joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e0e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45fc1c
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x1c]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
lea edx, [edi + 8]
mov dword [esi + 4], ecx
push edx
lea ecx, [esi + 8]
call dword [0x469ee4]
mov dword [esp + 0x14], 0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
movzx edx, byte [edi + 0x30]
mov byte [esi + 0x30], dl
movzx eax, byte [edi + 0x31]
mov byte [esi + 0x31], al
movzx ecx, byte [edi + 0x32]
mov byte [esi + 0x32], cl
movzx edx, byte [edi + 0x33]
mov byte [esi + 0x33], dl
movzx eax, byte [edi + 0x34]
mov byte [esi + 0x34], al
movzx ecx, byte [edi + 0x35]
mov byte [esi + 0x35], cl
movzx edx, byte [edi + 0x36]
mov byte [esi + 0x36], dl
movzx eax, byte [edi + 0x37]
mov byte [esi + 0x37], al
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
add edi, 0x40
push edi
lea ecx, [esi + 0x40]
mov dword [esi + 0x3c], edx
call dword [0x469ee4]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x41bec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x465304
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 0x4c]
mov dword [esp + 0x14], 4
call fcn.0041cca0
lea eax, [esi + 0x40]
mov byte [esp + 0x14], 3
call fcn.0041ca90
lea ebx, [esi + 0x30]
mov byte [esp + 0x14], 2
call fcn.00404490
lea ebx, [esi + 0x20]
mov byte [esp + 0x14], 1
call fcn.00404490
lea ebx, [esi + 0x10]
mov byte [esp + 0x14], 0
call fcn.00404490
mov eax, dword [esi + 4]
test eax, eax
je 0x41bf3a
push eax
call fcn.0045cfa4
add esp, 4
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x429960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x467fcb
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x49001c]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x7c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x90]
mov edi, dword [esp + 0x8c]
xor ebp, ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
xor ebx, ebx
mov eax, dword [edi + 0x2fc]
test eax, eax
je 0x429b32
mov ecx, dword [edi + 0x300]
sub ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jae 0x429b32
mov eax, dword [edi + 0x2fc]
test eax, eax
je 0x429a06
mov ecx, dword [edi + 0x300]
sub ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0x429a0c
call dword [0x469f94]
mov esi, dword [edi + 0x2fc]
mov eax, dword [esp + 0x18]
push eax
add esi, ebx
push esi
call dword [0x469eec]
add esp, 8
test al, al
jne 0x429a91
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
cmp edx, dword [esi + 0x3c]
jne 0x429a91
sub esp, 0x1c
lea eax, [esi + 0x78]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
push ecx
call dword [0x4691a8]
lea edx, [esp + 0x80]
add esp, 8
push edx
call dword [0x469194]
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0x80]
push ecx
mov dword [esp + 0xac], 0
call dword [0x469ef4]
add esp, 0x28
test al, al
jne 0x429a9f
lea ecx, [esp + 0x5c]
mov dword [esp + 0x84], 0xffffffff
call dword [0x469f00]
add ebp, 1
add ebx, 0xb0
jmp 0x4299b0
push 0
mov ecx, esi
call fcn.00427270
push 0x46a2ac
lea ecx, [esp + 0x44]
call dword [0x469efc]
push 0x46a2ac
lea ecx, [esp + 0x28]
mov byte [esp + 0x88], 1
call dword [0x469efc]
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x40]
push edx
mov byte [esp + 0x88], 2
mov edx, dword [ecx]
push eax
push edx
push 4
lea edx, [esp + 0x34]
mov ecx, edi
call fcn.00428840
lea ecx, [esp + 0x24]
mov byte [esp + 0x84], 1
call dword [0x469f00]
lea ecx, [esp + 0x40]
mov byte [esp + 0x84], 0
call dword [0x469f00]
lea ecx, [esp + 0x5c]
mov dword [esp + 0x84], 0xffffffff
call dword [0x469f00]
jmp 0x429b46
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.00429b70
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0045cf88
add esp, 0x74
ret 0xc
Function at 0x432240
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movzx edx, byte [ecx + 0x210]
movzx eax, byte [ecx + 0x211]
xor eax, edx
xor eax, dword [ecx + 4]
mov edx, 0xd
xor eax, dword [ecx]
add ecx, 8
push esi
mov edi, edi
mov esi, dword [ecx + 0x10]
xor esi, dword [ecx + 0xc]
add ecx, 0x14
xor esi, dword [ecx - 0xc]
xor esi, dword [ecx - 0x10]
xor esi, dword [ecx - 0x14]
xor eax, esi
sub edx, 1
jne 0x432260
pop esi
ret

Function at 0x4324a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x463b7f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
xor ebx, ebx
lea ebp, [edi + 0x14]
mov ecx, ebp
mov byte [edi], bl
mov dword [edi + 4], ebx
mov byte [edi + 8], bl
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0xffffffff
call dword [0x469ef8]
mov dword [esp + 0x38], ebx
mov byte [edi + 0x30], 1
call fcn.004340e0
mov dword [edi + 0x38], eax
mov byte [eax + 0x2d], 1
mov eax, dword [edi + 0x38]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x38]
mov dword [eax], eax
mov eax, dword [edi + 0x38]
mov dword [eax + 8], eax
mov dword [edi + 0x3c], ebx
mov byte [esp + 0x38], 1
mov esi, dword [0x469160]
lea ecx, [edi + 0x40]
call esi
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
lea ecx, [edi + 0x54]
mov byte [esp + 0x38], 3
call esi
lea ecx, [edi + 0x58]
mov byte [esp + 0x38], 4
call esi
mov bl, 5
mov byte [esp + 0x38], bl
call dword [0x469e38]
push eax
call dword [0x469f98]
add esp, 4
lea esi, [esp + 0x14]
call fcn.00432f40
push eax
mov ecx, ebp
mov byte [esp + 0x3c], 6
call dword [0x469f04]
mov ecx, esi
mov byte [esp + 0x38], bl
call dword [0x469f00]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
Function at 0x434760
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x460e2b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x49001c]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xa0], ebx
mov esi, ecx
push str.00000000000000
mov ecx, edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x14], ebx
call dword [0x469efc]
mov dword [esp + 0xa0], ebx
cmp byte [esi + 0xc], bl
mov dword [esp + 0x10], 1
jne 0x434800
mov eax, dword [esi + 8]
mov ecx, eax
and ecx, 0x20006
cmp ecx, 0x20006
sete dl
mov ecx, esi
push edx
push eax
push 0x470188
push 0x80000001
call dword [0x469380]
cmp al, bl
mov byte [esi + 0xc], al
je 0x434942
lea ecx, [esp + 0x40]
call dword [0x469ef8]
lea eax, [esp + 0x40]
push eax
push str.Time
mov ecx, esi
mov dword [esp + 0xa8], 1
call dword [0x469374]
test al, al
je 0x434931
cmp dword [esp + 0x54], 0x14
lea ecx, [esp + 0x40]
jne 0x434935
push 0xa
push ecx
lea edx, [esp + 0x80]
push edx
call dword [0x469590]
push 0xa
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x70]
push ecx
mov byte [esp + 0xb8], 2
call dword [0x469594]
add esp, 0x18
mov byte [esp + 0xa0], 3
cmp dword [esp + 0x90], 8
mov eax, dword [esp + 0x7c]
jae 0x434886
lea eax, [esp + 0x7c]
mov esi, dword [0x46907c]
push ebx
push eax
call esi
add esp, 8
cmp dword [esp + 0x74], 8
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x60]
jae 0x4348a6
lea eax, [esp + 0x60]
push ebx
push eax
call esi
add esp, 8
lea edx, [esp + 0x30]
mov dword [esp + 0x24], eax
push edx
lea eax, [esp + 0x28]
push eax
call dword [0x469e58]
test eax, eax
je 0x43490d
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x34]
push edx
push ebx
call dword [0x469e54]
test eax, eax
je 0x43490d
movzx eax, word [esp + 0x20]
movzx ecx, word [esp + 0x1e]
movzx edx, word [esp + 0x1c]
push eax
movzx eax, word [esp + 0x1e]
push ecx
movzx ecx, word [esp + 0x1e]
push edx
movzx edx, word [esp + 0x20]
push eax
push ecx
push edx
push str._04d_02d_02d_02d_02d_02d
push edi
call dword [0x4695d4]
add esp, 0x20
lea ecx, [esp + 0x5c]
mov byte [esp + 0xa0], 2
call dword [0x469f00]
lea ecx, [esp + 0x78]
mov byte [esp + 0xa0], 1
call dword [0x469f00]
lea ecx, [esp + 0x40]
mov byte [esp + 0xa0], bl
call dword [0x469f00]
mov eax, edi
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.0045cf88
add esp, 0x98
ret
Function at 0x435380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x460d33
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x49001c]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.00435430
mov esi, 1
mov dword [esp + 0x38], esi
cmp dword [esp + 0x24], 0
je 0x4353f2
push str.link.ini
lea ecx, [esp + 0x14]
call dword [0x469ee0]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call dword [0x469ee4]
jmp 0x4353ff
push 0x46a2ac
mov ecx, edi
call dword [0x469efc]
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
mov byte [esp + 0x38], 0
call dword [0x469f00]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0045cf88
add esp, 0x34
ret

Function at 0x435430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x460d33
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x49001c]
xor eax, esp
mov dword [esp + 0x24], eax
push edi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
call dword [0x469398]
add esp, 4
mov dword [esp + 0x38], 1
cmp dword [esp + 0x24], 0
je 0x4354c6
mov edi, dword [0x4692f4]
call edi
lea ecx, [esp + 0x10]
push eax
call dword [0x469f28]
push str.Kuai8
lea ecx, [esp + 0x14]
call dword [0x469ee0]
call edi
lea ecx, [esp + 0x10]
push eax
call dword [0x469f28]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call dword [0x469ee4]
jmp 0x4354d3
push 0x46a2ac
mov ecx, esi
call dword [0x469efc]
lea ecx, [esp + 0x10]
mov dword [esp + 8], 1
mov byte [esp + 0x38], 0
call dword [0x469f00]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0045cf88
add esp, 0x34
ret

Function at 0x435510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x460d33
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x49001c]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.00435430
mov esi, 1
mov dword [esp + 0x38], esi
cmp dword [esp + 0x24], 0
je 0x435593
call dword [0x4692f4]
lea ecx, [esp + 0x10]
push eax
call dword [0x469f28]
push str.register.ini
lea ecx, [esp + 0x14]
call dword [0x469ee0]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call dword [0x469ee4]
jmp 0x4355a0
push 0x46a2ac
mov ecx, edi
call dword [0x469efc]
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
mov byte [esp + 0x38], 0
call dword [0x469f00]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0045cf88
add esp, 0x34
ret
Function at 0x4355e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x460d33
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x49001c]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea esi, [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
call fcn.00435430
mov esi, 1
mov dword [esp + 0x38], esi
cmp dword [esp + 0x24], 0
je 0x435663
call dword [0x4692f4]
lea ecx, [esp + 0x10]
push eax
call dword [0x469f28]
push str.Icons
lea ecx, [esp + 0x14]
call dword [0x469ee0]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call dword [0x469ee4]
jmp 0x435670
push 0x46a2ac
mov ecx, edi
call dword [0x469efc]
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
mov byte [esp + 0x38], 0
call dword [0x469f00]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0045cf88
add esp, 0x34
ret

Function at 0x435b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x460b4c
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push edi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x54], ebx
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
call fcn.00435d30
mov dword [esp + 0x54], ebx
push str.K8BugReport.exe
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 1
call dword [0x469efc]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
push edi
push ecx
mov dword [esp + 0x60], 1
call dword [0x46938c]
add esp, 0xc
push eax
mov ecx, edi
mov byte [esp + 0x58], 2
call dword [0x469f04]
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 1
call dword [0x469f00]
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], bl
call dword [0x469f00]
mov eax, edi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x4c
ret

Function at 0x435d30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x460b93
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x49001c]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 8], 0
cmp byte [0x4913e0], 0
mov dword [esp + 0xc], edi
jne 0x435d7d
mov esi, edi
call fcn.00434ce0
jmp 0x435db1
lea esi, [esp + 0x10]
call fcn.00434ce0
lea eax, [esp + 0x10]
push eax
mov esi, 1
push edi
mov dword [esp + 0x40], esi
call dword [0x4691c8]
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
mov byte [esp + 0x38], 0
call dword [0x469f00]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0045cf88
add esp, 0x34
ret
Function at 0x435dd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x460b4c
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x54], ebx
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
call fcn.00435430
mov dword [esp + 0x54], ebx
push str.website.ini
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 1
call dword [0x469efc]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
push esi
push ecx
mov dword [esp + 0x60], 1
call dword [0x46938c]
add esp, 0xc
push eax
mov ecx, esi
mov byte [esp + 0x58], 2
call dword [0x469f04]
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 1
call dword [0x469f00]
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], bl
call dword [0x469f00]
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x4c
ret

Function at 0x435e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x460b01
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
mov ecx, 0x491518
mov dword [esp + 8], 0x491510
mov byte [0x491510], bl
mov word [0x491512], bx
mov byte [0x491514], bl
mov byte [0x491515], bl
mov byte [0x491516], bl
call dword [0x469ef8]
mov dword [esp + 0x30], ebx
push 0x46a2ac
mov ecx, 0x49153c
mov byte [0x491534], 1
mov dword [0x491538], ebx
call dword [0x469efc]
mov byte [esp + 0x30], 1
lea ecx, [esp + 0xc]
mov byte [0x491558], bl
mov byte [0x491559], 1
call fcn.00435270
push eax
mov ecx, 0x491518
mov byte [esp + 0x34], 2
call dword [0x469f04]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call dword [0x469f00]
mov eax, 0x491510
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x2c
ret
Function at 0x43e640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45e359
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49001c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebp
push edi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x14]
lea eax, [eax + eax*4]
add eax, eax
test eax, eax
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
mov dword [esi + 0x214], eax
jge 0x43e694
fadd dword [0x473ed8]
fdiv qword [0x473ed0]
fmul qword [0x473ec8]
fadd qword [0x473ec0]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fst dword [esi + 0x218]
fld1
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x43e6c9
fstp dword [esi + 0x218]
jmp 0x43e6cb
fstp st(0)
lea ecx, [esp + 0x10]
call dword [0x469ef8]
mov dword [esp + 0x38], 0
fld dword [esi + 0x218]
sub esp, 8
fstp qword [esp]
lea ecx, [esp + 0x18]
push str._.1f
push ecx
call dword [0x4695d4]
mov ebp, dword [0x469668]
add esp, 0x10
lea edi, [esi + 0x24]
push 0x6a
mov ecx, edi
call ebp
test eax, eax
je 0x43e727
mov byte [esi + 0x226], 1
mov edx, dword [eax]
mov edx, dword [edx + 0x170]
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call edx
push 0x69
mov ecx, edi
call ebp
mov edi, eax
test edi, edi
je 0x43e76b
fld1
mov ecx, edi
fcomp dword [esi + 0x218]
fnstsw ax
test ah, 1
mov eax, dword [edi]
mov edx, dword [eax + 0x124]
jne 0x43e767
push 0
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x2d0]
push 0
mov ecx, edi
call edx
mov byte [esi + 0x225], 0
jmp 0x43e76b
push 1
call edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call dword [0x469f00]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0045cf88
add esp, 0x30
ret 4
Function at 0x440960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x467109
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x49001c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call dword [0x469ef8]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0043f160
test al, al
je 0x4409d9
lea esi, [esp + 0xc]
call fcn.00440870
mov ecx, esi
mov bl, al
mov dword [esp + 0x38], 0xffffffff
call dword [0x469f00]
mov al, bl
jmp 0x4409ed
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call dword [0x469f00]
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0045cf88
mov esp, ebp
pop ebp
ret
Function at 0x4422b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x45e20d
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x49001c]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
push ebp
push edi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
cmp dword [esi + 0x14], 0
je 0x442460
lea ecx, [esp + 0x10]
call dword [0x469274]
mov dword [esp + 0x88], 0
mov al, 0x61
mov byte [esp + 0x6e], al
mov byte [esp + 0x72], al
mov al, 0x73
mov byte [esp + 0x73], al
mov byte [esp + 0x74], al
push 0xd
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x74], 0x4b
mov byte [esp + 0x75], 0x75
mov byte [esp + 0x77], 0x69
mov byte [esp + 0x78], 0x38
mov byte [esp + 0x79], 0x50
mov byte [esp + 0x7d], 0x77
mov byte [esp + 0x7e], 0x6f
mov byte [esp + 0x7f], 0x72
mov byte [esp + 0x80], 0x64
call dword [0x469264]
lea ecx, [esp + 0x50]
push esi
push ecx
call dword [0x4691a8]
add esp, 8
mov byte [esp + 0x88], 1
mov edx, dword [esp + 0x64]
push edx
lea ecx, [esp + 0x14]
call dword [0x46925c]
push eax
lea ecx, [esp + 0x1c]
call dword [0x4692e0]
mov byte [esp + 0x88], 2
cmp dword [esp + 0x68], 0x10
mov ebp, dword [esp + 0x64]
mov ebx, dword [esp + 0x54]
jae 0x4423a4
lea ebx, [esp + 0x54]
mov edi, dword [0x469168]
lea ecx, [esp + 0x18]
call edi
push eax
push ebp
push ebx
lea ecx, [esp + 0x1c]
call dword [0x469254]
lea ecx, [esp + 0x28]
mov ebp, eax
call dword [0x469284]
mov bl, 3
push ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x8c], bl
call edi
push eax
lea ecx, [esp + 0x30]
call dword [0x469278]
push eax
lea eax, [esp + 0x38]
push eax
call dword [0x469100]
add esp, 8
push eax
mov ecx, esi
mov byte [esp + 0x8c], 4
call dword [0x469f04]
lea ecx, [esp + 0x34]
mov byte [esp + 0x88], bl
call dword [0x469f00]
lea ecx, [esp + 0x28]
mov byte [esp + 0x88], 2
call dword [0x46927c]
lea ecx, [esp + 0x18]
mov byte [esp + 0x88], 1
call dword [0x4690b8]
lea ecx, [esp + 0x50]
mov byte [esp + 0x88], 0
call dword [0x469ed4]
lea ecx, [esp + 0x10]
mov dword [esp + 0x88], 0xffffffff
call dword [0x46926c]
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.0045cf88
add esp, 0x7c
ret
Function at 0x442490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x45e1ad
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x49001c]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push ebp
push esi
mov eax, dword [0x49001c]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [edi + 0x14], ebx
je 0x442674
lea ecx, [esp + 0x18]
call dword [0x469274]
mov dword [esp + 0x90], ebx
mov al, 0x61
mov byte [esp + 0x76], al
mov byte [esp + 0x7a], al
mov al, 0x73
mov byte [esp + 0x7b], al
mov byte [esp + 0x7c], al
push 0xd
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x7c], 0x4b
mov byte [esp + 0x7d], 0x75
mov byte [esp + 0x7f], 0x69
mov byte [esp + 0x80], 0x38
mov byte [esp + 0x81], 0x50
mov byte [esp + 0x85], 0x77
mov byte [esp + 0x86], 0x6f
mov byte [esp + 0x87], 0x72
mov byte [esp + 0x88], 0x64
call dword [0x469264]
lea ecx, [esp + 0x58]
push edi
push ecx
call dword [0x4691a8]
add esp, 8
lea ecx, [esp + 0x20]
mov byte [esp + 0x90], 1
call dword [0x469284]
mov byte [esp + 0x90], 2
cmp dword [esp + 0x70], 0x10
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], ebx
jae 0x442580
lea eax, [esp + 0x5c]
mov ecx, dword [esp + 0x6c]
lea edx, [esp + 0x14]
push edx
push ecx
push eax
lea ecx, [esp + 0x2c]
call dword [0x469270]
mov ebp, eax
cmp ebp, ebx
je 0x44263c
mov edx, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
call dword [0x46925c]
lea esi, [eax + 1]
push esi
lea ecx, [esp + 0x30]
call dword [0x4692e0]
push esi
mov byte [esp + 0x94], 3
mov esi, dword [0x469168]
push ebx
lea ecx, [esp + 0x34]
call esi
push eax
call fcn.0045d8d0
add esp, 0xc
lea ecx, [esp + 0x2c]
call esi
push eax
mov eax, dword [esp + 0x18]
push eax
push ebp
lea ecx, [esp + 0x24]
call dword [0x46924c]
lea ecx, [esp + 0x2c]
call esi
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [0x469100]
add esp, 8
push eax
mov ecx, edi
mov byte [esp + 0x94], 4
call dword [0x469f04]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x90], 3
call dword [0x469f00]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x90], 2
call dword [0x4690b8]
lea ecx, [esp + 0x20]
mov byte [esp + 0x90], 1
call dword [0x46927c]
lea ecx, [esp + 0x58]
mov byte [esp + 0x90], bl
call dword [0x469ed4]
lea ecx, [esp + 0x18]
mov dword [esp + 0x90], 0xffffffff
call dword [0x46926c]
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.0045cf88
add esp, 0x84
ret