joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ed70
Capabilities:
Capture microphone audio

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x2c]
cmp eax, 1
jne 0x41ed80
xor eax, eax
jmp 0x41ed81
inc eax
mov dword [esi + 0x2c], eax
shl eax, 5
mov ecx, dword [eax + esi + 0x34]
test ecx, ecx
jne 0x41eda5
mov eax, dword [esi + 0x30]
push eax
call sub.MFC42.DLL_operatornew
mov ecx, dword [esi + 0x2c]
add esp, 4
shl ecx, 5
mov dword [ecx + esi + 0x34], eax
mov edx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
shl edx, 5
xor eax, eax
push 0x20
mov edi, dword [edx + esi + 0x34]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
shl eax, 5
mov edi, dword [esp + 0x10]
mov dword [eax + esi + 0x38], ecx
mov edx, dword [esi + 0x2c]
shl edx, 5
mov dword [edx + esi + 0x44], 0
mov eax, dword [esi + 0x2c]
add eax, 2
shl eax, 5
mov dword [eax + esi], esi
mov ecx, dword [esi + 0x2c]
shl ecx, 5
lea edx, [ecx + esi + 0x34]
push edx
push edi
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
push eax
mov ecx, esi
call fcn.0041ef30
test al, al
je 0x41ee14
pop edi
xor al, al
pop esi
ret 4
mov eax, dword [esi + 0x2c]
push 0x20
shl eax, 5
lea ecx, [eax + esi + 0x34]
push ecx
push edi
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
push eax
mov ecx, esi
call fcn.0041ef30
test al, al
pop edi
pop esi
sete al
ret 4
Function at 0x401bd8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x4027ac
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x4027cb
mov eax, 0
jmp 0x40280f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x4027ee
mov eax, 0
jmp 0x40280f
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40280a
mov eax, 0
jmp 0x40280f
mov eax, 1
leave
ret

Function at 0x402811
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x402870
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x402868
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x402868
mov eax, dword [ebp - 4]
jmp 0x402884
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x402845
mov eax, 0
leave
ret
Function at 0x4016fc
Capabilities:
Encode data using xor

Disassembly:
invalid
fadd st(3), st(0)
movsb byte es:[edi], byte [esi]
aas
push ebp
jnp 0x40175d
jl 0x4016d4
pop es
lodsb al, byte [esi]
invalid
mul dword [ecx]
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xbb1900
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.DATA
lea edi, [esi - 0x5c9000]
push edi
or ebp, 0xffffffff
jmp 0xbb1922
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xbb1929
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbb1918
mov eax, 1
add ebx, ebx
jne 0xbb193b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xbb194c
jne 0xbb196b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbb196b
dec eax
add ebx, ebx
jne 0xbb1958
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xbb1930
add ebx, ebx
jne 0xbb1967
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xbb19bd
xor ecx, ecx
sub eax, 3
jb 0xbb1983
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xbb19f2
sar eax, 1
mov ebp, eax
jmp 0xbb198e
add ebx, ebx
jne 0xbb198e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbb195c
inc ecx
add ebx, ebx
jne 0xbb199c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbb195c
add ebx, ebx
jne 0xbb19a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xbb199e
jne 0xbb19ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xbb199e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xbb19dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xbb19ce
jmp 0xbb191e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xbb19dc
add edi, ecx
jmp 0xbb191e
pop esi
mov edi, esi
mov ecx, 0x20a70
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xbb19fa
cmp byte [edi], 0xaf
jne 0xbb19fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xbb19ff
lea edi, [esi + 0x7ad000]
mov eax, dword [edi]
or eax, eax
je 0xbb1a6e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7b3e7c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7b3fec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xbb1a2c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7b3ff4]
or eax, eax
je 0xbb1a68
mov dword [ebx], eax
add ebx, 4
jmp 0xbb1a49
call dword [esi + 0x7b3ff0]
mov ebp, dword [esi + 0x7b3ff8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xbb1aa2
sub esp, 0xffffff80
jmp 0x865e68

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41a2a1
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x436590]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00419802
mov dword [ebp - 0x14], eax
cmp dword [0x4387c4], edi
jne 0x41a392
push 0x800
push edi
push 0x42f9a0
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41a31f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x57
jne 0x41a472
push 0x42f9a0
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41a472
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x41a472
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4387c4], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4387c8], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4387cc], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
mov dword [0x4387d4], eax
test eax, eax
je 0x41a38f
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
mov dword [0x4387d0], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
je 0x41a3b7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41a3aa
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41a3cc
push 4
pop eax
jmp 0x41a474
cmp dword [ebp - 0x14], edi
je 0x41a3cc
push dword [0x4387c4]
call dword [sym.imp.KERNEL32.DLL_DecodePointer]
push 3
jmp 0x41a3b1
mov eax, dword [0x4387d0]
mov ebx, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, esi
je 0x41a42a
cmp dword [0x4387d4], esi
je 0x41a42a
push eax
call ebx
push dword [0x4387d4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41a42a
test eax, eax
je 0x41a42a
call ecx
test eax, eax
je 0x41a41f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41a41f
test byte [ebp - 8], 1
jne 0x41a42a
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x41a45a
mov eax, dword [0x4387c8]
cmp eax, esi
je 0x41a457
push eax
call ebx
test eax, eax
je 0x41a457
call eax
mov edi, eax
test edi, edi
je 0x41a457
mov eax, dword [0x4387cc]
cmp eax, esi
je 0x41a457
push eax
call ebx
test eax, eax
je 0x41a457
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4387c4]
call ebx
test eax, eax
je 0x41a472
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41a474
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415fcd
leave
ret
Function at 0x42b111
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0041727d
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
jne 0x42b149
xor eax, eax
jmp 0x42b175
cmp esi, dword [ebp - 4]
je 0x42b172
cmp dword [ebp + 0xc], 0
je 0x42b172
push dword [edi + 0x9c]
call fcn.0042ad1f
push dword [edi + 0x9c]
mov esi, eax
call fcn.0041a1ca
pop ecx
pop ecx
cmp esi, eax
je 0x42b145
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x968294
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x96833d
test eax, edx
je 0x968340
push 0
push 0
cmp word [eax - 0xa], 2
je 0x9682bd
push edx
mov edx, eax
mov eax, esp
call fcn.0095cf68
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x9682d3
push eax
lea eax, [esp + 8]
call fcn.0095cf68
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x9682e2
movzx eax, word [eax]
sub eax, ecx
jmp 0x968309
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x968323
add ecx, 4
js 0x9682fa
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x968320
push eax
mov eax, ecx
mov edx, 2
call fcn.0095c1b8
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x968307
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x968309
xor eax, eax
ret
test eax, eax
je 0x968350
test edx, edx
jne 0x9682a4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x96fc97
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0095c4ec
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.00961ab0
mov edi, eax
cmp edi, 0x104
jbe 0x96fcba
mov eax, edi
add eax, eax
call fcn.0095a140
mov esi, eax
jmp 0x96fcbc
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.00961ab0
push edi
push esi
call fcn.00961ef8
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x96fcf5
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x96fcdf
mov eax, esp
cmp esi, eax
je 0x96fd02
mov eax, esi
call fcn.0095a15c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x96fd3c
cmp bl, 0
je 0x96fd38
cmp bl, 0x41
jl 0x96fd33
cmp bl, 0x5a
jg 0x96fd33
or bl, 0x20
xor al, bl
inc esi
jmp 0x96fd17
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x96fc7c

Function at 0x9a20b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x9a20b6
ret
Function at 0x9ad9c4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x457c71
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x9adb5d
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x9adb5d
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x457a80]
call fcn.0095e7c0
add esp, 4
lea eax, [ebp - 4]
call fcn.0095fc2c
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x51c690]
push eax
call fcn.0099916c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.0095e5f8
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x2c
call fcn.0095a768
mov dword [ebp - 0x38], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], 1
mov word [ebp - 0x2a], 0x20
mov dl, 1
mov eax, dword [fcn.00407bd8]
call fcn.009aa3b8
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor ecx, ecx
push ebp
push 0x457c2b
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
mov dl, 7
call fcn.009abfcc
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
call fcn.009aacd8
call fcn.009a50a0
push eax
call fcn.00961e30
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.009aafdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x9adb5d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457c78
lea eax, [ebp - 8]
mov edx, dword [0x457a80]
call fcn.0095e7cc
lea eax, [ebp - 4]
call fcn.0095fc2c
ret
Function at 0xa13e6c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0xa13e84
add esp, 0xfffffff0
call fcn.0095b328
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4be08e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.0095a128
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0xa13f88
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.00a0f948
xor eax, eax
push ebp
push 0x4be065
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00a0f948
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.0095cfb4
jmp 0xa13f46
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.0095d55c
mov eax, dword [ebx + 4]
call fcn.0095d0bc
dec eax
jle 0xa13f5a
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0xa13f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be06c
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be095
lea eax, [ebp - 4]
call fcn.0095c874
ret
Function at 0xa575e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
push ebp
push 0x5017ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.00a58674
xor eax, eax
push ebp
push 0x5017d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x30]
push eax
mov ecx, ebx
mov edx, 4
mov eax, dword [0x5006c8]
call fcn.00a58e88
test al, al
jne 0xa5763f
call fcn.0095ba84
jmp 0xa576f0
mov eax, dword [ebx*4 + 0x51c3f8]
push eax
lea edx, [ebp - 4]
mov ecx, dword [0x51c488]
mov eax, dword [0x5006c8]
call fcn.00a58c08
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
lea edx, [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov eax, dword [0x5006c8]
call fcn.00a58c60
lea edx, [ebp - 8]
mov eax, dword [0x5006c8]
call fcn.00a59188
mov eax, dword [ebp - 8]
push eax
lea edx, [ebp - 4]
mov ecx, dword [0x51c498]
mov eax, dword [0x5006c8]
call fcn.00a58c08
lea eax, [ebp - 0xc]
call fcn.0095cd3c
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [0x51c450]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.0095fd3c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.00a58130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5017e0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.00a58ab4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
pop eax
xor ebx, ebx
jmp 0xa57702
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0095cd44
lea eax, [ebp - 4]
mov edx, dword [0x50058c]
call fcn.0095e7cc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0xa577c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
push ebp
push 0x5019ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.00a58674
xor eax, eax
push ebp
push 0x5019d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x30]
push eax
mov ecx, ebx
mov edx, 3
mov eax, dword [0x5006c8]
call fcn.00a58e88
test al, al
jne 0xa57827
call fcn.0095ba84
jmp 0xa578ef
mov eax, dword [ebx*4 + 0x51c42c]
push eax
lea edx, [ebp - 4]
mov ecx, dword [0x51c488]
mov eax, dword [0x5006c8]
call fcn.00a58c08
mov eax, dword [ebp + 0x10]
push eax
lea edx, [ebp - 4]
mov ecx, dword [0x51c4a4]
mov eax, dword [0x5006c8]
call fcn.00a58c08
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
lea edx, [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov eax, dword [0x5006c8]
call fcn.00a58c60
lea edx, [ebp - 8]
mov eax, dword [0x5006c8]
call fcn.00a59188
mov eax, dword [ebp - 8]
push eax
lea edx, [ebp - 4]
mov ecx, dword [0x51c498]
mov eax, dword [0x5006c8]
call fcn.00a58c08
lea eax, [ebp - 0xc]
call fcn.0095cd3c
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [0x51c44c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.0095fd3c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.00a58130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5019df
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
call fcn.00a58ab4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
pop eax
xor ebx, ebx
jmp 0xa57901
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0095cd44
lea eax, [ebp - 4]
mov edx, dword [0x50058c]
call fcn.0095e7cc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c