joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9cf0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
call fcn.00404b1c
lea esi, [ebp - 4]
xor eax, eax
push ebp
push 0x4d9eee
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [esi]
call fcn.004daa18
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d9ecc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x58]
mov edx, 0x4d9f04
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 8]
call fcn.004b1c44
mov edx, 0x4d9ff4
call fcn.004b0b3c
mov edx, dword [ebp - 0x10]
call fcn.004b07ec
mov eax, dword [ebp - 8]
call fcn.004b1c44
mov edx, 0x4da008
call fcn.004b0b3c
xor edx, edx
call fcn.004aff78
mov eax, dword [ebp - 8]
call fcn.004b14fc
jmp 0x4d9de1
test bl, bl
je 0x4d9d9e
xor ebx, ebx
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
mov edx, 0x4da018
mov ecx, dword [eax]
call dword [ecx + 0x38]
push ebp
lea eax, [ebp - 0x18]
call fcn.004d95f4
pop ecx
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00404704
mov eax, dword [ebp - 8]
call fcn.004b18c4
mov eax, dword [ebp - 8]
call fcn.004b1750
test al, al
jne 0x4d9dd4
lea eax, [ebp - 0x14]
mov edx, 0x4da024
call fcn.00404934
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
call fcn.004b1750
test al, al
je 0x4d9d89
test bl, bl
jne 0x4d9e00
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
mov edx, 0x4da030
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov bl, 1
mov eax, dword [ebp - 8]
call fcn.004b13b0
mov eax, dword [ebp - 8]
call fcn.004b1c44
mov edx, 0x4da008
call fcn.004b0b3c
mov edx, 1
call fcn.004aff78
mov eax, dword [ebp - 8]
call fcn.004b14fc
jmp 0x4d9e88
test bl, bl
je 0x4d9e45
xor ebx, ebx
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
mov edx, 0x4da03c
mov ecx, dword [eax]
call dword [ecx + 0x38]
push ebp
lea eax, [ebp - 0x1c]
call fcn.004d95f4
pop ecx
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
call fcn.00404704
mov eax, dword [ebp - 8]
call fcn.004b18c4
mov eax, dword [ebp - 8]
call fcn.004b1750
test al, al
jne 0x4d9e7b
lea eax, [ebp - 0x14]
mov edx, 0x4da024
call fcn.00404934
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 8]
call fcn.004b1750
test al, al
je 0x4d9e30
test bl, bl
jne 0x4d9ea7
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
mov edx, 0x4da030
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi]
mov eax, dword [eax + 0x38]
mov edx, 0x4da050
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9ed3
mov eax, dword [ebp - 8]
call fcn.0040381c
ret
Function at 0x401570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
call fcn.00401770
mov dword [esp], 0x100000
call sub.msvcrt.dll_malloc
mov dword [esp + 0x1c], eax
cmp dword [ebp + 8], 1
jg 0x40159b
mov eax, 1
jmp 0x401603
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll__open
mov dword [esp + 0x18], eax
mov dword [esp + 8], 0x100000
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll__read
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll__close
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
call eax
call sub.msvcrt.dll_getchar
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0
leave
ret

Function at 0x401ac0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00401b20
Function at 0x401b20
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4053a0]
test esi, esi
jle 0x401c0d
mov edi, dword [0x4053a4]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401b54
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401c06
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401b40
mov dword [esp], eax
mov ebx, eax
call fcn.00402440
test eax, eax
mov edi, eax
je 0x401c4a
lea ebx, [esi + esi*2]
mov esi, dword [0x4053a4]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.00402570
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4053a4]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c2a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401bff
sub eax, 0x40
and eax, 0xffffffbf
je 0x401bff
mov eax, dword [esp + 0x20]
add ebx, dword [0x4053a4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401c14
add dword [0x4053a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401b5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401ac0
mov eax, dword [0x4053a4]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401ac0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401ac0
lea esi, [esi]

Function at 0x4020b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4053b0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402105
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4020fe
test esi, esi
je 0x4020fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020e0
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x465030]
jne 0x401073
repz ret
jmp fcn.00402061

Function at 0x408d0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f5a
and dword [ebp - 4], 0
cmp dword [0x467b68], 0
mov ebx, eax
jne 0x408dbc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408e6d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408e6d
push eax
call fcn.00404ee8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x467b68], eax
call esi
push eax
call fcn.00404ee8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x467b6c], eax
call esi
push eax
call fcn.00404ee8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x467b70], eax
call esi
push eax
call fcn.00404ee8
pop ecx
mov dword [0x467b78], eax
test eax, eax
je 0x408dbc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404ee8
pop ecx
mov dword [0x467b74], eax
mov eax, dword [0x467b74]
cmp eax, ebx
je 0x408e14
cmp dword [0x467b78], ebx
je 0x408e14
push eax
call fcn.00404f63
push dword [0x467b78]
mov esi, eax
call fcn.00404f63
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408e14
test edi, edi
je 0x408e14
call esi
test eax, eax
je 0x408e0b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408e0b
test byte [ebp - 0xc], 1
jne 0x408e14
or dword [ebp + 0x10], 0x200000
jmp 0x408e4d
mov eax, dword [0x467b6c]
cmp eax, ebx
je 0x408e4d
push eax
call fcn.00404f63
pop ecx
test eax, eax
je 0x408e4d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408e4d
mov eax, dword [0x467b70]
cmp eax, ebx
je 0x408e4d
push eax
call fcn.00404f63
pop ecx
test eax, eax
je 0x408e4d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x467b68]
call fcn.00404f63
pop ecx
test eax, eax
je 0x408e6d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408e6f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4012b0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [esp + 8]
ret 8

Function at 0x4012e0
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
and eax, dword [esp + 8]
ret 8

Function at 0x402b10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432aa8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4445dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.0040cd4c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402b55
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x14], edi
push 0x100
mov dword [ebp - 4], 0
call fcn.0041fc67
mov esi, dword [ebp + 8]
add esp, 4
test eax, eax
mov dword [esi], eax
jne 0x402bb8
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402ba4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100
call fcn.0041fc67
mov ecx, dword [esi]
add esp, 4
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x402c0e
push ecx
call fcn.0041fb8a
add edi, 0xfffffff0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x402bfa
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x100
push 0
push ecx
call fcn.0041fb10
add esp, 0xc
xor esi, esi
mov eax, 0x100
cmp esi, eax
ja 0x402ca6
lea ebx, [esi + 1]
push ebx
lea edx, [ebp - 0x14]
push str.COM_d
push edx
mov byte [ebp - 4], 1
call fcn.00401770
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
add esp, 0xc
push 0x100
push eax
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x402c69
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov byte [esi + edx], 1
mov esi, ebx
jmp 0x402c20
mov eax, dword [ebp - 0x18]
push eax
call fcn.0041fb8a
lea eax, [edi - 0x10]
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402cd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403419
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403454
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403450
lea ebx, [ebx]
cmp esi, eax
jae 0x403454
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403440
cmp esi, eax
jb 0x40345a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x40c6a6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40c6e9
call fcn.004054f4
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40c6e9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40c704
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0040c25d
test ebx, ebx
mov esi, eax
je 0x40c702
test edi, edi
je 0x40c702
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40ee3a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x40ee80
call fcn.004054f4
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40ee80
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x40eec3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x40eeac
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x40eeac
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x40eec0
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x41f205
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4445dc]
jne 0x41f20f
repz ret
jmp fcn.00423e5f
Function at 0x42d9ad
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00424c50
xor ebx, ebx
cmp dword [0x448364], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x42da82
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x42d9ed
xor eax, eax
jmp 0x42db46
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43b254
push edi
call esi
cmp eax, ebx
je 0x42d9e6
push eax
call fcn.00424bed
mov dword [esp], 0x43b244
push edi
mov dword [0x448364], eax
call esi
push eax
call fcn.00424bed
mov dword [esp], 0x43b230
push edi
mov dword [0x448368], eax
call esi
push eax
call fcn.00424bed
mov dword [0x44836c], eax
lea eax, [ebp - 8]
push eax
call fcn.0042239b
test eax, eax
pop ecx
pop ecx
je 0x42da50
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00423d3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x42da82
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00424bed
cmp eax, ebx
pop ecx
mov dword [0x448374], eax
je 0x42da82
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00424bed
pop ecx
mov dword [0x448370], eax
mov eax, dword [0x448370]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x42dafb
cmp dword [0x448374], esi
je 0x42dafb
push eax
call fcn.00424c59
pop ecx
call eax
cmp eax, ebx
je 0x42dac8
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x448374]
call fcn.00424c59
pop ecx
call eax
test eax, eax
je 0x42dac8
test byte [ebp - 0x18], 1
jne 0x42dafb
lea eax, [ebp - 0xc]
push eax
call fcn.004223d2
test eax, eax
pop ecx
je 0x42dae3
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00423d3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x42daf2
or dword [ebp + 0x10], 0x200000
jmp 0x42db2c
or dword [ebp + 0x10], 0x40000
jmp 0x42db2c
mov eax, dword [0x448368]
cmp eax, esi
je 0x42db2c
push eax
call fcn.00424c59
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42db2c
mov eax, dword [0x44836c]
cmp eax, esi
je 0x42db2c
push dword [ebp - 4]
push eax
call fcn.00424c59
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x448364]
call fcn.00424c59
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431d68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov bh, 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00431ad4
lds ebx, [ebp + ebp*2 - 0x57ba7299]
push eax
call fcn.00431ae4
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00431a99
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x431dc2
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00431ad4
mov ebp, 0x8d82e8a1
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x431f0a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.00431a99
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
inc ebp
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x431f6f
inc ebp
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x431f6f
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00431ae4
push eax
push esi
push dword [ebp + 8]
call fcn.00431a99
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00431ad4
insd dword es:[edi], dx
aam 0x1b
loopne 0x431edf
invalid
popfd
jl 0x431f59
invalid
invalid
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00431ad4
inc edx
aam 0xdf
jp 0x431f4a
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid
Function at 0x4321e5
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4321ab
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4321c9
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x432227
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x43220e
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x432217
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x432221
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x432203
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x43218d
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x432274
dec eax
je 0x43226b
sub eax, 3
je 0x432262
mov dword [ebp - 4], 0x40
jmp 0x432291
mov dword [ebp - 4], 4
jmp 0x432277
mov dword [ebp - 4], 0x20
jmp 0x432277
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4322c3
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x432243
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00431ad4
inc dword [edx]
adc byte [ecx*2 + 0x6a1475ff], al
add dword [esi - 1], edx
xlatb
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax