joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f8c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x47f8db
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x47f8f7
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x47f8e6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x47f930
cmp eax, edi
jne 0x47f928
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x47f938
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x47f938
cmp eax, edi
jne 0x47f93b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.0047dff0
push 0x28
push edi
call fcn.004fa19d
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47fef0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 8], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 4], ebx
jb 0x47ff0f
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x47ff31
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x47ff20
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x47ff59
mov eax, ebx
jmp 0x47ff5d
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x47ffc9
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x47ff6b
mov edx, dword [edi]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x10], edi
cmp edi, 0x10
mov edi, dword [ebp + 0xc]
jb 0x47ff7f
mov ecx, dword [esi + 8]
push dword [ebp - 4]
mov eax, dword [esi + 0x18]
push edx
push eax
push ecx
mov dword [ebp - 0x14], eax
call fcn.0041a3a0
add esp, 0x10
test al, al
jne 0x47ffa1
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x47ff51
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x47ffac
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
jb 0x47ffb4
mov edi, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [ebp - 4]
push edi
call fcn.0041a3a0
add esp, 0x10
test al, al
cmovne ebx, esi
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x484100
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x48410e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
pop ebp
ret
Function at 0x484ae0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541330
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x58fc74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00483ea0
mov edi, eax
lea esi, [edi + 0x30]
push esi
call fcn.004f7d95
add esp, 4
test eax, eax
je 0x484b25
push eax
call fcn.004f7e74
add esp, 4
mov ebx, dword [edi + 0x110]
mov dword [edi + 0x110], 0
test ebx, ebx
je 0x484b4b
mov ecx, ebx
call fcn.00472940
push 0x64
push ebx
call fcn.004fa19d
add esp, 8
push esi
mov dword [ebp - 4], 0
call fcn.004f7dba
add esp, 4
test eax, eax
je 0x484b68
push eax
call fcn.004f7e74
add esp, 4
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.0047f720
lea esi, [edi + 0x60]
push esi
call fcn.004f7d95
add esp, 4
test eax, eax
je 0x484b8f
push eax
call fcn.004f7e74
add esp, 4
mov dword [edi + 0x108], 0
mov ebx, dword [edi + 0x10c]
mov dword [edi + 0x10c], 0
test ebx, ebx
je 0x484bce
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ebx + 4], eax
jne 0x484bce
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lock xadd dword [ebx + 8], edi
dec edi
jne 0x484bce
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
push esi
mov dword [ebp - 4], 1
call fcn.004f7dba
add esp, 4
test eax, eax
je 0x484beb
push eax
call fcn.004f7e74
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4887f0
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x58fc74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5a94b8]
test eax, eax
je 0x488818
call eax
mov dword [0x5a94b8], 0
mov eax, dword [0x5a94b0]
test eax, eax
je 0x488832
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x5a94b0], 0
push 0x208
lea eax, [ebp - 0x20c]
mov byte [0x5a94d0], 0
push 0
push eax
call fcn.00512450
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.ACPIWMI.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4888b4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x5a94b0], eax
jmp 0x4888b9
mov eax, dword [0x5a94b0]
test eax, eax
je 0x488965
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AsWMI_Open
push eax
call esi
push str.AsWMI_Close
push dword [0x5a94b0]
mov dword [0x5a94b4], eax
call esi
push str.AsWMI_DeviceControl
push dword [0x5a94b0]
mov dword [0x5a94b8], eax
call esi
push str.AsWMI_GetDeviceStatus
push dword [0x5a94b0]
mov dword [0x5a94c0], eax
call esi
push str.AsWMI_SetBootDevice
push dword [0x5a94b0]
mov dword [0x5a94bc], eax
call esi
push str.AsWMI_RegisterEvent
push dword [0x5a94b0]
mov dword [0x5a94c4], eax
call esi
push str.AsWMI_GetSystemInfo
push dword [0x5a94b0]
mov dword [0x5a94c8], eax
call esi
mov dword [0x5a94cc], eax
call dword [0x5a94b4]
mov byte [0x5a94d0], al
pop esi
test al, al
je 0x48897c
call dword [0x5a94c8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa15c
mov esp, ebp
pop ebp
ret
push 0x40040
push str._Error
push str.ACPIWMI.dll_does_not_be_found._Please_check_tool_package.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa15c
mov esp, ebp
pop ebp
ret

Function at 0x48afb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [eax]
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48afc0
sub eax, edx
mov esi, 0x811c9dc5
mov edx, 0
je 0x48afe6
movzx ecx, byte [edx + edi]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, eax
jb 0x48afd5
push 0x1f31d
and esi, 0x7fffffff
push esi
call fcn.00524455
imul eax, eax, 0xb14
add esp, 8
imul ecx, edx, 0x41a7
pop edi
pop esi
sub ecx, eax
lea eax, [ecx + 0x7fffffff]
js 0x48b014
mov eax, ecx
pop ebp
ret 4
Function at 0x498ca0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542e87
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x58fc74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [edi + 0x18], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov dword [ebp - 4], 0
mov byte [edi + 0x1c], 0
lea esi, [edi + 0x3c]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004b1590
mov dword [esi], eax
lea esi, [edi + 0x44]
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004b1590
mov dword [esi], eax
mov dword [edi + 0x4c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0xf
mov byte [edi + 0x50], 0
lea ecx, [edi + 0x68]
mov byte [ebp - 4], 4
mov dword [ecx + 0x10], 0
push 0
mov dword [ecx + 0x14], 0xf
push 0x54a7b0
mov byte [ecx], 0
call fcn.00404d70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4bfe10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545a20
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x58fc74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004c46a0
dec eax
cmp eax, 9
ja case.default.0x4bfe4a
jmp dword [eax*4 + 0x4bffbc]
push 0x6bd
push str.C:Users_testerDesktopprotobuf_cpp_3.2.0protobuf_3.2.0_srcgoogle_protobuf_map.h
push 3
lea ecx, [ebp - 0x34]
call fcn.00488ca0
push str.Unsupported
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00489010
push eax
lea ecx, [ebp - 0x59]
call fcn.00488e00
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.00488d80
push 0x6cc
push str.C:Users_testerDesktopprotobuf_cpp_3.2.0protobuf_3.2.0_srcgoogle_protobuf_map.h
push 3
lea ecx, [ebp - 0x58]
call fcn.00488ca0
push str.Cant_get_here.
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.00489010
push eax
lea ecx, [ebp - 0x5a]
call fcn.00488e00
lea ecx, [ebp - 0x58]
call fcn.00488d80
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa15c
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.004c0db0
mov edi, eax
cmp dword [edi + 0x14], 0x10
jb 0x4bfef8
mov edi, dword [edi]
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4bff00
sub ecx, edx
mov esi, 0x811c9dc5
mov edx, 0
je 0x4bff26
movzx eax, byte [edx + edi]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x4bff15
push 0x1f31d
and esi, 0x7fffffff
push esi
call fcn.00524455
imul edx, edx, 0x41a7
add esp, 8
imul ecx, eax, 0xb14
sub edx, ecx
jns 0x4bff50
add edx, 0x7fffffff
mov eax, edx
jmp 0x4bfeca
mov ecx, esi
call fcn.004c0b40
xor eax, 0xdeadbeef
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.00524455
imul edx, edx, 0x41a7
add esp, 8
imul ecx, eax, 0xb14
sub edx, ecx
jns 0x4bff50
add edx, 0x7fffffff
mov eax, edx
jmp 0x4bfeca
mov ecx, esi
call fcn.004c0a50
jmp 0x4bff5e
mov ecx, esi
call fcn.004c0fa0
jmp 0x4bff5e
mov ecx, esi
call fcn.004c0ea0
jmp 0x4bff5e
mov ecx, esi
call fcn.004c0960
movzx eax, al
jmp 0x4bff5e
Function at 0x4d52c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov edi, dword [esi + 0x14]
test edi, edi
jle 0x4d5302
mov edx, dword [esi + 0x1c]
xor ecx, ecx
nop dword [eax]
mov eax, dword [edx + ecx*4 + 4]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x4d52f3
mov eax, dword [eax]
inc ecx
mov byte [eax], 0
cmp ecx, edi
jl 0x4d52e0
mov dword [esi + 0x14], 0
push ebx
mov dword [esi + 0x20], 0
mov dword [esi + 0x2c], 0
mov ebx, dword [esi + 0x3c]
test ebx, ebx
jle 0x4d5338
mov eax, dword [esi + 0x44]
xor edi, edi
mov esi, eax
nop
mov ecx, dword [esi + edi*4 + 4]
call fcn.004d4c50
inc edi
cmp edi, ebx
jl 0x4d5320
mov esi, dword [ebp - 8]
mov dword [esi + 0x3c], 0
mov ebx, dword [esi + 0x4c]
test ebx, ebx
jle 0x4d5368
mov eax, dword [esi + 0x54]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.004d4f00
inc edi
cmp edi, ebx
jl 0x4d5350
mov esi, dword [ebp - 8]
mov dword [esi + 0x4c], 0
mov ebx, dword [esi + 0x5c]
test ebx, ebx
jle 0x4d5398
mov eax, dword [esi + 0x64]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.004d59b0
inc edi
cmp edi, ebx
jl 0x4d5380
mov esi, dword [ebp - 8]
mov dword [esi + 0x5c], 0
mov ebx, dword [esi + 0x6c]
test ebx, ebx
jle 0x4d53c8
mov eax, dword [esi + 0x74]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.004d5130
inc edi
cmp edi, ebx
jl 0x4d53b0
mov esi, dword [ebp - 8]
mov dword [esi + 0x6c], 0
mov ecx, dword [esi + 8]
pop ebx
test cl, 0x1f
je 0x4d5460
test cl, 1
je 0x4d53f2
mov eax, dword [esi + 0x78]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x4d53ec
mov eax, dword [eax]
mov byte [eax], 0
mov ecx, dword [esi + 8]
mov eax, ecx
shr eax, 1
test al, 1
je 0x4d5412
mov eax, dword [esi + 0x7c]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x4d540c
mov eax, dword [eax]
mov byte [eax], 0
mov ecx, dword [esi + 8]
mov eax, ecx
shr eax, 2
test al, 1
je 0x4d5436
mov eax, dword [esi + 0x80]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x4d5430
mov eax, dword [eax]
mov byte [eax], 0
mov ecx, dword [esi + 8]
mov eax, ecx
shr eax, 3
test al, 1
je 0x4d544d
mov ecx, dword [esi + 0x84]
call fcn.004d54f0
mov ecx, dword [esi + 8]
shr ecx, 4
test cl, 1
je 0x4d5460
mov ecx, dword [esi + 0x88]
call fcn.004d5a40
mov dword [esi + 8], 0
test byte [esi + 4], 1
je 0x4d547d
mov ecx, dword [esi + 4]
and ecx, 0xfffffffe
cmp dword [ecx], 0
je 0x4d547d
call fcn.00491480
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4fd665
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x52f8f0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052f766
Function at 0x412a94
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x412b48
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00412a24
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x412b21
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412b54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x412b6f
test ebp, ebp
je 0x412b6f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x412b77
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x412bb7
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x412c13
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x412c0e
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x412bf9
test dl, dl
je 0x412bf5
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x412bf9
add ecx, 2
add eax, 2
test dl, dl
jne 0x412bd9
xor eax, eax
jmp 0x412bfe
sbb eax, eax
or eax, 1
test eax, eax
je 0x412c1d
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x412bc6
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x412c34
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.00412a94
test eax, eax
jne 0x412c4c
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.00412b54
mov esi, eax
test esi, esi
jne 0x412c82
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x412c9c
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x412d94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.00412a94
mov esi, eax
test esi, esi
jne 0x412db2
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.00412b54
mov dword [esp + 0x18], eax
test eax, eax
je 0x412daa
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.00412b54
mov dword [esp + 0x34], eax
test eax, eax
je 0x412daa
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.00412b54
mov dword [esp + 0x28], eax
test eax, eax
je 0x412daa
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.00412b54
mov dword [esp + 0x30], eax
test eax, eax
je 0x412daa
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x412f79
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x412f79
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x412edc
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x412f5d
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x412eff
movzx esi, ax
jmp 0x412f04
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x412f23
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x412f32
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x412f86
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x412ef4
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x412eb9
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x412faf
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x412faf
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x412f94
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x412fc4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.00412a94
mov esi, eax
test esi, esi
je 0x413080
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.00412b54
mov ebp, eax
test ebp, ebp
je 0x41307f
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.00412b54
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x41307f
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x41307f
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x41307e
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x413064
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x41aafa
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x41abad
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x41acc2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x41ace5
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x41ace5
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x41acef
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x41ad31
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x41ad93
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x41ad8e
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41ad79
test dl, dl
je 0x41ad75
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41ad79
add ecx, 2
add eax, 2
test dl, dl
jne 0x41ad59
xor eax, eax
jmp 0x41ad7e
sbb eax, eax
or eax, 1
test eax, eax
je 0x41ad9f
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x41ad46
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8