joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a910
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x446f70
push 3
push 0x18
push 0x3c
call fcn.0045799c
mov dword [ebp - 0x44], eax
mov dword [eax], 2
mov dword [eax + 4], 1
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0xc], edx
mov ebx, dword [ebp - 0x20]
mov dword [eax + 0x10], ebx
mov esi, dword [ebp - 0x24]
mov dword [eax + 0x14], esi
push 0x446f70
push 3
push 0x18
push 0x3c
call fcn.0045799c
mov dword [ebp - 0x50], eax
mov dword [eax], 2
mov dword [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0xc], edx
mov edi, dword [ebp - 0x14]
mov dword [eax + 0x10], edi
mov edi, dword [ebp - 0x44]
mov dword [eax + 0x14], edi
mov edi, dword [ebp - 0x28]
mov dword [edi], eax
ret

Function at 0x41092e
Capabilities:
Write file on windows

Disassembly:
push 0x41032f
push ebp
push dword [ebp - 4]
push 0x2f
lea eax, [ebp - 0x1c]
push eax
jmp 0x41097c
lea ebp, [esp + 0xc]
mov eax, 0x4103aa
call fcn.00457a44
push 0x4103a0
push ebp
push dword [ebp - 4]
mov ax, word [ebp - 8]
push eax
push dword [ebp - 0xc]
jmp 0x41afa4
lea ebp, [esp + 0xc]
push ecx
push dword [ebp - 0xc]
mov ax, word [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.00457c12
test al, al
jne 0x41afc2
call fcn.00457a26
mov esp, ebp
pop ebp
ret

Function at 0x415048
Capabilities:
Get common file path

Disassembly:
lea ebp, [esp + 0xc]
sub esp, 0x2c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x20], ecx
push ecx
mov ebx, dword [ecx]
call dword [ebx + 8]
mov dword [ebp - 0x1c], eax
push 0x410816
push ebp
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
push eax
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x14]
push edx
jmp 0x410e6c
lea ebp, [esp + 0x14]
sub esp, 8
push dword [ebp - 4]
call fcn.004128fc
mov ecx, dword [eax]
cmp ecx, 3
je 0x410ebc
jmp 0x410e8d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
cmp ecx, 2
jne 0x410ebc
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
lea esp, [ebp - 0x10]
jmp 0x415034
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
mov dword [ebx], edx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x410a5e
push ebp
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
jmp 0x410dd8
lea ebp, [esp + 0x10]
sub esp, 0x24
push 0x414a50
push ebp
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x1c]
push eax
jmp 0x4150a8
lea ebp, [esp + 0xc]
sub esp, 0x10
mov eax, dword [ebp - 8]
test eax, eax
jge 0x4150d0
mov ecx, dword [ebp - 4]
push ecx
call fcn.004578ac
inc eax
mov dword [ebp - 0x10], eax
add eax, eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x4150d8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x42297b
Capabilities:
Get file version info

Disassembly:
lea ebp, [esp + 0xc]
sub esp, 0x20
push 0x413ff5
push ebp
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
jmp 0x41050c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x30], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ebx
lea esp, [ebp - 0x10]
jmp 0x422b68
lea ebp, [esp + 8]
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push dword [ebp - 4]
call fcn.004577f8
test eax, eax
jne 0x422b64
call fcn.00457732
mov dword [ebp - 0xc], eax
push 0x422564
push ebp
push 0x43529c
push 0x4404e4
push eax
jmp 0x4145dc
mov esp, ebp
pop ebp
ret
lea ebp, [esp + 0x10]
sub esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x422bad
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x18], ecx
push 0x422593
push ebp
push ecx
lea edx, [ebp - 0x14]
push edx
jmp 0x422b20
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1c], ecx
push 0
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [ebp - 8]
push ecx
call fcn.00457810
test eax, eax
jne 0x422bf9
call fcn.00457732
mov dword [ebp - 0x14], eax
cmp eax, 0xea
je 0x422bf9
push 0x4225f9
push ebp
push 0x4352a4
push 0x4404d0
push eax
push 0x4352ac
jmp 0x40ff10
mov esp, ebp
pop ebp
ret

Function at 0x433040
Capabilities:
Terminate process

Disassembly:
mov al, byte [0xe8004474]
dec ebx
add al, byte [eax]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x423470
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
fld qword [0x44e1b0]
mov eax, dword [0x44e02c]
add eax, 0x5a5304e0
mov dword [ebp - 4], eax
fild dword [ebp - 4]
mov edx, 1
push esi
fsubp st(1)
fstp qword [0x44e1b0]
mov dword [ecx], 0
fld qword [0x44e078]
fmul qword [0x447ec8]
fstp qword [0x44e078]
mov dword [ecx + 4], 0
fld dword [0x44e600]
fsub qword [0x447ec0]
fstp dword [0x44e600]
mov dword [ecx + 8], 0x67452301
add word [0x44e1fc], dx
mov ax, word [0x44e1fc]
mov si, word [0x44e280]
cwde
movsx esi, si
add eax, 0xefb250c0
cmp esi, eax
jne 0x423519
mov ax, word [0x44e59c]
cwde
mov esi, 0xfdac16f7
sub esi, eax
cmp esi, 0x8f275bca
jge 0x423519
fld dword [0x44e614]
fmul qword [0x447eb8]
fstp dword [0x44e614]
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [0x44e668]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
pop esi
fadd qword [0x44e570]
fadd qword [0x447eb0]
fmul qword [0x44e0d8]
fstp qword [0x44e0d8]
fld qword [0x44e570]
fld1
fadd st(1), st(0)
fxch st(1)
fstp qword [0x44e570]
add dword [0x44e668], edx
mov dword [ecx + 0x10], 0x98badcfe
fsubr qword [0x44e3c0]
fstp qword [0x44e3c0]
fld qword [0x44e3c0]
fcomp qword [0x447ea8]
fnstsw ax
test ah, 5
jp 0x4235a2
movzx edx, word [0x44e4a8]
movsx eax, dx
movzx edx, word [0x44e610]
lea eax, [edx + eax + 0x7e7b7edb]
mov word [0x44e610], ax
jmp 0x4235b6
mov dx, word [0x44e32c]
movsx eax, dx
sub eax, 0x5fcf21d
mov dword [0x44e3c8], eax
mov dword [ecx + 0x14], 0x10325476
movzx ecx, word [0x44e2b0]
add ecx, 0x3dc83ade
mov word [0x44e2b0], cx
mov esp, ebp
pop ebp
ret
Function at 0x42be20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [0x44e49c]
sub eax, 0x7b624e3a
mov word [0x44e49c], ax
call fcn.004316d0
mov cx, word [0x44e3a0]
mov dx, word [0x44e2b4]
movsx ecx, cx
movsx eax, dx
sub eax, ecx
mov ecx, dword [0x44e3d8]
add ecx, eax
cmp ecx, 0x85ea583f
jne 0x42be6e
fld dword [0x448000]
fstp dword [str.L8F]
jmp 0x42be92
fld qword [0x44e538]
fsub qword [0x447ff8]
fstp qword [0x44e510]
fld qword [0x44e538]
fsub qword [0x446e50]
fstp qword [0x44e538]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x42fbb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
fld dword [0x44e130]
mov ax, word [0x44e2c0]
movsx ecx, ax
mov dword [ebp - 4], ecx
push esi
fild dword [ebp - 4]
fadd qword [0x44e488]
fadd qword [0x44e128]
fcompp
fnstsw ax
fld qword [0x44e488]
fld1
fadd st(1), st(0)
fxch st(1)
fstp qword [0x44e488]
fld dword [0x44e130]
fadd st(1)
fstp dword [0x44e130]
test ah, 1
jne 0x42fc27
fld dword [0x44e47c]
fsub qword [0x44cdd8]
fadd qword [0x44e5f8]
fstp qword [0x44e5f8]
fadd dword [0x44e47c]
fstp dword [0x44e47c]
jmp 0x42fc44
mov dx, word [0x44e160]
fstp st(0)
movsx eax, dx
add eax, 0x396a6038
mov dword [0x44e228], eax
inc word [0x44e160]
call fcn.0042f0c0
fld dword [0x44e540]
fadd qword [0x44e208]
fstp qword [0x44e208]
fld dword [0x44e540]
fadd qword [0x446e50]
fstp dword [0x44e540]
call fcn.0041fd20
movzx ecx, word [0x44e0f0]
movsx edx, cx
mov dword [ebp - 4], edx
push 0x443128
push 0x443120
fild dword [ebp - 4]
fld dword [0x44e074]
fsubr qword [0x44cdd0]
fsubp st(1)
fistp qword [ebp - 8]
mov ax, word [ebp - 8]
mov word [0x44e0f0], ax
fld dword [0x44e074]
fadd qword [0x446e50]
fstp dword [0x44e074]
call fcn.0043e3e0
mov ecx, dword [0x44e62c]
movzx edx, word [0x44e59c]
mov dword [ebp - 4], ecx
movsx eax, dx
fild dword [ebp - 4]
mov dword [ebp - 4], eax
add esp, 8
fild dword [ebp - 4]
fadd qword [0x44e3e8]
fsub qword [0x44cdc8]
fsubp st(1)
fistp qword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [0x44e62c], ecx
fld qword [0x44e3e8]
fadd qword [0x446e50]
fstp qword [0x44e3e8]
inc word [0x44e59c]
call fcn.00415c70
dec word [0x44e51c]
movzx edx, word [0x44e2f4]
movzx ecx, word [0x44e51c]
inc word [0x44e2f4]
mov esi, eax
movsx eax, dx
movsx edx, cx
add eax, 0x9aff7a48
cmp eax, edx
jge 0x42fd73
mov ax, word [0x44e4ac]
movsx ecx, ax
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
fld qword [0x44e100]
fsub qword [0x44cdc0]
fsub qword [0x44cdb8]
fsubp st(1)
fistp qword [ebp - 8]
mov dx, word [ebp - 8]
mov word [0x44e4ac], dx
call fcn.004316d0
fld qword [0x44e250]
mov ax, word [0x44e2e4]
movsx ecx, ax
mov dword [ebp - 4], ecx
push esi
fild dword [ebp - 4]
fsubp st(1)
fstp qword [0x44e250]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4419f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
or eax, 0xffffffff
add word [0x44e22c], ax
movzx ecx, word [0x44e22c]
movsx edx, cx
add edx, 0x7b5baf1f
mov dword [ebp - 8], edx
push esi
push edi
fild dword [ebp - 8]
mov edi, dword [ebp + 0xc]
mov esi, edi
imul esi, dword [ebp + 0x10]
fmul qword [0x44e048]
fstp qword [0x44e048]
fld dword [0x44e020]
movzx ecx, word [0x44e138]
movsx edx, cx
add edx, 0x5ec67797
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
fild dword [ebp - 8]
fsub dword [0x44e600]
fsubp st(1)
fstp dword [0x44e020]
add word [0x44e138], ax
test esi, esi
jne 0x441a87
mov ax, word [0x44e2bc]
movsx ecx, ax
mov dword [0x44e228], ecx
inc word [0x44e2bc]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
fld qword [0x44e270]
mov ecx, dword [ebp + 0x14]
fsub qword [0x447d68]
fstp qword [0x44e270]
call fcn.0043d880
fld dword [0x44e13c]
mov dx, word [0x44e054]
mov ecx, eax
movsx eax, dx
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
faddp st(1)
fadd dword [0x44e630]
fcomp qword [0x447d60]
fnstsw ax
test ah, 0x41
jp 0x441af4
mov dx, word [0x44e164]
fld qword [0x44e4b8]
movsx eax, dx
mov edx, dword [0x44e1b8]
add edx, eax
mov dword [ebp + 0xc], edx
fild dword [ebp + 0xc]
fsubp st(1)
fstp qword [0x44e4b8]
mov edx, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x44e238]
add eax, 0x3ef1dd8b
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
xor edx, edx
fmul qword [0x44e620]
mov eax, dword [ebp - 4]
div edi
fstp qword [0x44e620]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5f05df
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f05fa
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b581f]
pop edx
test eax, eax
je 0x5f06cc
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5f06bb
test dword [ebp - 0x2a8], 1
jne 0x5f06bb
and dword [ebp - 0x2a8], 0x100
jne 0x5f06bb
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3a48]
pop edx
pop esi
test eax, eax
je 0x5f065e
jmp 0x5f06bb
cmp word [esi], 0x5a4d
jne 0x5f06bb
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5f06bb
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d3b54]
pop edx
test eax, eax
je 0x5f06bb
lea eax, [ebp - 0x28c]
push eax
call fcn.005f053b
test eax, eax
jne 0x5f06b4
jmp 0x5f06bb
mov eax, esi
jmp 0x5f06cc
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5f05fa
pop esi
leave
ret 4
Function at 0x403320
Capabilities:
Get disk information

Disassembly:
sub esp, 0x844
mov eax, dword [esp + 0x848]
mov ecx, dword [eax]
mov edx, dword [0x4353fc]
push ebx
push ebp
push esi
mov esi, dword [eax + 4]
mov eax, dword [0x4353f8]
push edi
xor edi, edi
mov dword [esp + 0x40], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x38], 0x9e3779b9
mov dword [esp + 0x3c], edx
call fcn.004032f0
mov eax, dword [0x435400]
mov edx, dword [0x435404]
add dword [esp + 0x10], 0x23f
mov ebx, dword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [esp + 0x34], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x30], 0x20
mov dword [esp + 0x24], 2
add dword [esp + 0x24], 3
mov eax, dword [0x81a264]
shl ecx, 4
add ecx, dword [esp + 0x34]
mov dword [esp + 0x14], ecx
cmp eax, 0xfa9
jne 0x4033c3
mov dword [0x81a260], 0xedeb2e40
jmp 0x4033d0
cmp eax, 0x3eb
jne 0x4033d0
mov dword [0x817168], edi
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
shr eax, 5
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x18]
mov dword [0x81a25c], 0xf4ea3dee
call fcn.00403300
mov eax, dword [esp + 0x20]
xor dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
xor dword [esp + 0x18], eax
cmp dword [0x81a264], 0x213
jne 0x403469
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x34]
push eax
push edi
push edi
push edi
mov dword [esp + 0x44], edi
call ebx
lea ecx, [esp + 0x54]
push ecx
push edi
call ebp
push edi
push 0x402d60
push 0x402d24
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
lea edx, [esp + 0x4c]
push edx
push 0x402de8
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
sub esi, dword [esp + 0x18]
lea ecx, [esp + 0x14]
mov eax, esi
mov dword [esp + 0x2c], esi
call fcn.004032e0
mov eax, dword [esp + 0x40]
add dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x10]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
nop
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov ecx, esi
shr ecx, 5
add ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
xor dword [esp + 0x14], eax
cmp dword [0x81a264], 0x121
jne 0x4034cf
push edi
push edi
lea edx, [esp + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
mov ecx, dword [esp + 0x14]
xor ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
mov dword [esp + 0x14], ecx
call fcn.00403310
mov eax, dword [esp + 0x38]
sub dword [esp + 0x10], eax
sub dword [esp + 0x30], 1
mov ecx, dword [esp + 0x28]
jne 0x403393
mov eax, dword [esp + 0x858]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x844
ret 4
Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434c38]
jne 0x40a3da
repz ret
jmp fcn.0040e622

Function at 0x40be9c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407f24
and dword [ebp - 4], 0
cmp dword [0x437208], 0
mov ebx, eax
jne 0x40bf4d
push 0x401b00
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bffe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401af4
push edi
call esi
test eax, eax
je 0x40bffe
push eax
call fcn.00407eb2
mov dword [esp], 0x401ae4
push edi
mov dword [0x437208], eax
call esi
push eax
call fcn.00407eb2
mov dword [esp], 0x401ad0
push edi
mov dword [0x43720c], eax
call esi
push eax
call fcn.00407eb2
mov dword [esp], 0x401ab4
push edi
mov dword [0x437210], eax
call esi
push eax
call fcn.00407eb2
pop ecx
mov dword [0x437218], eax
test eax, eax
je 0x40bf4d
push 0x401a9c
push edi
call esi
push eax
call fcn.00407eb2
pop ecx
mov dword [0x437214], eax
mov eax, dword [0x437214]
cmp eax, ebx
je 0x40bfa5
cmp dword [0x437218], ebx
je 0x40bfa5
push eax
call fcn.00407f2d
push dword [0x437218]
mov esi, eax
call fcn.00407f2d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bfa5
test edi, edi
je 0x40bfa5
call esi
test eax, eax
je 0x40bf9c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bf9c
test byte [ebp - 0xc], 1
jne 0x40bfa5
or dword [ebp + 0x10], 0x200000
jmp 0x40bfde
mov eax, dword [0x43720c]
cmp eax, ebx
je 0x40bfde
push eax
call fcn.00407f2d
pop ecx
test eax, eax
je 0x40bfde
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bfde
mov eax, dword [0x437210]
cmp eax, ebx
je 0x40bfde
push eax
call fcn.00407f2d
pop ecx
test eax, eax
je 0x40bfde
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x437208]
call fcn.00407f2d
pop ecx
test eax, eax
je 0x40bffe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c000
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43b64e
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
add ecx, 0x1fc2e3a
add esi, 1
sub ecx, 0x13ac7b0d
call fcn.0043b68f
sub esi, esi
add ecx, ecx
xor dword [edi], edx
add ecx, 0xd4c70a52
add edi, 1
dec ecx
sub esi, ecx
sub ecx, esi
cmp edi, eax
jne fcn.0043b64e
or esi, esi
sub esi, 0x80326098
ret
Function at 0x6cfcb4cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x6cfcb524
jmp 0x6cfcb568
jmp 0x6cfcb5ac
jmp 0x6cfcb5f0
jmp 0x6cfcb634
jmp 0x6cfcb678
jmp 0x6cfcb6bc
jmp 0x6cfcb700
jmp 0x6cfcb744
jmp 0x6cfcb788
jmp 0x6cfcb7cc
jmp 0x6cfcb810
jmp 0x6cfcb854
jmp 0x6cfcb898
jmp 0x6cfcb8dc
jmp 0x6cfcb920
jmp 0x6cfcb964
jmp 0x6cfcb9a8
jmp 0x6cfcb9ec
jmp 0x6cfcba30
jmp 0x6cfcba74
jmp 0x6cfcbab8
jmp 0x6cfcbafc
jmp 0x6cfcbb40
jmp 0x6cfcbb84
jmp 0x6cfcbbc8
jmp 0x6cfcbc0c
jmp 0x6cfcbc50
jmp 0x6cfcbc94
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x6cfcbcde
jmp 0x6cfcbd22
jmp 0x6cfcbd66
jmp 0x6cfcbdaa
jmp 0x6cfcbdee
jmp 0x6cfcbe32
jmp 0x6cfcbe76
jmp 0x6cfcbeba
jmp 0x6cfcbefe
jmp 0x6cfcbf42
jmp 0x6cfcbf86
jmp 0x6cfcbfca
jmp 0x6cfcc00e
jmp 0x6cfcc052
jmp 0x6cfcc096
jmp 0x6cfcc0da
jmp 0x6cfcc11e
jmp 0x6cfcc162
jmp 0x6cfcc1a6
jmp 0x6cfcc1ea
jmp 0x6cfcc22e
jmp 0x6cfcc272
jmp 0x6cfcc2b6
jmp 0x6cfcc2fa
jmp 0x6cfcc33e
jmp 0x6cfcc382
jmp 0x6cfcc3c6
jmp 0x6cfcc40a
jmp 0x6cfcc44e
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x6cfcc4ac
jmp 0x6cfcc4f0
jmp 0x6cfcc534
jmp 0x6cfcc578
jmp 0x6cfcc5bc
jmp 0x6cfcc600
jmp 0x6cfcc644
jmp 0x6cfcc688
jmp 0x6cfcc6cc
jmp 0x6cfcc710
jmp 0x6cfcc754
jmp 0x6cfcc798
jmp 0x6cfcc7dc
jmp 0x6cfcc820
jmp 0x6cfcc864
jmp 0x6cfcc8a8
jmp 0x6cfcc8ec
jmp 0x6cfcc930
jmp 0x6cfcc974
jmp 0x6cfcc9b8
jmp 0x6cfcc9fc
jmp 0x6cfcca40
jmp 0x6cfcca84
jmp 0x6cfccac8
jmp 0x6cfccb0c
jmp 0x6cfccb50
jmp 0x6cfccb94
jmp 0x6cfccbd8
jmp 0x6cfccc1c
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x6cfccc69
jmp 0x6cfcccad
jmp 0x6cfcccf1
jmp 0x6cfccd35
jmp 0x6cfccd79
jmp 0x6cfccdbd
jmp 0x6cfcce01
jmp 0x6cfcce45
jmp 0x6cfcce89
jmp 0x6cfccecd
jmp 0x6cfccf11
jmp 0x6cfccf55
jmp 0x6cfccf99
jmp 0x6cfccfdd
jmp 0x6cfcd021
jmp 0x6cfcd065
jmp 0x6cfcd0a9
jmp 0x6cfcd0ed
jmp 0x6cfcd131
jmp 0x6cfcd175
jmp 0x6cfcd1b9
jmp 0x6cfcd1fd
jmp 0x6cfcd241
jmp 0x6cfcd285
jmp 0x6cfcd2c9
jmp 0x6cfcd30d
jmp 0x6cfcd351
jmp 0x6cfcd395
jmp 0x6cfcd3d9
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x6cfcd436
jmp 0x6cfcd47a
jmp 0x6cfcd4be
jmp 0x6cfcd502
jmp 0x6cfcd546
jmp 0x6cfcd58a
jmp 0x6cfcd5ce
jmp 0x6cfcd612
jmp 0x6cfcd656
jmp 0x6cfcd69a
jmp 0x6cfcd6de
jmp 0x6cfcd722
jmp 0x6cfcd766
Function at 0x6cfe1c5a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d5b0018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6d5b0018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6cfe1cbe
jmp 0x6cfe1d02
jmp 0x6cfe1d46
jmp 0x6cfe1d8a
jmp 0x6cfe1dce
jmp 0x6cfe1e12
jmp 0x6cfe1e56
jmp 0x6cfe1e9a
jmp 0x6cfe1ede
jmp 0x6cfe1f22
jmp 0x6cfe1f66
jmp 0x6cfe1faa
jmp 0x6cfe1fee
jmp 0x6cfe2032
jmp 0x6cfe2076
jmp 0x6cfe20ba
jmp 0x6cfe20fe
jmp 0x6cfe2142
jmp 0x6cfe2186
jmp 0x6cfe21ca
jmp 0x6cfe220e
jmp 0x6cfe2252
jmp 0x6cfe2296
jmp 0x6cfe22da
jmp 0x6cfe231e
jmp 0x6cfe2362
jmp 0x6cfe23a6
jmp 0x6cfe23ea
jmp 0x6cfe242e
mov dword [ebp - 0x14], 0
jmp 0x6cfe2479
jmp 0x6cfe24bd
jmp 0x6cfe2501
jmp 0x6cfe2545
jmp 0x6cfe2589
jmp 0x6cfe25cd
jmp 0x6cfe2611
jmp 0x6cfe2655
jmp 0x6cfe2699
jmp 0x6cfe26dd
jmp 0x6cfe2721
jmp 0x6cfe2765
jmp 0x6cfe27a9
jmp 0x6cfe27ed
jmp 0x6cfe2831
jmp 0x6cfe2875
jmp 0x6cfe28b9
jmp 0x6cfe28fd
jmp 0x6cfe2941
jmp 0x6cfe2985
jmp 0x6cfe29c9
jmp 0x6cfe2a0d
jmp 0x6cfe2a51
jmp 0x6cfe2a95
jmp 0x6cfe2ad9
jmp 0x6cfe2b1d
jmp 0x6cfe2b61
jmp 0x6cfe2ba5
jmp 0x6cfe2be9
mov dword [ebp - 0x18], 0
jmp 0x6cfe2c34
jmp 0x6cfe2c78
jmp 0x6cfe2cbc
jmp 0x6cfe2d00
jmp 0x6cfe2d44
jmp 0x6cfe2d88
jmp 0x6cfe2dcc
jmp 0x6cfe2e10
jmp 0x6cfe2e54
jmp 0x6cfe2e98
jmp 0x6cfe2edc
jmp 0x6cfe2f20
jmp 0x6cfe2f64
jmp 0x6cfe2fa8
jmp 0x6cfe2fec
jmp 0x6cfe3030
jmp 0x6cfe3074
jmp 0x6cfe30b8
jmp 0x6cfe30fc
jmp 0x6cfe3140
jmp 0x6cfe3184
jmp 0x6cfe31c8
jmp 0x6cfe320c
jmp 0x6cfe3250
jmp 0x6cfe3294
jmp 0x6cfe32d8
jmp 0x6cfe331c
jmp 0x6cfe3360
jmp 0x6cfe33a4
mov dword [ebp - 0x10], 0
jmp 0x6cfe33ef
jmp 0x6cfe3433
jmp 0x6cfe3477
jmp 0x6cfe34bb
jmp 0x6cfe34ff
jmp 0x6cfe3543
jmp 0x6cfe3587
jmp 0x6cfe35cb
jmp 0x6cfe360f
jmp 0x6cfe3653
jmp 0x6cfe3697
jmp 0x6cfe36db
jmp 0x6cfe371f
jmp 0x6cfe3763
jmp 0x6cfe37a7
jmp 0x6cfe37eb
jmp 0x6cfe382f
jmp 0x6cfe3873
jmp 0x6cfe38b7
jmp 0x6cfe38fb
jmp 0x6cfe393f
jmp 0x6cfe3983
jmp 0x6cfe39c7
jmp 0x6cfe3a0b
jmp 0x6cfe3a4f
jmp 0x6cfe3a93
jmp 0x6cfe3ad7
jmp 0x6cfe3b1b
jmp 0x6cfe3b5f
mov dword [ebp - 0x10], 0
jmp 0x6cfe6237
jmp 0x6cfe3baf
jmp 0x6cfe3bf3
jmp 0x6cfe3c37
jmp 0x6cfe3c7b
jmp 0x6cfe3cbf
jmp 0x6cfe3d03
jmp 0x6cfe3d47
jmp 0x6cfe3d8b
jmp 0x6cfe3dcf
jmp 0x6cfe3e13
jmp fcn.6cfe3e57
mov eax, dword [0x6d5b0018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6cfe3b6b
nop
leave
ret