joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4203b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
je 0x4204b1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x3d0], ecx
mov dword [ebp - 4], 0
jmp 0x4203e2
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x3c
jge 0x42045f
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, dword [ebp - 0x14]
mov dword [ecx + eax + 4], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 4]
shl edx, 4
mov ecx, dword [ebp - 0x14]
mov dword [ecx + edx], eax
mov edx, dword [ebp - 4]
shl edx, 4
mov eax, dword [ebp - 0x14]
cmp dword [eax + edx], 0
je 0x42045a
mov ecx, dword [ebp - 4]
shl ecx, 4
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx + 4]
push eax
mov ecx, dword [edx + ecx]
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0041ffe0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
shl eax, 4
mov esi, dword [ebp - 0x14]
mov dword [esi + eax + 8], ecx
mov dword [esi + eax + 0xc], edx
jmp 0x4203d9
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x3c4], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x3c0], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x3c0], 0
je 0x4204b1
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x14]
push edx
push 0x4201a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x3d4], eax
mov eax, dword [ebp - 0x14]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x420b60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 4]
call fcn.00420860
test eax, eax
jne 0x420b7e
jmp 0x420be2
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x420be2
push str.CMMDeviceHandler::Start_n
call fcn.00401000
add esp, 4
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
call fcn.00424ba0
add esp, 4
mov ecx, dword [ebp - 4]
add ecx, 8
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x420b40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x424650
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 8], 0
je 0x424668
mov dword [ebp - 0x10], 0x434644
jmp 0x42466f
mov dword [ebp - 0x10], str.REALTEK
mov eax, dword [ebp - 0x10]
push eax
push 0x43465c
push 0x434680
call fcn.00401000
add esp, 0xc
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x4ac], edx
push 5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x4ac]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x5c
call fcn.0041ddf0
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x5c
call fcn.0041a460
test eax, eax
je 0x4247c4
mov ecx, dword [ebp - 0xc]
call fcn.00422ed0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4246fc
push 0x433e6c
push 0x2f8
push 0x4346c4
push 0x4346e8
call fcn.00401000
add esp, 0x10
mov eax, 2
jmp 0x4247ce
mov ecx, dword [ebp - 0xc]
call fcn.00422e20
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x424733
push 0x433f44
push 0x2fc
push 0x434750
push 0x434770
call fcn.00401000
add esp, 0x10
mov eax, 3
jmp 0x4247ce
mov ecx, dword [ebp - 0xc]
add ecx, 0x5c
call fcn.0041a660
test eax, eax
je 0x424781
mov ecx, dword [ebp - 0xc]
call fcn.00422d70
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x424776
push 0x433fe4
push 0x302
push 0x4347d8
push str.__s__RETURN_VALUE_ON_FALSE:_Line___d__File___s_n
call fcn.00401000
add esp, 0x10
mov eax, 4
jmp 0x4247ce
mov ecx, dword [ebp - 0xc]
add ecx, 0x5c
call fcn.0041be30
mov ecx, dword [ebp - 0xc]
add ecx, 0x5c
call fcn.0041ab70
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
je 0x4247c4
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x423a00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x4a8], eax
mov ecx, dword [ebp - 0xc]
call fcn.00423a40
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4252c0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42624c
mov eax, dword fs:[0]
push eax
mov eax, 0x10010
call fcn.00411600
mov eax, dword [0x43c06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1001c], 0
push 0x4386a4
lea ecx, [ebp - 0x10018]
call fcn.004017c0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x26
push 0xfffe
push 0
lea eax, [ebp - 0x10014]
push eax
call fcn.00406570
add esp, 0xc
lea ecx, [ebp - 0x10014]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x4253a3
lea eax, [ebp - 0x10014]
push eax
call fcn.004064f1
add esp, 4
movzx ecx, word [ebp + eax*2 - 0x10016]
cmp ecx, 0x5c
jne 0x42537d
lea edx, [ebp - 0x10014]
push edx
call fcn.004064f1
add esp, 4
xor ecx, ecx
mov word [ebp + eax*2 - 0x10016], cx
lea edx, [ebp - 0x10014]
push edx
lea ecx, [ebp - 0x10018]
call fcn.00401860
mov eax, dword [ebp - 0x10018]
push eax
push str.GetProgramFilesPath___s_n
call fcn.00401000
add esp, 8
lea ecx, [ebp - 0x10018]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004017a0
mov edx, dword [ebp - 0x1001c]
or edx, 1
mov dword [ebp - 0x1001c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10018]
call fcn.00401840
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00405b1d
mov esp, ebp
pop ebp
ret
Function at 0x1022dacd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov dword [ebp + 4], eax
jmp 0x1022ea12
jmp 0x1022fd8b
pushfd
pop dword [esp + 0x30]
pushfd
mov word [esp + 4], 0xbe1a
pushfd
push dword [esp + 0x38]
pop dword [ebp]
push dword [esp + 4]
lea esp, [esp + 0x40]
jmp fcn.1022dbe3

Function at 0x1022dbd3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ebx, esi
push ecx
stc
not dx
xchg al, dh
add esi, dword [ebp]
lea esp, [esp + 8]

Function at 0x1022deb3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [eax + edi], edx
push esp
push dword [esp]
mov byte [esp], 0xbf
lea esp, [esp + 0x34]
jmp fcn.1022dbe3

Function at 0x1022df5a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp]
mov word [esp], 0xbf49
lea esp, [esp + 0x34]
js 0x1022e0e2
pop dword [ebp]
push 0x6a0d3afc
pushal
mov word [esp], 0x9e1f
pushfd
lea esp, [esp + 0x28]
jmp fcn.1022fd2a
jmp 0x1022fcbe
pop dword [ebp]
pushfd
lea esp, [esp + 4]
jmp fcn.1022fd2a

Function at 0x1022e0cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
clc
push dword [esp + 0x5c]
popfd
mov byte [esp], ah
mov byte [esp], dh
lea esp, [esp + 0x60]
jmp fcn.1022dbe3

Function at 0x1022e34a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
push dword [esp + 0x38]
pop dword [ebp]
push dword [esp + 4]
push dword [esp + 4]
lea esp, [esp + 0x44]
jmp fcn.1022fd2a

Function at 0x1022e98e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
jmp 0x1023013e
push dword [esp + 0x38]
pop dword [ebp]
push dword [esp + 0x1c]
lea esp, [esp + 0x40]
jmp fcn.1022fd2a

Function at 0x1022ed5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [eax + edi], edx
push 0xf63ec81b
push dword [esp]
push dword [esp + 8]
push 0x18b5d766
lea esp, [esp + 0x18]
jmp fcn.1022dbe3

Function at 0x1022f492
Capabilities:
Encrypt data using rc4 prga

Disassembly:
stc
add ebp, 2
jmp 0x10230100
mov word [eax + edi], dx
push dword [esp + 4]
push edx
lea esp, [esp + 0x18]
jmp fcn.1022dbe3

Function at 0x1022fb20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1022fd76
push dword [esp + 4]
mov dword [ebp], eax
push 0x9251df61
lea esp, [esp + 0x10]
jmp fcn.1022dbe3
Function at 0x420bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x420bbf
pop dword [ebp - 0x10]
mov eax, 0x420bbf
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3e62e
push 0
mov eax, 0x1259e6db
add eax, 0xede86b3d
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x4922
xor esi, esi
add esi, eax
mov edi, 0x435400
add edi, dword [ebp - 0x10]
mov edx, 0xdaf2c60f
xor dword [ebp - 0xc], 0x7fe519dc
mov ebx, dword [edi]
add dword [ebp - 8], 0xefafdf65
sub ebx, edx
mov dword [ebp - 4], 0xf056c397
mov dword [esi], ebx
sub dword [ebp - 0xc], 0x5fac4579
add esi, 0x33c3ff70
sub esi, 0x33c3ff6c
add edi, 0xa20699bd
add edi, 0x5df96647
loop 0x420c09
add eax, 0x1175b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x402566
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
xor edx, edx
push ebx
inc edx
push esi
mov dword [ebp - 0xc], edx
mov bl, dl
mov edx, dword [ebp - 0x10]
mov esi, 0x100
push edi
movzx eax, bl
mov cl, bl
and cl, 0x80
mov byte [edx + 0x49dd68], bl
neg cl
sbb cl, cl
mov byte [eax + 0x49de68], dl
mov al, bl
and cl, 0x1b
add al, al
xor cl, al
xor bl, cl
inc edx
cmp edx, esi
jb 0x402583
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov byte [0x49de69], 0
movzx eax, dl
mov dword [ecx + 0x49e168], eax
mov al, dl
and al, 0x80
neg al
sbb al, al
add dl, dl
and al, 0x1b
add ecx, 4
xor dl, al
cmp ecx, 0x28
jb 0x4025b7
xor edx, edx
test edx, edx
je 0x4025ee
movzx eax, byte [edx + 0x49de68]
mov ecx, 0x49de67
sub ecx, eax
mov bl, byte [ecx]
jmp 0x4025f0
xor bl, bl
mov al, bl
mov cl, bl
rol al, 1
rol cl, 2
xor cl, al
mov al, cl
rol al, 2
xor al, cl
xor al, bl
xor al, 0x63
mov byte [edx + 0x49df68], al
movzx eax, al
mov byte [eax + 0x49e068], dl
inc edx
cmp edx, esi
jb 0x4025d8
xor esi, esi
mov bl, byte [esi + 0x49df68]
movzx edi, bl
mov eax, edi
mov byte [ebp - 4], bl
rol eax, 8
mov dword [esi*4 + 0x4a0590], eax
mov eax, edi
rol eax, 0x10
mov dword [esi*4 + 0x4a0990], eax
mov eax, edi
rol eax, 0x18
mov dword [esi*4 + 0x4a0190], edi
mov dword [esi*4 + 0x4a0d90], eax
test bl, bl
je 0x402669
push dword [ebp - 4]
push 2
call fcn.00402534
movzx eax, al
mov dword [ebp - 8], eax
jmp 0x40266d
and dword [ebp - 8], 0
test bl, bl
je 0x402680
push dword [ebp - 4]
push 3
call fcn.00402534
movzx ecx, al
jmp 0x402682
xor ecx, ecx
mov bl, byte [esi + 0x49e068]
shl ecx, 8
or ecx, edi
mov byte [ebp - 4], bl
shl ecx, 8
or ecx, edi
mov edi, dword [ebp - 4]
shl ecx, 8
or ecx, dword [ebp - 8]
mov eax, ecx
mov dword [esi*4 + 0x49e190], ecx
rol eax, 8
mov dword [esi*4 + 0x49e590], eax
mov eax, ecx
rol eax, 0x10
rol ecx, 0x18
mov dword [esi*4 + 0x49e990], eax
mov dword [esi*4 + 0x49ed90], ecx
movzx ecx, bl
mov eax, ecx
mov dword [esi*4 + 0x4a1190], ecx
rol eax, 8
mov dword [esi*4 + 0x4a1590], eax
mov eax, ecx
rol eax, 0x10
rol ecx, 0x18
mov dword [esi*4 + 0x4a1990], eax
mov dword [esi*4 + 0x4a1d90], ecx
test bl, bl
je 0x402707
push edi
push 0xe
call fcn.00402534
movzx eax, al
mov dword [ebp - 0x10], eax
jmp 0x40270b
and dword [ebp - 0x10], 0
test bl, bl
je 0x40271f
push edi
push 9
call fcn.00402534
movzx eax, al
mov dword [ebp - 0xc], eax
jmp 0x402723
and dword [ebp - 0xc], 0
test bl, bl
je 0x402737
push edi
push 0xd
call fcn.00402534
movzx eax, al
mov dword [ebp - 8], eax
jmp 0x40273b
and dword [ebp - 8], 0
test bl, bl
je 0x40274c
push edi
push 0xb
call fcn.00402534
movzx ecx, al
jmp 0x40274e
xor ecx, ecx
shl ecx, 8
or ecx, dword [ebp - 8]
shl ecx, 8
or ecx, dword [ebp - 0xc]
shl ecx, 8
or ecx, dword [ebp - 0x10]
mov eax, ecx
mov dword [esi*4 + 0x49f190], ecx
rol eax, 8
mov dword [esi*4 + 0x49f590], eax
mov eax, ecx
rol eax, 0x10
rol ecx, 0x18
mov dword [esi*4 + 0x49f990], eax
mov dword [esi*4 + 0x49fd90], ecx
inc esi
cmp esi, 0x100
jb 0x40261c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40279e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x36c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
or ebx, 0xffffffff
cmp dword [ebp + 0xc], 0x100
push edi
jne 0x402939
mov edi, dword [ebp + 8]
test edi, edi
je 0x402939
push 0x84
lea eax, [ebp - 0x130]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
xor ecx, ecx
mov dl, byte [edi + ecx*2]
lea eax, [edx - 0x30]
cmp al, 9
ja 0x4027f8
mov dl, al
jmp 0x402802
lea eax, [edx - 0x41]
cmp al, 5
ja 0x402802
add dl, 0xc9
cmp dl, 0xf
ja 0x40283f
shl dl, 4
mov byte [ebp + ecx - 0x130], dl
mov dl, byte [edi + ecx*2 + 1]
lea eax, [edx - 0x30]
cmp al, 9
ja 0x402820
mov dl, al
jmp 0x40282a
lea eax, [edx - 0x41]
cmp al, 5
ja 0x40282a
add dl, 0xc9
cmp dl, 0xf
ja 0x40283f
or byte [ebp + ecx - 0x130], dl
inc ecx
cmp ecx, 0x80
jb 0x4027ea
mov edi, 0x80
cmp ecx, edi
jne 0x402939
and dword [ebp - 0x18], 0
mov dword [ebp - 0x28], 0x756f6853
mov dword [ebp - 0x24], 0x7245694a
mov dword [ebp - 0x20], 0x53696853
mov dword [ebp - 0x1c], 0x69685369
call fcn.00402566
lea ecx, [ebp - 0x28]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402877
sub ecx, edx
lea eax, [ebp - 0x28]
push ecx
push eax
lea eax, [ebp - 0x36c]
push eax
call fcn.00402248
push edi
lea eax, [ebp - 0x130]
push eax
push eax
lea eax, [ebp - 0x36c]
push eax
call fcn.0040219c
lea eax, [ebp - 0x188]
push eax
call fcn.00403058
push 0x64
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x188]
push eax
call fcn.0040308e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x188]
push eax
call fcn.00402fd6
xor ecx, ecx
mov al, byte [ebp + ecx - 0x14]
cmp al, byte [ebp + ecx - 0xcc]
jne 0x4028ec
inc ecx
cmp ecx, 0x10
jb 0x4028d9
cmp ecx, 0x10
jb 0x402939
mov edx, dword [0xffdf0014]
xor ecx, ecx
mov edi, dword [0xffdf0018]
add ecx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xdc]
adc eax, 0
cmp edi, eax
jb 0x402939
ja 0x402918
cmp edx, ecx
jb 0x402939
mov eax, dword [ebp - 0xd4]
xor ecx, ecx
add ecx, dword [ebp - 0xd8]
adc eax, 0
cmp edi, eax
ja 0x402939
jb 0x402933
cmp edx, ecx
ja 0x402939
dec dword [esi]
xor ebx, ebx
jmp 0x40293b
inc dword [esi]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 0xc

Function at 0x403058
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x58
push 0
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [esi + 0x48], 0x67452301
mov dword [esi + 0x4c], 0xefcdab89
mov dword [esi + 0x50], 0x98badcfe
mov dword [esi + 0x54], 0x10325476
pop esi
pop ebp
ret 4
Function at 0x404476
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], 0x18
push esi
mov esi, dword [ebp + 8]
jb 0x404588
push edi
push 0xc
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x72006b
mov edi, 0x74006e
mov dword [ebp - 0x18], 0x6c006e
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], 0x70006d
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
mov dword [ebp - 8], ebx
call fcn.0047d8e4
test eax, eax
je 0x404585
push 0xc
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], edi
push eax
mov dword [ebp - 0x1c], 0x73006f
mov dword [ebp - 0x18], 0x72006b
mov dword [ebp - 0x14], 0x6c006e
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
mov dword [ebp - 8], ebx
call fcn.0047d8e4
test eax, eax
je 0x404585
push 0xc
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], edi
push eax
mov dword [ebp - 0x1c], 0x72006b
mov dword [ebp - 0x18], 0x6c006e
mov dword [ebp - 0x14], 0x610070
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
mov dword [ebp - 8], ebx
call fcn.0047d8e4
test eax, eax
je 0x404585
push 0xc
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], edi
push eax
mov dword [ebp - 0x1c], 0x72006b
mov dword [ebp - 0x18], 0x610070
mov dword [ebp - 0x14], 0x70006d
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
mov dword [ebp - 8], ebx
call fcn.0047d8e4
test eax, eax
jne 0x404587
mov bl, 1
pop edi
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x40487c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [ebp + 0x14], 1
je 0x4048a7
cmp dword [ebp + 0x14], 2
jne 0x4048a7
mov ecx, dword [eax + 0x88]
mov edx, dword [eax + 0x8c]
jmp 0x4048ad
mov edx, dword [eax + 0x7c]
mov ecx, dword [eax + 0x78]
mov ebx, dword [ebp + 0xc]
lea edi, [edx + ecx]
mov dword [ebp - 0xc], edi
cmp ecx, ebx
jae 0x4049ed
lea eax, [ecx + 0x28]
cmp eax, ebx
jae 0x4049ed
cmp edx, ebx
jae 0x4049ed
cmp edi, ebx
jae 0x4049ed
mov eax, dword [ecx + esi + 0x14]
mov ebx, dword [ecx + esi + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ecx + esi + 0x20]
mov dword [ebp + 0x14], ebx
mov dword [ebp - 8], eax
cmp eax, ecx
jb 0x4049ed
mov edi, ebx
lea ebx, [edx + ecx]
shl edi, 2
add eax, edi
cmp eax, ebx
jae 0x4049ed
cmp edi, edx
jae 0x4049ed
mov ebx, dword [ecx + esi + 0x24]
cmp ebx, ecx
jb 0x4049ed
mov eax, dword [ebp + 0x14]
lea edi, [edx + ecx]
lea eax, [ebx + eax*2]
cmp eax, edi
jae 0x4049ed
mov edi, dword [ecx + esi + 0x1c]
cmp edi, ecx
jb 0x4049ed
mov eax, dword [ebp - 4]
shl eax, 2
add eax, edi
cmp eax, dword [ebp - 0xc]
jae 0x4049ed
mov eax, dword [ebp - 4]
shl eax, 2
cmp eax, edx
jae 0x4049ed
mov eax, dword [ebp - 8]
xor edx, edx
add eax, esi
mov dword [ebp - 8], edx
mov dword [ebp + 8], eax
lea eax, [ebx + esi]
mov dword [ebp - 0x10], eax
lea eax, [edi + esi]
mov dword [ebp - 0x14], eax
mov eax, edx
cmp dword [ebp + 0x14], eax
jbe 0x4049ef
mov edx, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + eax*4]
cmp eax, ecx
jb 0x4049e2
mov edx, dword [ebp - 0xc]
cmp eax, edx
jae 0x4049df
mov edi, dword [ebp + 0x10]
add eax, esi
mov bl, byte [eax]
cmp bl, byte [edi]
jne 0x4049b1
test bl, bl
je 0x4049ad
mov bl, byte [eax + 1]
cmp bl, byte [edi + 1]
jne 0x4049b1
add eax, 2
add edi, 2
test bl, bl
jne 0x404991
xor eax, eax
jmp 0x4049b6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4049dc
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
movzx eax, word [ebx + eax*2]
cmp eax, dword [ebp - 4]
jae 0x4049dc
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx + eax*4]
cmp eax, dword [ebp + 0xc]
jae 0x4049dc
cmp eax, ecx
jb 0x4049fa
cmp eax, edx
jae 0x4049fa
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, edx
jb 0x40497e
xor edx, edx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, eax
jmp 0x4049ef
Function at 0x4049fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
push esi
push edi
test ecx, ecx
je 0x404a20
mov eax, dword [ebp + 0x10]
mov edx, ecx
mov byte [eax], bl
lea eax, [eax + 0xc]
dec edx
jne 0x404a18
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
mov esi, dword [eax + edi + 0x78]
mov edx, dword [eax + edi + 0x7c]
lea ebx, [edx + esi]
cmp esi, dword [ebp + 0xc]
jae 0x404b8a
lea eax, [esi + 0x28]
cmp eax, dword [ebp + 0xc]
jae 0x404b8a
cmp edx, dword [ebp + 0xc]
jae 0x404b8a
cmp ebx, dword [ebp + 0xc]
jae 0x404b8a
mov eax, dword [esi + edi + 0x18]
mov ecx, dword [esi + edi + 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x14], eax
jne 0x404b8a
mov eax, dword [esi + edi + 0x20]
mov dword [ebp + 0x14], eax
cmp eax, esi
jb 0x404b8a
mov ecx, dword [ebp - 4]
shl ecx, 2
add eax, ecx
cmp eax, ebx
jae 0x404b8a
cmp ecx, edx
jae 0x404b8a
mov eax, dword [esi + edi + 0x24]
mov dword [ebp - 0x10], eax
cmp eax, esi
jb 0x404b8a
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*2]
cmp eax, ebx
jae 0x404b8a
mov ecx, dword [esi + edi + 0x1c]
cmp ecx, esi
jb 0x404b8a
mov eax, dword [ebp - 8]
shl eax, 2
add eax, ecx
cmp eax, ebx
jae 0x404b8a
mov eax, dword [ebp - 8]
shl eax, 2
cmp eax, edx
jae 0x404b8a
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0x14]
add eax, edi
mov dword [ebp - 0x10], eax
add edx, edi
lea eax, [ecx + edi]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], eax
xor eax, eax
mov ecx, eax
mov dword [ebp + 0x14], eax
cmp dword [ebp - 4], eax
jbe 0x404b8c
mov eax, dword [ebp + 0x10]
add eax, 8
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [edx + ecx*4]
cmp edx, esi
jb 0x404b7a
cmp edx, ebx
jae 0x404b7a
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, dword [ebp - 8]
jae 0x404b77
mov edi, dword [ebp - 0x14]
mov eax, dword [edi + eax*4]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp + 0xc]
jae 0x404b77
cmp eax, esi
jb 0x404b3f
cmp eax, ebx
jb 0x404b77
cmp dword [ebp + 0x18], 0
lea eax, [edx + edi]
mov dword [ebp - 0x18], eax
je 0x404b56
push eax
call dword [ebp + 0x18]
cmp al, 1
jne 0x404b74
mov eax, dword [ebp - 0x18]
push eax
call fcn.004047f4
mov ecx, dword [ebp + 0x10]
inc dword [ebp - 0xc]
mov dword [ecx - 4], eax
mov eax, dword [ebp - 0x1c]
mov byte [ecx - 8], 1
mov dword [ecx], eax
add ecx, 0xc
mov dword [ebp + 0x10], ecx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
inc ecx
mov dword [ebp + 0x14], ecx
cmp ecx, eax
jb 0x404b0f
mov eax, dword [ebp - 0xc]
jmp 0x404b8c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14