joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4012e7
sub esp, 0x64
xor ebx, ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
call fcn.004a6e00
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
add eax, 0x886e0900
adc edx, 0xfffffff1
mov esi, 0x3b9aca00
xor ebx, ebx
mov ebp, edx
or ebp, ebx
jne 0x4012d2
mul esi
mov esi, eax
mov ebp, edx
mov dword [esp + 0x48], edi
mov eax, edi
cdq
mov ebx, eax
mov ecx, edx
mov eax, esi
mov edx, ebp
add eax, ebx
adc edx, ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0045ebe0
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov byte [esp + 0x60], al
lea eax, [esp + 0x50]
xor ebp, ebp
mov dword [eax], ebp
mov dword [eax + 4], ebp
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ebp
xchg ebp, ebx
mov byte [eax + 0x10], bl
xchg ebp, ebx
mov dword [esp + 0x2c], edx
mov dword [eax], edx
mov dword [esp + 0x30], ecx
mov dword [eax + 4], ecx
mov dword [esp + 0x28], eax
xor edi, edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov esi, edi
mov dword [esp + 0x3c], edi
xor eax, eax
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x68]
cmp eax, ebp
jge 0x40125f
mov eax, dword [esp + 0x70]
mov ebx, dword [esp + 0x28]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045f0e0
mov esi, dword [esp + 0x3c]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0x70]
cmp ebx, ebp
jae 0x4012cb
mov ebp, dword [esp + 0x6c]
add ebp, ebx
movzx ebx, byte [ebp]
mov byte [esp + 0x23], bl
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov ebx, eax
inc ebx
cmp ebx, esi
ja 0x40128f
mov edi, ebx
mov dword [esp + 0x38], ebx
mov ebx, ecx
add ebx, eax
movzx ebp, byte [esp + 0x23]
xchg ebp, eax
mov byte [ebx], al
xchg ebp, eax
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x68]
cmp eax, ebp
jl 0x4011f6
mov dword [esp], 0
mov ebx, dword [esp + 0x34]
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.0043f480
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x78], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x7c], ebx
add esp, 0x64
ret
mov dword [esp], 0x5bd4c0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
call fcn.0043b7e0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, eax
inc edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x34], ecx
jmp 0x401241
call fcn.00427bf0
ud2
imul edx, esi
mov ebp, eax
imul ebp, ebx
add ebp, edx
mov edx, esi
mul edx
add edx, ebp
jmp 0x40116e
call fcn.004501c0
jmp fcn.00401110
Function at 0x409420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4095ab
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x40959e
mov ebp, dword [eax]
cmp ebp, 0
je 0x40959e
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x409479
mov ebx, 0x5f703a
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.004298b0
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x4094fc
mov ecx, dword [eax + 0xc]
xor eax, eax
cmp eax, 8
jae 0x4094aa
mov esi, eax
shl esi, 2
add esi, 8
mov ebx, ecx
add ebx, esi
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x18]
cmp ebx, ebp
je 0x4094d0
inc eax
cmp eax, 8
jb 0x40948e
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, ecx
add ebx, eax
mov ecx, dword [ebx]
xor ebp, ebp
cmp ecx, ebp
jne 0x409487
mov ebx, 0x6d0660
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
mov ebx, ecx
add ebx, eax
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x4094a4
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov ebx, ebp
imul ebx, eax
add ebx, 0x28
mov eax, ebx
mov ebx, ecx
add ebx, eax
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x40959a
shl ebx, cl
dec ebx
mov edx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x409487
shr edx, 1
and edx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, edx
imul ebp, ebx
mov edx, eax
add edx, ebp
movzx ebp, byte [edx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x409596
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x409596
mov eax, 1
cmp al, 0
jne 0x409487
mov ecx, edx
jmp 0x409487
xor eax, eax
jmp 0x409586
xor ebx, ebx
jmp 0x409533
mov ebx, 0x6d0660
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
call fcn.004501c0
jmp fcn.00409420
Function at 0x4095c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40975e
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x40974c
mov ebp, dword [eax]
cmp ebp, 0
je 0x40974c
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x409619
mov ebx, 0x5f703a
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.004298b0
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x4096aa
mov ecx, dword [eax + 0xc]
xor eax, eax
cmp eax, 8
jae 0x40964e
mov esi, eax
shl esi, 2
add esi, 8
mov ebx, ecx
add ebx, esi
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x18]
cmp ebx, ebp
je 0x409679
inc eax
cmp eax, 8
jb 0x409632
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, ecx
add ebx, eax
mov ecx, dword [ebx]
xor ebp, ebp
cmp ecx, ebp
jne 0x40962b
mov ebx, 0x6d0660
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 0
add esp, 0xc
ret
mov ebx, ecx
add ebx, eax
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x409648
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov ebx, ebp
imul ebx, eax
add ebx, 0x28
mov eax, ebx
mov ebx, ecx
add ebx, eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 1
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x409748
shl ebx, cl
dec ebx
mov edx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x40962b
shr edx, 1
and edx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, edx
imul ebp, ebx
mov edx, eax
add edx, ebp
movzx ebp, byte [edx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x409744
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x409744
mov eax, 1
cmp al, 0
jne 0x40962b
mov ecx, edx
jmp 0x40962b
xor eax, eax
jmp 0x409734
xor ebx, ebx
jmp 0x4096e1
mov ebx, 0x6d0660
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 0
add esp, 0xc
ret
call fcn.004501c0
jmp fcn.004095c0
Function at 0x409770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x409902
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x4098f5
mov ebp, dword [eax]
cmp ebp, 0
je 0x4098f5
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x4097c9
mov ebx, 0x5f703a
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.004298b0
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x409853
mov edx, dword [eax + 0xc]
xor ecx, ecx
cmp ecx, 8
jae 0x409801
mov esi, ecx
shl esi, 3
add esi, 8
mov ebx, edx
add ebx, esi
mov esi, dword [ebx]
mov eax, dword [ebx + 4]
cmp eax, dword [esp + 0x1c]
jne 0x4097fb
cmp esi, dword [esp + 0x18]
je 0x409827
inc ecx
cmp ecx, 8
jb 0x4097de
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, edx
add ebx, eax
mov edx, dword [ebx]
xor ebp, ebp
cmp edx, ebp
jne 0x4097d7
mov ebx, 0x6d0660
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
mov ebx, edx
add ebx, ecx
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x4097fb
mov eax, edx
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov edx, ebp
imul edx, ecx
add edx, 0x48
mov ebx, eax
add ebx, edx
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x4098f1
shl ebx, cl
dec ebx
mov ecx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov edx, dword [edi + 0xc]
add edx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x4097d7
shr ecx, 1
and ecx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, ecx
imul ebp, ebx
mov ecx, eax
add ecx, ebp
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x4098ed
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x4098ed
mov eax, 1
cmp al, 0
jne 0x4097d7
mov edx, ecx
jmp 0x4097d7
xor eax, eax
jmp 0x4098dd
xor ebx, ebx
jmp 0x40988a
mov ebx, 0x6d0660
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
call fcn.004501c0
jmp fcn.00409770
Function at 0x421800
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x421a13
sub esp, 0x34
mov ecx, dword [esp + 0x38]
movzx ebp, byte [ecx + 6]
xchg ebp, eax
cmp al, 1
xchg ebp, eax
jne 0x4218f7
mov ebx, dword [esp + 0x3c]
mov dword [esp], ebx
mov ebp, dword [ecx + 8]
mov dword [esp + 4], ebp
mov ebp, dword [ecx + 0xc]
mov dword [esp + 8], ebp
mov ebp, dword [ecx + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x20], ecx
mov ebp, dword [ecx + 0x14]
mov dword [esp + 0x10], ebp
call fcn.00412b60
mov ebx, 0x6c1a80
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040bec0
mov eax, 0x6c1a80
add eax, 0x21d8
mov edx, dword [esp + 0x20]
mov ebp, dword [eax + 0x18]
mov ebx, dword [eax]
sub ebp, ebx
mov dword [eax + 0x18], ebp
mov dword [esp + 0x28], eax
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x18], edx
cmp edx, 0
je 0x4218f3
cmp byte [0x6cfdd8], 0
jne 0x4218dd
mov dword [edx], ebp
cmp eax, 0
je 0x4218d9
cmp byte [0x6cfdd8], 0
jne 0x4218c8
mov dword [eax + 0xc], edx
mov ebx, 0x6c1a80
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040c100
add esp, 0x34
ret
lea esi, [eax + 0xc]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.0040e740
jmp 0x4218b0
mov dword [eax], eax
jmp 0x4218a4
mov dword [esp], edx
mov dword [esp + 4], ebp
call fcn.0040e740
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
jmp 0x42189f
mov dword [edx], eax
jmp 0x421894
xchg ebp, eax
cmp al, 2
xchg ebp, eax
jne 0x4219b9
mov dword [esp + 0x1c], ecx
mov ebp, dword [ecx + 8]
mov dword [esp], ebp
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], ebx
call fcn.00422750
mov ebx, 0x6c1a80
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040bec0
mov eax, 0x6c1a80
add eax, 0x21f8
mov edx, dword [esp + 0x1c]
mov ebp, dword [eax + 0x18]
mov ebx, dword [eax]
sub ebp, ebx
mov dword [eax + 0x18], ebp
mov dword [esp + 0x24], eax
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x14], edx
cmp edx, 0
je 0x4219b5
cmp byte [0x6cfdd8], 0
jne 0x42199f
mov dword [edx], ebp
cmp eax, 0
je 0x42199b
cmp byte [0x6cfdd8], 0
jne 0x42198a
mov dword [eax + 0xc], edx
mov ebx, 0x6c1a80
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040c100
jmp 0x4218c4
lea esi, [eax + 0xc]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.0040e740
jmp 0x421971
mov dword [eax], eax
jmp 0x421965
mov dword [esp], edx
mov dword [esp + 4], ebp
call fcn.0040e740
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
jmp 0x421960
mov dword [edx], eax
jmp 0x421955
mov ebx, 0x5f16ea
mov dword [esp], ebx
mov dword [esp + 4], 0x10
call fcn.004298b0
mov ebx, 0x5f01c6
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0xb
mov dword [esp], 0x5bd2c0
lea ebx, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
call fcn.0040ae60
lea ebx, [esp + 0xc]
cld
mov ecx, dword [ebx]
mov dword [esp], ecx
mov ecx, dword [ebx + 4]
mov dword [esp + 4], ecx
call fcn.004291d0
ud2
call fcn.004501c0
jmp fcn.00421800
Function at 0x422d00
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x422e61
sub esp, 0x28
mov ebx, 0x6cfd10
mov dword [esp], ebx
call fcn.0040bec0
mov ebx, dword fs:[0x14]
mov ecx, dword [ebx]
mov eax, 2
mov dword [esp + 0x14], ecx
mov ebp, dword [ecx + 0x18]
mov byte [ebp + 0x1ed], al
mov ebx, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
call fcn.0042a090
mov ebx, 0x5efd6d
mov dword [esp], ebx
mov dword [esp + 4], 0xa
call fcn.0042aaa0
mov ebx, dword [esp + 0x2c]
mov dword [esp], ebx
call fcn.0042aa60
mov ebx, 0x5ee546
mov dword [esp], ebx
mov dword [esp + 4], 2
call fcn.0042aaa0
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.0042a930
mov ebx, 0x5ee544
mov dword [esp], ebx
mov dword [esp + 4], 2
call fcn.0042aaa0
call fcn.0042a110
mov ebx, dword [esp + 0x14]
mov dword [esp], ebx
call fcn.004477f0
lea ebx, [esp + 0x2c]
mov dword [esp], ebx
call fcn.00451a60
mov ebx, dword [esp + 4]
mov dword [esp + 8], ebx
lea ebx, [esp + 0x2c]
mov dword [esp], ebx
call fcn.00451ac0
mov edx, dword [esp + 4]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
mov ecx, 0x44c590
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x14]
mov dword [eax + 0xc], ecx
mov dword [esp], eax
call fcn.004500b0
call fcn.0042a090
mov ebx, 0x5ee526
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042aaa0
call fcn.0042a110
xor eax, eax
mov ebx, dword [esp + 0x14]
mov ebp, dword [ebx + 0x18]
mov byte [ebp + 0x1ed], al
mov ebx, 0x6cfd10
mov dword [esp], ebx
call fcn.0040c100
add esp, 0x28
ret
call fcn.004501c0
jmp fcn.00422d00
Function at 0x4234f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42367c
sub esp, 0x34
mov eax, dword [esp + 0x38]
xor ebx, ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x40], ebx
mov byte [esp + 0x44], bl
mov dword [esp + 0x48], ebx
xor edx, edx
mov byte [esp + 0x24], dl
mov dword [esp + 0x28], edx
mov byte [esp + 0x2c], dl
mov ebx, eax
dec ebx
and ebx, eax
cmp ebx, 0
jne 0x423671
mov ebx, eax
dec ebx
xor ebx, 0xffffffff
mov dword [esp + 0x30], ebx
mov ebx, eax
and ebx, 1
cmp ebx, 0
jne 0x423564
mov ebx, edx
inc ebx
mov edx, ebx
mov byte [esp + 0x24], bl
shr eax, 1
mov ebx, eax
and ebx, 1
cmp ebx, 0
je 0x42354f
mov ebp, 0x3f
mov dword [esp + 0x38], eax
xor esi, esi
mov edi, eax
mov eax, 1
xor edx, edx
xchg ebp, eax
movzx ecx, al
xchg ebp, eax
xchg ebp, eax
mov byte [esp + 0x1b], al
xchg ebp, eax
cmp ecx, 0x40
jae 0x423668
cmp ecx, 0x20
jae 0x42365d
shld edx, eax, cl
shl eax, cl
add eax, edi
adc edx, esi
sub eax, 1
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 8], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0xc], esi
call fcn.0044a6a0
movzx ebp, byte [esp + 0x1b]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, 1
jb 0x4235ea
jbe 0x4235e3
mov ebx, ebp
dec ebx
mov ebp, ebx
jmp 0x423571
cmp edx, 0
jb 0x4235ea
jmp 0x4235dc
mov eax, 1
xor edx, edx
xchg ebp, eax
movzx ecx, al
xchg ebp, eax
cmp ecx, 0x40
jae 0x423657
cmp ecx, 0x20
jae 0x42364f
shld edx, eax, cl
shl eax, cl
add eax, edi
adc edx, esi
sub eax, 1
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.0044a6a0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
movzx ebx, byte [esp + 0x1b]
mov eax, ebx
movzx ebx, byte [esp + 0x24]
mov byte [esp + 0x3c], bl
mov dword [esp + 0x40], ecx
mov byte [esp + 0x44], al
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x48], ebx
add esp, 0x34
ret
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x423605
xor edx, edx
xor eax, eax
jmp 0x4235fb
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x42359a
xor edx, edx
xor eax, eax
jmp 0x42358c
xor ecx, ecx
mov dword [esp + 0x30], ecx
jmp 0x423545
call fcn.004501c0
jmp fcn.004234f0
Function at 0x430ac0
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x3c
mov ebx, dword fs:[0x14]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x70]
inc edx
mov dword [ecx + 0x70], edx
mov ecx, 1
mov byte [eax + 0x85], cl
mov ecx, 0xfffffade
mov dword [eax + 8], ecx
mov ebp, dword [eax + 0x18]
mov ebx, dword [ebp + 0x54]
mov ecx, dword [ebx + 0x14]
mov ebp, dword [eax + 0x18]
mov dword [ebp + 0x204], ecx
mov ecx, 1
mov byte [eax + 0x87], cl
mov dword [esp + 0x18], eax
mov ebp, dword [eax + 0x18]
mov eax, dword [ebp + 0x54]
mov ecx, dword [eax + 0x14]
inc ecx
mov dword [eax + 0x14], ecx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.00451a60
mov ebx, dword [esp + 4]
mov dword [esp + 0x10], ebx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.00451ac0
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 4]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0xc], esi
mov ebx, dword fs:[0x14]
mov ecx, dword [ebx]
mov dword [ecx + 0x24], ebp
mov dword [ecx + 0x20], esi
xor edx, edx
mov dword [ecx + 0x34], edx
xor edx, edx
mov dword [ecx + 0x30], edx
xor edx, edx
mov dword [ecx + 0x2c], edx
mov dword [ecx + 0x28], ecx
mov ebp, dword [eax + 0x20]
mov dword [eax + 0x3c], ebp
mov ebp, dword [eax + 0x24]
mov dword [eax + 0x40], ebp
mov edx, dword [eax + 0x3c]
mov ebp, dword [eax]
cmp edx, ebp
jb 0x430c62
mov edx, dword [eax + 4]
mov ebp, dword [eax + 0x3c]
cmp edx, ebp
jb 0x430c62
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.0042cd00
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x3c]
mov ebp, dword [ecx]
cmp eax, ebp
jb 0x430c32
mov eax, dword [ecx + 4]
mov ebp, dword [ecx + 0x3c]
cmp eax, ebp
jb 0x430c32
mov ebx, 0x611f64
mov dword [esp], ebx
call fcn.004500b0
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.00451a60
mov ebx, dword [esp + 4]
mov dword [esp + 0x14], ebx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.00451ac0
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x14]
mov ebx, dword fs:[0x14]
mov eax, dword [ebx]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], ecx
xor ecx, ecx
mov dword [eax + 0x34], ecx
xor ecx, ecx
mov dword [eax + 0x30], ecx
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x28], eax
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax + 0x70]
dec ecx
mov dword [eax + 0x70], ecx
add esp, 0x3c
ret
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov edx, 0x44cbd0
mov dword [eax], edx
mov edx, dword [esp + 0xc]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [esp], eax
call fcn.004500b0
jmp 0x430bc6
mov edi, esi
mov esi, dword [eax + 0x20]
mov edx, dword [eax + 0x3c]
xor ecx, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0x44ca60
mov ebp, dword [esp + 0x14]
mov dword [ecx], ebp
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], eax
mov dword [esp], ecx
call fcn.004500b0
mov eax, dword [esp + 0x18]
jmp 0x430b97
Function at 0x43f9c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43fb8a
sub esp, 0x64
xor ebx, ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
xor ebx, ebx
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
xor eax, eax
mov ebp, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x60], ebx
xor edx, edx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x58], ebp
mov ecx, ebp
mov ebp, dword [esp + 0x2c]
cmp edx, ebp
jge 0x43fa82
mov dword [esp + 0x34], ecx
mov ecx, dword [ecx]
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], eax
lea ebx, [esp + 0x20]
cmp ebx, 0
je 0x43fb83
mov ebp, 4
mov edx, 4
mov dword [esp + 0x4c], ebx
mov dword [esp], ebx
mov dword [esp + 0x50], ebp
mov dword [esp + 4], ebp
mov dword [esp + 0x54], edx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call fcn.00436010
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
add eax, ecx
mov ecx, dword [esp + 0x34]
add ecx, 4
mov edx, dword [esp + 0x30]
inc edx
mov ebp, dword [esp + 0x2c]
cmp edx, ebp
jl 0x43fa1f
mov ebx, dword [esp + 0x68]
mov dword [esp], ebx
mov ebx, eax
mov dword [esp + 0x1c], eax
add ebx, 3
mov dword [esp + 4], ebx
call fcn.0043f550
mov ebx, dword [esp + 8]
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x3c], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x44], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x48], ebx
xor eax, eax
mov ebp, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x60], ebx
xor edx, edx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x58], ebp
mov ecx, ebp
mov ebp, dword [esp + 0x2c]
cmp edx, ebp
jge 0x43faff
mov dword [esp + 0x34], ecx
mov esi, dword [ecx]
mov dword [esp + 0x30], edx
mov ebp, dword [esp + 0x1c]
cmp eax, ebp
jl 0x43fb1e
mov ebx, dword [esp + 0x3c]
cmp eax, ebx
ja 0x43fb17
mov edx, dword [esp + 0x38]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
add esp, 0x64
ret
call fcn.00427c60
ud2
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
cmp eax, ecx
ja 0x43fb7c
mov ebp, ecx
sub ebp, eax
sub edx, eax
mov ecx, dword [esp + 0x40]
cmp edx, 0
je 0x43fb3f
add ecx, eax
mov dword [esp + 0x4c], ecx
mov dword [esp], ecx
mov dword [esp + 0x50], ebp
mov dword [esp + 4], ebp
mov dword [esp + 0x54], edx
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
call fcn.00436010
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x24]
add ebx, eax
mov eax, ebx
mov ecx, dword [esp + 0x34]
add ecx, 4
mov edx, dword [esp + 0x30]
inc edx
jmp 0x43fae5
call fcn.00427c60
ud2
mov dword [ebx], eax
jmp 0x43fa3a
call fcn.004501c0
jmp fcn.0043f9c0