joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ddfd
Capabilities:
Encode data using xor

Disassembly:
loopne 0x42dd29
mul byte [ecx]
shr byte [ebx + eax + 0x714cb226], 1
test byte [eax], ch
mov dh, 0x5e
add dword [ecx], esi
invalid
push es
mov bl, 0x72
push eax
test byte [ebx + esi*4 - 0x7f556abd], bh
jmp 0x42dcc4
cmp eax, 0xc1596913
ror ecx, 0xb3
lea eax, [ebx]
leave
mov bl, 0x8d
add al, 0xa3
pop ecx
das
cdq
out 0x7c, eax
and al, 0x13
jl 0x42dd62
mov byte [0xf9a3a7b7], al
add bh, byte [ebx - 1]
xlatb
pop ds
cmp eax, dword [edx + 6]
mov byte [0xddd244be], al
cdq
cmp esi, dword [ebx + 0x4e]
dec esi
xchg ebp, eax
sub cl, dl
int 0x2c
invalid
inc ebx
cmp dword [ecx - 0x102160f7], 0xfffffffa
mov ecx, 0xefde9f09
cli
adc esi, dword [eax]
pop eax
jb 0x42dd28
into
cmp dword [esi], ebx
loop 0x42dcfc
mov ebp, 0x4caa79b5
and dh, byte [edi - 0x6ad6ad9c]
xchg esi, eax
mov esi, 0x95703922
mov dword [0xd64fd762], eax
loope 0x42dd24
loopne 0x42dd4e
cmp al, 0xde
xchg ebx, eax
and dl, 0x36
invalid
shl dword [edi - 0x253707f7], 1
aaa
cmp al, 0x1b
arpl cx, si
sahf
jg 0x42de3a
insd dword es:[edi], dx
mov byte [eax], ah
jnp 0x42dd64
dec esi
sbb ah, byte [0xce06a785]
or byte [ebx + 0x78], al
in al, 0xac
or eax, 0xff4b5855
cwde
cmp eax, 0xeb4f75e8
pop esp
call 0x5d2e2d5d
scasb al, byte es:[edi]
xchg dword [ebx + 0x28ec6cda], eax
pop dword [ebx]
sub edi, dword [esi]
or al, 0xbb
or dword [ecx], 0x5e
cmc
daa
jno 0x42de4e
in eax, dx
outsd dx, dword [esi]
pushal
mov bl, 0x31
xchg esi, eax
or esp, dword [eax]
jb 0x42dd91
xchg edi, eax
pop esi
movsb byte es:[edi], byte [esi]
add al, 0x13
rcr byte [eax + ebx*2], cl
mov cl, 0x5e
sbb edi, ebx
mov bh, 0xf0
insd dword es:[edi], dx
xor dword [ebx + edi + 0x22], edx
pop esp
wait
jle 0x42de81
js 0x42ddbd
in al, dx
iretd
pop ss
xor byte [esi], ch
xor esp, dword [eax]
popal
in al, 0xe
retf
jb 0x42dde3
mov esp, 0x5a4720b7
lodsd eax, dword [esi]
xchg edx, eax
xchg esp, eax
ret 0xb998
add dl, byte [eax]
invalid

Function at 0x443967
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x737b012
mov dword [0xc59373c6], eax
mov cl, 9
movsb byte es:[edi], byte [esi]
pop eax
insb byte es:[edi], dx
imul ebx, dword [ebx], 0xffffffa6
out dx, eax
pop esp
sub dword [ebx - 0x27], esi
loope 0x44395f
not dword [esi - 0xb52644d]
int3
pop eax
xchg dl, dh
sbb dword [esi], ecx
cmp dword [edx], ebp
cmp eax, 0x13d20b1e
push ds
or edx, edx
adc edx, dword [ebp + 0x50]
push ds
or edx, edx
adc edx, dword [ebp + 0x50]
sub eax, 0x399e61f3
xor eax, 0x74ab276f
jae 0x4439bf
jge 0x44390f
imul ecx, dword [edx + 0x32a2397e], 0x5cbf5274
invalid
xor al, 0x69
jecxz 0x4439d7
invalid
adc esi, dword [edx]

Function at 0x443b32
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx], ah
mov cl, 0xa9
and bh, byte [ecx - 0x5b]
test eax, 0xa57922f2
push eax
jns 0x443b12
mov al, byte [0x1c906eaa]
sub dh, byte [eax - 0x7d]
adc byte [edx], bl
stc
xchg ebp, eax
adc al, 0x37
mov al, 0x16
dec eax
xor bl, al
bound edi, qword [ecx - 0x49]
mov bh, 0xad
mov bh, 0xad
pop es
pop eax
cmp eax, 0x140fabed
jns 0x443b15
jmp 0x1d4c3aa1
Function at 0x453cb6
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xe2
cmp byte [ecx], al
xor eax, 0x5d8ea36a
cmc
les eax, [ebp + 0x7f]
insd dword es:[edi], dx
fstp xword [edx - 0x3b90736b]
cmp al, 1
mov bh, 0x19
jl 0x453cf9
adc eax, edx
pop ss
idiv dword [eax - 0x69eb25b3]
test dword [edi + edx*2], edi
push eax
invalid
inc ebp
push esp
fld xword [ebp - 0x15]
test dword [esi + 0x7e2f4dfc], edi
cmpsd dword [esi], dword es:[edi]
arpl word [edi + 0x5e], dx
pop esi
out dx, al
xor ecx, ebx
jp 0x453ceb
aaa
jmp dword [ebp - 0x5e52bea8]
Function at 0x455ca4
Capabilities:
Encode data using xor

Disassembly:
push 0xb801abe7
or eax, edx
lds ebx, [ebx + edx*8 + 0x6621fd57]
adc eax, dword [edx + edx - 0x14f4cf6]
scasd eax, dword es:[edi]
pop esi
stosd dword es:[edi], eax
popal
test byte [ebx], ah
aam 0xa4
pushal
movsb byte es:[edi], byte [esi]
mov al, 0xd2
test byte [ebx + 0x3d4e2353], dh
rol byte [ebx + esi*4 + 0x3d4e2353], cl
xchg dword [ecx], eax
xor eax, dword [edi - 0x1a]
mov esi, 0x6a010ce2
cmc
out 0x75, eax
adc dh, ah
jns 0x455bea
sbb byte [ecx], dl
cmp bh, dh
enter 0x3911, 0xfffffffffffffff1
fild word [esi + 0x6cc38171]
retf 0x7ea
sbb al, dl
cmp al, 0xac
test dl, cl
jl 0x455c4b
cwde
push cs
mov al, 0x81
mov ch, 0x7d
mov cs, ebx
int1
sub eax, 0xe05a149a
xchg ebp, eax
pop edx
loopne 0x455be3
cmp dl, byte [esi + 0x405a7d89]
xor byte [ebx + edx*4], dh
xor al, 0x93
cmc
pop edx
jge 0x455c37
lahf
wait
les esi, [ebx + 0x49]
jg 0x455c04
pop esi
mov dh, 0x45
retf 0x4ca5
scasb al, byte es:[edi]
lodsd eax, dword [esi]
inc esp
outsd dx, dword [esi]
dec edx
js 0x455cf0
or esp, dword [ecx + 0xcecd646]
jae 0x455c55
inc esi
salc
in al, dx
or al, 0x73
cmpsd dword [esi], dword es:[edi]
jg 0x455ca8
and ebp, ebx
jle 0x455c9f
invalid
and dword [ebp + 0x30782345], 0xffffffbc
push 0xc61d1b71
std
and byte [ebp + 0x5b93f96f], bh
jae 0x455d10
push ecx
pop ebp
sbb ah, 0x25
inc edx
lea edi, [ecx - 0x5fcd91c4]
add al, 0x10
rol byte [ebx - 0x7c88fb59], cl
or byte [ebp - 0x14c60350], ch
push es
salc
in al, 0x33
sbb al, byte [esi - 0x7f34df4d]
mov dl, 0x13
call dword [ecx + 0x18f808d8]
xchg esp, eax
xor ecx, dword [edx]
xchg dword cs:[edx], ebp
mov ah, 0xda
xor byte [edi], 0x23
xchg ebx, eax
aas
or cl, byte [eax + 0x71e3b94e]
mov byte [esi - 0x47], cl
jecxz 0x455d87
cld
xchg ebp, eax
wait
fldenv [eax + edi]
or edi, dword [ebp + 0x776cb693]
jecxz 0x455cbe
dec esi
jecxz 0x455d11
insb byte es:[edi], dx
sbb al, 0x2d
invalid
xchg edx, ecx
jne 0x455d99
cmpsd dword [esi], dword es:[edi]
xchg esp, eax
stosd dword es:[edi], eax
rcr byte [eax], 0xe3
fst dword [ecx + 0x65]
scasd eax, dword es:[edi]
add cl, byte [ebx]
and eax, 0xdda05372
inc ebp
leave
push ds
push ebx
mov al, byte [0x1ec945dd]
js 0x455dab
or ecx, ebx
xor eax, 0xd5d0f1c8
pop es
test al, 0x16
push ss
dec ebx
mov eax, dword [0x3f0a83cc]
in eax, 0x5f
jne 0x455e32
int3
mov ebp, 0x9cc5d3f9
mov ch, 0x8a
ret
dec ecx
sub cl, ah
stc
xchg ebx, eax
sar dword [esi + 0x1d37b175], 0xf5
cmpsd dword [si], dword es:[di]
insb byte es:[edi], dx
mov esp, 0x60846661
pop esi
sbb al, dl
xchg byte [ebx + 0x48f4c362], ah
mov bh, 0xd6
jge 0x455e04
fnstcw word [edi - 0x1669229a]
salc
xor al, byte [edi - 0x52]
inc edi
jne 0x455e6d
invalid
sub eax, 0x89153790
or eax, 0xc4990efa
imul ecx, edx, 0xffffffbd
mov ch, 0x15
xor al, 0xdf
int3
Function at 0x47c60a
Capabilities:
Encode data using xor

Disassembly:
mov ch, byte [ebx]
movsb byte es:[edi], byte [esi]
inc ebx
mov esp, ebx
fmul qword [eax + 0x372b91cc]
mov esp, 0x9cd2be01
inc ebp
pop esp
xor al, 0x52
retf
xor dh, byte [edx + 0x30]
adc eax, esi
add dword [edi + 0x7f436d1d], esi
push 0x5ef4613f
inc ebp
out dx, al
xor al, 0xb0
sal byte [eax + ebx*8], 0x4c
pushal
xchg byte [esp + eax*2], bh
inc ebp
out 0xc9, eax
jo 0x47c614
xor byte [ebx], dl
mov byte [ecx], 0xb7
sbb eax, 0x687f436d
jg 0x47c67e
aas
popal
hlt
jno 0x47c60c
dec ebx
int1
loope 0x47c5e5
mov cl, 0xc7
invalid
add dword [ebp - 0x1ab26c7f], esp
adc dword [ebx], 0x235c9376
or dword [ecx - 0x75], esi
adc esi, dword [esi - 0x6d]
pop esp
and ecx, dword [ecx]
jno 0x47c611
cmp edx, dword [0xc0391c45]
xchg ch, bh
jne 0x47c677
push ebp
shl dword [ebp + 9], 1
inc esp
in eax, 0xce
push ebp
push edx
ret 0xb1f6

Function at 0x47f3cd
Capabilities:
Encode data using xor

Disassembly:
adc byte [0xc824cbb1], dh
xor byte [0x898008d0], dl
add al, byte [esi + 0x10]
mov ecx, ebp
out 0xff, al
push esp
inc eax
in al, 0xad
adc byte ds:[eax - 0x3c], ah
enter 0xffffffffffff896c, 0xffffffffffffffa1
dec ebp
mov ah, 0xd
push esp
mov dword [ecx + 0x540db44d], esp
popfd
mov bl, 0xd1
mov dword [eax], edx
mov ah, 0xdb
mov dword [0x10b2d069], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [0x1aad0194]
mov dword [ebp + edx*8 + 1], esi
mov esi, eax
je 0x47f367
mov dword [ebx + 0x7e], 0xfee81165
jmp 0x834febf2
inc ebx
jle 0x47f408
adc eax, ebp
invalid
push edi
jl 0x47f361
adc ah, byte [ebx - 0x6b]
pop ss
xchg esp, eax
mov eax, dword [0xacf23023]
js 0x47f3ed
loope 0x47f37f
mov ecx, 0x709749b7
xchg ch, dl
push ebp
jecxz 0x47f39f
inc esp
push ss
fcom dword [edx]
xchg esp, eax
sbb byte [edi + esi], cl
mov bl, 0x10
mov ch, 0x11
xchg esi, eax
and esp, dword [ebx - 0x152f7cf9]
sub cl, ah
in al, dx
cmp ch, al
clc
daa
add eax, 0x93b832e6
insd dword es:[edi], dx
push edx
push es
inc edi
pushfd
inc ecx
adc dl, byte [edi - 0x5e90806e]
cld
mov byte ds:[0xdcbefe45], al
into
clc
adc dword [ebx - 0xf], 0xa23cfc33
rcl bh, cl
and dh, byte [esi + 0x715c4714]
invalid
Function at 0x4882bb
Capabilities:
Encode data using xor

Disassembly:
aaa
aas
ljmp 0x9a2e
outsd dx, dword [esi]
adc byte [ebp - 0x6ba2885e], 0xf2
aam 0xa2
call dword [ecx]
sub al, 0xaf
inc ebp
mov esi, dword [ebp - 0x2cbd5b96]
and bl, byte [esi - 0x1847d533]
cld
sub al, ch
cmp al, 0x3a
pop eax
daa
ret
clc
fcomp st(2)
xor byte [ebx - 0x60baea3b], dh
lds edx, [0x85fa9f45]
inc ebx
invalid
jne 0x48822a
lds edx, [0x85fa9f45]
inc ebx
sub eax, 0xe6b9c675
stosb byte es:[edi], al
and dword [ebx], edi
mov ecx, 0x3b21aae6
xor dh, byte [ebx]
mov ch, 0xe7
mov ecx, 0x8155e34
stc
xlatb
loopne 0x48820e
loop 0x488255
aaa
add byte [ecx], dl
mov byte [eax], cl
and al, 0x98
cwde
in al, 0xa8
das
insd dword es:[edi], dx
out 0x51, al
sbb dword [ecx], 0x30b66232
or al, 0x30
inc esi
adc eax, 0x822db11b
sub dword [ebp - 0x12], 0xfffffff7
inc esi
neg byte [bx - 0x7a46]
push 0x78
mov edx, 0x25b608c2
push ebx
sbb al, 0x1b
insd dword es:[edi], dx
ror dword [ecx + 0x4e], 1
xchg dword [edx], esp
clc
sbb dword [ecx - 0x612006e8], esi
add al, 0x31
jle 0x48827e
xor al, 0x24
inc esp
jo 0x4882ba
imul eax, dword [esi], 0xffffffb5
shr byte [edi + ebp + 0x1b], 1
inc ebx
aas
mov gs, word [esi]
test al, 0xf9
test al, 0x5a
push 5
int1
jno 0x4882df
invalid
inc esi
add dword [ebp - 3], ebp
cmp byte [esp + edx*8 - 0x39], 0x70
sbb dl, byte [ebx - 0x1a736616]
mov bh, 0x77
cld
xlatb
invalid

Function at 0x48a1d4
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x86
mov ebp, 0x4ac64a64
jecxz 0x48a160
jnp 0x48a184
inc ebx
inc ebx
jb 0x48a140
jb 0x48a140
adc edi, dword [esi + 0x1b]
mov ch, 0xc2
insd dword es:[edi], dx
in eax, dx
mov esi, 0x89b78a34
sub bh, dl
sbb ebp, esi
xor esp, dword [edx - 0x55c970d6]
loope 0x48a143
push esp
mov ecx, 0x2f8ef310
and dword [ecx + 0xf57d46e], eax
xchg esi, eax
mov al, 0xd1
pop esi
inc ecx
cld
xor eax, 0x33b56996
push es
mov ch, 0x87
xor al, 0xe8
loop 0x48a19c
xor eax, 0x97c9a437
fisttp word [edx - 9]
xor byte [ebx + 0x1d], 0x72
je 0x48a1a3
popfd
pop edx
ret
cwd
lodsd eax, dword [esi]
jne 0x48a136
push ecx
scasd eax, dword es:[edi]
or cl, ah
xchg ebx, eax
mov byte [0x66d789b6], al
jnp 0x48a199
mov dl, 0x8f
add dh, byte [eax]
cmp esi, dword [ebp - 0x75]
mov dword [ebp - 0xd26002a], esp
test eax, 0x30ac04b2
adc ch, byte [edx]
mov edx, 0x4a0c32e7
xor cl, byte [edx + ecx*2]
fcom dword [0x3a8efc1e]
adc byte [edi + 0x15e5c5f5], al
sub dword [edx*8 - 0x776c0127], ebx
xchg ebx, eax
mov byte [esp + edx], cl
invalid
aad 0x6a
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
loope 0x48a1c0
cmp al, 0x94
test dh, al
push esp
popal
idiv byte [eax]
invalid
xchg ebp, eax
lds edx, [ecx]

Function at 0x49c0b0
Capabilities:
Encode data using xor

Disassembly:
fisttp word [edx]
xchg ebp, eax
pop edi
add eax, 0x66d7228e
dec edx
dec esi
mov esp, 0xe6c7ba4a
mov dh, byte [edi]
or al, 0x77
outsd dx, dword [esi]
xor dl, byte [edx + 0x4f9c72ca]
out 0x6e, al
test eax, 0xa0b6847b
sub dl, byte [ebp - 0x173f639]
cmp al, 0x46
sub esi, edi
xor byte [ebp + 0x30], dh
invalid
Function at 0x49fcb2
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
push esp
mov esp, 0xb3a3ee4d
mov bh, 0xd0
sar dword [edi + esi*4 + 0x31], 1
out dx, al
dec ecx
ror byte [edx - 0xd], cl
imul ecx
cmp ch, ah
cmc
neg ebp
sub eax, 0xc8f0258
pop ebx
sub al, 0xca
fidivr dword [ecx + 0x20]
inc ebp
call 0xdffb4a67
imul esi, edx, 0x44
nop
das
outsd dx, dword [esi]
jl 0x49fd21
push ds
inc edx
rcpps xmm7, xmmword [ebp + 0x68]
jns 0x49fd0e
xlatb
sar byte [esp + ebx - 0x21], cl
pop edi
dec edi
stosd dword es:[edi], eax
sub byte [edx - 0x4703deba], cl
dec esp
dec ebx
mov dl, 0x70
inc eax
pop edi
fiadd dword [ecx + 0x8846b3f]
invalid
invalid
lcall 0xb25c, 0xd258d2b2
lodsd eax, dword [esi]
push ebx
sbb eax, 0xac70dd37
imul ecx, esp, 0x8328573c
cli
jb 0x49fd35
dec ebx
retf 0x8e78

Function at 0x4ba545
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2378
cmp edx, dword [eax]
je 0x4ba567
add eax, 8
inc ecx
cmp eax, 0x4c2408
jl 0x4ba558
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2378]
jne 0x4ba695
mov eax, dword [0x4c6cfc]
cmp eax, 1
je 0x4ba66f
test eax, eax
jne 0x4ba598
cmp dword [0x4c22a0], 1
je 0x4ba66f
cmp edx, 0xfc
je 0x4ba695
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba5cf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baf30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb3c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba612
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb3c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf9a4
push edi
call fcn.004bd290
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baf30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baf40
lea eax, [ebp - 0xa0]
push 0x4bf984
push eax
call fcn.004baf40
push dword [esi + 0x4c237c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baf40
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd204
add esp, 0x2c
pop edi
jmp 0x4ba695
lea eax, [ebp + 8]
lea esi, [esi + 0x4c237c]
push 0
push eax
push dword [esi]
call fcn.004bb3c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x406982
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x4069e6
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x4069cf
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x4069be
xor ecx, eax
xor edx, ebx
dec edi
jne 0x4069af
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x40a582
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getsockname
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, cl
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
imul esi, esi, 0x666
mov dword [ebp - 4], esi
nop
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
mov eax, dword [ebp - 4]
jmp 0x40a61f
mov esp, ebp
pop ebp
ret
Function at 0x413509
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x413756
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x413653
cmp byte [edx + edi], 0xd
jne 0x413653
cmp byte [edx + edi + 1], 0xa
je 0x41368c
mov al, byte [edx + edi]
cmp al, 0xa
je 0x41368c
cmp al, 0x3d
jne 0x413668
inc ecx
cmp ecx, 2
ja 0x413764
cmp al, 0x7f
ja 0x413764
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x413764
cmp al, 0x40
jae 0x41368b
test ecx, ecx
jne 0x413764
inc esi
inc edx
cmp edx, ebx
jb 0x41363d
test esi, esi
je 0x413756
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x413775
cmp dword [ecx], eax
jb 0x413775
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x413745
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x413741
cmp al, 0xa
je 0x413741
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x413741
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x41372c
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x413739
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x413741
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x4136dd
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x456fb5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x456fd8
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x456fd8
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x456fe2
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x457024
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x457086
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x457081
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45706c
test dl, dl
je 0x457068
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45706c
add ecx, 2
add eax, 2
test dl, dl
jne 0x45704c
xor eax, eax
jmp 0x457071
sbb eax, eax
or eax, 1
test eax, eax
je 0x457092
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x457039
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x457117
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x45713a
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x45713a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x457144
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x457186
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4571e8
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4571e3
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4571ce
test dl, dl
je 0x4571ca
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4571ce
add ecx, 2
add eax, 2
test dl, dl
jne 0x4571ae
xor eax, eax
jmp 0x4571d3
sbb eax, eax
or eax, 1
test eax, eax
je 0x4571f4
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x45719b
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x457286
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4572a9
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4572a9
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4572b3
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4572f5
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x457357
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x457352
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45733d
test dl, dl
je 0x457339
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45733d
add ecx, 2
add eax, 2
test dl, dl
jne 0x45731d
xor eax, eax
jmp 0x457342
sbb eax, eax
or eax, 1
test eax, eax
je 0x457363
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x45730a
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8