joyce8/EMBER2024-capa huggingface dataset:
Function at 0xaac7ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lahf
bsr eax, esp
push edi
bsr ax, ax
neg ax
aam 0x5a
adc ah, bh
push ebx
shl ah, 2
cmp ah, dl
not ah
setne al
push edx
btr ax, 1
daa
movsx ax, bl
add al, 0x6b
mov eax, dword [ebp + 8]
push esp
stc
pushfd
pushfd
test eax, eax
mov byte [esp], 0x7c
pushal
lea esp, [esp + 0x2c]
je 0xab5eeb
shl esi, 0xd
jp 0xe914fd
stc
or dl, cl
mov esi, dword [eax + 0x3c]
bswap edx
adc edx, 0x2dd5143d
add esi, eax
not dl
btc dx, 4
mov edx, dword [esi + 0x78]
pushal
bt cx, 0xe
test bh, 0x2e
test edx, edx
pushfd
lea esp, [esp + 0x24]
je 0xab383d
pushal
mov word [esp], sp
lea esp, [esp + 0x20]
je 0xab5eeb
bsr cx, bx
jb 0xe46372
pushfd
movsx cx, bl
add edx, eax
shld cx, bx, cl
lea ecx, [edx + 0x40fe320c]
mov ecx, dword [esi + 0x7c]
clc
bt ecx, ebx
add ecx, edx
pushal
test bx, di
test dh, bl
jmp 0xe465e0
ror ax, 2
xor ax, bx
aas
lea eax, [esi - 0xa6141ec]
push ebp
lahf
mov ebp, esp
adc eax, 0xbe700a96
sub esp, 0x18
cmc
sal ax, cl
movzx ax, bl
push esi
rcl ah, 7
jmp 0xaa9f36
pushal
mov byte [esp + 0x14], al
lea esp, [esp + 0x20]
je 0xab5eeb
rcr ch, 4
setl ch
bsr cx, bx
stc
add edx, eax
jmp 0xac1274
jmp 0xac878b
jmp 0xac8410
lea ecx, [ebx - 0x64585bf1]
not ecx
mov ecx, dword [esi + 0x7c]
jmp 0xabc48b
stc
push 0x96cca767
add ecx, edx
pushal
clc
cmp bx, si
cmc
mov dword [ebp - 0x10], ecx
movzx cx, dl
bsr ecx, esi
mov ecx, dword [ebp + 0xc]
clc
cmp ecx, 0xffff
call fcn.00ab5b9e
mov dl, 0xc5
mov ebp, 0x37d15971
xchg byte [eax - 0x51451e3], ah
das
mov ecx, 0xc91d3d4f
pop ebx
popfd
sbb ebx, edx
in al, 0x96
pop esi
lcall 0x14ec, 0x1254d614
pop es
test dword [edx], 0xeaa682ee
sar dl, 1
retf 0xb8ea
adc eax, 0x7a5d2256
xor ebx, esi
cmc
arpl word [ecx - 0x43], cx
invalid
sub edi, eax
add eax, 0x43cf6bdd
in al, 0xbc
je 0xacde45
sahf
xor al, 0xd9
xchg esi, eax
xchg byte [ebx], dl
invalid
bsr cx, si
adc ch, 0x22
call int.00e469da
jmp 0xacde86
rcl cl, cl
inc ch
sal ecx, 0x12
add edx, eax
movzx cx, cl
test al, 0x12
shrd cx, si, 5
bsr ecx, esp
mov ecx, dword [esi + 0x7c]
push ebx
push ecx
add ecx, edx
mov byte [esp + 4], al
cmp di, 0x2cd2
push dword [esp]
call fcn.00ac257a
mov dword [ebp - 0x10], ecx
jmp 0xacdee6
inc si
rcr dl, 1
not dx
btr si, 0xd
mov esi, dword [eax + 0x3c]
call fcn.00e47177
Function at 0x4013c8
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40147c
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00401358
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x401455
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401488
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x4014a3
test ebp, ebp
je 0x4014a3
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4014ab
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x4014eb
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x401547
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x401542
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40152d
test dl, dl
je 0x401529
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40152d
add ecx, 2
add eax, 2
test dl, dl
jne 0x40150d
xor eax, eax
jmp 0x401532
sbb eax, eax
or eax, 1
test eax, eax
je 0x401551
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x4014fa
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x401568
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.004013c8
test eax, eax
jne 0x401580
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.00401488
mov esi, eax
test esi, esi
jne 0x4015b6
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x4015d0
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x4016c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.004013c8
mov esi, eax
test esi, esi
jne 0x4016e6
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.00401488
mov dword [esp + 0x18], eax
test eax, eax
je 0x4016de
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.00401488
mov dword [esp + 0x34], eax
test eax, eax
je 0x4016de
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.00401488
mov dword [esp + 0x28], eax
test eax, eax
je 0x4016de
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.00401488
mov dword [esp + 0x30], eax
test eax, eax
je 0x4016de
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x4018ad
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x4018ad
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x401810
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x401891
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x401833
movzx esi, ax
jmp 0x401838
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x401857
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x401866
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x4018ba
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x401828
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x4017ed
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x4018e3
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x4018e3
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x4018c8
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x4018f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.004013c8
mov esi, eax
test esi, esi
je 0x4019b4
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.00401488
mov ebp, eax
test ebp, ebp
je 0x4019b3
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.00401488
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x4019b3
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x4019b3
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4019b2
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x401998
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x401c31
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x401c41
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jle 0x401d4f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cwde
call fcn.00401d5f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5a4d
jne 0x401d4f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call fcn.00401d5f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4550
jne 0x401d4f
pop eax
push eax
mov eax, dword [eax + 0x7c]
call fcn.00401d5f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401d4f
pop eax
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push eax
mov eax, dword [eax + 0x20]
add eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
pop eax
mov eax, dword [eax + 0x18]
dec eax
mov dword [ebp - 4], eax
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x401d4c
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.00401d72
test eax, eax
je 0x401d3b
push ecx
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop ecx
leave
ret 8
push dword [ebp - 8]
call fcn.00401da6
add dword [ebp - 0xc], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x401cf6
add esp, 0xc
mov eax, 0
jmp 0x401d59
mov esp, ebp
pop ebp
ret 8
Function at 0x42eb8f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
test esi, esi
jne 0x42ebb4
xor eax, eax
jmp 0x42ebb9
mov eax, dword [esi + 4]
add eax, eax
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x461180
call fcn.0045f656
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x42ebef
push ebx
call fcn.0045f64a
add esp, 4
pop eax
mov dword [ebp - 4], eax
test esi, esi
je 0x42ebfc
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x42ec51
lea edx, [esi + 8]
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x42413938
mov dword [ebp - 8], 0x46454443
test edx, edx
je 0x42ec51
test eax, eax
je 0x42ec51
lea esi, [edx + ecx]
cmp edx, esi
jae 0x42ec51
nop
movzx ecx, byte [edx]
shr ecx, 4
inc edx
movzx ecx, byte [ebp + ecx - 0x14]
mov byte [eax], cl
movzx ecx, byte [edx - 1]
and ecx, 0xf
lea eax, [eax + 2]
movzx ecx, byte [ebp + ecx - 0x14]
mov byte [eax - 1], cl
cmp edx, esi
jb 0x42ec2d
pop esi
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x42f0a0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov edi, eax
mov eax, dword [esi + 4]
bswap eax
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp + 8], eax
mov eax, dword [ebx + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x42f0bf
mov ebx, dword [ebp + 8]
mov edx, 0xe3779b90
mov esi, 0x10
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shr ecx, 5
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
lea edx, [edx + 0x61c88647]
sub edi, ecx
sub esi, 1
jne 0x42f0db
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x432576
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov dword [ebp + 8], eax
mov ebx, dword [esi + 4]
bswap ebx
mov edi, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [edi + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x432593
mov edi, dword [ebp + 8]
xor edx, edx
lea esi, [edx + 0x20]
mov ecx, ebx
lea edx, [edx + 0x57e89147]
shr ecx, 5
mov eax, ebx
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add ebx, ecx
sub esi, 1
jne 0x4325aa
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43528b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov dword [ebp + 8], eax
mov ebx, dword [esi + 4]
bswap ebx
mov edi, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [edi + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x4352a8
mov edi, dword [ebp + 8]
xor edx, edx
lea esi, [edx + 0x10]
mov ecx, ebx
lea edx, [edx - 0x61c88647]
shr ecx, 5
mov eax, ebx
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add ebx, ecx
sub esi, 1
jne 0x4352bf
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x437e65
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x14
mov eax, dword [edx]
push ebx
mov dword [esp + 0x14], ecx
mov ebx, 0x10
mov ecx, dword [esp + 0x1c]
push ebp
push esi
mov esi, dword [edx + 4]
mov edx, dword [ecx + 4]
mov dword [esp + 0xc], edx
mov edx, dword [ecx]
mov ebp, dword [esp + 0xc]
mov dword [esp + 0x10], edx
mov edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
push edi
bswap esi
bswap eax
mov edi, 0x9e3779b9
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov edx, esi
mov ecx, esi
shr edx, 5
shl ecx, 4
add edx, ebp
add ecx, dword [esp + 0x14]
xor edx, ecx
lea ecx, [esi + edi]
xor edx, ecx
add eax, edx
mov edx, eax
mov ecx, eax
shl edx, 4
add edx, dword [esp + 0x18]
shr ecx, 5
add ecx, dword [esp + 0x1c]
xor edx, ecx
lea ecx, [eax + edi]
xor edx, ecx
lea edi, [edi - 0x61c88647]
add esi, edx
dec ebx
jne 0x437ea6
mov ebp, dword [esp + 0x20]
bswap esi
pop edi
bswap eax
mov dword [ebp + 4], esi
mov dword [ebp], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x456f88
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x456fab
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x456fab
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x456fb5
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x456ff7
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x457059
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x457054
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45703f
test dl, dl
je 0x45703b
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45703f
add ecx, 2
add eax, 2
test dl, dl
jne 0x45701f
xor eax, eax
jmp 0x457044
sbb eax, eax
or eax, 1
test eax, eax
je 0x457065
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x45700c
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x45e8ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x45e98f
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x45e98f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x45e98f
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x45e915
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x45e98f
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45e95a
test dl, dl
je 0x45e956
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45e95a
add ecx, 2
add eax, 2
test dl, dl
jne 0x45e93a
xor eax, eax
jmp 0x45e95f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x45e971
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x45e97c
inc esi
cmp esi, ebp
jae 0x45e98f
mov edx, dword [esp + 0x10]
jmp 0x45e930
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8

Function at 0x45ebf3
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x45ebfe
xor eax, eax
ret
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x40
jb 0x45ec12
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x45ec16
xor eax, eax
pop esi
ret
push edi
mov edi, dword [ecx + 0x3c]
lea eax, [edi + 0xf8]
cmp esi, eax
jb 0x45ec4f
cmp dword [edi + ecx], 0x4550
jne 0x45ec4f
mov eax, 0x14c
cmp word [edi + ecx + 4], ax
jne 0x45ec4f
test byte [edi + ecx + 0x16], 2
je 0x45ec4f
movzx eax, word [edi + ecx + 0x14]
mov edx, 0xe0
cmp ax, dx
jae 0x45ec54
pop edi
xor eax, eax
pop esi
ret
push ebx
add eax, 0xffffff20
movzx ebx, ax
add ebx, edi
movzx edi, word [edi + ecx + 6]
add ebx, ecx
xor edx, edx
test edi, edi
jle 0x45ec90
xor eax, eax
jmp 0x45ec73
lea eax, [eax + eax*4]
mov ecx, dword [ebx + eax*8 + 0x10c]
add ecx, dword [ebx + eax*8 + 0x108]
cmp ecx, esi
ja 0x45ec99
inc edx
movzx eax, dx
cmp eax, edi
jl 0x45ec73
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x45ec9f
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x10]
mov edi, dword [ebp + 0x30]
mov esi, dword [esp + 0x18]
movzx ebx, word [esi]
mov eax, ebx
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x45ecd7
add eax, 0x20
movzx edx, word [edi]
lea ecx, [edx - 0x41]
cmp ecx, 0x19
ja 0x45ece5
add edx, 0x20
cmp eax, edx
jne 0x45ecf6
test bx, bx
je 0x45ed2b
add esi, 2
add edi, 2
jmp 0x45ecc7
movzx ecx, word [esi]
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x45ed04
add ecx, 0x20
movzx edx, word [edi]
lea eax, [edx - 0x41]
cmp eax, 0x19
ja 0x45ed12
add edx, 0x20
sub ecx, edx
je 0x45ed2b
mov ebp, dword [ebp]
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x18], 0
jne 0x45ecc0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x45ed44
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x45ee1d
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x45ee1d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
je 0x45ee1d
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, ebx
mov esi, dword [eax + 0x1c]
sub ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
add esi, edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
cmp ecx, edx
ja 0x45eda3
mov eax, dword [esi + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov ebp, dword [eax + 0x18]
add edx, edi
add ecx, edi
xor esi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x45ee1d
mov eax, dword [edx + esi*4]
add eax, edi
mov ecx, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45ede8
test dl, dl
je 0x45ede4
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45ede8
add ecx, 2
add eax, 2
test dl, dl
jne 0x45edc8
xor eax, eax
jmp 0x45eded
sbb eax, eax
or eax, 1
test eax, eax
jne 0x45edff
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + esi*2]
cmp eax, dword [esp + 0x20]
jbe 0x45ee0a
inc esi
cmp esi, ebp
jae 0x45ee1d
mov edx, dword [esp + 0x10]
jmp 0x45edbe
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 8