joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x6dc0b8]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
mov ebx, dword [ebp + 0x18]
xorps xmm0, xmm0
push esi
movlpd qword [esp + 0xc], xmm0
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x14]
push edi
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], ecx
nop word [eax + eax]
test esi, esi
ja 0x429e90
jb 0x429d93
cmp eax, 0x40
jae 0x429e90
mov byte [esp + eax + 0x20], 0
add eax, 1
adc esi, 0
jne 0x429da5
cmp eax, 0x40
jb 0x429d80
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
jb 0x429e7c
mov eax, dword [ebp + 8]
ja 0x429dc5
test eax, eax
je 0x429e7c
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
nop dword [eax]
test ebx, ebx
je 0x429df1
movzx eax, byte [esp + 0x10]
or eax, 0
jne 0x429df1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
test eax, eax
jne 0x429e6a
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0xc]
push dword [esp + 0x18]
push dword [esp + 0x20]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x10]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x20]
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [esp + 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
cmp eax, 0x40
ja 0x429e65
xor edx, edx
xor ecx, ecx
test eax, eax
je 0x429e3b
nop
xor edx, dword [esp + ecx + 0x20]
add ecx, 4
cmp ecx, eax
jb 0x429e30
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x429e46
cmp edx, dword [eax]
jne 0x429e65
add esi, 1
mov dword [esp + 0x10], esi
adc edi, 0
cmp edi, dword [ebp + 0xc]
ja 0x429e7c
jb 0x429e5c
cmp esi, dword [ebp + 8]
jae 0x429e7c
mov ecx, dword [esp + 0xc]
jmp 0x429dd0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x64]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
call fcn.00545e21
int3
Function at 0x429ea0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x429fb1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
inc ecx
xor ecx, 1
sub edx, 1
jne 0x429ea8
mov eax, ecx
ret

Function at 0x42a2d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, edx
xor edi, edi
mov ebx, ecx
test esi, esi
je 0x42a311
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
movzx eax, cx
imul eax, eax, 0x9069
shr ecx, 0x10
add eax, ecx
mov ecx, dword [edx + 4]
mov dword [edx], eax
movzx eax, cx
imul eax, eax, 0x4650
shr ecx, 0x10
add eax, ecx
mov dword [edx + 4], eax
mov byte [edi + ebx], al
inc edi
cmp edi, esi
jb 0x42a2e3
or eax, 0xffffffff
xor edx, edx
test esi, esi
je 0x42a338
nop word [eax + eax]
movzx ecx, byte [edx + ebx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6f5ea0]
cmp edx, esi
jb 0x42a320
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x42a340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64a34e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6dc0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
push 4
push 0x1000
push 0x500
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0x18], 0
call dword [0x661fe8]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x42a4bb
mov dword [ebp - 0x18], 0x500
xor ecx, ecx
nop word [eax + eax]
mov byte [ecx + ebx], cl
inc ecx
cmp ecx, 0x100
jb 0x42a3b0
or ecx, 0xffffffff
lea edx, [ebx + 1]
mov esi, 0x40
movzx eax, byte [edx - 1]
lea edx, [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6f5ea0]
movzx eax, byte [edx - 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6f5ea0]
movzx eax, byte [edx - 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6f5ea0]
movzx eax, byte [edx - 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6f5ea0]
sub esi, 1
jne 0x42a3c7
not ecx
cmp ecx, 0x29058c73
jne 0x42a4bb
mov edx, 0x159a55e5
mov ecx, 0x1f123bb5
movzx eax, dx
imul eax, eax, 0x9069
shr edx, 0x10
add edx, eax
movzx eax, cx
imul eax, eax, 0x4650
shr ecx, 0x10
add ecx, eax
mov byte [ebx + esi + 0x100], cl
inc esi
cmp esi, 0x400
jb 0x42a433
mov dword [ebp - 0x10], 0
xor edi, edi
or esi, 0xffffffff
xor ecx, ecx
test edi, edi
je 0x42a489
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x6f5ea0]
cmp ecx, edi
jb 0x42a471
push 0x6f5ea0
push edi
mov edx, ebx
or ecx, 0xffffffff
call dword [0x6f7ea0]
not eax
not esi
cmp esi, eax
jne 0x42a4bb
inc edi
cmp edi, 0x20
jb 0x42a468
mov eax, dword [ebp - 0x10]
inc ebx
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x4e0
jb 0x42a466
mov bl, 1
jmp 0x42a4bd
xor bl, bl
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x42a4d9
push 0x8000
push 0
push eax
call dword [0x661fec]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a5e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x6dc0b8]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
push edi
push 0x60
lea eax, [esp + 0x1c]
mov bl, dl
push 0x20
push eax
mov edi, ecx
call fcn.005e0dd0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, dword [ebp + 0xc]
add ecx, 0x1388
adc eax, 0
push 0
push 0x2710
push eax
push ecx
call fcn.005462c0
push edx
push eax
lea ecx, [esp + 0x80]
call fcn.0049dd70
lea eax, [esp + 0x7f]
add esp, 8
mov esi, 0x5f
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a650
sub eax, edx
cmp eax, 6
jae 0x42a661
lea esi, [eax + 0x59]
mov edx, dword [edi]
lea eax, [esp + 0x18]
add eax, esi
mov ecx, edi
push eax
call dword [edx]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
add ecx, 0x7a120
push 0
push 0xf4240
adc eax, 0
push eax
push ecx
call fcn.005462c0
push edx
push eax
mov edx, 6
mov ecx, edi
call fcn.0042a4f0
mov ecx, dword [ebp + 0x18]
add esp, 8
mov eax, dword [ebp + 0x1c]
add ecx, 0x7a120
adc eax, 0
push 0
push 0xf4240
push eax
push ecx
call fcn.005462c0
push edx
push eax
mov edx, 6
mov ecx, edi
call fcn.0042a4f0
add esp, 8
test bl, bl
je 0x42a7cd
mov ebx, dword [ebp + 0x20]
mov eax, ebx
mov ecx, dword [ebp + 0x24]
or eax, ecx
jne 0x42a71a
mov byte [esp + 0x24], al
lea ecx, [esp + 0x18]
mov eax, dword [edi]
push ecx
mov ecx, edi
mov dword [esp + 0x1c], 0x20202020
mov dword [esp + 0x20], 0x20202020
mov dword [esp + 0x24], 0x20202020
call dword [eax]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
push ecx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00546280
push 0
push 0x64
push edx
push eax
call fcn.005462c0
mov esi, eax
mov dword [esp + 0x14], eax
mov eax, edx
mov ecx, esi
or ecx, eax
mov dword [esp + 0x10], eax
jne 0x42a751
mov esi, 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
push 0
push 0xf4240
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.00546280
push dword [esp + 0x10]
mov ecx, esi
mov esi, dword [esp + 0x14]
push dword [esp + 0x18]
shrd ecx, esi, 1
shr esi, 1
add eax, ecx
adc edx, esi
push edx
push eax
call fcn.005462c0
push edx
push eax
mov edx, 5
mov ecx, edi
call fcn.0042a4f0
add esp, 8
push 0
push 0x64
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.00546280
mov esi, dword [ebp + 0x24]
mov ecx, ebx
push dword [ebp + 0x24]
shrd ecx, esi, 1
push ebx
shr esi, 1
add eax, ecx
adc edx, esi
push edx
push eax
call fcn.005462c0
push edx
push eax
mov edx, 5
mov ecx, edi
call fcn.0042a4f0
add esp, 8
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
Function at 0x42f300
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64a877
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6dc0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov word [esi + 1], 0
mov byte [esi + 3], 0
mov word [esi + 7], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [ebp - 4], 0
push 8
mov dword [esi + 0x28], 0
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 3
mov word [eax], cx
mov byte [ebp - 4], 1
push 8
mov dword [esi + 0x38], ecx
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 3
mov word [eax], cx
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], ecx
mov byte [ebp - 4], 4
push 8
mov dword [esi + 0x70], ecx
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], 0
add esp, 0xc
mov dword [esi + 0x78], 3
mov word [eax], cx
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], ecx
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 6
call fcn.0042f200
mov byte [ebp - 4], 7
lea ecx, [esi + 0xe0]
mov dword [esi + 0xd8], 0
mov dword [esi + 0xdc], 0
call fcn.0042eed0
mov dword [esi + 0x208], 0
mov dword [esi + 0x20c], 0
mov dword [esi + 0x210], 0
mov word [esi + 0x214], 0
mov byte [esi + 0x216], 0
mov dword [esi + 0x218], 0
mov byte [ebp - 4], 9
push 8
mov dword [esi + 0x21c], 0
call fcn.00545b74
add esp, 4
mov dword [esi + 0x21c], eax
mov dword [esi + 0x220], 0
mov dword [esi + 0x224], 3
xor ecx, ecx
mov word [eax], cx
mov eax, esi
mov dword [esi + 0x228], ecx
mov dword [esi + 0x22c], ecx
mov dword [esi + 0x230], ecx
mov dword [esi + 0x234], 1
mov dword [esi + 0x238], 2
mov dword [esi + 0x23c], 1
mov dword [esi + 0x240], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42f7a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64a90f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6dc0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0x6aa714
mov dword [esi + 8], 0x6ad800
mov dword [esi + 0xc], 0x6ab7d4
mov dword [esi + 0x10], 0x6ade28
mov dword [esi + 0x14], 0x6ad800
mov dword [esi + 0x18], 0x6ad800
mov dword [esi + 0x1c], 0
mov dword [esi], 0x6ab87c
mov dword [esi + 4], 0x6ab868
mov dword [esi + 8], 0x6ab858
mov dword [esi + 0xc], 0x6ab834
mov dword [esi + 0x10], 0x6ab818
mov dword [esi + 0x14], 0x6ab808
mov dword [esi + 0x18], 0x6ab7f8
push 8
mov dword [esi + 0x20], 0
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 3
mov word [eax], cx
mov dword [ebp - 4], ecx
push 8
mov dword [esi + 0x30], ecx
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 3
mov word [eax], cx
mov byte [ebp - 4], 1
push 8
mov dword [esi + 0x4c], ecx
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 3
mov word [eax], cx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], ecx
mov dword [esi + 0x6c], ecx
mov byte [ebp - 4], 4
mov word [esi + 0x70], 1
mov dword [esi + 0x94], ecx
mov word [esi + 0x98], cx
push 8
mov dword [esi + 0x9c], ecx
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 3
mov word [eax], cx
mov byte [ebp - 4], 5
push 8
mov dword [esi + 0xa8], ecx
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 3
mov word [eax], cx
mov byte [ebp - 4], 6
push 8
mov dword [esi + 0xb4], ecx
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], 0
mov dword [esi + 0xbc], 3
mov word [eax], cx
mov byte [ebp - 4], 7
push 8
mov dword [esi + 0xc0], ecx
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc8], 3
mov word [eax], cx
mov byte [ebp - 4], 8
push 8
mov dword [esi + 0xcc], ecx
call fcn.00545b74
mov dword [esi + 0xcc], eax
add esp, 0x20
xor ecx, ecx
mov dword [esi + 0xd0], 0
mov dword [esi + 0xd4], 3
mov word [eax], cx
mov eax, esi
mov word [esi + 0xd8], cx
mov byte [esi + 0xda], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x439670
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], eax
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0xc]
push edi
push str.CreateDecoder
mov edi, dword [eax + edx*4 - 4]
push dword [edi + 0xc]
call esi
push str.CreateEncoder
push dword [edi + 0xc]
mov dword [edi + 0x24], eax
call esi
push str.GetMethodProperty
push dword [edi + 0xc]
mov dword [edi + 0x28], eax
call esi
mov dword [edi + 0x20], eax
test eax, eax
je 0x439788
push str.GetNumberOfMethods
push dword [edi + 0xc]
mov dword [esp + 0x14], 1
call esi
test eax, eax
je 0x4396e5
lea ecx, [esp + 0xc]
push ecx
call eax
test eax, eax
jne 0x4397d9
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x439782
mov eax, dword [esp + 8]
mov edx, esi
mov ecx, dword [edi + 0x20]
mov dword [esp + 0x14], esi
mov eax, dword [eax + 0x10]
dec eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
push 3
call fcn.004395c0
add esp, 0xc
test eax, eax
jne 0x4397d9
mov ecx, dword [edi + 0x20]
lea eax, [esp + 0x19]
push eax
lea eax, [esp + 0x30]
mov edx, esi
push eax
push 2
call fcn.004395c0
add esp, 0xc
test eax, eax
jne 0x4397d9
movups xmm0, xmmword [esp + 0x10]
mov eax, dword [esp + 0x38]
sub esp, 0x2c
mov ecx, esp
movups xmmword [ecx], xmm0
movups xmm0, xmmword [esp + 0x4c]
movups xmmword [ecx + 0x10], xmm0
movq xmm0, qword [esp + 0x5c]
movq qword [ecx + 0x20], xmm0
mov dword [ecx + 0x28], eax
mov ecx, dword [esp + 0x34]
lea ecx, [ecx + 0x40]
call fcn.0043afe0
inc esi
cmp esi, dword [esp + 0xc]
jb 0x4396f1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetHashers
push dword [edi + 0xc]
call esi
test eax, eax
je 0x4397d7
add edi, 0x30
push edi
call eax
test eax, eax
jne 0x4397d9
mov ecx, dword [edi]
test ecx, ecx
je 0x4397d7
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc]
mov edi, eax
xor esi, esi
test edi, edi
je 0x4397d7
mov eax, dword [esp + 8]
lea ecx, [eax + 0x4c]
nop dword [eax + eax]
mov eax, dword [eax + 0x10]
dec eax
push esi
push eax
call fcn.0040e030
mov eax, dword [esp + 8]
inc esi
lea ecx, [eax + 0x4c]
cmp esi, edi
jb 0x4397c0
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43b3c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64bab1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6dc0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
xor ecx, ecx
mov edx, 2
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov esi, dword [edi + 0x10]
mov dword [ebx + 0xc], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], esi
mov ecx, dword [edi + 0x10]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi + 0xc]
push eax
call fcn.005e0850
add esp, 0x10
lea eax, [edi + 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebx + 0x18]
call fcn.00431ca0
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x30]
mov eax, dword [edi + 0x24]
mov dword [ebx + 0x24], eax
movzx eax, byte [edi + 0x28]
mov byte [ebx + 0x28], al
movzx eax, byte [edi + 0x29]
mov byte [ebx + 0x29], al
mov eax, dword [edi + 0x2c]
mov dword [ebx + 0x2c], eax
lea eax, [edi + 0x30]
push eax
call fcn.0043b4c0
lea eax, [edi + 0x3c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebx + 0x3c]
call fcn.0040e210
mov eax, dword [edi + 0x48]
mov dword [ebx + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [ebx + 0x4c], eax
mov eax, ebx
movups xmm0, xmmword [edi + 0x50]
movups xmmword [ebx + 0x50], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x443a20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64c461
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6dc0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
xor ecx, ecx
mov edx, 2
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov esi, dword [edi + 0x14]
mov dword [ebx + 0x10], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], esi
mov ecx, dword [edi + 0x14]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi + 0x10]
push eax
call fcn.005e0850
mov dword [ebp - 4], 0
xor ecx, ecx
mov esi, dword [edi + 0x20]
mov edx, 2
mov dword [ebx + 0x1c], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], esi
mov ecx, dword [edi + 0x20]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi + 0x1c]
push eax
call fcn.005e0850
mov byte [ebp - 4], 1
xor ecx, ecx
mov eax, dword [edi + 0x28]
mov edx, 2
mov dword [ebx + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [ebx + 0x2c], eax
mov esi, dword [edi + 0x34]
mov dword [ebx + 0x30], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x38], esi
mov ecx, dword [edi + 0x34]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi + 0x30]
push eax
call fcn.005e0850
mov byte [ebp - 4], 2
mov esi, dword [edi + 0x40]
mov dword [ebx + 0x3c], 0
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], esi
mov dword [ebx + 0x44], esi
mov ecx, dword [edi + 0x40]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi + 0x3c]
push eax
call fcn.005e0850
movzx eax, byte [edi + 0x48]
add esp, 0x40
mov byte [ebx + 0x48], al
movzx eax, byte [edi + 0x49]
mov byte [ebx + 0x49], al
movzx eax, byte [edi + 0x4a]
mov byte [ebx + 0x4a], al
movzx eax, byte [edi + 0x4b]
mov byte [ebx + 0x4b], al
movzx eax, byte [edi + 0x4c]
mov byte [ebx + 0x4c], al
movzx eax, byte [edi + 0x4d]
mov byte [ebx + 0x4d], al
mov eax, dword [edi + 0x50]
mov dword [ebx + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [ebx + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [ebx + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [ebx + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [ebx + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [ebx + 0x64], eax
mov eax, dword [edi + 0x68]
mov dword [ebx + 0x68], eax
movzx eax, byte [edi + 0x6c]
mov byte [ebx + 0x6c], al
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4459b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64c6cb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
push 8
mov dword [ebp - 0x224], esi
mov dword [esi], 0
call fcn.00545b74
xor ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], 0
add esp, 4
mov dword [esi + 8], 3
mov word [eax], cx
mov dword [ebp - 4], ecx
mov byte [esi + 0xc], 1
mov eax, dword [esi]
mov dword [esi + 4], ecx
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.0049f520
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret

Function at 0x445a70
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64c700
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0xc], 0
je 0x445b32
push 8
call fcn.00545b74
xor ecx, ecx
mov dword [ebp - 0x228], eax
add esp, 4
mov dword [ebp - 0x220], 3
mov dword [ebp - 0x224], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
lea ecx, [ebp - 0x228]
lea eax, [ebp - 0x21c]
push eax
call fcn.0049f520
lea eax, [esi - 1]
cmp eax, 0x103
ja 0x445b24
mov edx, edi
lea ecx, [ebp - 0x228]
call fcn.0044e050
test al, al
je 0x445b24
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push dword [ebp - 0x228]
call fcn.00545b61
add esp, 4
push dword [edi]
call fcn.00545b61
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret