joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417ce5
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x8c
lea esi, [ebp - 0x1c]
mov dword [esi - 8], esp
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 8], 0x44ca54
mov dword [esi + 4], 0x422210
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
mov eax, dword fs:[0x30]
mov cl, byte [eax + 2]
mov byte [ebp - 0x25], cl
mov dword [ebp - 0x2c], eax
mov byte [eax + 2], 1
xor ebx, ebx
lea edi, [ebp - 0x98]
push 0x68
push ebx
push edi
call fcn.00425300
add esp, 0xc
mov eax, 0x40000000
mov dword [edi + 0xc], eax
mov dword [edi + 0x40], eax
mov dword [esi + 0xc], ebx
push edi
call dword [0x44c060]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x2c]
mov cl, byte [ebp - 0x25]
mov byte [eax + 2], cl
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword fs:[0], eax
mov eax, edx
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x417dae
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push edi
push esi
sub esp, 0x404
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
lea edi, [esp + 2]
push 0x200
push edi
push dword [eax + 8]
call dword [0x44c020]
xor esi, esi
push esi
push esi
push 3
push esi
push esi
push 0x80000000
push edi
call dword [0x44bf98]
cmp eax, 0xffffffff
je 0x417df7
push eax
call dword [0x44bf90]
jmp 0x417dfa
xor esi, esi
inc esi
mov eax, esi
add esp, 0x404
pop esi
pop edi
ret
Function at 0x418d95
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
push edi
push esi
sub esp, 0x2c
lea eax, [esp + 0xc]
mov dword [eax + 7], 0x6c6c64
mov dword [eax + 4], 0x642e6269
mov dword [eax], 0x6c746c66
push eax
call dword [0x44c08c]
mov dword [esp], eax
mov dword [esp + 4], 0x75f88081
mov eax, 0x75f88081
lea edi, [esp + 8]
lea ebx, [esp + 0x18]
cmp eax, 0x3d824cb1
je 0x418de9
cmp eax, 0x75f88081
je 0x418e3f
cmp eax, 0xb89fcf18
jne 0x418dd2
jmp 0x418e51
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0xed6e8d60
push 0xbb414079
push dword [eax + 8]
call fcn.00418f7c
push edi
push 0
push 1
push 0xa
call eax
push 0x75e46254
push 0xf75237e3
push dword [esp + 8]
call fcn.00418f7c
mov esi, eax
push 0x14
push 0x44461c
push ebx
call fcn.00424800
add esp, 0xc
push ebx
call esi
mov eax, 0xb89fcf18
jmp 0x418dd2
cmp dword [esp], 0
mov eax, 0xb89fcf18
je 0x418dd2
mov eax, 0x3d824cb1
jmp 0x418dd2
mov dword [esp + 4], eax
add esp, 0x2c
pop esi
pop edi
pop ebx
ret

Function at 0x418e5c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0xa5b5aa68
push 0xf9f77cc3
push dword [eax + 8]
call fcn.00418f7c
push 0
push 0xffffffffffffffff
call eax
ret

Function at 0x418eba
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 4]
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
mov edx, dword [ecx + 0xc]
mov ecx, dword [edx + 0x18]
mov edx, dword [edx + 0x20]
add edx, ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], esp
mov esi, dword [ebp - 0x10]
sub eax, esi
add eax, 0xfffffff8
cmp eax, 4
jae 0x418f59
mov eax, dword fs:[0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
lea ecx, [eax + edx]
movzx esi, word [eax + edx + 0x14]
add ecx, esi
add ecx, 0x18
movzx edx, word [eax + edx + 6]
test edx, edx
je 0x418f31
lea esi, [edx + edx*4]
lea esi, [ecx + esi*8]
test byte [ecx + 0x27], 0x20
jne 0x418f31
add ecx, 0x28
dec edx
jne 0x418f23
mov ecx, esi
add eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
add ecx, eax
push ecx
push eax
call fcn.00419bf9
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
sub esp, 0xa0
jmp edx
shr eax, 2
dec eax
xor edi, edi
mov ebx, dword [esi + edi*4]
cmp ebx, ecx
jbe 0x418f71
cmp ebx, edx
ja 0x418f71
mov dword [esi + edi*4], 0
cmp eax, edi
je 0x418efb
mov esi, dword [ebp - 0x10]
inc edi
jmp 0x418f5f
Function at 0x419860
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, eax
sar edx, 0x1f
shr edx, 0x1c
add edx, eax
add eax, 0xf
cmp eax, 0x1f
mov dword [esp], edx
jae 0x419895
mov edi, ebx
mov ebp, ebx
mov esi, ebx
mov edx, ebx
jmp 0x419978
mov eax, edx
sar eax, 4
mov edx, ebx
lea ebx, [ecx + 0xc]
mov esi, edx
mov ebp, edx
mov edi, edx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov eax, dword [ebx - 0xc]
imul edi, eax, 0x239b961b
imul eax, eax, 0xcb0d8000
shr edi, 0x11
or edi, eax
mov eax, dword [ebx - 8]
imul ebp, edi, 0xab0e9789
xor ebp, edx
imul edi, eax, 0xab0e9789
imul eax, eax, 0x97890000
shr edi, 0x10
or edi, eax
mov eax, dword [ebx - 4]
rol ebp, 0x13
add ebp, esi
imul edi, edi, 0x38b34ae5
xor edi, esi
imul esi, eax, 0x38b34ae5
imul eax, eax, 0x95ca0000
shr esi, 0xf
or esi, eax
mov ecx, dword [ebx]
rol edi, 0x11
mov edx, dword [esp + 8]
add edi, edx
imul eax, esi, 0xa1e38b93
xor eax, edx
imul esi, ecx, 0xa1e38b93
imul ecx, ecx, 0x2e4c0000
shr esi, 0xe
or esi, ecx
rol eax, 0xf
mov edx, dword [esp + 0xc]
add eax, edx
imul ecx, esi, 0x239b961b
xor ecx, edx
rol ecx, 0xd
lea esi, [ebp*4]
add esi, ebp
lea ecx, [ecx + esi + 0x561ccd1b]
lea edx, [ebp + ebp*4 + 0x561ccd1b]
lea esi, [edi + edi*4 + 0xbcaa747]
lea ebp, [eax + eax*4]
add ebp, 0x96cd1c35
mov eax, dword [esp + 4]
lea edi, [ecx + ecx*4]
add edi, 0x32ac3b17
add ebx, 0x10
dec eax
jne 0x4198a5
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x28]
and ebx, 0xf
dec ebx
cmp ebx, 0xe
ja 0x419b82
mov eax, dword [esp]
and eax, 0xfffffff0
xor edx, edx
mov ecx, dword [esp + 0x24]
mov dword [esp], eax
jmp dword [ebx*4 + 0x444630]
mov eax, dword [esp + 0x28]
xor ecx, eax
xor esi, eax
xor ebp, eax
xor edi, eax
lea eax, [edi + ebp]
add eax, esi
add eax, ecx
add esi, eax
add ebp, eax
add edi, eax
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
imul eax, ecx, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae35
mov edx, eax
shr edx, 0x10
xor edx, eax
mov eax, esi
shr eax, 0x10
xor eax, esi
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae35
mov esi, eax
shr esi, 0x10
xor esi, eax
mov eax, ebp
shr eax, 0x10
xor eax, ebp
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, edi
shr eax, 0x10
xor eax, edi
imul eax, eax, 0x85ebca6b
mov edi, eax
shr edi, 0xd
xor edi, eax
imul edi, edi, 0xc2b2ae35
mov eax, edi
shr eax, 0x10
xor eax, edi
add edx, esi
add edx, ecx
add edx, eax
add esi, edx
add ecx, edx
add eax, edx
mov edi, dword [esp + 0x30]
mov dword [edi], edx
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 4]
jmp 0x419ac2
Function at 0x419b8b
Capabilities:
Access peb ldr_data

Disassembly:
cmp byte [0x44eb4c], 0
jne 0x419bc5
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
push 0x67b0735f
push 0x80d4b146
push dword [eax + 8]
call fcn.00418f7c
mov dword [0x44eb54], eax
rdtsc
mov dword [0x44eb50], eax
mov byte [0x44eb4c], 1
push 0x44eb50
call dword [0x44eb54]
xor dword [0x44eb50], eax
ret
Function at 0x41b678
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
lea esi, [ebp - 0x54]
xor edi, edi
inc edi
push esi
push edi
call fcn.004127ea
add esp, 8
push esi
call fcn.00419c24
add esp, 4
push esi
call fcn.00412c78
add esp, 4
lea esi, [ebp - 0x4c]
push esi
push edi
call fcn.004127ea
add esp, 8
push esi
call fcn.0041a444
add esp, 4
push esi
call fcn.00412c78
add esp, 4
lea esi, [ebp - 0x44]
push esi
push 3
call fcn.004127ea
add esp, 8
push esi
call fcn.0041a9d7
add esp, 4
push esi
call fcn.00412c78
add esp, 4
lea esi, [ebp - 0x3c]
push esi
push edi
call fcn.004127ea
add esp, 8
push esi
call fcn.0041a9ee
add esp, 4
push esi
call fcn.00412c78
add esp, 4
mov eax, dword [ebp + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0xd], al
mov dword [ebp - 0x20], 0x5dedafa5
mov eax, 0x5dedafa5
mov esi, dword [ebp - 0x24]
cmp eax, 0xd9c24c6a
jg 0x41b750
cmp eax, 0xa4abf61e
jle 0x41b77f
cmp eax, 0xa4abf61f
je 0x41b83d
cmp eax, 0xaf060bc1
je 0x41b811
cmp eax, 0xb7b72d4c
jne 0x41b71e
mov eax, 0xa17e0551
jmp 0x41b71e
cmp eax, 0x46c67a23
jle 0x41b79f
cmp eax, 0x46c67a24
je 0x41b7d3
cmp eax, 0x57876763
je 0x41b824
cmp eax, 0x5dedafa5
jne 0x41b71e
mov cl, byte [ebp - 0xd]
mov eax, 0xaf060bc1
cmp cl, 0xcc
je 0x41b71e
jmp 0x41b7c9
cmp eax, 0x954ddf29
je 0x41b7fa
cmp eax, 0x9c46e6b9
jne 0x41b85f
add esi, 0x52
push esi
call fcn.0041a9d7
add esp, 4
jmp 0x41b7c9
cmp eax, 0xd9c24c6b
je 0x41b846
cmp eax, 0xdb0bbc46
jne 0x41b71e
add esi, 0x27e
mov eax, 0x46c67a24
cmp esi, 0x25
jge 0x41b71e
mov eax, 0x954ddf29
jmp 0x41b71e
imul eax, esi, 0x16ce
shr eax, 0x1b
imul esi, eax, 0xa9
mov eax, 0x954ddf29
cmp esi, 0x34
jae 0x41b71e
mov eax, 0x9c46e6b9
jmp 0x41b71e
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
cmp eax, 0xcd03
je 0x41b824
movzx eax, ax
cmp eax, 0xf0b
jne 0x41b83d
mov dword [ebp - 0x1c], esi
popal
jmp 0x41b815
imul eax, dword [ebp - 0x14], 0x13a00
add eax, 0x1203e91
mov dword [ebp - 0x14], eax
mov eax, 0xaf060bc1
jmp 0x41b71e
imul eax, dword [ebp - 0x14], 0x84e4
jmp 0x41b852
imul eax, dword [ebp - 0x14], 0x1b8000
add eax, 0xfffdc000
mov dword [ebp - 0x14], eax
mov eax, 0xb7b72d4c
jmp 0x41b71e
cmp eax, 0xa17e0551
jne 0x41b71e
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esi
lea esi, [ebp - 0x34]
push esi
xor edi, edi
inc edi
push edi
call fcn.004127ea
add esp, 8
push esi
call fcn.0041ae2a
add esp, 4
push esi
call fcn.00412c78
add esp, 4
lea esi, [ebp - 0x2c]
push esi
push edi
call fcn.004127ea
add esp, 8
push esi
call fcn.0041b337
add esp, 4
push esi
call fcn.00412c78
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41c5e2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 8]
ret
Function at 0x41c5f4
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], 0xec1ae820
mov eax, 0xec1ae820
cmp eax, 0x25e6dbdd
jle 0x41c650
cmp eax, 0x25e6dbde
je 0x41c6ad
cmp eax, 0x6bc14ec9
je 0x41c646
cmp eax, 0x74d3974c
jne 0x41c609
mov ecx, dword [ebp - 0x18]
movzx ecx, word [ecx]
cmp ecx, 0xcd03
je 0x41c6ad
movzx ecx, cx
cmp ecx, 0xf0b
jne 0x41c702
popal
jmp 0x41c647
cmp eax, 0xdbb36fbb
je 0x41c6c7
cmp eax, 0xec1ae820
jne 0x41c6f7
push 2
push 0x104
call fcn.0042bc6e
add esp, 8
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
push dword [ebp - 0x14]
mov esi, dword [0x44c104]
call esi
push 0x445b7e
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0xcc
mov eax, 0x6bc14ec9
je 0x41c609
mov eax, 0x74d3974c
jmp 0x41c609
imul eax, dword [ebp - 0x10], 0x95000
add eax, 0xffffff92
shr eax, 4
mov dword [ebp - 0x10], eax
mov eax, 0x6bc14ec9
jmp 0x41c609
mov ecx, dword [ebp - 0x10]
shr ecx, 3
imul eax, ecx, 0x8a9a
imul ecx, ecx
imul edx, ecx, 0x283
dec edx
mov dword [ebp - 0x10], eax
mov eax, 0x6bc14ec9
cmp ecx, edx
je 0x41c609
mov eax, 0xb9a360cd
jmp 0x41c609
cmp eax, 0xb9a360cd
jne 0x41c609
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
call fcn.004090a1
add esp, 4
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41cba0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x18], 0x8df67443
mov eax, 0x8df67443
mov ebx, dword [ebp - 0x20]
cmp eax, 0xcc362a7c
jg 0x41cbfb
cmp eax, 0xa64c72d1
jg 0x41cc1a
cmp eax, 0x8df67443
je 0x41cc85
cmp eax, 0x901d2ac4
jne 0x41cbb8
imul ebx, ebx, 0x2580
add ebx, 0xa4100
mov eax, 0x25574862
cmp ebx, 0xd01
jae 0x41cbf6
mov eax, 0xdcf2ba7d
shr ebx, 7
jmp 0x41cbb8
cmp eax, 0xde8dcad0
jg 0x41cc63
cmp eax, 0xcc362a7d
je 0x41ccd9
cmp eax, 0xdcf2ba7d
je 0x41cd2d
jmp 0x41cbb8
cmp eax, 0xa64c72d2
je 0x41cd14
cmp eax, 0xbc090d02
jne 0x41cbb8
mov ecx, dword [ebp - 0x1c]
add ecx, 0xd
mov eax, ecx
and eax, 0x3ffff
imul ecx, ecx
imul edx, ecx, 0x5bdd
dec edx
imul eax, eax, 0x4ce0
mov dword [ebp - 0x1c], eax
mov eax, 0xcc362a7d
cmp edx, ecx
je 0x41cbb8
mov eax, 0xde8dcad1
jmp 0x41cbb8
cmp eax, 0x25574862
jne 0x41cd40
shl ebx, 0xb
add ebx, 0xfffba089
push ebx
call fcn.0041c5f4
add esp, 4
jmp 0x41cd0a
mov edi, dword [ebp + 0xc]
push edi
push 0x445b90
mov esi, dword [ebp + 8]
push esi
call fcn.0041c721
add esp, 0xc
push edi
push 0x445ba0
push esi
call fcn.0041c721
add esp, 0xc
push edi
push 0x445bb2
push esi
call fcn.0041c721
add esp, 0xc
mov eax, dword [ebp + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0xcc
mov eax, 0xdcf2ba7d
je 0x41cbb8
mov eax, 0xa64c72d2
jmp 0x41cbb8
imul ebx, ebx, 0x74d0
add ebx, 0xfffcb11c
push ebx
call fcn.0041c5f4
add esp, 4
push ebx
push 0x435d
call fcn.0041cba0
add esp, 8
mov eax, 0x901d2ac4
cmp ebx, 2
jge 0x41cbb8
mov eax, 0xdcf2ba7d
jmp 0x41cbb8
mov ecx, dword [ebp - 0x10]
movzx ecx, word [ecx]
cmp ecx, 0xf0b
je 0x41cd2d
movzx ecx, cx
cmp ecx, 0xcd03
jne 0x41cd4b
mov dword [ebp - 0x14], ebx
popal
jmp 0x41cd31
cmp eax, 0xde8dcad1
jne 0x41cbb8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], ebx
mov edi, dword [ebp + 0xc]
push edi
push 0x445bd8
mov esi, dword [ebp + 8]
push esi
call fcn.0041c721
add esp, 0xc
push edi
push 0x445bf6
push esi
call fcn.0041c721
add esp, 0xc
push edi
push 0x445c0e
push esi
call fcn.0041c721
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41dce7
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x28], 0x30dfb435
mov eax, 0x30dfb435
mov edi, dword [ebp - 0x2c]
cmp eax, 0x39fbe174
jg 0x41dd41
cmp eax, 0xe417845b
jg 0x41dd7d
cmp eax, 0x8172cf31
je 0x41deb7
cmp eax, 0xafff14e8
je 0x41dee7
cmp eax, 0xe2d11378
jne 0x41dcff
shr edi, 0x11
call fcn.0041df8e
mov eax, 0x5cf83532
cmp edi, 0x64
je 0x41dcff
jmp 0x41de90
cmp eax, 0x5de49fb7
jle 0x41de06
cmp eax, 0x5de49fb8
je 0x41de35
cmp eax, 0x6cf13131
je 0x41de48
cmp eax, 0x73e5f87a
jne 0x41dcff
add edi, 0xffffff55
shr edi, 0xa
push 0x5327
push edi
jmp 0x41de2b
cmp eax, 0xe417845c
je 0x41de61
cmp eax, 0x143681c
je 0x41de9a
cmp eax, 0x30dfb435
jne 0x41dcff
mov dword [ebp - 0x18], edi
mov ebx, dword [ebp + 8]
push ebx
call dword [0x44c16c]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 0x10]
push esi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [0x44c168]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call dword [0x44c184]
mov dword [ebp - 0x20], eax
push 0xcc0020
xor eax, eax
push eax
push eax
push ebx
push esi
push edi
push eax
push eax
push dword [ebp - 0x14]
call dword [0x44c164]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp byte [eax], 0xcc
mov eax, 0x5de49fb8
je 0x41ddfe
mov eax, 0x143681c
mov edi, dword [ebp - 0x18]
jmp 0x41dcff
cmp eax, 0x39fbe175
je 0x41df1a
cmp eax, 0x5cf83532
jne 0x41df54
shr edi, 0xd
imul edi, edi, 0xd552000
push edi
push 0xed7
call fcn.0041e636
add esp, 8
jmp 0x41de90
mov dword [ebp - 0x18], edi
popal
jmp 0x41de39
mov eax, dword [ebp - 0x10]
shl eax, 7
add eax, 0xffffffe9
shr eax, 3
mov dword [ebp - 0x10], eax
mov eax, 0x525c5814
jmp 0x41dcff
shl edi, 0xb
or edi, 0x46
call fcn.0041e17e
push edi
push 0x2b3d
push 0x2d78
call fcn.0041dce7
add esp, 0xc
mov eax, 0x73e5f87a
cmp edi, 0x86
jge 0x41dcff
mov eax, 0x143681c
jmp 0x41dcff
mov ecx, dword [ebp - 0x24]
movzx ecx, word [ecx]
cmp ecx, 0xcd03
je 0x41dee7
movzx ecx, cx
cmp ecx, 0xf0b
jne 0x41df5f
mov eax, dword [ebp - 0x10]
imul ecx, eax, 0x83
imul ecx, ecx
imul edx, ecx, 0x57a3
dec edx
imul eax, eax, 0x830
add eax, 0xfffffd44
mov dword [ebp - 0x10], eax
mov eax, 0x143681c
cmp ecx, edx
je 0x41dcff
jmp 0x41df10
mov ecx, dword [ebp - 0x10]
shr ecx, 0xc
lea eax, [ecx - 0xc6]
imul ecx, ecx
imul edx, ecx, 0x8157
dec edx
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, 0x39fbe175
cmp edx, ecx
je 0x41dcff
mov eax, 0x5de49fb8
jmp 0x41dcff
shr edi, 0x10
mov esi, edi
and esi, 0xf800
lea edi, [esi - 0xc60]
push 0x3326
push edi
call fcn.0041e461
add esp, 8
mov eax, 0xe417845c
cmp esi, 0xce7
jb 0x41dcff
mov eax, 0xe2d11378
jmp 0x41dcff
cmp eax, 0x525c5814
jne 0x41dcff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edi
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call dword [0x44c184]
push dword [ebp - 0x14]
call dword [0x44c174]
push dword [ebp - 0x20]
call dword [0x44c178]
mov eax, dword [ebp - 0x1c]
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41df8e
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
xor eax, eax
lea ecx, [ebp - 0x34]
push eax
push ecx
push eax
push 0x30
call dword [0x44c158]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0xd], al
mov dword [ebp - 0x20], 0x8df67443
mov eax, 0x8df67443
mov edi, dword [ebp - 0x24]
cmp eax, 0xcc362a7c
jle 0x41e000
cmp eax, 0xde8dcad0
jle 0x41e036
cmp eax, 0xde8dcad1
je 0x41e092
cmp eax, 0x25574862
je 0x41e0ed
cmp eax, 0x5df9003c
jne 0x41dfc4
add edi, 8
shr edi, 0xf
imul edi, edi, 0x8b
jmp 0x41e140
cmp eax, 0x927b6d04
jle 0x41e052
cmp eax, 0x927b6d05
je 0x41e121
cmp eax, 0xa64c72d2
jne 0x41e14a
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
cmp eax, 0xf0b
je 0x41e092
movzx eax, ax
cmp eax, 0xcd03
je 0x41e044
jmp 0x41e0b4
cmp eax, 0xcc362a7d
je 0x41e0b4
cmp eax, 0xdcf2ba7d
jne 0x41dfc4
mov dword [ebp - 0x1c], edi
popal
jmp 0x41e048
cmp eax, 0x8df67443
je 0x41e12f
cmp eax, 0x901d2ac4
jne 0x41dfc4
shr edi, 4
and edi, 0xfffff00
add edi, 0x8100
shr edi, 0xd
call fcn.0041e17e
mov eax, 0x25574862
cmp edi, 0x30
je 0x41dfc4
jmp 0x41e140
mov eax, dword [ebp - 0x14]
lea eax, [eax*4 - 0xcd]
shr eax, 3
add eax, 0xffffff5c
shr eax, 5
mov dword [ebp - 0x14], eax
mov eax, 0xdcf2ba7d
jmp 0x41dfc4
mov eax, dword [ebp - 0x14]
mov ecx, 0xffffff6d
add eax, ecx
shr eax, 0xf
mov ecx, eax
imul ecx, eax
mov edx, ecx
shl edx, 0xd
add edx, ecx
dec edx
add eax, 0xfffffe95
mov dword [ebp - 0x14], eax
mov eax, 0xa64c72d2
cmp ecx, edx
je 0x41dfc4
mov eax, 0xbc090d02
jmp 0x41dfc4
shl edi, 3
and edi, 0xffff8000
imul esi, edi, 0xa1
mov edi, esi
shr edi, 2
push edi
call fcn.0041e78d
add esp, 4
mov eax, 0x5df9003c
test esi, esi
je 0x41dfc4
mov eax, 0x927b6d05
jmp 0x41dfc4
imul edi, edi, 0x1c558000
add edi, 0x89ac00
jmp 0x41e140
mov cl, byte [ebp - 0xd]
mov eax, 0xdcf2ba7d
cmp cl, 0xcc
je 0x41dfc4
mov eax, 0xa64c72d2
jmp 0x41dfc4
cmp eax, 0xbc090d02
jne 0x41dfc4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edi
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
call dword [0x44c148]
push eax
call dword [0x44c144]
push edi
push esi
push eax
call fcn.0041dce7
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41e17e
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [0x44c150]
push 0
call esi
mov dword [ebp - 0x28], eax
push 1
call esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0xd], al
mov dword [ebp - 0x20], 0x857e0064
mov eax, 0x857e0064
mov esi, dword [ebp - 0x24]
cmp eax, 0x13c31777
jle 0x41e200
cmp eax, 0x23a3ba1b
jle 0x41e22a
cmp eax, 0x587d1600
jg 0x41e27f
cmp eax, 0x23a3ba1c
je 0x41e2b3
cmp eax, 0x508e370a
jne 0x41e1b8
shl esi, 0xe
and esi, 0xfffc000
or esi, 0x166
imul esi, esi, 0x38
add esi, 0xffffff79
jmp 0x41e354
cmp eax, 0xb0f87fac
jle 0x41e250
cmp eax, 0xdf060c39
jg 0x41e29a
cmp eax, 0xb0f87fad
je 0x41e2fb
cmp eax, 0xdc5491cf
je 0x41e3b3
jmp 0x41e1b8
cmp eax, 0x13c31778
je 0x41e303
cmp eax, 0x17b1b3c9
je 0x41e316
cmp eax, 0x23099480
je 0x41e3e3
jmp 0x41e1b8
cmp eax, 0x857e0064
je 0x41e343
cmp eax, 0x93c5e8bc
je 0x41e35e
cmp eax, 0xab2ddb72
jne 0x41e1b8
imul esi, esi, 0xd3
add esi, 0x3d
jmp 0x41e354
cmp eax, 0x587d1601
je 0x41e391
cmp eax, 0x7b9c0616
je 0x41e3a8
jmp 0x41e1b8
cmp eax, 0xdf060c3a
jne 0x41e41c
imul esi, esi, 0x3c
add esi, 0xffffe674
jmp 0x41e354
shl esi, 4
add esi, 0xfffffdb8
shr esi, 0xd
push esi
push 0x1989
push 0x4dd
call fcn.0041d828
add esp, 0xc
push esi
push 0x7b2
call fcn.0041e636
add esp, 8
mov eax, 0x587d1601
cmp esi, 0xa6
je 0x41e1b8
mov eax, 0x13c31778
jmp 0x41e1b8
imul esi, esi, 0x518000
jmp 0x41e354
imul esi, esi, 0x2f800
add esi, 0x2341000
call fcn.0041e17e
jmp 0x41e354
add esi, 0xffffff50
shr esi, 2
imul esi, esi, 0xe7
add esi, 0xffffffb6
mov eax, 0xb0f87fad
cmp esi, 0xa8
je 0x41e1b8
mov eax, 0x93c5e8bc
jmp 0x41e1b8
mov cl, byte [ebp - 0xd]
mov eax, 0x7b9c0616
cmp cl, 0xcc
je 0x41e1b8
mov eax, 0x587d1601
jmp 0x41e1b8
shr esi, 0xc
call fcn.0041e17e
push 0x1b08
push esi
push 0x1fd8
call fcn.0041dce7
add esp, 0xc
mov eax, 0xdf060c3a
cmp esi, 0x60
je 0x41e1b8
mov eax, 0xab2ddb72
jmp 0x41e1b8
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
cmp eax, 0xf0b
je 0x41e3b3
movzx eax, ax
cmp eax, 0xcd03
jne 0x41e3e3
mov dword [ebp - 0x1c], esi
popal
jmp 0x41e3ac
mov eax, dword [ebp - 0x14]
imul ecx, eax, 0x43
imul ecx, ecx
imul edx, ecx, 0x989
imul eax, eax, 0x3fdc
dec edx
mov dword [ebp - 0x14], eax
mov eax, 0x17b1b3c9
cmp ecx, edx
je 0x41e1b8
mov eax, 0x7b9c0616
jmp 0x41e1b8
imul eax, dword [ebp - 0x14], 0xf5
shr eax, 7
lea ecx, [eax - 0x78]
imul ecx, ecx
imul edx, ecx, 0x6af7
dec edx
imul eax, eax, 0x61
add eax, 0xffff86c0
mov dword [ebp - 0x14], eax
mov eax, 0x508e370a
cmp edx, ecx
je 0x41e1b8
mov eax, 0xf465323e
jmp 0x41e1b8
cmp eax, 0xf465323e
jne 0x41e1b8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esi
xor eax, eax
push eax
push eax
push eax
push 0x445c2a
call dword [0x44c170]
mov esi, eax
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
push eax
call fcn.0041dce7
add esp, 0xc
mov edi, eax
push esi
call dword [0x44c174]
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41e461
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x20], 0x6968a62a
mov eax, 0x6968a62a
mov edi, dword [ebp - 0x24]
cmp eax, 0xdcc70d6a
jle 0x41e4a9
cmp eax, 0x18ea0db2
jg 0x41e4e8
cmp eax, 0xa1773
je 0x41e53e
cmp eax, 0x214f2d
je 0x41e56e
cmp eax, 0xdcc70d6b
jne 0x41e479
jmp 0x41e60e
cmp eax, 0xc98cd667
jg 0x41e527
cmp eax, 0x8ad35c08
je 0x41e5a3
cmp eax, 0xbd17c811
jne 0x41e479
shl edi, 0xc
add edi, 0xfffff55b
push edi
push 0x6272
push 0x54c8
call fcn.0041dce7
add esp, 0xc
call fcn.0041e17e
jmp 0x41e5cc
cmp eax, 0x18ea0db3
je 0x41e5c3
cmp eax, 0x6968a62a
jne 0x41e479
call fcn.0041df8e
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0xcc
mov eax, 0xd12351e5
je 0x41e479
mov eax, 0xa1773
jmp 0x41e479
cmp eax, 0xc98cd668
je 0x41e5d6
cmp eax, 0xd12351e5
je 0x41e55b
jmp 0x41e479
mov ecx, dword [ebp - 0x18]
movzx ecx, word [ecx]
cmp ecx, 0xcd03
je 0x41e56e
movzx ecx, cx
cmp ecx, 0xf0b
jne 0x41e60e
mov dword [ebp - 0x1c], edi
popal
jmp 0x41e55f
mov eax, dword [ebp - 0x10]
shr eax, 0xb
lea ecx, [eax + eax*8]
add ecx, 0xfffff925
imul ecx, ecx
imul edx, ecx, 0x3631
dec edx
lea eax, [eax + eax*8]
lea eax, [eax*8 - 0x3440]
mov dword [ebp - 0x10], eax
mov eax, 0xa1773
cmp edx, ecx
je 0x41e479
jmp 0x41e5cc
mov eax, dword [ebp - 0x10]
shl eax, 0x14
add eax, 0xffe50000
shr eax, 5
or eax, 0xdf
mov dword [ebp - 0x10], eax
mov eax, 0xdcc70d6b
jmp 0x41e479
shr edi, 3
and edi, 0x1ffffe00
mov eax, 0xd12351e5
jmp 0x41e479
mov esi, edi
add esi, 0xffffff81
mov edi, esi
shr edi, 7
push 0x2f21
push 0xc40
push edi
call fcn.0041d828
add esp, 0xc
mov eax, 0xd12351e5
cmp esi, 0x4100
jae 0x41e479
mov eax, 0xbd17c811
jmp 0x41e479
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x14]
call fcn.0041d828
add esp, 0xc
push dword [ebp - 0x14]
call dword [0x44c178]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret