joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4084b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x120]
add edx, 1
mov dword [ebp - 0x120], edx
add esp, 4
pop ebx
push ebx
and ebx, 0xb1e8
and ebx, 0x1084a
or ebx, 0xfe2e
and ebx, 0xcf25
pop ebx
mov dword [ebp - 0x2c], 0
jmp 0x4083e6
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x124]
add edx, dword [ebp - 0x2c]
movsx eax, byte [edx]
test eax, eax
je 0x408482
mov ecx, dword [ebp - 0x2c]
movsx edx, byte [ebp + ecx - 0x154]
test edx, edx
je 0x408482
push eax
push edi
add esp, 4
jmp 0x408416
jmp 0x40841f
sub eax, 0x2de2
pop eax
push ebx
add ebx, 0x15051
pop ebx
push edi
jmp 0x408434
sub edi, 0x7530
pop edi
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x2c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x2c]
movsx eax, byte [ebp + edx - 0x154]
cmp ecx, eax
je 0x408474
mov ecx, dword [ebp - 0x124]
add ecx, dword [ebp - 0x2c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x2c]
movsx ecx, byte [ebp + eax - 0x154]
cmp edx, ecx
jne 0x40847b
jmp 0x4083dd
jmp 0x408482
push ecx
push edx
add esp, 4
xor ecx, 0xb5cf
call 0x408499
add byte [eax], al
add byte [ebx], bh
inc ebx
inc edi
push eax
inc ebx
cmp eax, dword [ebx + 0x3eb04c4]
cmp dword [eax + edi + 0x59], eax
cmp byte [ecx + 0x51], bl
call method.CommandAppAuthSecuromGameRegistration.virtual_8
add byte [edx + ecx*2 + 0x32], al
inc esp
push eax
dec esi
dec ebp
add esp, 4
pop ecx
mov edx, dword [ebp - 0x124]
add edx, dword [ebp - 0x2c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x2c]
movsx edx, byte [ebp + ecx - 0x154]
cmp eax, edx
jne 0x4084de
mov dword [ebp - 0x1fc], 0
jmp 0x408579
push ebx
push ebx
add esp, 4
xor ebx, 0x7c88
and ebx, 0x113fe
xor ebx, 0x9fa4
pop ebx
push edx
push esi
add esp, 4
xor edx, 0xd095
jmp 0x408509
or edx, 0xf2d9
pop edx
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x2c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x2c]
movsx eax, byte [ebp + edx - 0x154]
or eax, 0x20
cmp ecx, eax
jge 0x40853d
mov dword [ebp - 0x1fc], 0xffffffff
jmp 0x408579
push eax
push ecx
add esp, 4
xor eax, 0xb28e
jmp 0x40854d
pop eax
push edi
push esi
add esp, 4
call 0x40855f
add byte [edi + esi], bh
dec edx
xor eax, 0xc4833749
add al, 0x81
invalid
cmp dword [ebp - 0x1fc], 0
jne 0x4085c2
push edx
xor edx, 0x11f82
pop edx
push ecx
jmp 0x408592
jmp 0x408599
jmp 0x40859f
pop ecx
push edi
add edi, 0xdab6
and edi, 0xa615
add edi, 0x3163
pop edi
mov ecx, dword [ebp - 0x498]
mov dword [ebp - 0x98], ecx
jmp 0x4085d3
jmp 0x4082da
Function at 0x40855f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x120]
add edx, 1
mov dword [ebp - 0x120], edx
add esp, 4
pop ebx
push ebx
and ebx, 0xb1e8
and ebx, 0x1084a
or ebx, 0xfe2e
and ebx, 0xcf25
pop ebx
mov dword [ebp - 0x2c], 0
jmp 0x4083e6
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x124]
add edx, dword [ebp - 0x2c]
movsx eax, byte [edx]
test eax, eax
je 0x408482
mov ecx, dword [ebp - 0x2c]
movsx edx, byte [ebp + ecx - 0x154]
test edx, edx
je 0x408482
push eax
push edi
add esp, 4
jmp 0x408416
jmp 0x40841f
sub eax, 0x2de2
pop eax
push ebx
add ebx, 0x15051
pop ebx
push edi
jmp 0x408434
sub edi, 0x7530
pop edi
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x2c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x2c]
movsx eax, byte [ebp + edx - 0x154]
cmp ecx, eax
je 0x408474
mov ecx, dword [ebp - 0x124]
add ecx, dword [ebp - 0x2c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x2c]
movsx ecx, byte [ebp + eax - 0x154]
cmp edx, ecx
jne 0x40847b
jmp 0x4083dd
jmp 0x408482
push ecx
push edx
add esp, 4
xor ecx, 0xb5cf
call 0x408499
add byte [eax], al
add byte [ebx], bh
inc ebx
inc edi
push eax
inc ebx
cmp eax, dword [ebx + 0x3eb04c4]
cmp dword [eax + edi + 0x59], eax
cmp byte [ecx + 0x51], bl
call method.CommandAppAuthSecuromGameRegistration.virtual_8
add byte [edx + ecx*2 + 0x32], al
inc esp
push eax
dec esi
dec ebp
add esp, 4
pop ecx
mov edx, dword [ebp - 0x124]
add edx, dword [ebp - 0x2c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x2c]
movsx edx, byte [ebp + ecx - 0x154]
cmp eax, edx
jne 0x4084de
mov dword [ebp - 0x1fc], 0
jmp 0x408579
push ebx
push ebx
add esp, 4
xor ebx, 0x7c88
and ebx, 0x113fe
xor ebx, 0x9fa4
pop ebx
push edx
push esi
add esp, 4
xor edx, 0xd095
jmp 0x408509
or edx, 0xf2d9
pop edx
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x2c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x2c]
movsx eax, byte [ebp + edx - 0x154]
or eax, 0x20
cmp ecx, eax
jge 0x40853d
mov dword [ebp - 0x1fc], 0xffffffff
jmp 0x408579
push eax
push ecx
add esp, 4
xor eax, 0xb28e
jmp 0x40854d
pop eax
push edi
push esi
add esp, 4
call 0x40855f
add byte [edi + esi], bh
dec edx
xor eax, 0xc4833749
add al, 0x81
invalid
cmp dword [ebp - 0x1fc], 0
jne 0x4085c2
push edx
xor edx, 0x11f82
pop edx
push ecx
jmp 0x408592
jmp 0x408599
jmp 0x40859f
pop ecx
push edi
add edi, 0xdab6
and edi, 0xa615
add edi, 0x3163
pop edi
mov ecx, dword [ebp - 0x498]
mov dword [ebp - 0x98], ecx
jmp 0x4085d3
jmp 0x4082da
Function at 0x408add
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0xc776
pop edx
mov ecx, dword [ebp - 0xc8]
cmp ecx, dword [ebp - 0x208]
je 0x408b05
mov edx, dword [ebp - 0xc8]
cmp dword [edx + 0x30], 0
jne 0x408849
push edi
push edx
add esp, 4
call 0x408b16
add byte [ecx + 0x3a], cl
cmp al, 0x41
aaa
inc ebx
add esp, 4
jmp 0x408b1e
pop edi
push edx
push ebx
add esp, 4
and edx, 0x2541
and edx, 0x119a6
sub edx, 0x114cc
pop edx
mov dword [ebp - 0x6c], 0

Function at 0x408b16
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edx, 0xc776
pop edx
mov ecx, dword [ebp - 0xc8]
cmp ecx, dword [ebp - 0x208]
je 0x408b05
mov edx, dword [ebp - 0xc8]
cmp dword [edx + 0x30], 0
jne 0x408849
push edi
push edx
add esp, 4
call 0x408b16
add byte [ecx + 0x3a], cl
cmp al, 0x41
aaa
inc ebx
add esp, 4
jmp 0x408b1e
pop edi
push edx
push ebx
add esp, 4
and edx, 0x2541
and edx, 0x119a6
sub edx, 0x114cc
pop edx
mov dword [ebp - 0x6c], 0
Function at 0x40a585
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
push edi
jmp 0x40a593
pop edi
mov dword [ebp - 0xec], 0
jmp 0x40a8aa
Function at 0x40b2d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or ecx, 0x179ce
jmp 0x40b2e3
pop ecx
movzx eax, word [ebp - 0x68]
movzx ecx, word [ebp - 0x1c]
cmp eax, ecx
jge 0x40b2fc
mov dword [ebp - 0x314], 0xffffffff
jmp 0x40b306
mov dword [ebp - 0x314], 1
mov edx, dword [ebp - 0x314]
mov dword [ebp - 0x318], edx
invalid
inc dword [ebx - 0x31743]
inc dword [eax]
jne 0x40b35b
push edi
push ebx
add esp, 4
jmp 0x40b328
add edi, 0x174b7
pop edi
push ebx
push ecx
add esp, 4
or ebx, 0xadfd
or ebx, 0x7c38
or ebx, 0x10793
sub ebx, 0x2eb9
pop ebx
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x70], eax
jmp 0x40b3f2
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ecx]
mov dword [ebp - 0xa8], edx
push esi
jmp 0x40b373
jmp 0x40b37b
and esi, 0x153b6
call 0x40b38f
add byte [edi], dh
cmp dh, byte [esi + esi]
cmp eax, dword [edi + 0x36]
xor al, byte [ebx + 0x565e04c4]
or esi, 0x15a7b
pop esi
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x254]
je 0x40b3b9
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx + 0x30], 0
jne 0x40b0fd
push edi
push edx
add esp, 4
xor edi, 0x7c66
and edi, 0x22a7
or edi, 0x13cd3
add edi, 0x6305
pop edi
push edi
and edi, 0x5ccd
sub edi, 0x4910
xor edi, 0xaa36
pop edi
mov dword [ebp - 0x70], 0

Function at 0x40b38f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or ecx, 0x179ce
jmp 0x40b2e3
pop ecx
movzx eax, word [ebp - 0x68]
movzx ecx, word [ebp - 0x1c]
cmp eax, ecx
jge 0x40b2fc
mov dword [ebp - 0x314], 0xffffffff
jmp 0x40b306
mov dword [ebp - 0x314], 1
mov edx, dword [ebp - 0x314]
mov dword [ebp - 0x318], edx
invalid
inc dword [ebx - 0x31743]
inc dword [eax]
jne 0x40b35b
push edi
push ebx
add esp, 4
jmp 0x40b328
add edi, 0x174b7
pop edi
push ebx
push ecx
add esp, 4
or ebx, 0xadfd
or ebx, 0x7c38
or ebx, 0x10793
sub ebx, 0x2eb9
pop ebx
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x70], eax
jmp 0x40b3f2
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ecx]
mov dword [ebp - 0xa8], edx
push esi
jmp 0x40b373
jmp 0x40b37b
and esi, 0x153b6
call 0x40b38f
add byte [edi], dh
cmp dh, byte [esi + esi]
cmp eax, dword [edi + 0x36]
xor al, byte [ebx + 0x565e04c4]
or esi, 0x15a7b
pop esi
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x254]
je 0x40b3b9
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx + 0x30], 0
jne 0x40b0fd
push edi
push edx
add esp, 4
xor edi, 0x7c66
and edi, 0x22a7
or edi, 0x13cd3
add edi, 0x6305
pop edi
push edi
and edi, 0x5ccd
sub edi, 0x4910
xor edi, 0xaa36
pop edi
mov dword [ebp - 0x70], 0
Function at 0x40c64d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [eax + 0x32], al
dec esi
dec eax
inc ecx
inc edx
cmp ecx, dword [ecx + 0x33]
cmp dword [ebx - 0x74a7fb3c], eax
xchg ebp, eax
inc esp
invalid

Function at 0x40c6a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop ecx
mov dword [ebp - 0xd0], 0
cmp dword [ebp - 0xd0], 0
jne 0x40c6f5
push ecx
and ecx, 0x14c30
add ecx, 0x105d2
sub ecx, 0x1298f
pop ecx
push ecx
push ebx
add esp, 4
sub ecx, 0x118a9
call 0x40c6e2
add byte [eax], bh
inc ebp
xor eax, 0x354a324b
cmp eax, dword [ebx - 0x38a6fb3c]
test dword [eax - 2], ecx
invalid
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0xe0], 0
push edx
sub edx, 0x10b2a
sub edx, 0xb052
pop edx
push ebx
add ebx, 0x6fc5
or ebx, 0x50f7
pop ebx
push esi
or esi, 0x175e9
pop esi
push edi

Function at 0x40c730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or edi, 0xdd77
sub edi, 0x9f94
pop edi
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0
jne 0x40c792
push ebx
push esi
add esp, 4
add ebx, 0xcd20
jmp 0x40c762
add ebx, 0x17bf9
and ebx, 0x1f4b
pop ebx
push edx
push esi
add esp, 4
and edx, 0x16dc7
sub edx, 0x9aa1
pop edx
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x90], ecx
jmp 0x40cc6c
mov edx, dword [ebp - 0x344]
mov eax, dword [ebp - 0x7c]
add eax, dword [edx + 0x3c]
invalid
invalid

Function at 0x40c7a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x75fffffc
adc dword [ebx - 0xdf73], ecx
dec dword [ecx - 0x8f73]
invalid

Function at 0x40c880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec ebp
test byte [ebx], al
lea esi, [esp + edi*8 - 0x72760001]
sub al, 0xff
invalid
Function at 0x40cfa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x278]
mov ax, word [edx]
mov word [ebp - 0x1dc], ax
mov ecx, dword [ebp - 0x278]
add ecx, 2
mov dword [ebp - 0x278], ecx
mov dx, word [ebp - 0x1dc]
mov word [ebp - 0x50], dx
push eax
push esi
add esp, 4
or eax, 0x13700
pop eax
push ecx
push ebx
add esp, 4
sub ecx, 0x7aaa
sub ecx, 0x18a8
xor ecx, 0xfeb6
pop ecx
push ebx
or ebx, 0x4dc1
xor ebx, 0x55e0
pop ebx
mov eax, dword [ebp - 0x27c]
mov cx, word [eax]
mov word [ebp - 0x1de], cx
mov edx, dword [ebp - 0x27c]
add edx, 2
mov dword [ebp - 0x27c], edx
mov ax, word [ebp - 0x1de]
mov word [ebp - 0x28], ax
push edi
push ecx
add esp, 4
xor edi, 0x11133
sub edi, 0xe7f8
call 0x40d046
add byte [esi + 0x37], cl
dec eax
cmp eax, 0x40403536
dec eax
add esp, 4
add edi, 0x3a53
pop edi
push ebx
and ebx, 0x1692b
pop ebx
movzx ecx, word [ebp - 0x28]
test ecx, ecx
jne 0x40d075
movzx edx, word [ebp - 0x50]
movzx eax, word [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x358], edx
jmp 0x40d0f8
movzx ecx, word [ebp - 0x50]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x40cf6e
movzx eax, word [ebp - 0x50]
xor eax, 0x20
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x40cf6e
push edi
jmp 0x40d0a2
or edi, 0x486c
sub edi, 0x7642
pop edi
push eax
push esi
add esp, 4
and eax, 0x15df
call 0x40d0c6
add byte [ebp + 0x44], cl
inc esi
cmp al, 0x41
add esp, 4
pop eax
movzx edx, word [ebp - 0x50]
movzx eax, word [ebp - 0x28]
cmp edx, eax
jge 0x40d0e2
mov dword [ebp - 0x354], 0xffffffff
jmp 0x40d0ec
mov dword [ebp - 0x354], 1
mov ecx, dword [ebp - 0x354]
mov dword [ebp - 0x358], ecx
cmp dword [ebp - 0x358], 0
jne 0x40d141
push ecx
push edx
add esp, 4
jmp 0x40d10e
pop ecx
push edi
sub edi, 0xda91
jmp 0x40d11f
pop edi
push edx
call 0x40d12f
add byte [edi + edi + 0x3c], al
dec esi
cmp byte [ecx + edi + 0x34], cl
add esp, 4
pop edx
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x74], edx
jmp 0x40d1d8
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov dword [ebp - 0xb4], ecx
push ebx
push eax
add esp, 4
xor ebx, 0x8fdc
pop ebx
push edx
push edx
add esp, 4
xor edx, 0x23c4
pop edx
push ecx
or ecx, 0x668e
xor ecx, 0xac2e
add ecx, 0x12052
add ecx, 0x12dc7
pop ecx
mov edx, dword [ebp - 0xb4]
cmp edx, dword [ebp - 0x280]
je 0x40d19f
mov eax, dword [ebp - 0xb4]
cmp dword [eax + 0x30], 0
jne 0x40cee3
push edi
push ebx
add esp, 4
and edi, 0xed47
xor edi, 0x17367
pop edi
push ebx
and ebx, 0x12511
or ebx, 0x16ed9
pop ebx
push edi
push ebx
add esp, 4
add edi, 0x10841
or edi, 0x8196
pop edi
mov dword [ebp - 0x74], 0
Function at 0x40d046
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x278]
mov ax, word [edx]
mov word [ebp - 0x1dc], ax
mov ecx, dword [ebp - 0x278]
add ecx, 2
mov dword [ebp - 0x278], ecx
mov dx, word [ebp - 0x1dc]
mov word [ebp - 0x50], dx
push eax
push esi
add esp, 4
or eax, 0x13700
pop eax
push ecx
push ebx
add esp, 4
sub ecx, 0x7aaa
sub ecx, 0x18a8
xor ecx, 0xfeb6
pop ecx
push ebx
or ebx, 0x4dc1
xor ebx, 0x55e0
pop ebx
mov eax, dword [ebp - 0x27c]
mov cx, word [eax]
mov word [ebp - 0x1de], cx
mov edx, dword [ebp - 0x27c]
add edx, 2
mov dword [ebp - 0x27c], edx
mov ax, word [ebp - 0x1de]
mov word [ebp - 0x28], ax
push edi
push ecx
add esp, 4
xor edi, 0x11133
sub edi, 0xe7f8
call 0x40d046
add byte [esi + 0x37], cl
dec eax
cmp eax, 0x40403536
dec eax
add esp, 4
add edi, 0x3a53
pop edi
push ebx
and ebx, 0x1692b
pop ebx
movzx ecx, word [ebp - 0x28]
test ecx, ecx
jne 0x40d075
movzx edx, word [ebp - 0x50]
movzx eax, word [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x358], edx
jmp 0x40d0f8
movzx ecx, word [ebp - 0x50]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x40cf6e
movzx eax, word [ebp - 0x50]
xor eax, 0x20
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x40cf6e
push edi
jmp 0x40d0a2
or edi, 0x486c
sub edi, 0x7642
pop edi
push eax
push esi
add esp, 4
and eax, 0x15df
call 0x40d0c6
add byte [ebp + 0x44], cl
inc esi
cmp al, 0x41
add esp, 4
pop eax
movzx edx, word [ebp - 0x50]
movzx eax, word [ebp - 0x28]
cmp edx, eax
jge 0x40d0e2
mov dword [ebp - 0x354], 0xffffffff
jmp 0x40d0ec
mov dword [ebp - 0x354], 1
mov ecx, dword [ebp - 0x354]
mov dword [ebp - 0x358], ecx
cmp dword [ebp - 0x358], 0
jne 0x40d141
push ecx
push edx
add esp, 4
jmp 0x40d10e
pop ecx
push edi
sub edi, 0xda91
jmp 0x40d11f
pop edi
push edx
call 0x40d12f
add byte [edi + edi + 0x3c], al
dec esi
cmp byte [ecx + edi + 0x34], cl
add esp, 4
pop edx
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x74], edx
jmp 0x40d1d8
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov dword [ebp - 0xb4], ecx
push ebx
push eax
add esp, 4
xor ebx, 0x8fdc
pop ebx
push edx
push edx
add esp, 4
xor edx, 0x23c4
pop edx
push ecx
or ecx, 0x668e
xor ecx, 0xac2e
add ecx, 0x12052
add ecx, 0x12dc7
pop ecx
mov edx, dword [ebp - 0xb4]
cmp edx, dword [ebp - 0x280]
je 0x40d19f
mov eax, dword [ebp - 0xb4]
cmp dword [eax + 0x30], 0
jne 0x40cee3
push edi
push ebx
add esp, 4
and edi, 0xed47
xor edi, 0x17367
pop edi
push ebx
and ebx, 0x12511
or ebx, 0x16ed9
pop ebx
push edi
push ebx
add esp, 4
add edi, 0x10841
or edi, 0x8196
pop edi
mov dword [ebp - 0x74], 0
Function at 0x40d0c6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x278]
mov ax, word [edx]
mov word [ebp - 0x1dc], ax
mov ecx, dword [ebp - 0x278]
add ecx, 2
mov dword [ebp - 0x278], ecx
mov dx, word [ebp - 0x1dc]
mov word [ebp - 0x50], dx
push eax
push esi
add esp, 4
or eax, 0x13700
pop eax
push ecx
push ebx
add esp, 4
sub ecx, 0x7aaa
sub ecx, 0x18a8
xor ecx, 0xfeb6
pop ecx
push ebx
or ebx, 0x4dc1
xor ebx, 0x55e0
pop ebx
mov eax, dword [ebp - 0x27c]
mov cx, word [eax]
mov word [ebp - 0x1de], cx
mov edx, dword [ebp - 0x27c]
add edx, 2
mov dword [ebp - 0x27c], edx
mov ax, word [ebp - 0x1de]
mov word [ebp - 0x28], ax
push edi
push ecx
add esp, 4
xor edi, 0x11133
sub edi, 0xe7f8
call 0x40d046
add byte [esi + 0x37], cl
dec eax
cmp eax, 0x40403536
dec eax
add esp, 4
add edi, 0x3a53
pop edi
push ebx
and ebx, 0x1692b
pop ebx
movzx ecx, word [ebp - 0x28]
test ecx, ecx
jne 0x40d075
movzx edx, word [ebp - 0x50]
movzx eax, word [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x358], edx
jmp 0x40d0f8
movzx ecx, word [ebp - 0x50]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x40cf6e
movzx eax, word [ebp - 0x50]
xor eax, 0x20
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x40cf6e
push edi
jmp 0x40d0a2
or edi, 0x486c
sub edi, 0x7642
pop edi
push eax
push esi
add esp, 4
and eax, 0x15df
call 0x40d0c6
add byte [ebp + 0x44], cl
inc esi
cmp al, 0x41
add esp, 4
pop eax
movzx edx, word [ebp - 0x50]
movzx eax, word [ebp - 0x28]
cmp edx, eax
jge 0x40d0e2
mov dword [ebp - 0x354], 0xffffffff
jmp 0x40d0ec
mov dword [ebp - 0x354], 1
mov ecx, dword [ebp - 0x354]
mov dword [ebp - 0x358], ecx
cmp dword [ebp - 0x358], 0
jne 0x40d141
push ecx
push edx
add esp, 4
jmp 0x40d10e
pop ecx
push edi
sub edi, 0xda91
jmp 0x40d11f
pop edi
push edx
call 0x40d12f
add byte [edi + edi + 0x3c], al
dec esi
cmp byte [ecx + edi + 0x34], cl
add esp, 4
pop edx
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x74], edx
jmp 0x40d1d8
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov dword [ebp - 0xb4], ecx
push ebx
push eax
add esp, 4
xor ebx, 0x8fdc
pop ebx
push edx
push edx
add esp, 4
xor edx, 0x23c4
pop edx
push ecx
or ecx, 0x668e
xor ecx, 0xac2e
add ecx, 0x12052
add ecx, 0x12dc7
pop ecx
mov edx, dword [ebp - 0xb4]
cmp edx, dword [ebp - 0x280]
je 0x40d19f
mov eax, dword [ebp - 0xb4]
cmp dword [eax + 0x30], 0
jne 0x40cee3
push edi
push ebx
add esp, 4
and edi, 0xed47
xor edi, 0x17367
pop edi
push ebx
and ebx, 0x12511
or ebx, 0x16ed9
pop ebx
push edi
push ebx
add esp, 4
add edi, 0x10841
or edi, 0x8196
pop edi
mov dword [ebp - 0x74], 0
Function at 0x40d12f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x278]
mov ax, word [edx]
mov word [ebp - 0x1dc], ax
mov ecx, dword [ebp - 0x278]
add ecx, 2
mov dword [ebp - 0x278], ecx
mov dx, word [ebp - 0x1dc]
mov word [ebp - 0x50], dx
push eax
push esi
add esp, 4
or eax, 0x13700
pop eax
push ecx
push ebx
add esp, 4
sub ecx, 0x7aaa
sub ecx, 0x18a8
xor ecx, 0xfeb6
pop ecx
push ebx
or ebx, 0x4dc1
xor ebx, 0x55e0
pop ebx
mov eax, dword [ebp - 0x27c]
mov cx, word [eax]
mov word [ebp - 0x1de], cx
mov edx, dword [ebp - 0x27c]
add edx, 2
mov dword [ebp - 0x27c], edx
mov ax, word [ebp - 0x1de]
mov word [ebp - 0x28], ax
push edi
push ecx
add esp, 4
xor edi, 0x11133
sub edi, 0xe7f8
call 0x40d046
add byte [esi + 0x37], cl
dec eax
cmp eax, 0x40403536
dec eax
add esp, 4
add edi, 0x3a53
pop edi
push ebx
and ebx, 0x1692b
pop ebx
movzx ecx, word [ebp - 0x28]
test ecx, ecx
jne 0x40d075
movzx edx, word [ebp - 0x50]
movzx eax, word [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x358], edx
jmp 0x40d0f8
movzx ecx, word [ebp - 0x50]
movzx edx, word [ebp - 0x28]
cmp ecx, edx
je 0x40cf6e
movzx eax, word [ebp - 0x50]
xor eax, 0x20
movzx ecx, word [ebp - 0x28]
cmp eax, ecx
je 0x40cf6e
push edi
jmp 0x40d0a2
or edi, 0x486c
sub edi, 0x7642
pop edi
push eax
push esi
add esp, 4
and eax, 0x15df
call 0x40d0c6
add byte [ebp + 0x44], cl
inc esi
cmp al, 0x41
add esp, 4
pop eax
movzx edx, word [ebp - 0x50]
movzx eax, word [ebp - 0x28]
cmp edx, eax
jge 0x40d0e2
mov dword [ebp - 0x354], 0xffffffff
jmp 0x40d0ec
mov dword [ebp - 0x354], 1
mov ecx, dword [ebp - 0x354]
mov dword [ebp - 0x358], ecx
cmp dword [ebp - 0x358], 0
jne 0x40d141
push ecx
push edx
add esp, 4
jmp 0x40d10e
pop ecx
push edi
sub edi, 0xda91
jmp 0x40d11f
pop edi
push edx
call 0x40d12f
add byte [edi + edi + 0x3c], al
dec esi
cmp byte [ecx + edi + 0x34], cl
add esp, 4
pop edx
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x74], edx
jmp 0x40d1d8
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
mov dword [ebp - 0xb4], ecx
push ebx
push eax
add esp, 4
xor ebx, 0x8fdc
pop ebx
push edx
push edx
add esp, 4
xor edx, 0x23c4
pop edx
push ecx
or ecx, 0x668e
xor ecx, 0xac2e
add ecx, 0x12052
add ecx, 0x12dc7
pop ecx
mov edx, dword [ebp - 0xb4]
cmp edx, dword [ebp - 0x280]
je 0x40d19f
mov eax, dword [ebp - 0xb4]
cmp dword [eax + 0x30], 0
jne 0x40cee3
push edi
push ebx
add esp, 4
and edi, 0xed47
xor edi, 0x17367
pop edi
push ebx
and ebx, 0x12511
or ebx, 0x16ed9
pop ebx
push edi
push ebx
add esp, 4
add edi, 0x10841
or edi, 0x8196
pop edi
mov dword [ebp - 0x74], 0
Function at 0x10001030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
pop ebp
ret

Function at 0x10001048
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1000e078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
xor ebx, ebx
push ebx
push 8
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100010ab
call esi
cmp eax, 0x3f0
jne 0x100010a4
lea eax, [ebp - 0x10]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100010ab
xor eax, eax
jmp 0x1000117d
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x100010a4
call esi
cmp eax, 0x7a
jne 0x100010a4
mov eax, dword [ebp - 0x14]
add eax, 8
cmp eax, 0x400
ja 0x100010ec
call fcn.10004f50
mov esi, esp
cmp esi, ebx
je 0x100010a4
mov dword [esi], 0xcccc
add esi, 8
jmp 0x10001102
push eax
call fcn.100031fe
pop ecx
cmp eax, ebx
je 0x10001100
mov dword [eax], 0xdddd
add eax, 8
mov esi, eax
cmp esi, ebx
je 0x100010a4
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push esi
push 2
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x100010a4
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x100010a4
xor edi, edi
mov dword [ebp - 0x1c], ebx
cmp dword [esi], ebx
jbe 0x10001171
lea ebx, [esi + 4]
push dword [ebp - 0x18]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10001163
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x1000114a
jmp 0x10001171
test byte [esi + edi*8 + 8], 4
je 0x10001171
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002a98
leave
ret