joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401df0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x8c
mov ecx, 0x20
xor eax, eax
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x1c]
xor esi, esi
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push esi
push str.SOFTWAREBrotherBrother_MFL_ProZL2Brother_DCP_8020
push 0x80000002
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, 0x80
test eax, eax
jne 0x401e71
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push esi
push str.Printer
push ecx
mov dword [esp + 0x2c], ebp
call ebx
test eax, eax
jne 0x401e5e
mov esi, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401f74
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SOFTWAREBrotherBrother_MFL_ProZL2Brother_DCP_8025D
push 0x80000002
call edi
test eax, eax
jne 0x401eca
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.Printer
push ecx
mov dword [esp + 0x2c], ebp
call ebx
test eax, eax
jne 0x401eb7
mov esi, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401f74
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SOFTWAREBrotherBrother_MFL_ProZL2Brother_MFC_8420
push 0x80000002
call edi
test eax, eax
jne 0x401f1f
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.Printer
push ecx
mov dword [esp + 0x2c], ebp
call ebx
test eax, eax
jne 0x401f10
mov esi, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x401f74
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SOFTWAREBrotherBrother_MFL_ProZL2Brother_MFC_8820D
push 0x80000002
call edi
test eax, eax
jne 0x401fe1
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.Printer
push ecx
mov dword [esp + 0x2c], ebp
call ebx
test eax, eax
jne 0x401f69
mov esi, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 1
jne 0x401fe1
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SOFTWAREBrotherPrinterInformation
push 0x80000002
call edi
test eax, eax
jne 0x401fe1
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
push edx
push esi
push 0
push str.PrinterName
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x401fd6
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x8c
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8c
ret
Function at 0x402c75
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4064d0
cmp edx, dword [eax]
je 0x402c97
add eax, 8
inc ecx
cmp eax, 0x406560
jl 0x402c88
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4064d0]
jne 0x402dc5
mov eax, dword [0x406888]
cmp eax, 1
je 0x402d9f
test eax, eax
jne 0x402cc8
cmp dword [0x406424], 1
je 0x402d9f
cmp edx, 0xfc
je 0x402dc5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402cff
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00403220
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403390
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x402d42
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403390
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4053c0
push edi
call fcn.00404020
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00403220
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403230
lea eax, [ebp - 0xa0]
push 0x4053a0
push eax
call fcn.00403230
push dword [esi + 0x4064d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403230
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00403f8e
add esp, 0x2c
pop edi
jmp 0x402dc5
lea eax, [ebp + 8]
lea esi, [esi + 0x4064d4]
push 0
push eax
push dword [esi]
call fcn.00403390
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x408140
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40815e
mov eax, 0x58176f
push eax
push 1
mov ebx, 0x4a38d0
call fcn.004a31ea
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x408188
mov eax, 0
jmp 0x4081fc
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x4081e9
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x4081d2
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x4081c1
xor ecx, eax
xor edx, ebx
dec edi
jne 0x4081b2
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x417c80
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x417ca2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
mov dword [ebp - 4], 0
nop
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getsockname
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
nop
imul esi, esi, 0x88
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
imul edx, edx, 6
add esi, edx
nop
nop
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getsockname
cpuid
shr ecx, 0x10
imul ecx, ecx, 9
add esi, ecx
pop edx
pop ecx
pop ebx
nop
nop
nop
xor esi, 0x124254
mov dword [ebp - 4], esi
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
nop
nop
nop
mov eax, dword [ebp - 4]
jmp 0x417ddd
mov esp, ebp
pop ebp
ret

Function at 0x419b58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
jmp 0x419b6d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
push edx
push ecx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, ds:[esi*4]
mov ecx, dword [eax + ecx]
xor ecx, 0x25226160
xor ecx, 0x72a1e76f
xor ecx, 0x3246b280
xor ecx, 0x56cf0954
xor ecx, 0x5cd773ad
xor ecx, 0x4bc4373d
xor ecx, 0xc6f81d7
xor ecx, 0x40cc9522
xor ecx, 0xd23dbf0
xor ecx, 0x25fa1a1d
xor ecx, 0x7c1caae8
xor ecx, 0x405c73a9
xor ecx, 0x429d8bcf
xor ecx, 0xe31998
xor ecx, 0x6d9fe52f
xor ecx, 0x1e459db3
xor ecx, 0x6799dbdd
xor ecx, 0x6dbafbe8
xor ecx, 0x63ebbfef
xor ecx, 0x7d87c7f9
xor ecx, 0x76c8f2d5
xor ecx, 0x79d83daa
xor ecx, 0x741bb5e8
xor ecx, 0x2e481a0f
xor ecx, 0x14a6cce
xor ecx, 0x662747a1
xor ecx, 0x7ff441
xor ecx, 0x3416a68d
xor ecx, 0x1a115d74
nop
nop
nop
nop
nop
nop
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp esi, dword [ebp + 0xc]
jne 0x419bdf
pop esi
pop ecx
pop edx
nop
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x419ce2
nop
nop
nop
nop
nop
nop
mov esp, ebp
pop ebp
ret 8
Function at 0x41cb9d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
jmp 0x41cbb2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push ebx
mov ebx, 1
mov ebx, 2
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 5
pop ebx
push esi
xor esi, esi
nop
mov eax, reloc.WS2_32.dll_getsockname
cpuid
shr ecx, 0x10
add esi, ecx
nop
nop
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
mov eax, 1
xor edx, edx
cpuid
add esi, edx
xor esi, eax
rdtsc
add esi, edx
xor esi, 0x76bcf50e
mov eax, reloc.WS2_32.dll_getsockname
cpuid
shr ecx, 0x10
add esi, ecx
nop
nop
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
mov eax, 1
xor edx, edx
cpuid
add esi, edx
xor esi, eax
rdtsc
add esi, edx
xor esi, 0xe9db1063
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41e299
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
jmp 0x41e2ae
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push ebx
mov ebx, 1
mov ebx, 2
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 5
pop ebx
push edx
push ecx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, ds:[esi*4]
mov ecx, dword [eax + ecx]
xor ecx, 0x37714fe1
xor ecx, 0x2463c0fd
xor ecx, 0x477dadce
xor ecx, 0x2a6e3456
xor ecx, 0x788c8776
xor ecx, 0x7c90e81d
xor ecx, 0x2d1b08f5
xor ecx, 0x5c51fda6
xor ecx, 0x538527c3
xor ecx, 0x3c4940ac
xor ecx, 0x78ebe208
xor ecx, 0x4eb1cac0
xor ecx, 0x16c56d63
xor ecx, 0x3ddc3283
xor ecx, 0x6986def
xor ecx, 0x26252c68
xor ecx, 0x2acc1a3a
xor ecx, 0x2135f540
xor ecx, 0x11b13b78
xor ecx, 0x360cda90
xor ecx, 0x18919944
xor ecx, 0x48007a53
xor ecx, 0x64dd51e3
xor ecx, 0x29369c0f
xor ecx, 0x113b3306
xor ecx, 0x1a115d74
xor ecx, 0x3416a68d
xor ecx, 0x7ff441
xor ecx, 0x662747a1
nop
nop
nop
nop
nop
nop
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp esi, dword [ebp + 0xc]
jne 0x41e320
pop esi
pop ecx
pop edx
nop
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x41e423
nop
nop
nop
nop
nop
nop
mov esp, ebp
pop ebp
ret 8
Function at 0x420786
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x4209d3
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x4208d0
cmp byte [edx + edi], 0xd
jne 0x4208d0
cmp byte [edx + edi + 1], 0xa
je 0x420909
mov al, byte [edx + edi]
cmp al, 0xa
je 0x420909
cmp al, 0x3d
jne 0x4208e5
inc ecx
cmp ecx, 2
ja 0x4209e1
cmp al, 0x7f
ja 0x4209e1
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x4209e1
cmp al, 0x40
jae 0x420908
test ecx, ecx
jne 0x4209e1
inc esi
inc edx
cmp edx, ebx
jb 0x4208ba
test esi, esi
je 0x4209d3
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x4209f2
cmp dword [ecx], eax
jb 0x4209f2
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x4209c2
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x4209be
cmp al, 0xa
je 0x4209be
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x4209be
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x4209a9
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x4209b6
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x4209be
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x42095a
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x43d511
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43d534
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43d534
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43d53e
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43d580
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43d5e2
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43d5dd
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43d5c8
test dl, dl
je 0x43d5c4
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43d5c8
add ecx, 2
add eax, 2
test dl, dl
jne 0x43d5a8
xor eax, eax
jmp 0x43d5cd
sbb eax, eax
or eax, 1
test eax, eax
je 0x43d5ee
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43d595
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x43d673
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43d696
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43d696
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43d6a0
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43d6e2
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43d744
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43d73f
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43d72a
test dl, dl
je 0x43d726
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43d72a
add ecx, 2
add eax, 2
test dl, dl
jne 0x43d70a
xor eax, eax
jmp 0x43d72f
sbb eax, eax
or eax, 1
test eax, eax
je 0x43d750
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43d6f7
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x43d7e2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43d805
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43d805
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43d80f
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43d851
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43d8b3
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43d8ae
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43d899
test dl, dl
je 0x43d895
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43d899
add ecx, 2
add eax, 2
test dl, dl
jne 0x43d879
xor eax, eax
jmp 0x43d89e
sbb eax, eax
or eax, 1
test eax, eax
je 0x43d8bf
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43d866
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x43d94c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43d96f
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43d96f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43d979
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43d9bb
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43da1d
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43da18
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43da03
test dl, dl
je 0x43d9ff
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43da03
add ecx, 2
add eax, 2
test dl, dl
jne 0x43d9e3
xor eax, eax
jmp 0x43da08
sbb eax, eax
or eax, 1
test eax, eax
je 0x43da29
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43d9d0
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x43dac2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43dae5
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43dae5
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43daef
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43db31
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43db93
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43db8e
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43db79
test dl, dl
je 0x43db75
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43db79
add ecx, 2
add eax, 2
test dl, dl
jne 0x43db59
xor eax, eax
jmp 0x43db7e
sbb eax, eax
or eax, 1
test eax, eax
je 0x43db9f
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43db46
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x43dc33
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43dc56
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x43dc56
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x43dc60
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x43dca2
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x43dd04
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x43dcff
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x43dcea
test dl, dl
je 0x43dce6
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x43dcea
add ecx, 2
add eax, 2
test dl, dl
jne 0x43dcca
xor eax, eax
jmp 0x43dcef
sbb eax, eax
or eax, 1
test eax, eax
je 0x43dd10
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x43dcb7
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8