joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63a3f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.004e72e0
mov eax, dword [0x6e33d4]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [esp + 0xbc]
xor ebp, ebp
mov dword [esp + 0x2c], eax
push edi
mov eax, dword [esi + 8]
mov dword [esp + 0x10], eax
sub eax, ebx
mov dword [esp + 0x24], eax
cmp dword [esi + 0xc], ebx
jae 0x63a450
push 0x4d4
push 0x6c4304
push str.assertion_failed:_rec__orig_len___md_size
call fcn.0058acc0
add esp, 0xc
cmp ebx, 0x40
jbe 0x63a46c
push 0x4d5
push 0x6c4304
push str.assertion_failed:_md_size___EVP_MAX_MD_SIZE
call fcn.0058acc0
add esp, 0xc
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x34]
neg eax
mov dword [esp + 0x20], ecx
and eax, 0x3f
lea edi, [esp + 0x34]
add edi, eax
lea eax, [ebx + 0x100]
mov dword [esp + 0x2c], edi
cmp ecx, eax
jbe 0x63a49a
mov ebp, ecx
sub ebp, ebx
sub ebp, 0x100
push ebx
xor esi, esi
mov dword [esp + 0x18], 0
push esi
push edi
call fcn.004fe600
add esp, 0xc
mov dword [esp + 0x18], esi
cmp ebp, dword [esp + 0x20]
jae 0x63a54d
mov eax, dword [esp + 0xc0]
mov ecx, ebp
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x28], eax
mov eax, ebp
mov edx, ecx
xor eax, dword [esp + 0x24]
xor edx, dword [esp + 0x10]
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, ebp
xor eax, dword [esp + 0x10]
neg edi
or edx, eax
mov eax, dword [esp + 0x28]
xor edx, ebp
shr edx, 0x1f
neg edx
mov cl, byte [eax + ebp]
mov eax, edi
or eax, dword [esp + 0x14]
inc ebp
and eax, edx
mov edx, dword [esp + 0x18]
and edi, edx
mov dword [esp + 0x14], eax
and al, cl
or esi, edi
mov edi, dword [esp + 0x2c]
or byte [edx + edi], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, ebx
xor eax, ebx
xor ecx, ebx
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
cmp ebp, dword [esp + 0x20]
jb 0x63a4d5
xor edx, edx
test ebx, ebx
je 0x63a581
mov ebp, dword [esp + 0x30]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + edi]
movzx eax, byte [esi + edi]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, ebx
mov eax, esi
xor ecx, ebx
xor eax, ebx
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, ebx
jb 0x63a557
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e6543
add esp, 0xa8
ret
Function at 0x63b0c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.004e72e0
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov eax, dword [ebx + 4]
mov edi, dword [esp + 0x28]
inc edi
mov eax, dword [eax + 0x64]
test byte [eax + 0x34], 1
je 0x63b10d
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 8]
lea eax, [edi + ecx]
cmp eax, edx
jbe 0x63b0fd
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
add dword [esi + 0x14], ecx
sub edx, ecx
add dword [esi + 0x18], ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], edx
jmp 0x63b112
cmp edi, dword [esi + 8]
ja 0x63b0f4
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
push ebp
push dword [ebx + 0xb0]
mov al, byte [ecx + eax - 1]
movzx ebp, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebp
call fcn.005780f0
push eax
call fcn.00574620
add esp, 8
test eax, 0x200000
je 0x63b158
or eax, 0xffffffff
sub eax, ebp
add dword [esi + 8], eax
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esi + 8]
lea ecx, [edi + ebp]
mov ebx, edx
mov dword [esp + 0x10], edx
sub ebx, ecx
mov eax, edx
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edx
shr ebx, 0x1f
dec ebx
cmp edx, eax
cmovb eax, edx
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x63b1e4
mov eax, dword [esi + 0x14]
mov esi, dword [esp + 0x20]
mov edx, esi
mov ebp, dword [esp + 0x10]
shr edx, 0x1f
dec ebp
mov dword [esp + 0x18], edx
add ebp, eax
nop
mov ecx, esi
lea ebp, [ebp - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x2c]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [ebp + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x18]
cmp edi, dword [esp + 0x14]
jb 0x63b1a0
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
not ebx
movzx eax, bl
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [ebp + 1]
neg ecx
and eax, ecx
sub edx, eax
mov eax, ecx
pop ebp
pop edi
mov dword [esi + 8], edx
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebx
add esp, 0xc
ret
Function at 0x63fb10
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
cmp dword [eax], 5
je 0x63fb2b
push eax
push esi
call fcn.00640150
add esp, 8
test eax, eax
jle 0x63fb73
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push esi
mov edi, eax
call fcn.005743d0
add esp, 8
test edi, edi
jg 0x63fb70
push edi
call fcn.005bc680
add esp, 4
test eax, eax
je 0x63fb70
push 0xa
push esi
call fcn.00574b30
add esp, 8
mov eax, edi
pop edi
pop esi
ret
Function at 0x50540fec
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
test eax, eax
jle 0x50541011
and eax, 0xffff
or eax, 0x80070000
ret 8

Function at 0x5054eb3e
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x468
push ebx
push ebp
push esi
xor esi, esi
cmp dword [0x5055df98], esi
push edi
mov dword [esp + 0x10], esi
jne 0x5054ed0f
push 0x14
call sub.MSVCR70.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x5054eb6f
mov ecx, eax
call fcn.5054e63e
jmp 0x5054eb71
xor eax, eax
mov dword [0x5055df98], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov dword [esp + 0x14], esi
mov esi, 0x5055dfa0
push esi
call fcn.50556c45
test eax, eax
je 0x5054ed0f
mov ebx, dword [sym.imp.MSVCR70.dll_wcscat]
push 0x505342dc
push esi
call ebx
push esi
mov edi, str.file:__
push edi
call ebx
add esp, 0x10
lea eax, [esp + 0x10]
push eax
mov eax, 0x50537848
push eax
push eax
mov ecx, 0x5055df50
call fcn.50538f90
test eax, eax
mov ebp, dword [sym.imp.MSVCR70.dll_swprintf]
jl 0x5054ec07
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x5054ec07
push dword [esp + 0x1c]
push esi
push 0x505342c4
push esi
call ebp
push dword [esp + 0x2c]
push edi
push 0x505342b8
push edi
call ebp
add esp, 0x20
mov dword [esp + 0x14], 1
jmp 0x5054ec11
push 0x505342ac
push esi
call ebx
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5054ec24
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esp + 0x10], 0
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x5054ecc7
cmp dword [esp + 0x14], 0
je 0x5054ed0f
push 0x5053429c
push edi
call dword [sym.imp.MSVCR70.dll_wcscpy]
pop ecx
pop ecx
push esi
call fcn.50556c45
push 0x505342dc
push esi
call ebx
push esi
push edi
call ebx
push 0x505342ac
push esi
call ebx
add esp, 0x18
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x5054ed0f
lea eax, [esp + 0x4c]
push eax
push edi
lea eax, [esp + 0x278]
push 0x50534290
push eax
call ebp
mov eax, dword [0x5055df98]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [esp + 0x270]
push edx
push eax
call dword [ecx + 0x20]
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.vsansi.dll_FindNextFileW]
test eax, eax
jne 0x5054ec8a
jmp 0x5054ed0f
lea eax, [esp + 0x4c]
push eax
push edi
lea eax, [esp + 0x278]
push 0x50534290
push eax
call ebp
mov eax, dword [0x5055df98]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [esp + 0x270]
push edx
push eax
call dword [ecx + 0x20]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.vsansi.dll_FindNextFileW]
test eax, eax
jne 0x5054ecc7
push dword [esp + 0x18]
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, dword [0x5055df98]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x468
ret
Function at 0x50556c45
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x50556c54
pop dword [ebp - 4]
mov eax, 0x1ce6d838
sub eax, 0xcc916be4
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x70af92ba
sub dword [ebp - 0x14], 0x225d4d6f
mov dword [ebp - 0x10], 0xf23efdd2
sub dword [ebp - 0x10], 0xc00bb18d
mov dword [ebp - 0xc], 0x8f74f563
add dword [ebp - 0xc], 0xbcd74ecb
mov dword [ebp - 8], 0xd2065b
sub dword [ebp - 8], 0xd2065b
lea eax, [ebp - 0x14]
push eax
mov eax, 0x909c1170
sub eax, 0x4049004c
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x7656b6fb
add dword [ebp - 0x14], 0xfe1bb25b
mov dword [ebp - 0x10], 0xdec95970
add dword [ebp - 0x10], 0x62a30805
mov dword [ebp - 0xc], 0xdc8944dc
add dword [ebp - 0xc], 0x86e62790
mov dword [ebp - 8], 0xd3329959
add dword [ebp - 8], 0x2ccd66a7
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0xb9227542
add eax, 0x97309bf2
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x38ec1
push 0
call eax
mov ecx, 0x4f6f8bc8
sub ecx, 0x4f6f4610
mov ebx, eax
mov edx, 0x50565000
add edx, dword [ebp - 4]
mov edi, 0x1b95c742
add edi, 0x7a2ee708
mov esi, dword [edx]
xor esi, edi
mov dword [ebx], esi
add ebx, 0xb2160e79
add ebx, 0x4de9f18b
add edx, 0x40e7cfce
sub edx, 0x40e7cfca
loop 0x50556d70
add eax, 0xa093d7bf
sub eax, 0xa092ce0c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd3a18dbb
add ecx, 0x7cb17245
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x5055a599
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.5055a582
and byte [esi + 0xc], 0
mov eax, 0x50530000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.MSVCR70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x5055a5f3
cmp dword [ebp - 0x18], 5
jb 0x5055a60b
jmp 0x5055a607
cmp dword [ebp - 0xc], 1
jne 0x5055a60b
cmp dword [ebp - 0x18], 4
ja 0x5055a607
jne 0x5055a60b
cmp dword [ebp - 0x14], 0
jbe 0x5055a60b
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x5055c050
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x412362
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
cmp dword [ebp - 0xcb4], 0
jne 0x41237e
mov dword [ebp - 0x31c], 0
jmp 0x4125c9
mov ecx, dword [ebp - 0xcb4]
mov dword [ebp - 0x50c], ecx
push ebx
add ebx, 0x16ca8
pop ebx
push edi
or edi, 0xe5bc
call 0x4123a6
add byte [eax + 0x4d], cl
xor al, 0x3b
dec esp
dec ecx
cmp eax, dword [ebx + 0x515f04c4]
push esi
add esp, 4
add ecx, 0x613a
add ecx, 0xeac
pop ecx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push ecx
push eax
add esp, 4
add ecx, 0x9da1
sub ecx, 0x17005
sub ecx, 0x28d0
pop ecx
push edi
add edi, 0x4fbe
and edi, 0x8381
or edi, 0xf5dd
and edi, 0x4695
pop edi
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
test esp, eax
out dx, eax
invalid
dec dword [ebx - 0xcaf73]
inc dword [ebx - 0x7276fd3f]
push eax
invalid
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
invalid
out dx, eax
invalid
jmp dword [esi - 0x77]
push ebp
int3
push esi
sub esi, 0x4cad
xor esi, 0x2964
xor esi, 0x4ed7
or esi, 0xdbfb
pop esi
push ecx
sub ecx, 0x74c1
call 0x41249d
add byte [edi + 0x41], al
inc esp
dec eax
cmp al, 0x3e
aaa
add esp, 4
pop ecx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x4124be
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x412518
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4123e6
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x4123e6
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x412502
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x41250c
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x412561
push eax
push ebx
add esp, 4
or eax, 0x13691
pop eax
push edx
and edx, 0x2f85
call 0x412541
add byte [ecx], bh
cmp cl, byte [ebp + 0x41]
cmp ecx, dword [esi + 0x38]
add esp, 4
add edx, 0x12f7
pop edx
push edx
sub edx, 0x9e84
pop edx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x4125c9
push ecx
push ecx
add esp, 4
add ecx, 0xd5b1
and ecx, 0x12f74
call 0x412581
add byte [esi], bh
dec ebp
cmp al, 0x43
cmp dh, byte [ebx + edi]
dec ebp
dec ebp
add esp, 4
pop ecx
push esi
push edi
add esp, 4
jmp 0x412592
pop esi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
invalid
test esp, esi
cli
invalid
Function at 0x412541
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
cmp dword [ebp - 0xcb4], 0
jne 0x41237e
mov dword [ebp - 0x31c], 0
jmp 0x4125c9
mov ecx, dword [ebp - 0xcb4]
mov dword [ebp - 0x50c], ecx
push ebx
add ebx, 0x16ca8
pop ebx
push edi
or edi, 0xe5bc
call 0x4123a6
add byte [eax + 0x4d], cl
xor al, 0x3b
dec esp
dec ecx
cmp eax, dword [ebx + 0x515f04c4]
push esi
add esp, 4
add ecx, 0x613a
add ecx, 0xeac
pop ecx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push ecx
push eax
add esp, 4
add ecx, 0x9da1
sub ecx, 0x17005
sub ecx, 0x28d0
pop ecx
push edi
add edi, 0x4fbe
and edi, 0x8381
or edi, 0xf5dd
and edi, 0x4695
pop edi
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
test esp, eax
out dx, eax
invalid
dec dword [ebx - 0xcaf73]
inc dword [ebx - 0x7276fd3f]
push eax
invalid
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
invalid
out dx, eax
invalid
jmp dword [esi - 0x77]
push ebp
int3
push esi
sub esi, 0x4cad
xor esi, 0x2964
xor esi, 0x4ed7
or esi, 0xdbfb
pop esi
push ecx
sub ecx, 0x74c1
call 0x41249d
add byte [edi + 0x41], al
inc esp
dec eax
cmp al, 0x3e
aaa
add esp, 4
pop ecx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x4124be
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x412518
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4123e6
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x4123e6
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x412502
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x41250c
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x412561
push eax
push ebx
add esp, 4
or eax, 0x13691
pop eax
push edx
and edx, 0x2f85
call 0x412541
add byte [ecx], bh
cmp cl, byte [ebp + 0x41]
cmp ecx, dword [esi + 0x38]
add esp, 4
add edx, 0x12f7
pop edx
push edx
sub edx, 0x9e84
pop edx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x4125c9
push ecx
push ecx
add esp, 4
add ecx, 0xd5b1
and ecx, 0x12f74
call 0x412581
add byte [esi], bh
dec ebp
cmp al, 0x43
cmp dh, byte [ebx + edi]
dec ebp
dec ebp
add esp, 4
pop ecx
push esi
push edi
add esp, 4
jmp 0x412592
pop esi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
invalid
test esp, esi
cli
invalid
Function at 0x412581
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
cmp dword [ebp - 0xcb4], 0
jne 0x41237e
mov dword [ebp - 0x31c], 0
jmp 0x4125c9
mov ecx, dword [ebp - 0xcb4]
mov dword [ebp - 0x50c], ecx
push ebx
add ebx, 0x16ca8
pop ebx
push edi
or edi, 0xe5bc
call 0x4123a6
add byte [eax + 0x4d], cl
xor al, 0x3b
dec esp
dec ecx
cmp eax, dword [ebx + 0x515f04c4]
push esi
add esp, 4
add ecx, 0x613a
add ecx, 0xeac
pop ecx
lea edx, [ebp - 0x1738]
mov dword [ebp - 0xcb0], edx
mov eax, dword [ebp - 0x50c]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xcac], ecx
xor edx, edx
mov word [ebp - 0x218], dx
xor eax, eax
mov word [ebp - 0x34], ax
push ecx
push eax
add esp, 4
add ecx, 0x9da1
sub ecx, 0x17005
sub ecx, 0x28d0
pop ecx
push edi
add edi, 0x4fbe
and edi, 0x8381
or edi, 0xf5dd
and edi, 0x4695
pop edi
mov ecx, dword [ebp - 0xcac]
mov dx, word [ecx]
mov word [ebp - 0x103a], dx
mov eax, dword [ebp - 0xcac]
add eax, 2
mov dword [ebp - 0xcac], eax
mov cx, word [ebp - 0x103a]
mov word [ebp - 0x218], cx
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103c], ax
test esp, eax
out dx, eax
invalid
dec dword [ebx - 0xcaf73]
inc dword [ebx - 0x7276fd3f]
push eax
invalid
invalid
jmp dword [esi - 0x75]
xchg ebp, eax
invalid
out dx, eax
invalid
jmp dword [esi - 0x77]
push ebp
int3
push esi
sub esi, 0x4cad
xor esi, 0x2964
xor esi, 0x4ed7
or esi, 0xdbfb
pop esi
push ecx
sub ecx, 0x74c1
call 0x41249d
add byte [edi + 0x41], al
inc esp
dec eax
cmp al, 0x3e
aaa
add esp, 4
pop ecx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x4124be
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1604], ecx
jmp 0x412518
movzx eax, word [ebp - 0x218]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4123e6
movzx edx, word [ebp - 0x218]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x4123e6
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x412502
mov dword [ebp - 0x1600], 0xffffffff
jmp 0x41250c
mov dword [ebp - 0x1600], 1
mov eax, dword [ebp - 0x1600]
mov dword [ebp - 0x1604], eax
cmp dword [ebp - 0x1604], 0
jne 0x412561
push eax
push ebx
add esp, 4
or eax, 0x13691
pop eax
push edx
and edx, 0x2f85
call 0x412541
add byte [ecx], bh
cmp cl, byte [ebp + 0x41]
cmp ecx, dword [esi + 0x38]
add esp, 4
add edx, 0x12f7
pop edx
push edx
sub edx, 0x9e84
pop edx
mov ecx, dword [ebp - 0x50c]
mov dword [ebp - 0x31c], ecx
jmp 0x4125c9
push ecx
push ecx
add esp, 4
add ecx, 0xd5b1
and ecx, 0x12f74
call 0x412581
add byte [esi], bh
dec ebp
cmp al, 0x43
cmp dh, byte [ebx + edi]
dec ebp
dec ebp
add esp, 4
pop ecx
push esi
push edi
add esp, 4
jmp 0x412592
pop esi
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
invalid
test esp, esi
cli
invalid
Function at 0x4133a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc dword [eax]
add byte [eax], al
add cl, ch
sub byte [ebx], cl
add byte [eax], al
push edx
call 0x413388
add byte [0x46343b50], bh
dec esi
dec ebp
add esp, 4
xor edx, 0x1b48
jmp 0x413399
call 0x4133a8
add byte [ecx + 0x3a], cl
xor bh, byte [esi]
cmp esi, dword [ebx]
inc edx
inc edx
add esp, 4
pop edx
mov ecx, dword [ebp - 0x774]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x166c], eax
inc dword [ebx - 0x166b43]
inc dword [eax]
jne 0x4133eb
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x4136dc
mov edx, dword [ebp - 0x166c]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1670], eax
jne 0x413413
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x4136dc
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1670]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1678], edx
cmp dword [ebp - 0x1678], 0
jne 0x413445
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], eax
jmp 0x4136dc
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [ebp - 0x1678]
mov dword [ebp - 0x778], ecx
jne 0x41346a
mov edx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], edx
jmp 0x4136dc
mov eax, dword [ebp - 0x778]

Function at 0x413470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19a4], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19a8], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19ac], edx
mov dword [ebp - 0x77c], 0
jmp 0x4134c4
mov edx, dword [ebp - 0x1a0]
add edx, 1
invalid
xchg ebp, eax

Function at 0x41358f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x4135d8
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a0]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x4135df
jmp 0x413525
jmp 0x4135e6
push edi
or edi, 0xd554
sub edi, 0xd0cc
or edi, 0xf57f
or edi, 0xc40
pop edi
push ecx
push edx
add esp, 4
add ecx, 0x287c
pop ecx
push edi
push ecx
add esp, 4
jmp 0x413617
pop edi
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
cmp ecx, eax
jne 0x413645
mov dword [ebp - 0xcd4], 0
jmp 0x4136b4
push edi
and edi, 0x9906
add edi, 0x6739
pop edi
push esi
push edx
add esp, 4
add esi, 0xa600
add esi, 0x15ca5
pop esi
push esi
push esi
add esp, 4
or esi, 0xdeb8