joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10051b40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10051c50
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10051c15
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10051b85
mov eax, dword [ebp - 4]
cmp eax, dword [0x1006f004]
ja 0x10051b85
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10051b55
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x10051baa
jmp 0x10051c15
cmp dword [ebp - 0x14], 0x10000
jne 0x10051bfe
cmp dword [ebp - 0x18], 0x10000
jb 0x10051bfe
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10051be1
mov eax, dword [ebp - 8]
jmp 0x10051c17
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10051bf1
xor eax, eax
jmp 0x10051c17
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10051c10
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10051c50
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10051b55
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10051c80
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10052070
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x10070bc4], 0
jne 0x10051cbd
cmp dword [0x10070bc0], 0
je 0x10051cbd
mov eax, dword [0x10070bc0]
mov dword [0x10070bc4], eax
cmp dword [0x10070bc4], 0
je 0x10051d3a
mov ecx, dword [0x10070bc4]
cmp dword [ecx + 8], 0
je 0x10051d3a
mov edx, dword [0x10070bc4]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x10051d3a
mov ecx, dword [0x10070bc4]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x10051d3a
mov eax, dword [0x10070bc4]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10051d09
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10051d10
xor eax, eax
jmp 0x10051e59
mov ecx, dword [0x10070bc4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10051e59
mov edx, dword [0x10070bc0]
mov dword [0x10070bc4], edx
jmp 0x10051d56
mov eax, dword [0x10070bc4]
mov ecx, dword [eax + 4]
mov dword [0x10070bc4], ecx
cmp dword [0x10070bc4], 0
je 0x10051d96
cmp dword [0x10070bc4], 0
je 0x10051d94
mov edx, dword [0x10070bc4]
cmp dword [edx + 8], 0
je 0x10051d94
mov eax, dword [0x10070bc4]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10051d94
mov edx, dword [0x10070bc4]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10051d94
jmp 0x10051cee
jmp 0x10051d48
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10051e60
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10051e57
mov eax, dword [ebp - 0x18]
mov dword [0x10070bc4], eax
mov ecx, dword [0x10070bc4]
mov dword [ecx], 0x52727464
mov edx, dword [0x10070bc4]
mov dword [edx + 8], 0
mov eax, dword [0x10070bc4]
mov ecx, dword [0x10070bc0]
mov dword [eax + 4], ecx
mov edx, dword [0x10070bc4]
mov dword [0x10070bc0], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x10070bc4]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10051e27
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10051e47
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x10051e1e
mov eax, dword [0x10070bc4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x10051cee
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10052ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10070bc0]
mov dword [ebp - 4], eax
jmp 0x10052bb9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10052be0
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x10052bde
call sub.KERNEL32.dll_GetLastError
jmp 0x10052be2
jmp 0x10052bb0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10053080
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x10070bd0], eax
je 0x100530a4
mov eax, 0x10dd
jmp 0x1005324c
cmp dword [0x10070bd4], 0
je 0x100530b7
mov eax, dword [0x10070bd4]
jmp 0x1005324c
cmp dword [ebp + 0xc], 0
jne 0x100530c7
mov eax, 0x57
jmp 0x1005324c
cmp dword [ebp + 8], 0
jne 0x100530d7
mov eax, 6
jmp 0x1005324c
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10053100
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x10070bd4], ecx
mov edx, dword [ebp + 8]
mov dword [0x10070bd8], edx
mov eax, dword [ebp - 8]
jmp 0x1005324c
push 0x18
call fcn.10054736
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1005315b
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x10070bd4], ecx
cmp dword [ebp - 4], 0
je 0x1005314a
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.10054769
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x10070bd8], ecx
mov eax, dword [ebp - 8]
jmp 0x1005324c
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10053060
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10053060
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x1005319b
cmp dword [ebp - 0xc], 0x1e
jbe 0x100531b7
mov dword [ebp - 8], 9
cmp dword [0x10070bc8], 0
je 0x100531b2
jmp 0x10053129
jmp 0x10053120
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x100531de
mov dword [ebp - 8], 9
cmp dword [0x10070bc8], 0
je 0x100531d9
jmp 0x10053129
jmp 0x10053120
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x10053209
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x10053120
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x10070be0]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x10070be0], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10053260
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x10070bd0], eax
je 0x1005327d
mov eax, 0x10dd
jmp 0x10053360
mov eax, dword [0x10070be0]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100532fc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100532d8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100532d8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10052100
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.10054769
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10053285
mov dword [0x10070be0], 0
call fcn.100529e0
mov ecx, dword [0x10070bdc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1005334a
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10054769
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10053314
mov dword [0x10070bdc], 0
mov dword [0x10070bd0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10053840
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10070bd4], 0
je 0x10053859
mov eax, dword [0x10070bd4]
jmp 0x100538f8
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1005386a
xor eax, eax
jmp 0x100538f8
push 8
call fcn.10054736
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100538c2
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100538ab
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.10054769
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10070bd4], eax
mov dword [0x10070bd8], 0
mov eax, dword [ebp - 8]
jmp 0x100538f8
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x100538da
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1005388a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10070bdc]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10070bdc], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100573d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b65e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1006f014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1006f020]
cmp eax, 0xffffffff
jne 0x10057406
xor ebx, ebx
jmp 0x1005740f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10057451
nop dword [eax]
cmp dword [ebx + 0x18], 0
mov esi, dword [ebx + 0xc]
jne 0x10057490
test esi, esi
jne 0x10057494
push 0x10056ed0
push 0x10070f70
call fcn.10056a40
mov eax, dword [0x1006f020]
add esp, 8
cmp eax, 0xffffffff
je 0x10057451
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1005747e
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1005747e
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100574d6
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x100574bf
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10057494
cmp dword [ebx + 0x18], 0
je 0x10057420
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x100574fd
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x100574fd
push eax
mov eax, dword [esi + 0x14]
push ecx
call eax
add esp, 8
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10056ef0
cmp dword [ebx + 0x18], 0
jne 0x100574e0
jmp 0x10057420
Function at 0x410b84
Capabilities:
Encode data using xor

Disassembly:
inc eax
push ebx
dec eax
sub esp, 0x10
movups xmm0, xmmword [ecx]
dec eax
mov dword [esp + 0x28], edx
mov ecx, edx
inc esp
mov eax, dword [esp + 0x2c]
inc ebp
xor edx, edx
movups xmmword [esp], xmm0
mov edx, dword [esp + 0xc]
inc esp
mov ebx, dword [esp + 8]
mov ebx, dword [esp + 4]
inc esp
mov ecx, dword [esp]
mov eax, edx
ror ecx, 8
inc ecx
add ecx, eax
mov edx, ebx
inc ecx
xor ecx, ecx
ror edx, 8
inc ecx
add edx, ecx
inc ecx
rol eax, 3
inc ecx
xor edx, edx
inc ecx
rol ecx, 3
inc esp
xor ecx, edx
inc esp
xor eax, ecx
inc ecx
inc edx
inc ecx
mov ebx, ebx
inc esp
mov ebx, eax
inc ecx
cmp edx, 0x1b
jb 0x410bb1
mov dword [esp + 0x28], ecx
inc esp
mov dword [esp + 0x2c], eax
dec eax
mov eax, dword [esp + 0x28]
dec eax
add esp, 0x10
pop ebx
ret

Function at 0x410bf8
Capabilities:
Encode data using xor
Encrypt data using chaskey

Disassembly:
inc ebp
test ecx, ecx
je 0x410d46
dec eax
mov dword [esp + 8], ebx
dec eax
mov dword [esp + 0x10], esi
dec eax
mov dword [esp + 0x18], edi
push ebp
inc ecx
push esp
inc ecx
push esi
dec eax
mov ebp, esp
dec eax
sub esp, 0x10
dec esp
mov ebx, ecx
dec eax
lea eax, [ebp - 0x10]
dec esp
sub ebx, eax
dec esp
lea esi, [edx + 0xf]
dec ecx
mov edi, eax
inc ecx
mov esp, 0x10
dec eax
lea eax, [ebp - 0x10]
dec ecx
cmp eax, esi
ja 0x410c4f
dec eax
lea eax, [ebp - 1]
dec eax
cmp eax, edx
jb 0x410c4f
movups xmm0, xmmword [edx]
movdqu xmmword [ebp - 0x10], xmm0
jmp 0x410c57
movups xmm0, xmmword [edx]
movdqu xmmword [ebp - 0x10], xmm0
dec eax
lea ecx, [ebp - 0x10]
inc ecx
mov eax, 4
inc ecx
mov eax, dword [ebx + ecx]
xor dword [ecx], eax
dec eax
lea ecx, [ecx + 4]
dec ecx
sub eax, 1
jne 0x410c61
inc esp
mov eax, dword [ebp - 4]
dec ecx
mov ebx, esp
mov eax, dword [ebp - 8]
inc esp
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
inc ecx
add ecx, edx
inc ecx
add eax, eax
inc ecx
rol edx, 5
inc esp
xor edx, ecx
inc ecx
rol eax, 8
inc esp
xor eax, eax
rol ecx, 0x10
inc ecx
add eax, edx
inc ecx
add ecx, eax
inc ecx
rol edx, 7
inc ecx
rol eax, 0xd
inc esp
xor edx, eax
inc esp
xor eax, ecx
rol eax, 0x10
dec eax
sub ebx, 1
jne 0x410c82
inc esp
mov dword [ebp - 4], eax
inc esp
lea eax, [ebx + 4]
mov dword [ebp - 0x10], ecx
dec eax
lea ecx, [ebp - 0x10]
inc esp
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
inc edx
mov eax, dword [ecx + ebx]
xor dword [ecx], eax
dec eax
lea ecx, [ecx + 4]
dec ecx
sub eax, 1
jne 0x410ccc
inc ebp
cmp ecx, esp
inc ecx
mov ecx, ecx
inc ecx
cmova ecx, esp
inc esp
mov edx, ecx
test ecx, ecx
je 0x410d0a
dec eax
lea ebx, [ebp - 0x10]
dec esp
mov eax, edi
dec eax
sub ebx, edi
inc ecx
mov esi, edx
inc edx
mov al, byte [ebx + eax]
inc ecx
xor byte [eax], al
dec ecx
inc eax
dec eax
sub esi, 1
jne 0x410cfa
inc esp
sub ecx, ecx
inc ebp
mov eax, esp
dec ecx
add edi, edx
inc ecx
lea eax, [eax - 1]
add byte [eax + edx], 1
jne 0x410d25
inc ecx
dec eax
inc ebp
test eax, eax
jg 0x410d13
inc ebp
test ecx, ecx
jne 0x410c33
dec eax
mov ebx, dword [esp + 0x30]
dec eax
mov esi, dword [esp + 0x38]
dec eax
mov edi, dword [esp + 0x40]
dec eax
add esp, 0x10
inc ecx
pop esi
inc ecx
pop esp
pop ebp
ret
Function at 0x4119d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1dc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1f0]
push edi
mov ebp, dword [esi + 0x3c]
mov eax, dword [esi + ebp + 0x78]
test eax, eax
je 0x411ad5
lea edi, [eax + esi]
mov ebx, dword [edi + 0x18]
test ebx, ebx
je 0x411ad5
mov eax, dword [edi + 0x1c]
xor edx, edx
add eax, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x20]
add eax, esi
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x24]
add eax, esi
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0xc]
add eax, esi
mov cl, byte [eax]
test cl, cl
je 0x411a54
mov esi, dword [esp + 0x10]
lea edx, [esp + 0xe8]
sub edx, eax
or cl, 0x20
inc esi
mov byte [edx + eax], cl
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x411a37
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1f4]
mov edx, dword [esp + 0x10]
push dword [esp + 0x204]
lea eax, [esp + 0xec]
mov byte [esp + edx + 0xec], 0
push dword [esp + 0x204]
push eax
call fcn.0041390e
mov dword [esp + 0x24], eax
add esp, 0xc
mov eax, dword [esp + 0x14]
add eax, 0xfffffffc
mov dword [esp + 0x1c], edx
lea eax, [eax + ebx*4]
mov dword [esp + 0x10], eax
push dword [esp + 0x204]
mov ecx, dword [eax]
push dword [esp + 0x204]
add ecx, esi
push ecx
call fcn.0041390e
xor eax, dword [esp + 0x24]
add esp, 0xc
xor edx, dword [esp + 0x1c]
cmp eax, dword [esp + 0x1f8]
jne 0x411ac5
cmp edx, dword [esp + 0x1fc]
je 0x411ae2
mov eax, dword [esp + 0x10]
sub eax, 4
mov dword [esp + 0x10], eax
sub ebx, 1
jne 0x411a90
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1dc
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
movzx eax, word [eax + ebx*2 - 2]
mov edx, dword [ecx + eax*4]
add edx, esi
cmp edx, edi
jb 0x411b6e
mov eax, dword [esi + ebp + 0x7c]
add eax, edi
cmp edx, eax
jae 0x411b6e
xor ecx, ecx
cmp byte [edx], cl
je 0x411b25
lea ebx, [esp + 0x28]
mov edi, edx
sub ebx, edx
cmp ecx, 0x3c
jae 0x411b25
mov al, byte [edi]
mov byte [ebx + edi], al
cmp al, 0x2e
je 0x411b25
inc ecx
inc edi
cmp byte [edi], 0
jne 0x411b10
inc edx
mov dword [esp + ecx + 0x29], 0x6c6c64
add ecx, edx
xor edx, edx
cmp byte [ecx], dl
je 0x411b4d
lea edi, [esp + 0x68]
sub edi, ecx
cmp edx, 0x7f
jae 0x411b4d
mov al, byte [ecx]
inc edx
mov byte [edi + ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x411b3c
lea eax, [esp + 0x68]
mov byte [esp + edx + 0x68], 0
push eax
lea eax, [esp + 0x2c]
push eax
push esi
push dword [esp + 0x1fc]
call fcn.00411b75
add esp, 0x10
mov edx, eax
mov eax, edx
jmp 0x411ad7
Function at 0x411b75
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [eax + 0x30]
mov edi, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
cmp dword [esi + 0x18], ecx
je 0x411bbe
mov ebx, dword [ebp + 0xc]
test ecx, ecx
jne 0x411bda
cmp dword [esi + 0x18], ebx
je 0x411bb2
push ecx
push dword [ebp + 0x14]
push dword [esi + 0x18]
push edi
call fcn.00413770
add esp, 0x10
mov ecx, eax
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
jne 0x411b97
test ecx, ecx
jne 0x411bda
push dword [ebp + 0x10]
push edi
call fcn.004136d2
pop ecx
pop ecx
test eax, eax
je 0x411bd8
push dword [ebp + 0x14]
push eax
call dword [edi + 0x34]
mov ecx, eax
jmp 0x411bda
xor ecx, ecx
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x4136d2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x40
xor ecx, ecx
push ebx
push esi
or ebx, 0xffffffff
push edi
cmp byte [edx], cl
je 0x4136fd
lea esi, [ebp - 0x40]
sub esi, edx
cmp ecx, 0x40
jae 0x4136fd
mov al, byte [edx]
inc ecx
mov byte [esi + edx], al
inc edx
cmp byte [edx], 0
jne 0x4136ec
cmp byte [ebp + ecx - 0x44], 0x2e
mov byte [ebp + ecx - 0x40], 0
je 0x413716
mov dword [ebp + ecx - 0x40], 0x6c6c642e
mov byte [ebp + ecx - 0x3c], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x18]
test esi, esi
je 0x41375d
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
xor eax, eax
test ecx, ecx
je 0x413753
mov eax, dword [ecx + esi + 0xc]
add eax, esi
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00413da0
mov ebx, eax
xor eax, eax
pop ecx
pop ecx
test ebx, ebx
je 0x41376c
mov edi, dword [edi]
test ebx, ebx
jne 0x413725
test eax, eax
jne 0x413767
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x30]
pop edi
pop esi
pop ebx
leave
ret
mov eax, esi
jmp 0x413767
Function at 0x413770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xa8]
xor esi, esi
test edi, edi
je 0x4138be
mov ecx, dword [edi + 0x3c]
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + edi + 0x78]
test eax, eax
je 0x4138be
lea ebx, [eax + edi]
mov eax, dword [ebx + 0x20]
mov edx, dword [ebx + 0x1c]
add eax, edi
mov dword [esp + 0x10], eax
add edx, edi
mov eax, dword [ebx + 0x24]
add eax, edi
mov dword [esp + 0x1c], edx
cmp dword [esp + 0xac], esi
je 0x4138aa
mov ebp, dword [ebx + 0x18]
test ebp, ebp
je 0x4138be
lea eax, [eax + ebp*2]
add eax, 0xfffffffe
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea eax, [eax + ebp*4]
add eax, 0xfffffffc
mov dword [esp + 0x10], eax
mov eax, dword [eax]
push dword [esp + 0xac]
add eax, edi
push eax
call fcn.00413d79
pop ecx
pop ecx
test eax, eax
jne 0x41380f
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
movzx eax, word [eax]
mov esi, dword [ecx + eax*4]
add esi, edi
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], 2
sub eax, 4
mov dword [esp + 0x10], eax
sub ebp, 1
je 0x413828
test esi, esi
je 0x4137e8
mov ecx, dword [esp + 0x18]
cmp esi, ebx
jb 0x4138a6
mov eax, dword [ecx + edi + 0x7c]
add eax, ebx
cmp esi, eax
jae 0x4138a6
xor ecx, ecx
cmp byte [esi], cl
je 0x41385d
lea ebx, [esp + 0x20]
mov edx, esi
sub ebx, esi
cmp ecx, 0x3c
jae 0x41385d
mov al, byte [edx]
mov byte [ebx + edx], al
cmp al, 0x2e
je 0x41385d
inc ecx
inc edx
cmp byte [edx], 0
jne 0x413848
mov dword [esp + ecx + 0x21], 0x6c6c64
xor edx, edx
inc ecx
add ecx, esi
cmp byte [ecx], dl
je 0x413885
lea esi, [esp + 0x60]
sub esi, ecx
cmp edx, 0x3f
jae 0x413885
mov al, byte [ecx]
inc edx
mov byte [esi + ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x413874
lea eax, [esp + 0x60]
mov byte [esp + edx + 0x60], 0
push eax
lea eax, [esp + 0x24]
push eax
push edi
push dword [esp + 0xb0]
call fcn.00411b75
add esp, 0x10
mov esi, eax
mov eax, esi
jmp 0x4138c0
mov eax, dword [esp + 0xb0]
sub eax, dword [ebx + 0x10]
mov esi, dword [edx + eax*4]
add esi, edi
jmp 0x41382c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret

Function at 0x4138cb
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
xor ecx, ecx
push esi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
jmp 0x413902
test ecx, ecx
jne 0x413909
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.004119d0
mov esi, dword [esi]
add esp, 0x18
mov ecx, eax
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x4138e2
mov eax, ecx
pop esi
pop ebp
ret