joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a8b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x814
mov eax, dword [0x46e460]
xor eax, esp
mov dword [esp + 0x80c], eax
mov eax, dword [esp + 0x818]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x82c]
push 0x464898
push eax
mov dword [esp + 0x1c], ecx
or esi, 0xffffffff
call fcn.00434eae
mov edi, eax
add esp, 8
test edi, edi
je 0x42a974
push 2
push 0
push edi
call fcn.00434d65
add esp, 0xc
push edi
call fcn.004362b1
add esp, 4
push 0
push 0
push edi
mov ebx, eax
call fcn.00434d65
add esp, 0xc
lea ebp, [esp + 0x18]
cmp ebx, 0x800
jb 0x42a934
lea edx, [ebx + 1]
push edx
call fcn.004317ee
add esp, 4
mov ebp, eax
push edi
push ebx
push 1
push ebp
call fcn.004360f7
add esp, 0x10
test eax, eax
jbe 0x42a95a
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
push 0
push ebx
push eax
mov ecx, ebp
call fcn.0042a9a0
mov esi, eax
push edi
call fcn.0043448e
lea ecx, [esp + 0x1c]
add esp, 4
cmp ebp, ecx
je 0x42a974
push ebp
call fcn.00432bdd
add esp, 4
mov ecx, dword [esp + 0x81c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00432bce
add esp, 0x814
ret 8

Function at 0x42ab50
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebx, ecx
mov edi, edx
test eax, eax
je 0x42ab7e
push eax
mov eax, dword [edi*4 + 0x46fc10]
push ebx
push eax
mov ecx, ebp
call fcn.0042a9a0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov cl, byte [esi + 0x35]
test cl, cl
je 0x42ab98
push 0
push ebp
push edi
mov edi, esi
call fcn.0042abf0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
lea edx, [ebx + 0x10]
push edx
call fcn.00433147
add esp, 4
mov esi, eax
push ebx
lea eax, [esi + 0xc]
push ebp
push eax
mov dword [esi], edi
mov dword [esi + 4], 0
mov dword [esi + 8], ebx
call fcn.00437760
add esp, 0xc
push 0
push 0
push esi
push 0x42a420
push 0
push 0
call fcn.00435da7
add esp, 0x18
push eax
call dword [0x45a07c]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x42fbd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x457bc3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46e460]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esi], 0x464aa4
mov byte [esi + 4], 1
mov byte [esi + 5], 1
mov byte [esi + 6], bl
mov byte [esi + 7], bl
lea eax, [esi + 0x20]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
push eax
mov byte [esi + 0x18], 0xff
mov dword [esi + 0x1c], ebx
call fcn.004156c0
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x2c]
mov dword [esi], 0x464c34
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ebx
xor edx, edx
mov dword [esi + 0x64], 7
mov dword [esi + 0x60], ebx
mov word [esi + 0x50], dx
mov byte [esp + 0x20], 1
mov dword [esi + 0x68], 1
mov dword [esi + 0x6c], 0xff000000
mov dword [esi + 0x74], ebx
mov dword [esi + 0x70], ebx
mov eax, dword [esi + 0x44]
push eax
push ecx
call fcn.0042bfe0
add esp, 4
call fcn.0042c1b0
mov edi, eax
mov edx, dword [edi + 4]
lea ecx, [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x30], ebx
call fcn.00430cd2
cmp eax, ebx
je 0x42fc9e
mov dword [edi + 8], eax
mov ecx, dword [edi + 4]
mov ebp, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
push ecx
mov dword [esp + 0x34], ebx
call fcn.00430d56
cmp eax, ebx
je 0x42fcbb
mov dword [edi + 8], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
shr eax, 2
cmp ecx, ecx
jne 0x42fcda
cmp edx, edx
jne 0x42fcda
cmp dword [esi + 0x10], eax
jne 0x42fcda
cmp dword [esi + 0x14], ebp
je 0x42fce6
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebp
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x450df0
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
jne 0x450e43
cmp dword [esi + 4], 0
jne 0x450e4c
call fcn.0043828d
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call fcn.004360f7
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x450e47
mov edx, dword [esi + 0x40]
push edx
mov dword [esi + 0x3c], 1
call fcn.00455890
add esp, 4
test eax, eax
je 0x450e43
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
dec dword [esi + 4]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
ret

Function at 0x450e60
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, eax
push edi
mov edi, dword [esi + 4]
cmp edi, 2
jae 0x450ed5
test edi, edi
je 0x450e79
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov dl, byte [eax]
mov byte [ecx], dl
call fcn.0043828d
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, edi
push eax
mov eax, dword [esi + 0x44]
mov edx, 0x4000
sar edx, cl
add eax, edi
push edx
push 1
push eax
call fcn.004360f7
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x450ebf
mov ecx, dword [esi + 0x40]
push ecx
call fcn.00455890
add esp, 4
test eax, eax
je 0x450ebf
mov dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov edx, dword [esi + 0x44]
mov dword [esi], edx
cmp eax, 2
jae 0x450ed5
pop edi
mov dword [esi + 0x58], eax
pop esi
ret
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x450fae
cmp byte [eax + 1], 0x8b
jne 0x450fae
add dword [esi + 4], 0xfffffffe
add eax, 2
push ebx
mov dword [esi], eax
call fcn.00450df0
mov edi, eax
call fcn.00450df0
mov ebx, eax
cmp edi, 8
jne 0x450fa3
test bl, 0xe0
jne 0x450fa3
mov edi, 6
lea esp, [esp]
call fcn.00450df0
sub edi, 1
jne 0x450f20
test bl, 4
je 0x450f51
call fcn.00450df0
mov edi, eax
call fcn.00450df0
shl eax, 8
add edi, eax
mov eax, edi
dec edi
test eax, eax
je 0x450f51
call fcn.00450df0
cmp eax, 0xffffffff
jne 0x450f40
test bl, 8
je 0x450f64
call fcn.00450df0
test eax, eax
je 0x450f64
cmp eax, 0xffffffff
jne 0x450f56
test bl, 0x10
je 0x450f7e
lea esp, [esp]
call fcn.00450df0
test eax, eax
je 0x450f7e
cmp eax, 0xffffffff
jne 0x450f70
test bl, 2
je 0x450f92
mov edi, 2
call fcn.00450df0
sub edi, 1
jne 0x450f88
mov ecx, dword [esi + 0x3c]
neg ecx
sbb ecx, ecx
pop ebx
and ecx, 0xfffffffd
pop edi
mov dword [esi + 0x38], ecx
pop esi
ret
pop ebx
pop edi
mov dword [esi + 0x38], 0xfffffffd
pop esi
ret
pop edi
mov dword [esi + 0x58], 1
pop esi
ret
Function at 0x451070
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x45111b
cmp byte [esi + 0x5c], 0x77
jne 0x45111b
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
mov dword [esi], ebp
mov dword [esi + 4], edi
test edi, edi
je 0x451101
lea ebx, [ebx]
cmp dword [esi + 0x10], 0
jne 0x4510ca
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call fcn.00434395
add esp, 0x10
cmp eax, 0x4000
jne 0x4510fa
mov dword [esi + 0x10], eax
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x10]
add dword [esi + 0x64], edx
add dword [esi + 0x68], eax
push 0
push esi
call fcn.00452480
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
sub dword [esi + 0x64], ecx
sub dword [esi + 0x68], edx
add esp, 8
mov dword [esi + 0x38], eax
test eax, eax
jne 0x451101
test ecx, ecx
jne 0x4510a0
jmp 0x451101
mov dword [esi + 0x38], 0xffffffff
mov eax, dword [esi + 0x4c]
push edi
push ebp
push eax
call fcn.004523e0
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, edi
sub eax, dword [esi + 4]
pop edi
pop ebp
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x451130
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x4511e4
cmp byte [esi + 0x5c], 0x77
jne 0x4511e4
mov dword [esi + 4], ebx
push edi
lea esp, [esp]
mov edi, 0x4000
sub edi, dword [esi + 0x10]
je 0x45117e
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call fcn.00434395
add esp, 0x10
cmp eax, edi
jne 0x4511da
mov edx, dword [esi + 0x48]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x4000
test ebx, ebx
jne 0x4511ca
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push ecx
push esi
call fcn.00452480
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
add esp, 8
mov dword [esi + 0x38], eax
test edi, edi
jne 0x4511ab
cmp eax, 0xfffffffb
jne 0x4511ab
mov dword [esi + 0x38], edi
test ecx, ecx
jne 0x4511b9
cmp dword [esi + 0x38], 1
je 0x4511b9
xor ebx, ebx
jmp 0x4511be
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x451150
cmp eax, 1
je 0x451150
mov esi, dword [esi + 0x38]
mov eax, esi
dec eax
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x452fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x2c]
push edi
lea esp, [esp]
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea edx, [ecx + ebp - 0x106]
mov dword [esp + 0xc], edi
cmp eax, edx
jb 0x453050
mov eax, dword [esi + 0x38]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call fcn.00437760
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebp
sub dword [esi + 0x6c], ebp
add esp, 0xc
sub dword [esi + 0x5c], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x45301f
sub eax, ebp
jmp 0x453021
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x453010
mov ecx, dword [esi + 0x40]
mov edx, ebp
lea ecx, [ecx + ebp*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x453040
sub eax, ebp
jmp 0x453042
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x453031
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x453107
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [esp + 0xc]
mov ebx, ecx
mov dword [esp + 0x10], eax
cmp ebx, edx
jbe 0x453078
mov ebx, edx
test ebx, ebx
je 0x4530c9
mov edx, dword [edi + 0x1c]
sub ecx, ebx
mov dword [edi + 4], ecx
mov ecx, dword [edx + 0x18]
cmp ecx, 1
jne 0x45309b
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
push eax
push ecx
call fcn.00451e90
jmp 0x4530ad
cmp ecx, 2
jne 0x4530b7
mov edx, dword [edi]
mov eax, dword [edi + 0x30]
push ebx
push edx
push eax
call fcn.004523e0
mov dword [edi + 0x30], eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [edi]
push ebx
push ecx
push eax
call fcn.00437760
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x4530f3
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x453107
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x452fd0
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x42ca0d
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.0042c9b6
test eax, eax
je 0x42cb66
lea ecx, [esp + 0x18]
call fcn.0042c9b6
lea ecx, [esp + 0x18]
test eax, eax
je 0x42cad5
call fcn.0042c9b6
test eax, eax
je 0x42ca97
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.0042c9b6
lea edi, [eax + edi*2]
dec ebx
jne 0x42ca6d
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x42ca8e
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x42ca91
mov byte [edx], 0
inc edx
jmp 0x42cb78
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x42cacd
test ecx, ecx
je 0x42cb61
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42cabf
jmp 0x42cb5d
xor ebp, ebp
inc ebp
jmp 0x42cb61
call fcn.0042c9ec
test edi, edi
jne 0x42cb0a
cmp eax, 2
jne 0x42cb05
lea ecx, [esp + 0x18]
call fcn.0042c9ec
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x42cb61
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x42cafa
jmp 0x42cb5d
sub eax, 3
jmp 0x42cb0d
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.0042c9ec
mov ecx, eax
cmp esi, 0x7d00
jb 0x42cb34
inc ecx
cmp esi, 0x500
jb 0x42cb3d
inc ecx
cmp esi, 0x80
jae 0x42cb48
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x42cb61
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42cb54
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x42cb7e
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x42ca3d
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42cd03
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x42cd35
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x42cd16
jmp 0x42cd39
mov eax, dword [esp + 0x10]
test edi, edi
je 0x42cd43
xor byte [esi], al
inc esi
dec edi
jne 0x42cd3d
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x403a5f
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 4]
mov eax, dword [ebp - 4]
jmp 0x403a96
mov esp, ebp
pop ebp
ret
Function at 0x40f571
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40f625
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040f501
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40f5fe
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f631
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40f64c
test ebp, ebp
je 0x40f64c
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40f654
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40f694
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40f6f0
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40f6eb
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40f6d6
test dl, dl
je 0x40f6d2
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40f6d6
add ecx, 2
add eax, 2
test dl, dl
jne 0x40f6b6
xor eax, eax
jmp 0x40f6db
sbb eax, eax
or eax, 1
test eax, eax
je 0x40f6fa
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40f6a3
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40f711
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040f571
test eax, eax
jne 0x40f729
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040f631
mov esi, eax
test esi, esi
jne 0x40f75f
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40f779
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x40f871
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0040f571
mov esi, eax
test esi, esi
jne 0x40f88f
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0040f631
mov dword [esp + 0x18], eax
test eax, eax
je 0x40f887
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0040f631
mov dword [esp + 0x34], eax
test eax, eax
je 0x40f887
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0040f631
mov dword [esp + 0x28], eax
test eax, eax
je 0x40f887
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0040f631
mov dword [esp + 0x30], eax
test eax, eax
je 0x40f887
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x40fa56
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x40fa56
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x40f9b9
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x40fa3a
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x40f9dc
movzx esi, ax
jmp 0x40f9e1
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x40fa00
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x40fa0f
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x40fa63
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x40f9d1
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x40f996
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x40fa8c
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x40fa8c
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x40fa71
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x40faa1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0040f571
mov esi, eax
test esi, esi
je 0x40fb5d
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0040f631
mov ebp, eax
test ebp, ebp
je 0x40fb5c
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0040f631
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x40fb5c
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x40fb5c
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40fb5b
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x40fb41
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x40fe7f
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x40fe8f
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jle 0x40ff9d
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cwde
call fcn.0040ffad
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5a4d
jne 0x40ff9d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call fcn.0040ffad
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4550
jne 0x40ff9d
pop eax
push eax
mov eax, dword [eax + 0x7c]
call fcn.0040ffad
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40ff9d
pop eax
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push eax
mov eax, dword [eax + 0x20]
add eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
pop eax
mov eax, dword [eax + 0x18]
dec eax
mov dword [ebp - 4], eax
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x40ff9a
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.0040ffc0
test eax, eax
je 0x40ff89
push ecx
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop ecx
leave
ret 8
push dword [ebp - 8]
call fcn.0040fff4
add dword [ebp - 0xc], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x40ff44
add esp, 0xc
mov eax, 0
jmp 0x40ffa7
mov esp, ebp
pop ebp
ret 8