joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x39c6124]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x424afa
cmp byte [esi + 0x3d], 0
je 0x424afa
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x424ae8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x424ab0
sub eax, 1
je 0x424ab4
sub eax, 2
jne 0x424ae8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a920
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x424ad1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00431e06
add esp, 0x10
cmp edi, eax
jne 0x424ae8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a920
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a920
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0042a920
mov esp, ebp
pop ebp
ret

Function at 0x425370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x39ac5e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x39c6124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x39bde58
call fcn.0042ad15
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004297ae
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x439ac1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00439937
Function at 0x402e70
Capabilities:
Create mailslot

Disassembly:
push ecx
cmp dword [0x2b9d1c4], 3
jne 0x402e96
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [esp], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
xor dword [esp], eax
mov eax, dword [esp]
mov ecx, dword [esp + 8]
mov dword [ecx], eax
pop ecx
ret 0xc

Function at 0x4030a0
Capabilities:
Enumerate gui resources
Get disk information

Disassembly:
mov eax, dword [0x2b9d1c4]
mov ecx, dword [0x2b9d138]
shr eax, 3
sub esp, 0xc08
test eax, eax
jbe 0x4031b6
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x2b9d1c4], 0x959
jne 0x403198
call edi
push 0
lea eax, [esp + 0x41c]
push eax
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x402ae0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x402af0
push 0x402af8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edx, dword [esp + 0x10]
push edx
call fcn.00402ee0
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x4030e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x407a10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43fa30]
jne 0x407a1a
repz ret
jmp fcn.004097fc

Function at 0x40904b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405115
and dword [ebp - 4], 0
cmp dword [0x44639c], 0
mov ebx, eax
jne 0x4090fc
push 0x402a34
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4091ad
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402a28
push edi
call esi
test eax, eax
je 0x4091ad
push eax
call fcn.004050a3
mov dword [esp], 0x402a18
push edi
mov dword [0x44639c], eax
call esi
push eax
call fcn.004050a3
mov dword [esp], 0x402a04
push edi
mov dword [0x4463a0], eax
call esi
push eax
call fcn.004050a3
mov dword [esp], 0x4029e8
push edi
mov dword [0x4463a4], eax
call esi
push eax
call fcn.004050a3
pop ecx
mov dword [0x4463ac], eax
test eax, eax
je 0x4090fc
push 0x4029d0
push edi
call esi
push eax
call fcn.004050a3
pop ecx
mov dword [0x4463a8], eax
mov eax, dword [0x4463a8]
cmp eax, ebx
je 0x409154
cmp dword [0x4463ac], ebx
je 0x409154
push eax
call fcn.0040511e
push dword [0x4463ac]
mov esi, eax
call fcn.0040511e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409154
test edi, edi
je 0x409154
call esi
test eax, eax
je 0x40914b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40914b
test byte [ebp - 0xc], 1
jne 0x409154
or dword [ebp + 0x10], 0x200000
jmp 0x40918d
mov eax, dword [0x4463a0]
cmp eax, ebx
je 0x40918d
push eax
call fcn.0040511e
pop ecx
test eax, eax
je 0x40918d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40918d
mov eax, dword [0x4463a4]
cmp eax, ebx
je 0x40918d
push eax
call fcn.0040511e
pop ecx
test eax, eax
je 0x40918d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44639c]
call fcn.0040511e
pop ecx
test eax, eax
je 0x4091ad
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4091af
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4011a2
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp esi, edi
je 0x4011c8
push esi
call fcn.00401139
cmp word [eax], di
jne 0x4011d4
xor eax, eax
jmp 0x401271
cmp word [eax], di
je 0x4011e1
inc dword [ebp - 4]
push eax
call fcn.00401186
cmp eax, edi
jne 0x4011cf
mov eax, dword [ebp - 4]
shl eax, 2
push ebx
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
cmp ebx, edi
pop ecx
mov dword [ebp - 0xc], ebx
jne 0x4011fc
xor esi, esi
jmp 0x40126e
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [eax + eax + 2]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, edi
pop ecx
pop ecx
mov dword [ebp - 8], eax
jne 0x40121a
xor esi, esi
jmp 0x401258
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov esi, dword [sym.imp.msvcrt.dll_wcstok]
mov edi, 0x40109c
push edi
push dword [ebp - 8]
call esi
add esp, 0x10
jmp 0x401244
push edi
mov dword [ebx], eax
push 0
add ebx, 4
call esi
pop ecx
pop ecx
test eax, eax
jne 0x401238
mov ebx, dword [ebp - 0xc]
push 3
push ebx
push dword [ebp - 4]
call sub.MSDTCTM.dll_Ordinal_4
mov esi, eax
cmp dword [ebp - 8], 0
je 0x401267
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x403550
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, dword [0x4c9234]
mov ecx, dword [0x4c613c]
sub esp, 0xc2c
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403643
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x4c9234], 0x959
jne 0x403629
push 0
push 0
call esi
push 0
lea eax, [esp + 0x43c]
push eax
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
push 0x402bf8
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov eax, dword [esp + 0x14]
push eax
call fcn.004033a0
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x403590
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc2c
ret
Function at 0x403ff0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x459da8
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
xor ebx, ebx
cmp dword [0x4c9234], 0x84
jne 0x40407c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomW]
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], ebx
mov byte [esp + 8], bl
push ebx
mov dword [esp + 0x2c], ebx
call fcn.00405719
push ebx
push ebx
call fcn.004057a7
add esp, 0xc
mov dword [esp + 0x28], 0xffffffff
cmp dword [esp + 0x1c], 0x10
jb 0x40406c
mov eax, dword [esp + 8]
push eax
call fcn.0040598e
add esp, 4
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], ebx
mov byte [esp + 8], bl
cmp byte [0x45f0e0], bl
jle 0x40408c
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [0x45e284]
mov edx, dword [0x45e258]
mov dword [0x4c9234], ecx
mov dword [0x4c9bd4], edx
call fcn.00403750
mov ecx, dword [esp + 0x20]
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0x10

Function at 0x406f6c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45c238]
jne 0x406f76
repz ret
jmp fcn.0040b1a5
Function at 0x40bc9f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004097d6
and dword [ebp - 4], 0
cmp dword [0x45efd0], 0
mov ebx, eax
jne 0x40bd50
push 0x40241c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40be01
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402410
push edi
call esi
test eax, eax
je 0x40be01
push eax
call fcn.00409764
mov dword [esp], 0x402400
push edi
mov dword [0x45efd0], eax
call esi
push eax
call fcn.00409764
mov dword [esp], 0x4023ec
push edi
mov dword [0x45efd4], eax
call esi
push eax
call fcn.00409764
mov dword [esp], 0x4023d0
push edi
mov dword [0x45efd8], eax
call esi
push eax
call fcn.00409764
pop ecx
mov dword [0x45efe0], eax
test eax, eax
je 0x40bd50
push 0x4023b8
push edi
call esi
push eax
call fcn.00409764
pop ecx
mov dword [0x45efdc], eax
mov eax, dword [0x45efdc]
cmp eax, ebx
je 0x40bda8
cmp dword [0x45efe0], ebx
je 0x40bda8
push eax
call fcn.004097df
push dword [0x45efe0]
mov esi, eax
call fcn.004097df
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bda8
test edi, edi
je 0x40bda8
call esi
test eax, eax
je 0x40bd9f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bd9f
test byte [ebp - 0xc], 1
jne 0x40bda8
or dword [ebp + 0x10], 0x200000
jmp 0x40bde1
mov eax, dword [0x45efd4]
cmp eax, ebx
je 0x40bde1
push eax
call fcn.004097df
pop ecx
test eax, eax
je 0x40bde1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bde1
mov eax, dword [0x45efd8]
cmp eax, ebx
je 0x40bde1
push eax
call fcn.004097df
pop ecx
test eax, eax
je 0x40bde1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45efd0]
call fcn.004097df
pop ecx
test eax, eax
je 0x40be01
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40be03
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402da0
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xffffffff
xor ecx, ecx
test edx, edx
je 0x402dcc
push edi
lea ebx, [ebx]
movzx edi, byte [ecx + esi]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x427aa0]
inc ecx
cmp ecx, edx
jb 0x402db0
pop edi
not eax
ret

Function at 0x402dd0
Capabilities:
Parse pe header

Disassembly:
test ecx, ecx
jne 0x402dd7
xor eax, eax
ret
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x402dd4
mov eax, dword [ecx + 0x3c]
add eax, ecx
xor ecx, ecx
cmp dword [eax], 0x4550
setne cl
dec ecx
and eax, ecx
ret
Function at 0x40a630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ebx, 0xed
xor edx, edx
mov al, byte [edi + edx + 0x4a493668]
xor al, bl
inc ebx
and ebx, 0x800000ff
mov byte [edx + esi], al
jns 0x40a65f
dec ebx
or ebx, 0xffffff00
inc ebx
inc edx
cmp edx, 0xc
jl 0x40a642
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x416fb0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41e1c8
push 0x4184c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], 0
jne 0x416fed
push 0
call dword [0x41c388]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x417023
push 0xc1
call dword [0x41c3d0]
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
jmp 0x417181
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0x4550
je 0x41705b
push 0xbf
call dword [0x41c3d0]
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
jmp 0x417181
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax + 0x14]
test ecx, ecx
jne 0x417087
push 0xc0
call dword [0x41c3d0]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3c]
jmp 0x417181
mov edx, dword [ebp - 0x24]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 0
jmp 0x4170aa
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x28], edx
jae 0x41715b
push str..detour
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
add ecx, eax
push ecx
call fcn.004184cc
add esp, 8
test eax, eax
jne 0x417156
mov edx, dword [ebp - 0x28]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x20]
cmp dword [eax + edx + 0xc], 0
je 0x4170f7
mov ecx, dword [ebp - 0x28]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x20]
cmp dword [edx + ecx + 0x10], 0
jne 0x4170f9
jmp 0x41715b
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx], 0x30
jb 0x417126
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 4], 0x727444
je 0x417128
jmp 0x41715b
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 8], 0
jne 0x41713c
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov dword [ecx + 8], eax
push 0
call dword [0x41c3d0]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x40]
jmp 0x417181
jmp 0x4170a1
mov dword [ebp - 4], 0xffffffff
jmp 0x417174
push 0xc0
call dword [0x41c3d0]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x440407
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0xc]
jbe 0x444cd0
sub di, 0x6195
jmp 0x44b907
lea edi, [edi - 0x425ccc01]
neg bl
mov edi, dword [edx + 0x24]
shl bl, 1
add edi, eax
neg ch
cmc
movsx bx, bl
mov ebx, dword [edx + 0x20]
dec ch
dec cl
setge ch
add ebx, eax
jmp 0x44a5b8

Function at 0x442edd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [edx + 0x24]
push ebx
pushal
push dword [esp + 8]
add edi, eax
test dl, cl
movzx ecx, word [edi + ecx*2]
add esp, 0x28
push 0x3b715f57
lea esp, [esp + 8]
jne 0x448506
jmp 0x43ed07
Function at 0x4493c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x24]
jo 0x44c4c9
jae 0x4474f8
stc
test ah, dl
push esp
add ecx, 1
push dword [esp]
push esp
call fcn.00447628
dec ebp
push ebx
push esi
inc ebx
push edx
xor dword [eax], esi
xor byte [esi], ch
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [edi], bh
push esp
push 0x46776f72
pop edi
je 0x449439
inc eax
pop ecx
inc ecx
pop eax
push eax
inc ecx
inc esp
pop edx
pop edx
add byte [eax], al
add byte [ebp + 0x6e], dh
je 0x44946e
add byte [esi - 0x4a], ah
mov dh, 0xa9
pop edx
out 0x2b, eax
mov dword [0xf30199eb], eax
push eax
xchg ebx, eax
movsd dword es:[edi], dword [esi]
fdiv dword [edx - 0x145ac19c]
das
in eax, 0x45
ret
ljmp 0x2492:0xc9d142de
sub al, 0x52
invalid
pushfd
pushal
push dword [esp + 0x14]
lea esp, [esp + 0x28]
jae 0x4474f8
call fcn.00446c2c
add byte [eax], al
aas
push esp
jb 0x44c54d
insd dword es:[edi], dx
push ebx
jo 0x44c549
arpl word [ebp + 0x73], sp
dec esp
je 0x44c530
inc ebx
push esp
push ebx
je 0x44c567
imul ebp, dword [esi + 0x67], 0x41514040
inc ebp
dec edx
pop eax
pop edx
add byte [esi - 0x77], ah
and al, 4
lea esp, [esp + 0xc]
ja 0x447f2d
cmp ebx, 0xfe8e3229
shl al, 1
shr al, 4
and al, al
sub ebx, edi
rol edi, 8
and edi, ebx
rcl al, 3
sub al, 0xbc
add ebx, esp
cmc
mov edi, ebx
adc al, dh
sbb al, 0x16
dec al
mov al, 0x2e
pushfd
repne scasb al, byte es:[edi]
mov byte [esp], dh
push 0x3fe063cc
mov byte [esp + 4], 0xa4
call fcn.00447b0f
add byte [eax], al
invalid
push eax
jb 0x44c5bf
arpl word [ebp + 0x73], sp
jae fcn.0044c588
xor cl, byte [esi + 0x65]
js 0x44c5ce
add byte [eax], al
add byte [edi + 0x65], al
je 0x44c5a4
jne 0x44c5d5
jb 0x44c5ca
outsb dx, byte [esi]
je 0x44c5ac
inc esp
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x44c5b2
add byte [ecx - 0x17], al
xchg byte [esi], bl
add byte [eax], al
add bh, bh
je 0x44c5cc
or bl, dh
pushfd
pop dword [esp + 0x3c]
inc esp
and al, 0x3c
jmp 0x44e79d
add byte [eax], al
btc ecx, edx
xor al, 0x31
bts ecx, edi
jmp 0x44d560
add byte [eax], al
jmp 0x44cec0
jmp 0x44de93
sbb byte [eax], al
invalid
Function at 0x449af9
Capabilities:
Check for software breakpoints

Disassembly:
stc
pushfd
pushfd
repne scasb al, byte es:[edi]
push 0x57d82178
mov word [esp], 0x2115
pushal
call fcn.004453df
add byte [eax], al
aas
inc dword [eax]
add byte [edi], bh
aas
xor byte [ebx + 0x54], al
inc esi
imul ebp, dword [ebp + 0x53], 0x61657274
insd dword es:[edi], dx
inc eax
inc eax
push ecx
inc ecx
inc ebp
inc eax
pop eax
pop edx
add byte [eax], al
add byte [esi + 0x6c], al
insb byte es:[edi], dx
jne 0x449ba2
push 0x74736e49
jb 0x449bab
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
inc ebx
popal
arpl word [eax + 0x65], bp
add byte [ecx], bh
js 0x449b4c
cwde
cmpsb byte [esi], byte es:[edi]
pop edx
out 0x3d, eax
mov ch, 0x35
jae 0x449b2c
fild word [ebp - 0x77]
ret
inc ebp
mov ebx, eax
push cs
mov eax, 0xb224cc5e
cli
aam 0x6e
hlt
int3
je 0x449b0e
jl 0x449b53
mov esi, 0x3656cc02
fst dword gs:[esi]
rcl dword [ecx - 0x57], 0xcf
jge 0x449b10
push ecx
movsd dword es:[edi], dword [esi]
test ecx, edx
mov cl, 0x44
cmp dword [ebx - 0x6ce8c8f4], 0xffffff89
aaa
cmpsd dword [esi], dword es:[edi]
out 0xb2, eax
lodsd eax, dword [esi]
arpl bx, cx
pop ds
imul edx, dword [esi], 0x6a
fidivr dword [eax]
test al, 0x9e
daa
mov dword [ebx - 0x7e], edx
rcl byte [eax], 0xcb
aaa
lodsd eax, dword [esi]
stc
lahf
sbb ebx, edx
fdiv qword [edx + 0x41]
aas
and eax, 0x4bf55f01
or dword [edi], ecx
ror edi, 1
sbb dword [edi + 0x1232f41], 0xd3bd0711
mov dword [ecx], ebp
mov ch, 0xd
iretd
mov ebp, 0x2e2989d3
mov ch, 0xd
jnp 0x449b5a
push ds
sahf
mov word [edx], gs
jo 0x449be4
push ebx
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edx - 0x59a55dee], ch
pop edx
out 0x6d, eax
xor eax, 0xd5fb9775
inc ecx
invalid
test al, 0xe0
test dh, 0x32
test al, 0xd4
invalid