joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4094fe
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x4094ec
mov ebp, dword [eax]
cmp ebp, 0
je 0x4094ec
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x4093b9
mov ebx, 0x5f6d83
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.00429650
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x40944a
mov ecx, dword [eax + 0xc]
xor eax, eax
cmp eax, 8
jae 0x4093ee
mov esi, eax
shl esi, 2
add esi, 8
mov ebx, ecx
add ebx, esi
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x18]
cmp ebx, ebp
je 0x409419
inc eax
cmp eax, 8
jb 0x4093d2
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, ecx
add ebx, eax
mov ecx, dword [ebx]
xor ebp, ebp
cmp ecx, ebp
jne 0x4093cb
mov ebx, 0x6d0660
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 0
add esp, 0xc
ret
mov ebx, ecx
add ebx, eax
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x4093e8
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov ebx, ebp
imul ebx, eax
add ebx, 0x28
mov eax, ebx
mov ebx, ecx
add ebx, eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 1
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x4094e8
shl ebx, cl
dec ebx
mov edx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x4093cb
shr edx, 1
and edx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, edx
imul ebp, ebx
mov edx, eax
add edx, ebp
movzx ebp, byte [edx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x4094e4
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x4094e4
mov eax, 1
cmp al, 0
jne 0x4093cb
mov ecx, edx
jmp 0x4093cb
xor eax, eax
jmp 0x4094d4
xor ebx, ebx
jmp 0x409481
mov ebx, 0x6d0660
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], 0
add esp, 0xc
ret
call fcn.0044ff60
jmp fcn.00409360
Function at 0x409510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4096a2
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x409695
mov ebp, dword [eax]
cmp ebp, 0
je 0x409695
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x409569
mov ebx, 0x5f6d83
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.00429650
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x4095f3
mov edx, dword [eax + 0xc]
xor ecx, ecx
cmp ecx, 8
jae 0x4095a1
mov esi, ecx
shl esi, 3
add esi, 8
mov ebx, edx
add ebx, esi
mov esi, dword [ebx]
mov eax, dword [ebx + 4]
cmp eax, dword [esp + 0x1c]
jne 0x40959b
cmp esi, dword [esp + 0x18]
je 0x4095c7
inc ecx
cmp ecx, 8
jb 0x40957e
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, edx
add ebx, eax
mov edx, dword [ebx]
xor ebp, ebp
cmp edx, ebp
jne 0x409577
mov ebx, 0x6d0660
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
mov ebx, edx
add ebx, ecx
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x40959b
mov eax, edx
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov edx, ebp
imul edx, ecx
add edx, 0x48
mov ebx, eax
add ebx, edx
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x409691
shl ebx, cl
dec ebx
mov ecx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov edx, dword [edi + 0xc]
add edx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x409577
shr ecx, 1
and ecx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, ecx
imul ebp, ebx
mov ecx, eax
add ecx, ebp
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x40968d
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x40968d
mov eax, 1
cmp al, 0
jne 0x409577
mov edx, ecx
jmp 0x409577
xor eax, eax
jmp 0x40967d
xor ebx, ebx
jmp 0x40962a
mov ebx, 0x6d0660
mov dword [esp + 0x20], ebx
add esp, 0xc
ret
call fcn.0044ff60
jmp fcn.00409510
Function at 0x4215a0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4217b3
sub esp, 0x34
mov ecx, dword [esp + 0x38]
movzx ebp, byte [ecx + 6]
xchg ebp, eax
cmp al, 1
xchg ebp, eax
jne 0x421697
mov ebx, dword [esp + 0x3c]
mov dword [esp], ebx
mov ebp, dword [ecx + 8]
mov dword [esp + 4], ebp
mov ebp, dword [ecx + 0xc]
mov dword [esp + 8], ebp
mov ebp, dword [ecx + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x20], ecx
mov ebp, dword [ecx + 0x14]
mov dword [esp + 0x10], ebp
call fcn.00412900
mov ebx, 0x6c1a80
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040bc60
mov eax, 0x6c1a80
add eax, 0x21d8
mov edx, dword [esp + 0x20]
mov ebp, dword [eax + 0x18]
mov ebx, dword [eax]
sub ebp, ebx
mov dword [eax + 0x18], ebp
mov dword [esp + 0x28], eax
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x18], edx
cmp edx, 0
je 0x421693
cmp byte [0x6cfdd8], 0
jne 0x42167d
mov dword [edx], ebp
cmp eax, 0
je 0x421679
cmp byte [0x6cfdd8], 0
jne 0x421668
mov dword [eax + 0xc], edx
mov ebx, 0x6c1a80
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040bea0
add esp, 0x34
ret
lea esi, [eax + 0xc]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.0040e4e0
jmp 0x421650
mov dword [eax], eax
jmp 0x421644
mov dword [esp], edx
mov dword [esp + 4], ebp
call fcn.0040e4e0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
jmp 0x42163f
mov dword [edx], eax
jmp 0x421634
xchg ebp, eax
cmp al, 2
xchg ebp, eax
jne 0x421759
mov dword [esp + 0x1c], ecx
mov ebp, dword [ecx + 8]
mov dword [esp], ebp
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], ebx
call fcn.004224f0
mov ebx, 0x6c1a80
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040bc60
mov eax, 0x6c1a80
add eax, 0x21f8
mov edx, dword [esp + 0x1c]
mov ebp, dword [eax + 0x18]
mov ebx, dword [eax]
sub ebp, ebx
mov dword [eax + 0x18], ebp
mov dword [esp + 0x24], eax
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x14], edx
cmp edx, 0
je 0x421755
cmp byte [0x6cfdd8], 0
jne 0x42173f
mov dword [edx], ebp
cmp eax, 0
je 0x42173b
cmp byte [0x6cfdd8], 0
jne 0x42172a
mov dword [eax + 0xc], edx
mov ebx, 0x6c1a80
mov dword [esp], ebx
add dword [esp], 0x2218
call fcn.0040bea0
jmp 0x421664
lea esi, [eax + 0xc]
mov dword [esp], esi
mov dword [esp + 4], edx
call fcn.0040e4e0
jmp 0x421711
mov dword [eax], eax
jmp 0x421705
mov dword [esp], edx
mov dword [esp + 4], ebp
call fcn.0040e4e0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
jmp 0x421700
mov dword [edx], eax
jmp 0x4216f5
mov ebx, 0x5f1430
mov dword [esp], ebx
mov dword [esp + 4], 0x10
call fcn.00429650
mov ebx, 0x5eff1c
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0xb
mov dword [esp], 0x5bd020
lea ebx, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
call fcn.0040ac00
lea ebx, [esp + 0xc]
cld
mov ecx, dword [ebx]
mov dword [esp], ecx
mov ecx, dword [ebx + 4]
mov dword [esp + 4], ecx
call fcn.00428f70
ud2
call fcn.0044ff60
jmp fcn.004215a0
Function at 0x422aa0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x422c01
sub esp, 0x28
mov ebx, 0x6cfd10
mov dword [esp], ebx
call fcn.0040bc60
mov ebx, dword fs:[0x14]
mov ecx, dword [ebx]
mov eax, 2
mov dword [esp + 0x14], ecx
mov ebp, dword [ecx + 0x18]
mov byte [ebp + 0x1ed], al
mov ebx, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
call fcn.00429e30
mov ebx, 0x5efacd
mov dword [esp], ebx
mov dword [esp + 4], 0xa
call fcn.0042a840
mov ebx, dword [esp + 0x2c]
mov dword [esp], ebx
call fcn.0042a800
mov ebx, 0x5ee2a6
mov dword [esp], ebx
mov dword [esp + 4], 2
call fcn.0042a840
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.0042a6d0
mov ebx, 0x5ee2a4
mov dword [esp], ebx
mov dword [esp + 4], 2
call fcn.0042a840
call fcn.00429eb0
mov ebx, dword [esp + 0x14]
mov dword [esp], ebx
call fcn.00447590
lea ebx, [esp + 0x2c]
mov dword [esp], ebx
call fcn.00451800
mov ebx, dword [esp + 4]
mov dword [esp + 8], ebx
lea ebx, [esp + 0x2c]
mov dword [esp], ebx
call fcn.00451860
mov edx, dword [esp + 4]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
mov ecx, 0x44c330
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x14]
mov dword [eax + 0xc], ecx
mov dword [esp], eax
call fcn.0044fe50
call fcn.00429e30
mov ebx, 0x5ee286
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042a840
call fcn.00429eb0
xor eax, eax
mov ebx, dword [esp + 0x14]
mov ebp, dword [ebx + 0x18]
mov byte [ebp + 0x1ed], al
mov ebx, 0x6cfd10
mov dword [esp], ebx
call fcn.0040bea0
add esp, 0x28
ret
call fcn.0044ff60
jmp fcn.00422aa0
Function at 0x423290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42341c
sub esp, 0x34
mov eax, dword [esp + 0x38]
xor ebx, ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x40], ebx
mov byte [esp + 0x44], bl
mov dword [esp + 0x48], ebx
xor edx, edx
mov byte [esp + 0x24], dl
mov dword [esp + 0x28], edx
mov byte [esp + 0x2c], dl
mov ebx, eax
dec ebx
and ebx, eax
cmp ebx, 0
jne 0x423411
mov ebx, eax
dec ebx
xor ebx, 0xffffffff
mov dword [esp + 0x30], ebx
mov ebx, eax
and ebx, 1
cmp ebx, 0
jne 0x423304
mov ebx, edx
inc ebx
mov edx, ebx
mov byte [esp + 0x24], bl
shr eax, 1
mov ebx, eax
and ebx, 1
cmp ebx, 0
je 0x4232ef
mov ebp, 0x3f
mov dword [esp + 0x38], eax
xor esi, esi
mov edi, eax
mov eax, 1
xor edx, edx
xchg ebp, eax
movzx ecx, al
xchg ebp, eax
xchg ebp, eax
mov byte [esp + 0x1b], al
xchg ebp, eax
cmp ecx, 0x40
jae 0x423408
cmp ecx, 0x20
jae 0x4233fd
shld edx, eax, cl
shl eax, cl
add eax, edi
adc edx, esi
sub eax, 1
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 8], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0xc], esi
call fcn.0044a440
movzx ebp, byte [esp + 0x1b]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, 1
jb 0x42338a
jbe 0x423383
mov ebx, ebp
dec ebx
mov ebp, ebx
jmp 0x423311
cmp edx, 0
jb 0x42338a
jmp 0x42337c
mov eax, 1
xor edx, edx
xchg ebp, eax
movzx ecx, al
xchg ebp, eax
cmp ecx, 0x40
jae 0x4233f7
cmp ecx, 0x20
jae 0x4233ef
shld edx, eax, cl
shl eax, cl
add eax, edi
adc edx, esi
sub eax, 1
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.0044a440
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
movzx ebx, byte [esp + 0x1b]
mov eax, ebx
movzx ebx, byte [esp + 0x24]
mov byte [esp + 0x3c], bl
mov dword [esp + 0x40], ecx
mov byte [esp + 0x44], al
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x48], ebx
add esp, 0x34
ret
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x4233a5
xor edx, edx
xor eax, eax
jmp 0x42339b
mov edx, eax
shl edx, cl
xor eax, eax
jmp 0x42333a
xor edx, edx
xor eax, eax
jmp 0x42332c
xor ecx, ecx
mov dword [esp + 0x30], ecx
jmp 0x4232e5
call fcn.0044ff60
jmp fcn.00423290
Function at 0x430860
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x3c
mov ebx, dword fs:[0x14]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x70]
inc edx
mov dword [ecx + 0x70], edx
mov ecx, 1
mov byte [eax + 0x85], cl
mov ecx, 0xfffffade
mov dword [eax + 8], ecx
mov ebp, dword [eax + 0x18]
mov ebx, dword [ebp + 0x54]
mov ecx, dword [ebx + 0x14]
mov ebp, dword [eax + 0x18]
mov dword [ebp + 0x204], ecx
mov ecx, 1
mov byte [eax + 0x87], cl
mov dword [esp + 0x18], eax
mov ebp, dword [eax + 0x18]
mov eax, dword [ebp + 0x54]
mov ecx, dword [eax + 0x14]
inc ecx
mov dword [eax + 0x14], ecx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.00451800
mov ebx, dword [esp + 4]
mov dword [esp + 0x10], ebx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.00451860
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 4]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0xc], esi
mov ebx, dword fs:[0x14]
mov ecx, dword [ebx]
mov dword [ecx + 0x24], ebp
mov dword [ecx + 0x20], esi
xor edx, edx
mov dword [ecx + 0x34], edx
xor edx, edx
mov dword [ecx + 0x30], edx
xor edx, edx
mov dword [ecx + 0x2c], edx
mov dword [ecx + 0x28], ecx
mov ebp, dword [eax + 0x20]
mov dword [eax + 0x3c], ebp
mov ebp, dword [eax + 0x24]
mov dword [eax + 0x40], ebp
mov edx, dword [eax + 0x3c]
mov ebp, dword [eax]
cmp edx, ebp
jb 0x430a02
mov edx, dword [eax + 4]
mov ebp, dword [eax + 0x3c]
cmp edx, ebp
jb 0x430a02
mov dword [esp], eax
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.0042caa0
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x3c]
mov ebp, dword [ecx]
cmp eax, ebp
jb 0x4309d2
mov eax, dword [ecx + 4]
mov ebp, dword [ecx + 0x3c]
cmp eax, ebp
jb 0x4309d2
mov ebx, 0x611c7c
mov dword [esp], ebx
call fcn.0044fe50
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.00451800
mov ebx, dword [esp + 4]
mov dword [esp + 0x14], ebx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.00451860
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x14]
mov ebx, dword fs:[0x14]
mov eax, dword [ebx]
mov dword [eax + 0x24], edx
mov dword [eax + 0x20], ecx
xor ecx, ecx
mov dword [eax + 0x34], ecx
xor ecx, ecx
mov dword [eax + 0x30], ecx
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x28], eax
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax + 0x70]
dec ecx
mov dword [eax + 0x70], ecx
add esp, 0x3c
ret
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov edx, 0x44c970
mov dword [eax], edx
mov edx, dword [esp + 0xc]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [esp], eax
call fcn.0044fe50
jmp 0x430966
mov edi, esi
mov esi, dword [eax + 0x20]
mov edx, dword [eax + 0x3c]
xor ecx, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0x44c800
mov ebp, dword [esp + 0x14]
mov dword [ecx], ebp
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], eax
mov dword [esp], ecx
call fcn.0044fe50
mov eax, dword [esp + 0x18]
jmp 0x430937
Function at 0x43f760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43f92a
sub esp, 0x64
xor ebx, ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
xor ebx, ebx
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
xor eax, eax
mov ebp, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x60], ebx
xor edx, edx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x58], ebp
mov ecx, ebp
mov ebp, dword [esp + 0x2c]
cmp edx, ebp
jge 0x43f822
mov dword [esp + 0x34], ecx
mov ecx, dword [ecx]
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], eax
lea ebx, [esp + 0x20]
cmp ebx, 0
je 0x43f923
mov ebp, 4
mov edx, 4
mov dword [esp + 0x4c], ebx
mov dword [esp], ebx
mov dword [esp + 0x50], ebp
mov dword [esp + 4], ebp
mov dword [esp + 0x54], edx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call fcn.00435db0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
add eax, ecx
mov ecx, dword [esp + 0x34]
add ecx, 4
mov edx, dword [esp + 0x30]
inc edx
mov ebp, dword [esp + 0x2c]
cmp edx, ebp
jl 0x43f7bf
mov ebx, dword [esp + 0x68]
mov dword [esp], ebx
mov ebx, eax
mov dword [esp + 0x1c], eax
add ebx, 3
mov dword [esp + 4], ebx
call fcn.0043f2f0
mov ebx, dword [esp + 8]
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x3c], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x44], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x48], ebx
xor eax, eax
mov ebp, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x60], ebx
xor edx, edx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x58], ebp
mov ecx, ebp
mov ebp, dword [esp + 0x2c]
cmp edx, ebp
jge 0x43f89f
mov dword [esp + 0x34], ecx
mov esi, dword [ecx]
mov dword [esp + 0x30], edx
mov ebp, dword [esp + 0x1c]
cmp eax, ebp
jl 0x43f8be
mov ebx, dword [esp + 0x3c]
cmp eax, ebx
ja 0x43f8b7
mov edx, dword [esp + 0x38]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
add esp, 0x64
ret
call fcn.00427a00
ud2
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
cmp eax, ecx
ja 0x43f91c
mov ebp, ecx
sub ebp, eax
sub edx, eax
mov ecx, dword [esp + 0x40]
cmp edx, 0
je 0x43f8df
add ecx, eax
mov dword [esp + 0x4c], ecx
mov dword [esp], ecx
mov dword [esp + 0x50], ebp
mov dword [esp + 4], ebp
mov dword [esp + 0x54], edx
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
call fcn.00435db0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x24]
add ebx, eax
mov eax, ebx
mov ecx, dword [esp + 0x34]
add ecx, 4
mov edx, dword [esp + 0x30]
inc edx
jmp 0x43f885
call fcn.00427a00
ud2
mov dword [ebx], eax
jmp 0x43f7da
call fcn.0044ff60
jmp fcn.0043f760
Function at 0x441fe0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4421cf
sub esp, 0x3c
mov edi, dword [esp + 0x40]
mov ecx, dword [edi + 4]
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0xe9
xchg ebp, eax
jne 0x442027
mov ebp, dword [edi + 4]
add ebp, 5
mov dword [esp + 0xc], ebp
mov esi, ecx
inc esi
mov eax, dword [esi]
cdq
mov ebx, dword [esp + 0xc]
add ebx, eax
mov dword [edi + 4], ebx
add esp, 0x3c
ret
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0xeb
xchg ebp, eax
jne 0x442052
mov ebp, dword [edi + 4]
add ebp, 2
mov dword [esp + 8], ebp
mov eax, ecx
inc eax
movzx eax, byte [eax]
movsx eax, al
cdq
mov ebx, dword [esp + 8]
add ebx, eax
mov dword [edi + 4], ebx
add esp, 0x3c
ret
movzx ebp, byte [ecx]
xchg ebp, eax
cmp al, 0xcc
xchg ebp, eax
jne 0x442060
add esp, 0x3c
ret
movzx ebp, byte [ecx]
xor edx, edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], edx
movzx ebp, byte [ecx + 1]
xor edx, edx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], edx
movzx ebp, byte [ecx + 2]
xor edx, edx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], edx
movzx ebp, byte [ecx + 3]
xor edx, edx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x38], ecx
movzx ebp, byte [ecx + 4]
xor ecx, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ecx
call fcn.00429e30
mov ebx, 0x5f0437
mov dword [esp], ebx
mov dword [esp + 4], 0xc
call fcn.0042a840
mov ebx, dword [esp + 0x38]
mov dword [esp], ebx
call fcn.0042a800
mov ebx, 0x5ee264
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042a840
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0042a6d0
mov ebx, 0x5ee264
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042a840
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.0042a6d0
mov ebx, 0x5ee264
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042a840
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0042a6d0
mov ebx, 0x5ee264
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042a840
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.0042a6d0
mov ebx, 0x5ee264
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042a840
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.0042a6d0
mov ebx, 0x5ee286
mov dword [esp], ebx
mov dword [esp + 4], 1
call fcn.0042a840
call fcn.00429eb0
mov ebx, 0x5f748e
mov dword [esp], ebx
mov dword [esp + 4], 0x22
call fcn.00429650
add esp, 0x3c
ret
call fcn.0044ff60
jmp fcn.00441fe0
Function at 0x444600
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4446fa
sub esp, 0x3c
mov esi, dword [esp + 0x40]
xor edx, edx
xor ecx, ecx
mov dword [esi + 0x90], edx
mov dword [esi + 0x94], ecx
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
mov ebp, dword [ebx + 0x18]
mov eax, dword [ebp + 0x54]
mov dword [esi + 0x98], eax
mov dword [esp], 0x5b6460
call fcn.0040db10
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x44]
inc ecx
mov dword [eax], ecx
mov edx, 1
mov ecx, 1
mov ebx, 0x6c7b60
mov dword [esp], ebx
add dword [esp], 0x54
mov dword [esp + 0x30], eax
mov dword [esp + 4], eax
mov dword [esp + 0x34], edx
mov dword [esp + 8], edx
mov dword [esp + 0x38], ecx
mov dword [esp + 0xc], ecx
call fcn.00443d80
mov edx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
mov ebx, dword [esp + 0x40]
mov esi, dword [ebx + 0x64]
mov ebp, dword [ebx + 0x68]
mov dword [eax], esi
mov dword [eax + 4], ebp
mov ebp, edx
xor edx, edx
mov dword [eax + 8], ebp
mov dword [eax + 0xc], edx
mov edx, 2
mov ecx, 2
mov byte [esp], 0xd
mov dword [esp + 4], 2
mov dword [esp + 0x24], eax
mov dword [esp + 8], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0xc], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x10], ecx
call fcn.00443590
add esp, 0x3c
ret
call fcn.0044ff60
jmp fcn.00444600
Function at 0x444b20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x444c3e
sub esp, 0x48
mov edi, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
cmp edi, 0
jne 0x444b4b
cmp esi, 0
je 0x444b65
mov edx, dword [0x6c7b78]
mov eax, dword [0x6c7b7c]
cmp eax, edi
jl 0x444b65
jg 0x444b61
cmp edx, esi
jbe 0x444b65
xor esi, esi
xor edi, edi
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
mov ebp, dword [ebx + 0x18]
mov ecx, dword [ebp + 0x4c]
mov eax, dword [ecx + 0x90]
mov edx, dword [ecx + 0x94]
add eax, 1
adc edx, 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 0x90], eax
mov dword [ecx + 0x94], edx
mov ebp, dword [ecx + 0x18]
mov eax, dword [ebp + 0x54]
mov dword [ecx + 0x98], eax
xor ebp, ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
lea ebp, [esp + 0x24]
mov eax, dword [ecx + 0x64]
mov dword [esp + 0x1c], eax
mov edx, dword [ecx + 0x68]
mov eax, dword [esp + 0x1c]
mov dword [ebp], eax
mov dword [ebp + 4], edx
mov edx, dword [ecx + 0x90]
mov ecx, dword [ecx + 0x94]
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], ecx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], edi
mov eax, esi
mov edx, edi
shrd eax, edi, 6
shr edx, 6
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], edx
mov edx, 3
mov ecx, 3
mov byte [esp], 0x1d
mov dword [esp + 4], 0xffffffff
mov dword [esp + 0x3c], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x40], edx
mov dword [esp + 0xc], edx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x10], ecx
call fcn.00443590
add esp, 0x48
ret
call fcn.0044ff60
jmp fcn.00444b20