joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4291e7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4444c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004204c1
and dword [ebp - 0x14], 0
cmp dword [0x4471b4], 0
mov dword [ebp - 0x18], eax
jne 0x42929a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x429342
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x429342
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4471b4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4471b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4471bc], eax
call edi
push eax
call esi
mov dword [0x4471c4], eax
test eax, eax
je 0x42929a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4471c0], eax
mov eax, dword [0x4471c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4292f3
cmp dword [0x4471c4], ecx
je 0x4292f3
push eax
call esi
push dword [0x4471c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4292f3
test ebx, ebx
je 0x4292f3
call edi
test eax, eax
je 0x4292ea
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4292ea
test byte [ebp - 8], 1
jne 0x4292f3
or dword [ebp + 0x10], 0x200000
jmp 0x429326
mov eax, dword [0x4471b8]
cmp eax, dword [ebp - 0x18]
je 0x429326
push eax
call esi
test eax, eax
je 0x429326
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x429326
mov eax, dword [0x4471bc]
cmp eax, dword [ebp - 0x18]
je 0x429326
push eax
call esi
test eax, eax
je 0x429326
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4471b4]
call esi
test eax, eax
je 0x429342
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x429344
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041c438
leave
ret
Function at 0x42ee10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
je 0x42ee70
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [edi], 0
jmp 0x42ee30
mov eax, 0x400000
cmp esi, 0x400000
ja 0x42ee3f
mov eax, esi
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x42ee76
test ecx, ecx
je 0x42ee6f
test esi, esi
jne 0x42ee30
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop ebx
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x42ee80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
je 0x42eee0
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [edi], 0
jmp 0x42eea0
mov eax, 0x400000
cmp esi, 0x400000
ja 0x42eeaf
mov eax, esi
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x42eee6
test ecx, ecx
je 0x42eedf
test esi, esi
jne 0x42eea0
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop ebx
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x431980
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x448360], ecx
inc edx
cmp edx, 0x100
jb 0x431982
cmp edx, 0x800
jae 0x431a59
lea esp, [esp]
mov eax, dword [edx*4 + 0x447f60]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x448360]
inc edx
mov dword [edx*4 + 0x44835c], eax
cmp edx, 0x800
jb 0x431a30
mov eax, 0x432e00
mov dword [0x44a368], eax
mov dword [0x44a360], eax
mov dword [0x44a364], 0x432eb0
call fcn.00432d40
test eax, eax
jne 0x431a85
mov dword [0x44a360], 0x432eb0
ret
Function at 0x436a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [eax]
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
and esi, 7
cmp eax, 5
jae 0x436aa0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
push ebx
mov ebx, dword [ebp + 8]
sub eax, 4
add ebx, eax
mov dword [ebp - 4], ebx
mov edx, dword [ebp + 8]
add edx, edi
cmp edx, ebx
jae 0x436acd
lea esp, [esp]
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x436acd
inc edx
cmp edx, ebx
jb 0x436ac0
mov eax, dword [ebp + 8]
mov ecx, edx
sub ecx, edi
mov edi, edx
sub ecx, eax
sub edi, eax
cmp edx, ebx
jae 0x436ba5
cmp ecx, 2
jbe 0x436b24
xor esi, esi
movzx ecx, byte [edx + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x436b42
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or eax, ecx
mov ecx, dword [ebp + 0x10]
add ecx, edi
add edi, 5
cmp dword [ebp + 0x18], 0
mov dword [ebp + 0xc], ecx
je 0x436b4d
add eax, ecx
jmp 0x436b4f
shr esi, cl
test esi, esi
je 0x436ae9
cmp esi, 4
ja 0x436b42
cmp esi, 3
je 0x436b42
mov ecx, esi
shr ecx, 1
movzx eax, byte [ecx + edx + 1]
inc eax
test al, 0xfe
jne 0x436ae9
or esi, 8
shr esi, 1
inc edi
jmp 0x436ab0
sub eax, ecx
test esi, esi
je 0x436b83
and esi, 6
add esi, esi
add esi, esi
mov ebx, eax
mov ecx, esi
shr ebx, cl
inc ebx
test bl, 0xfe
jne 0x436b7e
mov ebx, 0x100
shl ebx, cl
dec ebx
xor eax, ebx
cmp dword [ebp + 0x18], 0
je 0x436b7b
add eax, dword [ebp + 0xc]
jmp 0x436b7e
sub eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
xor esi, esi
mov ecx, eax
shr ecx, 8
mov byte [edx + 1], al
mov byte [edx + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
and al, 1
neg al
mov byte [edx + 3], cl
mov byte [edx + 4], al
jmp 0x436ab0
pop ebx
cmp ecx, 2
jbe 0x436bba
mov edx, dword [ebp + 0x14]
xor esi, esi
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
shr esi, cl
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e306
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40e324
mov eax, 0x514721
push eax
push 1
mov ebx, 0x458770
call fcn.004581ca
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40e34e
mov eax, 0
jmp 0x40e3c2
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x40e3af
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40e398
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40e387
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40e378
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x416bb4
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x416bd6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
mov dword [ebp - 4], 0
nop
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, VariantCopy
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
nop
imul esi, esi, 0x88
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
imul edx, edx, 6
add esi, edx
nop
nop
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
push ebx
push ecx
push edx
mov eax, VariantCopy
cpuid
shr ecx, 0x10
imul ecx, ecx, 9
add esi, ecx
pop edx
pop ecx
pop ebx
nop
nop
nop
xor esi, 0x124254
mov dword [ebp - 4], esi
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
nop
nop
nop
mov eax, dword [ebp - 4]
jmp 0x416d11
mov esp, ebp
pop ebp
ret

Function at 0x418a8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x418aae
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
mov dword [ebp - 4], 0x2b7e9735
push edx
push ecx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, ds:[esi*4]
mov ecx, dword [eax + ecx]
xor ecx, dword [ebp - 4]
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp esi, dword [ebp + 0xc]
jne 0x418b27
pop esi
pop ecx
pop edx
nop
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x418b75
nop
nop
nop
nop
nop
nop
mov esp, ebp
pop ebp
ret 8
Function at 0x41ba30
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
jmp 0x41ba45
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push ebx
mov ebx, 1
mov ebx, 2
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 5
pop ebx
push esi
xor esi, esi
nop
mov eax, VariantCopy
cpuid
shr ecx, 0x10
add esi, ecx
nop
nop
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
mov eax, 1
xor edx, edx
cpuid
add esi, edx
xor esi, eax
rdtsc
add esi, edx
xor esi, 0x354e7978
mov eax, VariantCopy
cpuid
shr ecx, 0x10
add esi, ecx
nop
nop
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
mov eax, 1
xor edx, edx
cpuid
add esi, edx
xor esi, eax
rdtsc
add esi, edx
xor esi, 0x836bd0f7
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41d12c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x41d14e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push ebx
mov ebx, 1
mov ebx, 2
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 5
pop ebx
mov dword [ebp - 4], 0x2ec3d7e5
push edx
push ecx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, ds:[esi*4]
mov ecx, dword [eax + ecx]
xor ecx, dword [ebp - 4]
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp esi, dword [ebp + 0xc]
jne 0x41d1c7
pop esi
pop ecx
pop edx
nop
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x41d215
nop
nop
nop
nop
nop
nop
mov esp, ebp
pop ebp
ret 8
Function at 0x41f578
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x41f7c5
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x41f6c2
cmp byte [edx + edi], 0xd
jne 0x41f6c2
cmp byte [edx + edi + 1], 0xa
je 0x41f6fb
mov al, byte [edx + edi]
cmp al, 0xa
je 0x41f6fb
cmp al, 0x3d
jne 0x41f6d7
inc ecx
cmp ecx, 2
ja 0x41f7d3
cmp al, 0x7f
ja 0x41f7d3
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x41f7d3
cmp al, 0x40
jae 0x41f6fa
test ecx, ecx
jne 0x41f7d3
inc esi
inc edx
cmp edx, ebx
jb 0x41f6ac
test esi, esi
je 0x41f7c5
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x41f7e4
cmp dword [ecx], eax
jb 0x41f7e4
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x41f7b4
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x41f7b0
cmp al, 0xa
je 0x41f7b0
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x41f7b0
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x41f79b
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x41f7a8
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x41f7b0
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x41f74c
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x430cfa
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov esi, dword [ebp + 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
lea ecx, [eax + 0x14]
mov eax, dword [eax + 0x14]
cmp eax, ecx
je 0x430e30
mov edx, eax
mov eax, dword [eax]
test eax, eax
je 0x430d1d
cmp dword [edx + 0x10], esi
jne 0x430d15
xor eax, eax
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], SysReAllocString
mov eax, dword [edx + 0x20]
mov dword [esp], eax
call dword [ebp + 0x10]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x430e30
mov ecx, dword [esi + 0x3c]
mov eax, dword [ebp + 0xc]
add ecx, esi
sub eax, esi
lea edx, [ecx + 0xf8]
movzx ecx, word [ecx + 6]
mov dword [ebp - 0x24], eax
imul ecx, ecx, 0x28
add ecx, edx
cmp edx, ecx
je 0x430e29
mov esi, dword [edx + 0xc]
cmp eax, esi
jb 0x430daa
mov edi, dword [edx + 0x10]
add edi, esi
cmp edi, eax
jb 0x430daa
add eax, dword [edx + 0x14]
sub eax, esi
jne 0x430daf
jmp 0x430e29
add edx, 0x28
jmp 0x430d89
xor edi, edi
mov dword [esp + 4], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp], ebx
call dword [ebp + 0x14]
sub esp, 0x10
inc eax
je 0x430e29
xor esi, esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], esi
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [ebp + 0x18]
sub esp, 0x14
test eax, eax
je 0x430e29
cmp dword [ebp - 0x24], 8
jne 0x430e29
cmp byte [ebp - 0x20], 0xb8
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jne 0x430e29
shrd eax, edx, 8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
add eax, 5
mov dword [ebp - 0x1c], eax
mov dword [esp], ebx
call dword [ebp + 0x1c]
push ebx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jmp 0x430e34
mov dword [esp], ebx
call dword [ebp + 0x1c]
push eax
xor eax, eax
xor edx, edx
leave
ret 0x18
Function at 0x434482
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4344a5
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4344a5
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4344af
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4344f1
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x434553
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43454e
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x434539
test dl, dl
je 0x434535
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x434539
add ecx, 2
add eax, 2
test dl, dl
jne 0x434519
xor eax, eax
jmp 0x43453e
sbb eax, eax
or eax, 1
test eax, eax
je 0x43455f
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x434506
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4345e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x434607
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x434607
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x434611
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x434653
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4346b5
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4346b0
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43469b
test dl, dl
je 0x434697
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43469b
add ecx, 2
add eax, 2
test dl, dl
jne 0x43467b
xor eax, eax
jmp 0x4346a0
sbb eax, eax
or eax, 1
test eax, eax
je 0x4346c1
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x434668
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x434753
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x434776
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x434776
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x434780
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4347c2
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x434824
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43481f
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43480a
test dl, dl
je 0x434806
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43480a
add ecx, 2
add eax, 2
test dl, dl
jne 0x4347ea
xor eax, eax
jmp 0x43480f
sbb eax, eax
or eax, 1
test eax, eax
je 0x434830
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4347d7
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4348bd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4348e0
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4348e0
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4348ea
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43492c
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43498e
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x434989
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x434974
test dl, dl
je 0x434970
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x434974
add ecx, 2
add eax, 2
test dl, dl
jne 0x434954
xor eax, eax
jmp 0x434979
sbb eax, eax
or eax, 1
test eax, eax
je 0x43499a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x434941
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8