joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438ddc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00406528
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00433d44
test ebx, ebx
jne 0x438e2f
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00438d18
mov ebx, eax
test ebx, ebx
je 0x438f1a
cmp esi, ebx
je 0x438e58
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x438e6d
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x438ea5
add eax, 0xffffff5f
sub eax, 2
jb 0x438ebd
dec eax
sub eax, 2
jb 0x438ed1
dec eax
sub eax, 2
jb 0x438ec7
jmp 0x438edb
add eax, 0xfffffdff
sub eax, 2
jb 0x438ebd
dec eax
sub eax, 2
jb 0x438ed1
dec eax
sub eax, 2
jb 0x438ec7
jmp 0x438edb
mov byte [esp + 0x120], 0
jmp 0x438ee3
mov byte [esp + 0x120], 2
jmp 0x438ee3
mov byte [esp + 0x120], 1
jmp 0x438ee3
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.00446510
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00435484
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x438f1c
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x440cc4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4c4a1c]
cmp byte [eax + 0xc], 0
je 0x440e31
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x440e2a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c8544], 0
jne 0x440d18
push 0x440e38
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x440e40
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c8544], eax
cmp dword [0x45a574], 0
jne 0x440e13
push 0x440e50
call sub.kernel32.dll_LoadLibraryA
mov dword [0x45a574], eax
cmp dword [0x45a574], 0
je 0x440e13
push 0x440e5c
mov eax, dword [0x45a574]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c8548], eax
push 0x440e6c
mov eax, dword [0x45a574]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c854c], eax
push 0x440e80
mov eax, dword [0x45a574]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c8550], eax
push 0x440e98
mov eax, dword [0x45a574]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c8554], eax
push 0x440eb0
mov eax, dword [0x45a574]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c8558], eax
push 0x440ec4
mov eax, dword [0x45a574]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c855c], eax
push 0x440edc
mov eax, dword [0x45a574]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c8560], eax
push 0x440ef4
mov eax, dword [0x45a574]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c8564], eax
push 0x440f10
mov eax, dword [0x45a574]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c8568], eax
push 0x440f1c
mov eax, dword [0x45a574]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c856c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440e31
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x446478
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x4464cc]
test si, 4
je 0x44648d
or bl, 1
test si, 8
je 0x446497
or bl, 4
test si, 1
je 0x4464a1
or bl, 8
test si, 2
je 0x4464ab
or bl, 0x10
test si, 0x10
je 0x4464b5
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4464c4
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4464d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x44650c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4464ea
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4464f9
or bl, 4
test esi, 0x20000000
je 0x446504
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44dbc0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44dbd2
add esp, 0xfffffff0
call fcn.00403b5c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419ecc
mov eax, dword [0x4c46f8]
mov dword [eax + 4], ebx
mov dword [eax], 0x44df64
mov eax, dword [0x4c4704]
mov dword [eax + 4], ebx
mov dword [eax], 0x44df70
mov eax, ebx
call fcn.0044df7c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411cc8]
call fcn.00403820
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411cc8]
call fcn.00403820
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411cc8]
call fcn.00403820
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411cc8]
call fcn.00403820
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411cc8]
call fcn.00403820
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x449a14
push eax
push 0
push 0
mov eax, dword [0x4c4848]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41d9c0]
call fcn.0041eee0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41d9c0]
call fcn.0041eee0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41d9c0]
call fcn.0041eee0
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044e3ac
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44e27c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44e27c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44e27c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44dd0f
call fcn.00403bb4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44e060
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44e20b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44e1ec
mov dl, 1
mov eax, dword [0x4120ec]
call fcn.00403820
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404664
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44e1db
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00441020
test al, al
je 0x44e1ce
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44e21c
lea eax, [ebp - 0x254]
call fcn.00409174
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44e1ce
xor eax, eax
push ebp
push 0x44e1c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44e254
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44e1b0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004048d4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44e1b0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004048d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e1ce
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44e0d1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.00415dcc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e212
lea eax, [ebp - 0x260]
call fcn.00404664
ret

Function at 0x44eb84
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4c857c]
cmp byte [eax + 0xad], 0
jne 0x44ebf5
cmp dword [0x4c8594], 0
jne 0x44ebb6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44eb40
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4c8594], eax
cmp dword [0x4c8590], 0
jne 0x44ebd1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4c8590], eax
cmp dword [0x4c8598], 0
jne 0x44ebf5
push esp
push 0
push 0
push 0x44eae4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4c8598], eax
pop edx
ret
Function at 0x44edc8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44eddf
add esp, 0xfffffff0
call fcn.00403b5c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419ecc
mov eax, dword [0x4c4830]
cmp word [eax + 2], 0
jne 0x44ee07
mov eax, dword [0x4c4830]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00450878
mov eax, dword [0x4c48d4]
cmp word [eax + 2], 0
jne 0x44ee21
mov eax, dword [0x4c48d4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00450a84
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411cc8]
call fcn.00403820
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411cc8]
call fcn.00403820
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x411cc8]
call fcn.00403820
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41e19c]
call fcn.00423fe4
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x44efd8
mov eax, dword [0x4c475c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004243b8
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x451144
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4c475c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c884
test eax, eax
je 0x44ef28
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408b2c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c8b8
test eax, eax
je 0x44ef3c
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004048d4
mov byte [ebx + 0xd4], 0
push ebx
push 0x4503d8
call fcn.0041b048
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4c4668]
cmp byte [eax], 0
jne 0x44ef8d
mov eax, ebx
call fcn.0044f11c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00451320
mov eax, ebx
call fcn.00451e80
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44efcd
call fcn.00403bb4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f39c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4c857c]
cmp dword [eax + 0x30], 0
je 0x44f446
cmp dword [ebx + 0x94], 0
jne 0x44f440
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44f32c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44f440
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44f406
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44f440
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414074
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44f415
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x450160
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x450195
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404754
jmp 0x4501a2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004046b8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x451504
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x451572
mov eax, esi
call fcn.0043bedc
test al, al
je 0x451572
mov eax, dword [ebx + 0x84]
call fcn.0043bbe0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x451572
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x451566
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043bbe0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00434124
jmp 0x451572
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00451340
pop esi
pop ebx
ret
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x401240
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push ebp
push 0x40
push 0x3000
push 0x320
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, eax
test ebx, ebx
jne 0x401272
push 0
push 0x40e3e4
push 0x40e3d4
push 0
call ebp
push esi
push edi
mov ecx, 0xc8
mov esi, 0x40e0a0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
test ebx, ebx
jne 0x401296
push ebx
push 0x40e3e4
push 0x40e3c8
push ebx
call ebp
call ebx
pop ebp
pop ebx
ret
Function at 0x20402f80
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push eax
mov dword [esp + 8], 0
call fcn.20402330
add esp, 8
test eax, eax
jne 0x20403001
mov eax, dword [ebx + 0x7c]
push ebp
mov ebp, dword [eax + 0x74]
push edi
mov eax, ebp
xor edi, edi
test eax, eax
je 0x20402fba
jmp 0x20402fb0
mov eax, dword [eax + 0x78]
add edi, 1
test eax, eax
jne 0x20402fb0
xor eax, eax
test edi, edi
push esi
jbe 0x20402ff9
xor esi, esi
test eax, eax
mov edx, dword [ebp + 0x53]
push edi
push esi
sub esp, 0x25c
mov eax, dword [esp + 0x270]
mov eax, dword [eax + 0x14]
mov dword [esp + 8], eax
mov ecx, dword [eax + 0x24]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
test ecx, ecx
jne 0x204030f0
nop
mov eax, dword [eax]
cmp dword [eax + 0x30], 0
je 0x20402ff6
js 0x2040302b
add byte [eax + edi*8 - 0x75], dh
inc eax
sbb byte [ecx - 0x74ebdbbc], cl
inc esp
and al, 8
mov eax, dword [eax + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x40]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
test ecx, ecx
jne 0x20403140
nop
nop
nop
nop
nop
nop
mov eax, dword [eax]
cmp dword [eax + 0x30], 0
je 0x20403026
add byte [eax + edi*8 - 0x75], dh
inc eax
sbb byte [ecx - 0x74efdbbc], cl
inc esp
and al, 8
mov eax, dword [eax + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 8]
mov eax, dword [eax + 0xd8]
mov dword [esp], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x3c]
mov eax, dword [ecx + eax + 0x78]
mov edx, dword [ecx + eax + 0x20]
add edx, ecx
mov dword [esp + 4], edx
mov edx, dword [ecx + eax + 0x1c]
mov dword [esp + 0xc], edx
mov eax, dword [ecx + eax + 0x24]
mov dword [esp + 0x18], eax
xor eax, eax
lea esi, [esp + 0x54]
jmp 0x20403084
xor esi, esi
cmp esi, ecx
je 0x20402ffe
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
test edx, edx
je 0x204030f0
movzx edi, word [edx]
test di, di
je 0x204030e6
add edx, 2
xor esi, esi
jmp 0x20403126
movzx edi, di
add esi, edi
movzx edi, word [edx]
add edx, 2
test di, di
je 0x204030e8
lea ebx, [edi - 0x41]
cmp bx, 0x1a
jae 0x20403116
add edi, 0x20
jmp 0x20403116
xor esi, esi
cmp esi, ecx
je 0x2040302e
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
test edx, edx
je 0x20403140
movzx edi, word [edx]
test di, di
je 0x20403136
add edx, 2
xor esi, esi
jmp 0x20403176
movzx edi, di
add esi, edi
movzx edi, word [edx]
add edx, 2
test di, di
je 0x20403138
lea ebx, [edi - 0x41]
cmp bx, 0x1a
jae 0x20403166
add edi, 0x20
jmp 0x20403166
Function at 0x20403950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
nop
nop
nop
nop
nop
movsx ecx, byte [edi + eax]
mov word [esp + eax*2 + 0x54], cx
dec eax
jne 0x20403956
Function at 0x20404010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebp, ecx
imul ecx, ecx, 0x8a
mov eax, dword [esp]
mov dword [esp + 0x20], ecx
lea ebx, [eax + ecx]
mov ecx, ebx
call fcn.204045c6
lea eax, [eax + eax + 2]
push eax
push 0x40
mov eax, dword [esp + 0x14]
call dword [eax + 0x6c]
mov edi, eax
mov ecx, ebx
call fcn.204045c6
test eax, eax
je 0x20404001
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx ecx, byte [esi + eax]
mov word [edi + eax*2], cx
dec eax
jne 0x20403ff6
movsx eax, byte [ebx]
mov word [edi], ax
mov ecx, edi
call fcn.204045f6
test eax, eax
je 0x20404046
mov ecx, dword [esp + 8]
mov edx, dword [ecx + 0x28]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul ecx, edx
movzx ebx, word [edi]
add ecx, ebx
add edi, 2
dec eax
jne 0x20404026
cmp ecx, dword [esp + 4]
jne 0x20404052
jmp 0x204043bf
xor ecx, ecx
cmp ecx, dword [esp + 4]
je 0x204043bf
mov ecx, ebp
inc ecx
add esi, 0x8a
mov eax, dword [esp + 0x10]
cmp ecx, dword [eax]
or byte [edi], cl
or byte [edi - 1], 0xff
invalid
mov dword [esp + 4], 0
mov dword [esp + 0x10], 0
jmp 0x204043e0
mov ebp, dword [esp]
mov ecx, dword [esp + 0x20]
mov eax, dword [ebp + ecx + 0x86]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
add eax, dword [ebp + ecx + 0x82]
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x24]
push 0x20a
push 0x40
call dword [esp + 0x20]
mov edi, eax
add ebx, 0xf4
mov ecx, ebx
call fcn.204045c6
test eax, eax
mov esi, dword [esp + 0xc]
je 0x20404411
movsx ecx, byte [ebx + eax]
mov word [edi + eax*2], cx
dec eax
jne 0x20404406
cmc
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
lea eax, [ecx + eax + 0x3dd]
mov dword [esp], eax
movsx eax, byte [ebx]
mov word [edi], ax
add edi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi - 2], 0
lea edi, [edi + 2]
jne 0x20404436
nop
nop
nop
nop
nop
nop
cmp word [edi - 4], 0x5c
lea edi, [edi - 2]
jne 0x20404446
push 0x20a
push 0x40
call dword [esi + 0x6c]
mov ebx, eax
mov ecx, edi
call fcn.204045f6
test eax, eax
je 0x20404485
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [edi]
mov word [ecx], dx
add ecx, 2
add edi, 2
dec eax
jne 0x20404476
push ebx
call dword [esi + 0x78]
mov esi, eax
mov eax, dword [eax + 0x3c]
add esi, dword [esi + eax + 0x2c]
mov ebx, dword [esp + 4]
push ebx
push 0x40
call dword [esp + 0x20]
mov edi, eax
invalid

Function at 0x204040b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x20a
push 0x40
call dword [esp + 0x20]
mov ebx, eax
movzx eax, byte [edi]
test al, al
je 0x204040d7
xor ecx, ecx
movsx eax, al
mov word [ebx + ecx*2], ax
movzx eax, byte [edi + ecx + 1]
inc ecx
test al, al
jne 0x204040c6
push 0x20a
push 0x40
mov esi, dword [esp + 0x14]
call dword [esi + 0x6c]
mov edi, eax
push 0x105
push eax
push 0
call dword [esi]
lea eax, [edi - 2]
nop
nop
cmp word [eax + 2], 0
lea eax, [eax + 2]
jne 0x204040f6
Function at 0x20404100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
nop
nop
nop
nop
nop
mov word [eax], 0
cmp word [eax - 2], 0x5c
lea eax, [eax - 2]
jne 0x20404106
mov edx, edi
add edx, 0xfffffffe
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp word [edx + 2], 0
lea edx, [edx + 2]
jne 0x20404126
xor ecx, ecx
cmp word [edx - 2], 0x5c
je 0x20404144
mov word [edx], 0x5c
mov ecx, 1
test ebx, ebx
je 0x20404168
movzx esi, word [ebx]
test si, si
je 0x2040416d
lea ebp, [edx + ecx*2]
xor edx, edx
nop
inc eax
mov edx, eax
jmp 0x20404177
xor edx, edx