joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f50e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48387a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [0x5430a4]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x3c], eax
lea ecx, [esp + 0x10]
call dword [0x4ef3f0]
xor ebx, ebx
mov dword [esp + 0x14], 0x437f0000
mov dword [esp + 0x18], 0xff000000
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], 0xea60
mov word [esp + 0x34], bx
mov dword [esp + 0x38], ebx
push 0x4f5e40
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], ebx
call dword [0x4ef40c]
mov ecx, dword [esp + 0x50]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x54], 1
call fcn.004040b0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 2
call dword [0x4ef3c0]
lea ecx, [esp + 0xc]
call dword [0x4ef410]
lea ecx, [esp + 8]
mov byte [esp + 0x48], bl
call dword [0x4ef410]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], 0xff208040
mov word [esp + 0x38], 1
mov dword [esp + 0x3c], 7
mov dword [esp + 0x34], 0x1d4c0
call fcn.0041e740
lea ecx, [esp + 0x10]
call dword [0x4ef410]
mov ecx, dword [esp + 0x40]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x38]
pop ebx
call fcn.004754bd
add esp, 0x44
ret 4

Function at 0x41f650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48387a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [0x5430a4]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x3c], eax
lea ecx, [esp + 0x10]
call dword [0x4ef3f0]
xor ebx, ebx
mov dword [esp + 0x14], 0x437f0000
mov dword [esp + 0x18], 0xff000000
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], 0xea60
mov word [esp + 0x34], bx
mov dword [esp + 0x38], ebx
push 0x4f5e4c
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], ebx
call dword [0x4ef40c]
mov ecx, dword [esp + 0x50]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x54], 1
call fcn.004040b0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 2
call dword [0x4ef3c0]
lea ecx, [esp + 0xc]
call dword [0x4ef410]
lea ecx, [esp + 8]
mov byte [esp + 0x48], bl
call dword [0x4ef410]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], 0xff0080ff
call fcn.0041e740
lea ecx, [esp + 0x10]
call dword [0x4ef410]
mov ecx, dword [esp + 0x40]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x38]
pop ebx
call fcn.004754bd
add esp, 0x44
ret 4
Function at 0x41f66e
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48387a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [0x5430a4]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x3c], eax
lea ecx, [esp + 0x10]
call dword [0x4ef3f0]
xor ebx, ebx
mov dword [esp + 0x14], 0x437f0000
mov dword [esp + 0x18], 0xff000000
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], 0xea60
mov word [esp + 0x34], bx
mov dword [esp + 0x38], ebx
push 0x4f5e4c
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], ebx
call dword [0x4ef40c]
mov ecx, dword [esp + 0x50]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x54], 1
call fcn.004040b0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 2
call dword [0x4ef3c0]
lea ecx, [esp + 0xc]
call dword [0x4ef410]
lea ecx, [esp + 8]
mov byte [esp + 0x48], bl
call dword [0x4ef410]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], 0xff0080ff
call fcn.0041e740
lea ecx, [esp + 0x10]
call dword [0x4ef410]
mov ecx, dword [esp + 0x40]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x38]
pop ebx
call fcn.004754bd
add esp, 0x44
ret 4
Function at 0x42ad60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48c2bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [0x5430a4]
push ebp
push esi
mov esi, dword [0x560d4c]
mov dword [esp + 0x30], eax
mov ebp, ecx
call fcn.00446f60
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
push eax
lea ecx, [esp + 0xc]
call dword [0x4ef40c]
mov dword [esp + 0x3c], 0
call fcn.00429eb0
add eax, 0x10
mov ecx, eax
call dword [0x4ef3f4]
push eax
lea ecx, [esp + 0xc]
call dword [0x4ef3e8]
test eax, eax
je 0x42ae0b
call fcn.00429eb0
add eax, 0x14
mov ecx, eax
call dword [0x4ef3f4]
push eax
lea ecx, [esp + 0xc]
call dword [0x4ef3e8]
test eax, eax
je 0x42ae0b
call fcn.00429eb0
add eax, 0x18
mov ecx, eax
call dword [0x4ef3f4]
push eax
lea ecx, [esp + 0xc]
call dword [0x4ef3e8]
test eax, eax
jne 0x42af7c
mov esi, dword [0x560d4c]
push ebx
push edi
call fcn.00446f60
mov ecx, dword [esi + 0x34]
add ecx, 0x1cc
push ecx
lea ecx, [esp + 0x1c]
call dword [0x4ef40c]
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 1
mov dword [esp + 0x1c], 0x80
mov byte [esp + 0x30], 1
call dword [0x4ef3f4]
push eax
push 8
lea edx, [esp + 0x28]
push edx
call fcn.00402510
lea ebx, [ebp + 0x598]
mov ecx, ebx
call dword [0x4ef3f4]
push eax
push 8
lea eax, [esp + 0x30]
push eax
call fcn.00402510
mov esi, 1
mov edi, 0x54ccc0
lea ebx, [ebx]
push edi
lea ecx, [esp + 0x18]
call dword [0x4ef3dc]
mov ecx, ebx
mov byte [esp + 0x44], 2
call dword [0x4ef3f4]
push eax
lea ecx, [esp + 0x18]
call dword [0x4ef3e8]
test eax, eax
je 0x42aec4
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 1
call dword [0x4ef410]
add edi, 4
inc esi
cmp edi, 0x54ccd8
jle 0x42ae80
jmp 0x42af2e
mov eax, dword [esp + 0x4c]
sub eax, 0x1af5
je 0x42aef8
dec eax
je 0x42aee5
dec eax
jne 0x42af10
imul esi, esi, 0x58
mov ecx, dword [esi + ebp + 4]
add esi, ebp
mov dword [esi + 0x58], ecx
xor eax, eax
jmp 0x42af09
imul esi, esi, 0x58
mov edx, dword [esi + ebp + 4]
add esi, ebp
mov dword [esi + 0x58], edx
mov eax, 2
jmp 0x42af09
imul esi, esi, 0x58
mov eax, dword [esi + ebp + 4]
add esi, ebp
mov dword [esi + 0x58], eax
mov eax, 1
mov dword [esi + 4], eax
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x1c]
push 0x1c
push ecx
call fcn.0043c040
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 1
call dword [0x4ef410]
mov ecx, ebp
call fcn.0042a850
call fcn.00429eb0
mov esi, eax
call fcn.0043e69c
mov edx, dword [esi]
mov edi, eax
mov ebx, dword [edi]
mov ecx, esi
call dword [edx + 0x14]
push eax
mov ecx, edi
call dword [ebx]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
test eax, eax
pop edi
pop ebx
je 0x42af6a
call fcn.00429eb0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 4]
lea ecx, [esp + 0x10]
call dword [0x4ef410]
lea ecx, [esp + 8]
call dword [0x4ef410]
mov ecx, dword [esp + 0x34]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2c]
pop ebp
call fcn.004754bd
add esp, 0x38
ret 4
Function at 0x432a19
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4908aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
call dword [0x4ef3f0]
xor ebx, ebx
mov dword [esp + 0x14], 0x437f0000
mov dword [esp + 0x18], 0xff000000
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0xea60
mov word [esp + 0x24], bx
push 0x4f88f4
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], ebx
call dword [0x4ef40c]
mov ecx, dword [esp + 0x38]
push ecx
push eax
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x3c], 1
call fcn.004040b0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 2
call dword [0x4ef3c0]
lea ecx, [esp + 8]
call dword [0x4ef410]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], bl
call dword [0x4ef410]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x1c], 0xffff0000
mov dword [esp + 0x20], 0xffffffff
call fcn.00432850
lea ecx, [esp + 0x10]
call dword [0x4ef410]
mov ecx, dword [esp + 0x28]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4

Function at 0x432af9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4908aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
call dword [0x4ef3f0]
xor ebx, ebx
mov dword [esp + 0x14], 0x437f0000
mov dword [esp + 0x18], 0xff000000
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0xea60
mov word [esp + 0x24], bx
push 0x4f8900
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], ebx
call dword [0x4ef40c]
mov ecx, dword [esp + 0x38]
push ecx
push eax
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x3c], 1
call fcn.004040b0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 2
call dword [0x4ef3c0]
lea ecx, [esp + 8]
call dword [0x4ef410]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], bl
call dword [0x4ef410]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], 0xffc08000
call fcn.00432850
lea ecx, [esp + 0x10]
call dword [0x4ef410]
mov ecx, dword [esp + 0x28]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x432bc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4908aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
call dword [0x4ef3f0]
xor ebx, ebx
mov dword [esp + 0x14], 0x437f0000
mov dword [esp + 0x18], 0xff000000
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0xea60
mov word [esp + 0x24], bx
push 0x4f890c
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], ebx
call dword [0x4ef40c]
mov ecx, dword [esp + 0x38]
push ecx
push eax
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x3c], 1
call fcn.004040b0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 2
call dword [0x4ef3c0]
lea ecx, [esp + 8]
call dword [0x4ef410]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], bl
call dword [0x4ef410]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], 0xffff0000
call fcn.00432850
lea ecx, [esp + 0x10]
call dword [0x4ef410]
mov ecx, dword [esp + 0x28]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4

Function at 0x432cb9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4908aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
call dword [0x4ef3f0]
xor ebx, ebx
mov dword [esp + 0x14], 0x437f0000
mov dword [esp + 0x18], 0xff000000
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0xea60
mov word [esp + 0x24], bx
push 0x4f8918
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], ebx
call dword [0x4ef40c]
mov ecx, dword [esp + 0x38]
push ecx
push eax
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x3c], 1
call fcn.004040b0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 2
call dword [0x4ef3c0]
lea ecx, [esp + 8]
call dword [0x4ef410]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], bl
call dword [0x4ef410]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x1c], 0xffffff00
call fcn.00432850
lea ecx, [esp + 0x10]
call dword [0x4ef410]
mov ecx, dword [esp + 0x28]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x432e90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4908aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
call dword [0x4ef3f0]
xor ebx, ebx
mov dword [esp + 0x14], 0x437f0000
mov dword [esp + 0x18], 0xff000000
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0xea60
mov word [esp + 0x24], bx
push 0x4f8930
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], ebx
call dword [0x4ef40c]
mov ecx, dword [esp + 0x38]
push ecx
push eax
lea edx, [esp + 0x10]
push edx
mov byte [esp + 0x3c], 1
call fcn.004040b0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 2
call dword [0x4ef3c0]
lea ecx, [esp + 8]
call dword [0x4ef410]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], bl
call dword [0x4ef410]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov dword [esp + 0x1c], 0xff000000
mov dword [esp + 0x20], 0xffffffff
call fcn.00432850
lea ecx, [esp + 0x10]
call dword [0x4ef410]
mov ecx, dword [esp + 0x28]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x437480
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x491c56
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x24]
push ebp
push esi
push edi
mov esi, ecx
push eax
lea ecx, [esp + 0x34]
call dword [0x4ef40c]
xor ebp, ebp
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], ebp
call dword [0x4ef3ec]
cmp eax, 0xe
jle 0x43754f
push 2
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x38]
call dword [0x4ef2d4]
mov edi, eax
push 0xa
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 1
call dword [0x4ef3bc]
push 0x4f8b4c
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x34], 2
call fcn.004040b0
push edi
push eax
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x40], 3
call fcn.00404010
add esp, 0x18
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 4
call dword [0x4ef3c0]
lea ecx, [esp + 0x10]
call dword [0x4ef410]
lea ecx, [esp + 0x14]
call dword [0x4ef410]
lea ecx, [esp + 0x18]
call dword [0x4ef410]
lea ecx, [esp + 0x1c]
call dword [0x4ef410]
lea ecx, [esp + 0xc]
call dword [0x4ef3f0]
mov edx, dword [esp + 0x38]
push edx
lea eax, [esp + 0x10]
push 0x4f0c28
push eax
mov byte [esp + 0x34], 5
call dword [0x4ef3f8]
add esp, 0xc
call fcn.0043e69c
mov edx, dword [eax]
push 0x1a97
push 0x44
mov ecx, eax
call dword [edx + 4]
mov edi, eax
mov eax, dword [esi + 0xe24]
mov dword [eax], 1
mov ecx, dword [esi + 0xe24]
mov dword [ecx + 8], ebp
mov edx, dword [esi + 0xe24]
lea ecx, [esp + 0x30]
mov dword [edx + 4], ebp
call dword [0x4ef3f4]
mov ecx, dword [esi + 0xe24]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0xe24]
mov edx, dword [edi]
push ebp
push eax
push 4
mov ecx, edi
call dword [edx + 0x10]
mov ecx, dword [esi + 0xe24]
mov dword [ecx + 8], ebp
mov edx, dword [esi + 0xe24]
lea ecx, [esp + 0xc]
mov dword [edx + 4], 1
call dword [0x4ef3f4]
mov ecx, dword [esi + 0xe24]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0xe24]
mov edx, dword [edi]
push ebp
push eax
push 4
mov ecx, edi
call dword [edx + 0x10]
lea ecx, [esp + 0xc]
call dword [0x4ef410]
lea ecx, [esp + 0x30]
call dword [0x4ef410]
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x43f550
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
movzx eax, word [ecx + 0x14]
push ebx
push esi
push edi
movzx edi, word [ecx + 6]
xor esi, esi
test edi, edi
lea eax, [eax + ecx + 0x18]
jbe 0x43f58f
mov ebx, dword [esp + 0x10]
lea ecx, [ecx]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x43f57a
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x43f587
add edx, ecx
cmp ebx, edx
jb 0x43f591
inc esi
add eax, 0x28
cmp esi, edi
jb 0x43f570
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x43f5a0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push edi
mov edi, dword [esp + 0x28]
push edi
push str.Begin_Load_Func__s
call fcn.00440110
mov ebx, dword [esp + 0x2c]
add esp, 8
cmp word [ebx], 0x5a4d
je 0x43f5d7
push str.in_GetProcAddressDirectly_1
call fcn.00440110
add esp, 4
pop edi
xor eax, eax
pop ebx
add esp, 0x18
ret
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx]
add eax, ebx
cmp ecx, 0x4550
je 0x43f5fc
push str.in_GetProcAddressDirectly_2
call fcn.00440110
add esp, 4
pop edi
xor eax, eax
pop ebx
add esp, 0x18
ret
cmp word [eax + 0x14], 0xe0
jne 0x43f772
cmp word [eax + 0x18], 0x10b
jne 0x43f772
push esi
mov esi, dword [eax + 0x78]
push eax
push esi
call fcn.0043f550
add esp, 8
test eax, eax
jne 0x43f63c
push str.in_GetProcAddressDirectly_4
call fcn.00440110
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 0x18
ret
push ebp
mov ebp, esi
test ebp, ebp
jne 0x43f65a
push str.in_GetProcAddressDirectly_5
call fcn.00440110
add esp, 4
pop ebp
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 0x18
ret
mov edx, dword [ebp + ebx + 0x24]
mov ecx, dword [ebp + ebx + 0x20]
mov esi, dword [ebp + ebx + 0x1c]
add ebp, ebx
mov eax, edi
add edx, ebx
add ecx, ebx
add esi, ebx
shr eax, 0x10
test eax, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], esi
je 0x43f740
mov eax, dword [ebp + 0x14]
mov esi, dword [esi]
dec eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], esi
lea ecx, [ecx]
mov esi, dword [esp + 0x10]
test esi, esi
je 0x43f707
mov eax, dword [ebp + 0x18]
xor edi, edi
dec eax
mov dword [esp + 0x1c], eax
movzx esi, word [edx + edi*2]
cmp esi, dword [esp + 0x2c]
jne 0x43f6fe
mov eax, dword [ecx + edi*4]
mov esi, dword [esp + 0x30]
add eax, ebx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x43f6e9
test cl, cl
je 0x43f6e5
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x43f6e9
add eax, 2
add esi, 2
test cl, cl
jne 0x43f6c5
xor eax, eax
jmp 0x43f6ee
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43f72b
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
inc edi
cmp edi, eax
jbe 0x43f6b2
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
inc esi
cmp esi, eax
mov dword [esp + 0x2c], esi
jbe 0x43f6a0
push str.in_GetProcAddressDirectly_6
call fcn.00440110
add esp, 4
pop ebp
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
mov eax, dword [eax + ecx*4]
pop ebp
pop esi
pop edi
add eax, ebx
pop ebx
add esp, 0x18
ret
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
xor eax, eax
dec ecx
lea esp, [esp]
cmp edi, edx
jne 0x43f75a
cmp dword [esi + eax*4], 0
jne 0x43f762
inc eax
inc edx
cmp eax, ecx
jbe 0x43f750
jmp 0x43f714
mov eax, dword [esi + eax*4]
pop ebp
pop esi
shl eax, 6
pop edi
add eax, ebx
pop ebx
add esp, 0x18
ret
push str.in_GetProcAddressDirectly_3
call fcn.00440110
add esp, 4
pop edi
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x440280
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
lea eax, [edi + 1]
push eax
mov esi, ecx
call fcn.004750aa
mov dword [esi], eax
add esp, 4
xor eax, eax
test edi, edi
jle 0x4402db
mov ecx, dword [esp + 0x18]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
sub ebp, ecx
mov ecx, dword [esp + 0x1c]
lea esp, [esp]
mov dl, byte [eax + ebp]
mov ebx, dword [esi]
xor dl, cl
mov byte [eax + ebx], dl
mov edx, eax
xor edx, 0x2a
add edx, ecx
and edx, 0xff
inc eax
cmp eax, edi
mov ecx, edx
jl 0x4402b0
mov eax, dword [esi]
pop ebp
pop ebx
mov byte [edi + eax], 0
pop edi
pop esi
ret 0x10
mov ecx, dword [esi]
mov byte [edi + ecx], 0
pop edi
pop esi
ret 0x10

Function at 0x4405b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x4405d5
push eax
call fcn.004750a4
add esp, 4
mov ecx, 0x55ff68
mov dword [edi], 0
call fcn.00440940
push 0x400
call fcn.004750aa
add esp, 4
mov dword [edi], eax
xor ebx, ebx
xor ecx, ecx
test bl, 1
je 0x4405f2
mov ecx, 0x80
mov eax, ebx
shr eax, 1
test al, 1
je 0x4405fd
or ecx, 0x40
shr eax, 1
test al, 1
je 0x440606
or ecx, 0x20
shr eax, 1
test al, 1
je 0x44060f
or ecx, 0x10
shr eax, 1
test al, 1
je 0x440618
or ecx, 8
shr eax, 1
test al, 1
je 0x440621
or ecx, 4
shr eax, 1
test al, 1
je 0x44062a
or ecx, 2
test al, 2
je 0x440631
or ecx, 1
mov eax, dword [edi]
shl ecx, 0x18
mov dword [eax + ebx*4], ecx
mov esi, 8
mov edi, edi
mov ecx, 0x55ff68
call fcn.004408f0
mov ecx, dword [edi]
mov edx, dword [ecx + ebx*4]
lea ecx, [ecx + ebx*4]
mov ebp, edx
and ebp, 0x80000000
neg ebp
sbb ebp, ebp
and ebp, eax
add edx, edx
xor ebp, edx
dec esi
mov dword [ecx], ebp
jne 0x440640
mov eax, dword [edi]
lea esi, [eax + ebx*4]
mov eax, dword [esi]
xor edx, edx
mov ecx, 0x1f
test al, 1
je 0x440684
mov ebp, 1
shl ebp, cl
or edx, ebp
shr eax, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x440677
inc ebx
cmp ebx, 0x100
mov dword [esi], edx
jl 0x4405e6
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4406c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
mov eax, 1
mov dword [ecx], edx
push esi
lea esp, [esp]
mov edx, dword [ecx]
mov esi, edx
shr esi, 0x1e
xor esi, edx
imul esi, esi, 0x6c078965
add esi, eax
mov dword [ecx + 4], esi
add ecx, 4
inc eax
cmp eax, 0x270
jl 0x4406d0
pop esi
ret 4
Function at 0x440780
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov eax, ecx
mov esi, 0xe3
lea esp, [esp]
mov edx, dword [eax]
mov edi, dword [eax + 4]
xor edi, edx
and edi, 0x7ffffffe
xor edi, edx
and edx, 1
neg edx
shr edi, 1
and edx, 0x9908b0df
xor edi, edx
xor edi, dword [eax + 0x634]
mov dword [eax], edi
add eax, 4
dec esi
jne 0x440790
mov esi, 0x18c
mov edx, dword [eax]
mov edi, dword [eax + 4]
xor edi, edx
and edi, 0x7ffffffe
xor edi, edx
and edx, 1
neg edx
shr edi, 1
and edx, 0x9908b0df
xor edi, edx
xor edi, dword [eax - 0x38c]
mov dword [eax], edi
add eax, 4
dec esi
jne 0x4407c1
mov edx, dword [eax]
mov esi, dword [ecx]
xor esi, edx
and esi, 0x7ffffffe
xor esi, edx
and edx, 1
neg edx
shr esi, 1
and edx, 0x9908b0df
xor esi, edx
xor esi, dword [eax - 0x38c]
mov dword [eax], esi
pop edi
mov dword [ecx + 0x9c4], 0x270
mov dword [ecx + 0x9c0], ecx
pop esi
ret

Function at 0x440830
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [ecx + 0x9c4]
test eax, eax
jne 0x44083f
call fcn.00440780
mov edx, dword [ecx + 0x9c4]
mov eax, dword [ecx + 0x9c0]
dec edx
mov dword [ecx + 0x9c4], edx
mov edx, dword [eax]
add eax, 4
mov dword [ecx + 0x9c0], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov ecx, edx
and ecx, 0xff3a58ad
shl ecx, 7
xor edx, ecx
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x440890
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
call dword [0x4ef620]
push eax
push 0
call dword [0x4ef5c4]
add esp, 4
push eax
mov ecx, esi
call fcn.00440700
push eax
mov ecx, esi
call fcn.004406c0
mov ecx, esi
pop esi
jmp fcn.00440780
Function at 0x440940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x44095b
push eax
call fcn.004750a4
add esp, 4
mov dword [edi], 0
push 0x400
call fcn.004750aa
add esp, 4
mov dword [edi], eax
xor ebx, ebx
lea esp, [esp]
xor ecx, ecx
test bl, 1
je 0x44097c
mov ecx, 0x80
mov eax, ebx
shr eax, 1
test al, 1
je 0x440987
or ecx, 0x40
shr eax, 1
test al, 1
je 0x440990
or ecx, 0x20
shr eax, 1
test al, 1
je 0x440999
or ecx, 0x10
shr eax, 1
test al, 1
je 0x4409a2
or ecx, 8
shr eax, 1
test al, 1
je 0x4409ab
or ecx, 4
shr eax, 1
test al, 1
je 0x4409b4
or ecx, 2
test al, 2
je 0x4409bb
or ecx, 1
mov eax, dword [edi]
shl ecx, 0x18
mov dword [eax + ebx*4], ecx
mov esi, 8
jmp 0x4409d0
mov ecx, 0x55ff70
call fcn.00440890
mov ecx, 0x55ff70
call fcn.00440830
and eax, 0xff
jle 0x4409f2
cmp eax, 0x100
jl 0x440a00
and eax, 0x800000ff
jns 0x440a00
dec eax
or eax, 0xffffff00
inc eax
mov edx, dword [eax*4 + 0x5423e8]
mov ecx, dword [edi]
lea eax, [ecx + ebx*4]
mov ecx, dword [eax]
mov ebp, ecx
and ebp, 0x80000000
neg ebp
sbb ebp, ebp
and ebp, edx
lea edx, [ecx + ecx]
xor ebp, edx
dec esi
mov dword [eax], ebp
jne 0x4409d0
mov eax, dword [edi]
lea esi, [eax + ebx*4]
mov eax, dword [esi]
xor edx, edx
mov ecx, 0x1f
test al, 1
je 0x440a41
mov ebp, 1
shl ebp, cl
or edx, ebp
shr eax, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x440a34
inc ebx
cmp ebx, 0x100
mov dword [esi], edx
jl 0x440970
pop edi
pop esi
pop ebp
pop ebx
ret