ax
je 0x41c29e
mov ecx, eax
and ecx, 0xffff
invalid
Function at 0x41bc2b
Capabilities:
Packed with generic packer

Disassembly:
cmp ecx, 0x25
jge 0x41be05
add byte [eax], al
cmp ecx, 9
je 0x41bddd
cmp ecx, 0xd
je 0x41bc82
cmp ecx, 0x1b
jne 0x41be48
push eax
mov ecx, ebp
call fcn.0043567e
test eax, eax
jne 0x41bd65
cmp dword [ebp + 0xa8], 1
jne 0x41bd65
mov edx, dword [ebp + 0x1c]
push 0
push 0
push 0x10
push edx
call dword [0x46f42c]
mov eax, 1
jmp 0x437201
push eax
mov ecx, ebp
call fcn.004356b5
test eax, eax
jne 0x41bd65
mov dword [esp + 0x10], eax
mov eax, dword [edi]
test eax, eax
je 0x41bcee
push eax
mov eax, dword [ebp + 0x1c]
push eax
push eax
call 0x51dd7f
test eax, eax
je 0x41bcee
mov edx, dword [ebp + 0xdc]
lea ecx, [esp + 0x10]
push 0
push ecx
push edx
mov ecx, esi
call fcn.0042b83b
cmp eax, 1
jne 0x41bcee
mov eax, dword [edi]
mov ecx, dword [esp + 0x10]
push 0
push eax
call fcn.0042c0de
cmp eax, ebx
je 0x41bcee
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov ecx, ebp
call fcn.004364cf
cmp eax, 1
jne 0x41bcee
jmp 0x43726d
cmp dword [ebp + 0xa4], 1
jne 0x41bd11
mov edx, dword [edi]
push 0
push 0
push 1
push edx
mov ecx, ebp
call fcn.00435ae2
mov eax, 1
jmp 0x437290
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x41bd33
mov ecx, dword [ebp + 0xdc]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
mov ecx, esi
call fcn.0042b8a9
cmp eax, 1
jne 0x41bd65
mov edx, dword [esp + 0x10]
mov esi, 1
mov ebx, dword [edx + 0x18]
cmp ebx, esi
jle 0x41bd65
mov eax, dword [esp + 0x10]
push esi
push eax
mov ecx, ebp
call fcn.0043653b
cmp eax, 1
je 0x41c2e1
inc esi
cmp esi, ebx
jl 0x41bd43
mov edi, dword [esp + 0x94]
mov eax, dword [edi + 4]
cmp eax, 0x100
je 0x41bda4
cmp eax, 0x101
je 0x41bda4
cmp eax, 0x104
je 0x41bda4
cmp eax, 0x105
je 0x41bda4
cmp eax, 0x102
je 0x41bda4
cmp eax, 0x200
jb 0x41bd99
cmp eax, 0x209
jbe 0x41bda4
cmp eax, 0x20a
jne case.0x41c433.518
mov ecx, dword [ebp + 0xdc]
xor ebx, ebx
lea eax, [esp + 0x10]
push ebx
push eax
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.0042b937
mov esi, 1
cmp eax, esi
jne case.0x41c433.518
mov eax, dword [edi]
mov ecx, dword [ebp + 0x1c]
cmp eax, ecx
jne 0x41c2eb
xor eax, eax
jmp 0x4370d7
push eax
mov ecx, ebp
call fcn.00435810
test eax, eax
jne 0x41bd65
mov ecx, dword [edi]
push eax
push eax
push 1
push ecx
mov ecx, ebp
call fcn.00435bd6
mov eax, 1
jmp 0x437384
cmp ax, 0x27
je 0x41be15
cmp ax, 0x28
je 0x41be15
xor eax, eax
jmp 0x41be1a
mov eax, 1
mov edx, dword [edi]
push eax
push edx
mov ecx, ebp
call fcn.00435b50
cmp eax, 1
jne 0x41bd65
jmp 0x4373b2
mov edx, eax
and edx, 0xe000
cmp edx, 0x8000
jne 0x41bd65
and ecx, 0xff
mov byte [esp + 0x24], 0
mov ebx, ecx
cmp ebx, 0x30
invalid

Function at 0x41ee3a
Capabilities:
Encode data using xor

Disassembly:
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]

Function at 0x4231e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
aad 0x8b
test byte [esp + eax*4], ah
add byte [eax], al
add byte [ebp - 0x72ea8b40], al
dec esp
and al, 0x48
Function at 0x42365a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x2c
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x34]
dec esi
mov dword [esp + 0x84], eax
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x24]
neg esi
mov dword [esp + 0x90], eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x78], edx
sbb esi, esi
mov dword [esp + 0x80], eax
inc esi
mov dword [esp + 0x88], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0x475fd4
push 2
lea edx, [esp + 0x70]
push 5
push edx
mov byte [esp + 0xac], 1
call 0x51025c
in eax, dx
push eax
lea ecx, [esp + 0x1c]
call 0x48929f
lea eax, [esp + 0x18]
push 1
push eax
mov ecx, edi
call 0x488eeb
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x44], ecx
and al, 0x44
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x94]
push ebx
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0xb8]
push edx
push ebp
push eax
lea edx, [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push edi
call fcn.00445819
test eax, eax
jne 0x423750
mov dword [esp + 0x18], 0x4751e0
lea ecx, [esp + 0x18]
mov byte [esp + 0xa0], 2
call 0x489367
jmp 0x445c3f
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x28]
cmp esi, 1
mov dword [esp + 0x84], eax
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x38]
cmp byte [ecx + 0x80248c], cl
add byte [eax], al
xchg byte [ecx + eax + 0x50ff0000], dh
or byte [ebx - 0x3f7afb3c], al
jne 0x445c51
pop edi
pop esi
ret
mov ecx, dword [esi + 0x144]
xor eax, eax
test ecx, ecx
jle 0x445c74
lea ecx, [edi + 0x18]
mov dword [ecx], 0
mov edx, dword [esi + 0x144]
inc eax
add ecx, 4
cmp eax, edx
jl 0x445c60
mov dword [edi + 0x14], 0
mov ecx, dword [esi + 0x114]
mov dword [edi + 0x28], ecx
mov dword [edi + 0x10], 0
pop edi
mov eax, 1
pop esi
ret
Function at 0x4236f6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x2c
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x34]
dec esi
mov dword [esp + 0x84], eax
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x24]
neg esi
mov dword [esp + 0x90], eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x78], edx
sbb esi, esi
mov dword [esp + 0x80], eax
inc esi
mov dword [esp + 0x88], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0x475fd4
push 2
lea edx, [esp + 0x70]
push 5
push edx
mov byte [esp + 0xac], 1
call 0x51025c
in eax, dx
push eax
lea ecx, [esp + 0x1c]
call 0x48929f
lea eax, [esp + 0x18]
push 1
push eax
mov ecx, edi
call 0x488eeb
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x44], ecx
and al, 0x44
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x94]
push ebx
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0xb8]
push edx
push ebp
push eax
lea edx, [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push edi
call fcn.00445819
test eax, eax
jne 0x423750
mov dword [esp + 0x18], 0x4751e0
lea ecx, [esp + 0x18]
mov byte [esp + 0xa0], 2
call 0x489367
jmp 0x445c3f
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x28]
cmp esi, 1
mov dword [esp + 0x84], eax
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x38]
cmp byte [ecx + 0x80248c], cl
add byte [eax], al
xchg byte [ecx + eax + 0x50ff0000], dh
or byte [ebx - 0x3f7afb3c], al
jne 0x445c51
pop edi
pop esi
ret
mov ecx, dword [esi + 0x144]
xor eax, eax
test ecx, ecx
jle 0x445c74
lea ecx, [edi + 0x18]
mov dword [ecx], 0
mov edx, dword [esi + 0x144]
inc eax
add ecx, 4
cmp eax, edx
jl 0x445c60
mov dword [edi + 0x14], 0
mov ecx, dword [esi + 0x114]
mov dword [edi + 0x28], ecx
mov dword [edi + 0x10], 0
pop edi
mov eax, 1
pop esi
ret

Function at 0x423780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [ecx + 0x80248c], cl
add byte [eax], al
mov dword [esp + 0x90], eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x88], edx
mov dword [esp + 0x78], eax
jne 0x4237b5
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 4]
push eax
push ecx
push esi
call 0x51c766
jmp 0x4237be
push 0
mov ecx, edi
call 0x488e04
invalid
lea ecx, [esp + 0x18]
call 0x4893e3
push 2
Function at 0x424ad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ebx
call 0x483fe8
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x24]
push 6
push ecx
mov eax, dword [esi]
mov dword [ebp - 4], ebx
mov ecx, esi
mov byte [ebp - 4], 1
call dword [eax + 0x34]
cmp eax, 6
jne 0x424c90
cmp word [ebp - 0x24], bx
jne 0x424c90
mov cx, word [ebp - 0x22]
cmp cx, 1
je 0x424b1c
cmp cx, 2
jne 0x424c90
mov eax, dword [ebp - 0x20]
cmp ax, bx
cmp eax, ebx
jbe 0x424c90
xor edx, edx
cmp cx, 1
sete dl
and eax, 0xffff
mov dword [ebp - 0x18], edx
rol dword [eax + 0x4e8e0f0a], 1
add byte [eax], al
xor edi, edi
cmp edi, dword [ebp + 8]
jge 0x424b98
mov eax, dword [esi]
mov ecx, edi
shl ecx, 4
add ecx, 6
push ebx
push ecx
mov ecx, esi
call dword [eax + 0x28]
mov edx, dword [esi]
lea eax, [ebp - 0x3c]
push 0x10
push eax
mov ecx, esi
call dword [edx + 0x34]
cmp eax, 0x10
jne 0x424c90
cmp byte [ebp - 0x3a], 0x10
jb 0x424b95
cmp dword [ebp + 0xc], 1
jne 0x424b86
mov cl, byte [ebp - 0x3c]
xor eax, eax
cmp cl, 0x20
jmp 0x424b8e
mov cl, byte [ebp - 0x3c]
xor eax, eax
cmp cl, 0x10
sete al
invalid

Function at 0x42915a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, esi
call dword [edx + 4]
lea ecx, [esp + 0x624]
invalid
invalid

Function at 0x429168
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and al, 0x40
push es
add byte [eax], al
xor al, byte [eax]
add byte [eax], al

Function at 0x429227
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and al, 0x40
push es
add byte [eax], al
sub eax, ebp
add dh, byte [ecx + 6]
jno 0x42922f
add byte [ebp + 0x3a8248c], cl
add byte [eax], al

Function at 0x4295a1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
mov eax, 0x1418
add byte [eax], al
mov dword fs:[0], esp
call 0x478c5a
add al, 0
push ebx
Function at 0x4295b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
test eax, eax
invalid
jne 0x4295c3
xor eax, eax
jmp 0x451f2e
invalid
mov dword [edx], eax
invalid
lea ecx, [esp + 0x78]
call fcn.004525b7
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x1430], 0
mov eax, dword [ecx]
call dword [eax + 0x5c]
test eax, eax
je 0x4295ed
push eax
lea ecx, [esp + 0x7c]
call fcn.00452768
mov ebx, dword [0x46f1b4]
lea ecx, [esp + 0x234]
push 0x1f4
push ecx
push 0x48a240
push str.device
push str.windows
call ebx
lea edx, [esp + 0x234]
push 0x4811d8
push edx
call 0x4796fc
add esp, 8
mov dword [esp + 0x20], eax
lea eax, [esp + 0x428]
push 0x1000
push eax
push 0x48f604
push 0
push str.devices
call ebx
mov ecx, dword [0x48b5a8]
or eax, 0xffffffff
lea esi, [esp + 0x428]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x1430], 1
call 0x487664
lea ecx, [esp + 0x50]
mov byte [esp + 0x1430], 2
call 0x487675
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1430], 3
call 0x487686
mov byte [esp + 0x1430], 4
and al, 0x30
adc al, 0
add byte [ebx + ecx*4], al
invalid
mov ds, word [eax]
mov dword [edi + ecx*4 + 0x18], eax
mov eax, dword [esi + ecx*4 + 0x14]
mov dword [edi + ecx*4 + 0x14], eax
mov eax, dword [esi + ecx*4 + 0x10]
mov dword [edi + ecx*4 + 0x10], eax
mov eax, dword [esi + ecx*4 + 0xc]
mov dword [edi + ecx*4 + 0xc], eax
mov eax, dword [esi + ecx*4 + 8]
mov dword [edi + ecx*4 + 8], eax
mov eax, dword [esi + ecx*4 + 4]
mov dword [edi + ecx*4 + 4], eax
lea eax, [ecx*4]
add esi, eax
add edi, eax
jmp dword [edx*4 + 0x451f70]
Function at 0x429696
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc]
test eax, eax
invalid
jne 0x4295c3
xor eax, eax
jmp 0x451f2e
invalid
mov dword [edx], eax
invalid
lea ecx, [esp + 0x78]
call fcn.004525b7
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x1430], 0
mov eax, dword [ecx]
call dword [eax + 0x5c]
test eax, eax
je 0x4295ed
push eax
lea ecx, [esp + 0x7c]
call fcn.00452768
mov ebx, dword [0x46f1b4]
lea ecx, [esp + 0x234]
push 0x1f4
push ecx
push 0x48a240
push str.device
push str.windows
call ebx
lea edx, [esp + 0x234]
push 0x4811d8
push edx
call 0x4796fc
add esp, 8
mov dword [esp + 0x20], eax
lea eax, [esp + 0x428]
push 0x1000
push eax
push 0x48f604
push 0
push str.devices
call ebx
mov ecx, dword [0x48b5a8]
or eax, 0xffffffff
lea esi, [esp + 0x428]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x1430], 1
call 0x487664
lea ecx, [esp + 0x50]
mov byte [esp + 0x1430], 2
call 0x487675
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1430], 3
call 0x487686
mov byte [esp + 0x1430], 4
and al, 0x30
adc al, 0
add byte [ebx + ecx*4], al
invalid
mov ds, word [eax]
mov dword [edi + ecx*4 + 0x18], eax
mov eax, dword [esi + ecx*4 + 0x14]
mov dword [edi + ecx*4 + 0x14], eax
mov eax, dword [esi + ecx*4 + 0x10]
mov dword [edi + ecx*4 + 0x10], eax
mov eax, dword [esi + ecx*4 + 0xc]
mov dword [edi + ecx*4 + 0xc], eax
mov eax, dword [esi + ecx*4 + 8]
mov dword [edi + ecx*4 + 8], eax
mov eax, dword [esi + ecx*4 + 4]
mov dword [edi + ecx*4 + 4], eax
lea eax, [ecx*4]
add esi, eax
add edi, eax
jmp dword [edx*4 + 0x451f70]

Function at 0x42969e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x30
adc al, 0
add byte [ebx + ecx*4], al
inc byte [ebx - 0x3fcc0037]
or ecx, 0xffffffff
xor eax, eax

Function at 0x42babb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor bl, byte [esi + eax]
push ebp
push ebp
push ebp
lea ecx, [esp + 0x1d0]
mov byte [esp + 0x290], 0xb
call 0x491708
mov eax, 5
mov dword [esp + 0x164], ebp
mov dword [esp + 0x16c], ebp
mov dword [esp + 0x168], ebp
mov dword [esp + 0x170], eax
mov dword [esp + 0x17c], ebp
mov dword [esp + 0x184], ebp
mov dword [esp + 0x180], ebp
mov dword [esp + 0x188], eax
lea ecx, [esp + 0x1ec]
mov byte [esp + 0x284], 0xe
call fcn.00454da2
mov ecx, dword [0x48b5a8]
mov dword [esp + 0xb0], ecx
mov byte [esp + 0x284], 0x10
mov dword [esp + 0x54], 1

Function at 0x437058
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [eax + eax*2]
push eax
call 0x495d1a
mov ecx, dword [ebx + 0x80]
add esp, 4
mov dword [ebx + 0xa8], eax
lea ecx, [ecx + ecx*2]
lea edx, [ecx + 0xd]
cmp esi, edx
jg 0x437098
push eax
call 0x495d62
add esp, 4
mov dword [ebx + 0xa8], edi
mov dword [ebx + 0x80], edi
mov edi, eax
mov eax, ecx
lea esi, [ebp + 0xd]
shr ecx, 0xa2
push ebx
test eax, 0xe183c88b
add esi, ebx
movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x80]
mov esi, dword [esp + 0x18]
lea ecx, [eax + ebp]
lea ebp, [ecx + eax*2 + 0xd]
jmp 0x4370c1
Function at 0x440010
Capabilities:
Check for software breakpoints

Disassembly:
sti
and byte [eax + eax], al
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44002c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4400b9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4400a2
mov eax, dword [esi + 8]
test eax, eax
je 0x440057
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44009e
cmp eax, 2
je 0x4400a2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44004a
xlatb
cmp eax, 3
je 0x44007d
cmp eax, 1
jne 0x44004a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44004a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44004a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
invalid
invalid

Function at 0x444687
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x11c]
mov eax, dword [edi + 0x13c]
mov ecx, dword [edi + 0x98]
mov esi, dword [edi + 0x1a8]
dec eax
mov dword [esp + 0x88], eax
mov eax, dword [edi + 0x90]
cmp eax, ecx
mov dword [esp + 0x94], esi
jg 0x44470a
mov edx, dword [edi + 0x1b0]
mov ebx, dword [edx + 0x14]
test ebx, ebx
jne 0x44470a
cmp eax, ecx
jne 0x4446ec
mov ebp, dword [edi + 0x18c]
mov ebx, dword [edi + 0x9c]
mov ecx, dword [edi + 0x94]
xor eax, eax
test ebp, ebp
sete al
add eax, ebx
cmp ecx, eax
ja 0x44470a
push ds
push edi
call dword [edx]
add esp, 4
test eax, eax
je 0x44477a
mov eax, dword [edi + 0x90]
mov ecx, dword [edi + 0x98]
cmp eax, ecx
jle 0x4446bc
mov ecx, dword [edi + 0x20]
mov ebp, dword [edi + 0xd8]
xor eax, eax
mov dword [esp + 0x2c], ebp
cmp ecx, eax
mov dword [esp + 0x68], eax
jle 0x444cc2
mov ecx, dword [esp + 0x120]
mov dword [esp + 0x54], eax
mov eax, 0xffffffbc
lea ebx, [esi + 0x48]
sub eax, esi
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x8c], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret
mov esi, dword [edi + 0x9c]
mov edx, dword [edi + 0x13c]
inc esi
mov eax, esi
mov dword [edi + 0x9c], esi
cmp eax, edx
pop edi
sbb eax, eax
pop esi
pop ebp
add eax, 4
pop ebx
add esp, 0x108
ret

Function at 0x444768
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, ecx
mov dword [esp + 0x60], 0
mov dword [esp + 0x10], eax
add eax, eax
jmp 0x4447a6
Function at 0x444a1e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cdq
shl ebp, 8
idiv ebp
test ecx, ecx
jle 0x444a36
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x444a36
lea eax, [edx - 1]
neg eax
mov ebp, dword [esp + 0x2c]
mov word [esp + 0xa8], ax
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + 0xc]
test ecx, ecx
je 0x444acb
cmp word [esp + 0xb8], 0
jne 0x444acb
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x74]
lea eax, [edx + edx]
mov edx, eax
mov eax, dword [esp + 0x20]
sub eax, edx
mov edx, dword [esp + 0x1c]
add eax, edx
imul eax, dword [esp + 0x18]
lea edx, [eax + eax*8]
mov eax, ebp
test edx, edx
jl 0x444aa0
shl eax, 7
add eax, edx
cdq
shl ebp, 8
idiv ebp
test ecx, ecx
jle 0x444abf
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x444abf
lea eax, [edx - 1]
jmp 0x444abf
shl eax, 7
sub eax, edx
cdq
shl ebp, 8
idiv ebp
test ecx, ecx
jle 0x444abd
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x444abd
lea eax, [edx - 1]
neg eax
mov ebp, dword [esp + 0x2c]
mov word [esp + 0xb8], ax
mov eax, dword [esp + 0x14]