joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450619
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov ax, word [ebp - 0x46]
call fcn.004559d1
jb 0x450630
call fcn.0045b37b
jb 0x450630
pop edi
pop esi
ret
pop edi
pop esi
jmp fcn.0044ea56

Function at 0x4506ca
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.0044eb1e
jb 0x4506da
ret
jmp fcn.0044ea56

Function at 0x4506df
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call fcn.0044eb57
jb 0x4506da
ret

Function at 0x450739
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00455959
or ecx, ecx
je 0x45080f
mov ebx, esi
mov edx, 3
mov al, byte [ebx]
cmp al, 0x22
jne 0x450770
inc ebx
dec ecx
je 0x45078d
cmp byte [ebx], 0x22
jne 0x450762
inc ebx
loop 0x45075c
jmp 0x45078d
cmp al, 0x5c
jne 0x45077d
inc ebx
dec ecx
je 0x45078d
inc ebx
loop 0x45075c
jmp 0x45078d
cmp al, 0x3b
je 0x450786
inc ebx
loop 0x45075c
jmp 0x45078d
push ebx
dec edx
je 0x450791
inc ebx
loop 0x45075c
push ebx
dec edx
jne 0x45078d
pop edx
pop ecx
pop ebx
ftst
wait
fnstsw ax
sahf
jb 0x4507b1
jne 0x4507ad
cmp ecx, edx
je 0x4507ad
inc ecx
cmp ecx, edx
je 0x4507ad
mov eax, edx
mov esi, ecx
jmp 0x4507c0
mov eax, ebx
jmp 0x4507c0
cmp ebx, ecx
je 0x4507ad
inc ebx
cmp ebx, edx
je 0x4507ad
mov eax, ecx
mov esi, ebx
fchs
cmp eax, esi
jbe 0x45080f
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x4507c9
push esp
push esi
push esi
push eax
mov ecx, eax
sub ecx, esi
call fcn.00450837
call fcn.0045bc48
pop ecx
mov esi, esp
push ecx
call fcn.0045b74b
jb 0x4507fd
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
mov edx, eax
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.0044ea4b
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x450814
mov esi, esp
call fcn.0045b934
call fcn.0045bc48
dec edx
cmp byte [esi], 0x20
jne 0x450833
dec edx
inc esi
mov ecx, edx
jmp 0x4507ea

Function at 0x451592
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.00455959
jecxz 0x4515d4
call fcn.004558fd
jb 0x451620
cld
test eax, eax
je 0x4515bf
lodsb al, byte [esi]
call fcn.004516eb
stosb byte es:[edi], al
loop 0x4515b2
mov esi, edx
jmp 0x4515cc
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharLowerBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00455931
pop ebp
pop edi
pop esi
pop ecx
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
jmp fcn.0044ea4b
Function at 0x4515d9
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.00455959
jecxz 0x45161b
call fcn.004558fd
jb 0x451620
cld
test eax, eax
je 0x451606
lodsb al, byte [esi]
call fcn.00451727
stosb byte es:[edi], al
loop 0x4515f9
mov esi, edx
jmp 0x451613
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharUpperBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00455931
pop ebp
pop edi
pop esi
pop ecx
ret

Function at 0x45162b
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
push ebx
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.00455959
test ecx, ecx
je 0x4516df
call fcn.004558fd
jb 0x4516e5
cld
test eax, eax
je 0x451675
mov ah, 0xff
lodsb al, byte [esi]
test ah, ah
jne 0x451664
call fcn.004516eb
jmp 0x451669
call fcn.00451727
stosb byte es:[edi], al
call fcn.00451763
loop 0x451658
mov esi, edx
jmp 0x4516d7
push edi
push ecx
push edi
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
mov edi, 0xffffffff
test byte [esi], 0xff
mov ebx, 1
je 0x45169a
push eax
push ecx
push esi
call dword [sym.imp.USER32.DLL_CharNextA]
mov ebx, eax
sub ebx, esi
pop ecx
pop eax
test edi, edi
jne 0x4516aa
push ecx
push ebx
push esi
call dword [sym.imp.USER32.DLL_CharLowerBuffA]
pop ecx
jmp 0x4516b4
push ecx
push ebx
push esi
call dword [sym.imp.USER32.DLL_CharUpperBuffA]
pop ecx
push ecx
push 0
push esp
push ebx
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_GetStringTypeA]
pop eax
pop ecx
xor edi, edi
test eax, 0x100
jne 0x4516d0
dec edi
add esi, ebx
sub ecx, ebx
jg 0x451681
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00455931
pop ebx
pop ebp
pop edi
pop esi
pop ecx
ret
pop ebx
jmp 0x451620
Function at 0x451a02
Capabilities:
Get socket status
Send data
Send data on socket
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x104
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00455959
call fcn.00455a0f
jb 0x451aae
test byte [edi + 0xc], 0x40
je 0x451ab2
add esp, 0x104
mov ebx, ecx
mov eax, dword [edi + 6]
mov ecx, 0x40
push eax
loop 0x451a42
push 0x40
mov edx, esp
mov eax, dword [edi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push edx
push 0
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x451a9f
test eax, eax
je 0x451abe
push 0
push ebx
push esi
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_send]
cmp eax, 0xffffffff
je 0x451a9f
add esi, eax
sub ebx, eax
jg 0x451a47
and word [edi + 0x2c], 0xfffd
call fcn.0045bc48
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x451ab6
jmp 0x451aba
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0045bc48
add esp, 0x104
pop edi
pop esi
jmp fcn.0044ea56

Function at 0x451e04
Capabilities:
Get hostname

Disassembly:
push esi
push edi
sub esp, 0x100
push 0x100
lea eax, [esp + 4]
push eax
call dword [sym.imp.WS2_32.DLL_gethostname]
test eax, eax
je 0x451e24
mov byte [esp], 0
lea ecx, [esp - 1]
mov esi, esp
inc ecx
test byte [ecx], 0xff
jne 0x451e2a
sub ecx, esi
cmp ecx, 0x100
jb 0x451e3f
mov ecx, 0x100
call fcn.0045b74b
add esp, 0x100
pop edi
pop esi
ret

Function at 0x451fb2
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push esi
push edi
mov ebx, eax
sub esp, 0x190
push esp
push 2
call dword [sym.imp.WS2_32.DLL_WSAStartup]
mov cl, byte [esp]
add esp, 0x190
test eax, eax
jne 0x452008
cmp cl, 2
jne 0x452008
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00455959
push esi
call dword [sym.imp.WS2_32.DLL_gethostbyname]
test eax, eax
je 0x452008
mov ecx, dword [eax + 0xc]
jecxz 0x452008
mov eax, dword [ecx]
test eax, eax
je 0x452008
dec ebx
je 0x452004
add ecx, 4
jmp 0x451ff6
mov eax, dword [eax]
jmp 0x45200a
xor eax, eax
push eax
call dword [sym.imp.WS2_32.DLL_WSACleanup]
call fcn.0045bc48
pop eax
pop edi
pop esi
ret
Function at 0x45207c
Capabilities:
Create udp socket
Get hostname
Initialize winsock library
Set socket configuration
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x228
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], 0
xchg ch, cl
mov ebx, ecx
sub esp, 0x190
push esp
push 2
call dword [sym.imp.WS2_32.DLL_WSAStartup]
mov cl, byte [esp]
add esp, 0x190
test eax, eax
jne 0x45220a
cmp cl, 2
jne 0x45220a
mov ax, word [ebp - 0x46]
test ax, ax
js 0x452206
call fcn.00455a0f
jae 0x452202
mov ecx, 0x10044
call fcn.004558fd
jb 0x45220c
mov dword [ebp - 0x64], edx
call fcn.00455a4d
jb 0x45220c
cld
xor eax, eax
mov ecx, 0x20
push edi
add edi, 4
rep stosw word es:[edi], ax
pop edi
mov ax, word [ebp - 0x46]
mov ecx, dword [ebp - 0x6c]
mov word [edi + 4], ax
mov word [edi + 0xa], 2
mov word [edi + 0xc], pe_nt_image_headers32
mov word [edi + 0xe], 0xc0
mov dword [edi + 0x1c], 0x10000
mov dword [edi + 0x30], ebx
mov dword [edi + 0x38], ecx
push 0
push 2
push 2
call dword [sym.imp.WSOCK32.DLL_socket]
cmp eax, 0xffffffff
je 0x4521e6
mov dword [edi + 6], eax
push 0x100
lea eax, [esp + 8]
push eax
call dword [sym.imp.WS2_32.DLL_gethostname]
test eax, eax
jne 0x4521e6
lea eax, [esp + 3]
lea edx, [eax + 1]
inc eax
test byte [eax], 0xff
jne 0x452162
sub eax, edx
cmp eax, 0x100
jb 0x452176
mov eax, 0x100
mov dword [esp], eax
cmp dword [edi + 0x30], 0xffffffff
je 0x4521a1
push 0
push 0
push 0
push word [edi + 0x30]
push 2
mov eax, esp
push 0x10
push eax
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_bind]
add esp, 0x10
test eax, eax
jne 0x4521e6
mov ebx, edi
mov ecx, dword [esp]
call fcn.004558fd
jb 0x45220c
mov dword [ebx + 0x10], edx
cld
lea esi, [esp + 4]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
mov edx, esp
push 4
push edx
push 0x20
push 0xffff
push dword [ebx + 6]
call dword [sym.imp.WSOCK32.DLL_setsockopt]
pop edx
test eax, eax
jne 0x4521e6
add esp, 0x228
pop edi
pop esi
ret
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
cmp eax, 0x2734
jne 0x4521f7
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
push eax
call fcn.00451c55
pop eax
mov dx, 0x37b0
mov al, 0x37
mov dx, 0x34b0
mov al, 0x34
mov dx, 0x44b0
mov al, 0x44
mov edx, dword [ebp - 0x64]
test edx, edx
je 0x452221
push eax
mov esi, edx
call fcn.00455a98
call fcn.00455931
pop eax
add esp, 0x228
pop edi
pop esi
jmp fcn.0044ea56
Function at 0x45222e
Capabilities:
Get socket status
Receive data
Receive data on socket
Terminate process

Disassembly:
push esi
push edi
mov dword [ebp - 0x6c], 0
sub esp, 0x104
mov ax, word [ebp - 0x46]
call fcn.004559d1
jb 0x452327
test byte [esi + 0xc], 0x80
je 0x45232b
and word [esi + 0x2c], 0xfffd
add esp, 0x104
mov eax, dword [esi + 6]
mov ecx, 0x40
push eax
loop 0x452269
push 0x40
mov edx, esp
mov eax, dword [esi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push 0
push edx
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x452318
test eax, eax
je 0x452337
lea ecx, [esi + 0x34]
lea edx, [esi + 0x44]
push 0
push 0
push dword [esi + 0x34]
push word [esi + 0x30]
push 2
mov ecx, esp
lea edx, [esi + 0x44]
push 0x10
push esp
push ecx
push 0
push 0x10000
push edx
push dword [esi + 6]
call dword [sym.imp.WSOCK32.DLL_recvfrom]
add esp, 4
mov ebx, dword [esp + 4]
movzx ecx, word [esp + 2]
add esp, 0x10
cmp eax, 0xffffffff
je 0x452318
test eax, eax
jne 0x4522ee
or word [esi + 0x2c], 2
xchg ecx, eax
call fcn.004558fd
jb 0x452339
add esi, 0x44
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045b704
mov ecx, ebx
xchg ah, al
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x45232f
jmp 0x452333
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0045b702
add esp, 0x104
pop edi
pop esi
jmp fcn.0044ea56

Function at 0x45234b
Capabilities:
Get socket status
Send data
Send data on socket
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x104
mov ebx, ecx
push eax
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00455959
call fcn.00455a0f
pop eax
jb 0x452404
test byte [edi + 0xc], 0x80
je 0x452408
xchg ah, al
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ebx
add esp, 0x104
mov ebx, ecx
mov eax, dword [edi + 6]
mov ecx, 0x40
push eax
loop 0x452397
push 0x40
mov edx, esp
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.WSOCK32.DLL_select]
cmp eax, 0xffffffff
je 0x4523f5
test eax, eax
je 0x452414
push 0
push 0
push dword [edi + 0x34]
push word [edi + 0x30]
push 2
mov ecx, esp
push 0x10
push ecx
push 0
push ebx
push esi
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_sendto]
add esp, 0x10
cmp eax, 0xffffffff
je 0x4523f5
cmp eax, ebx
jb 0x452410
and word [edi + 0x2c], 0xfffd
call fcn.0045bc48
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x45240c
jmp 0x452410
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0045bc48
add esp, 0x104
pop edi
pop esi
jmp fcn.0044ea56
Function at 0x4524a8
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.004559d1
jb 0x4524e9
cmp word [esi + 0xa], 1
jne 0x4524e5
mov ax, word [esi + 0xc]
fild qword [esi + 0x14]
test al, 1
je 0x4524c5
fiadd dword [esi + 0x24]
fiadd word [esi + 0x2e]
test al, 0xb
je 0x4524e3
push pe_nt_image_headers32
fidiv dword [esp]
fldcw word [0x44e776]
frndint
fldcw word [0x44e76e]
pop eax
pop esi
ret
fldz
pop esi
ret
fldz
pop esi
jmp fcn.0044ea56

Function at 0x4524f1
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.004559d1
jb 0x452525
cmp word [esi + 0xa], 2
je 0x452521
push ecx
lea eax, [esi + 0x3c]
push eax
push dword [esi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_GetFileSize]
call fcn.0045bc61
pop ecx
jb 0x452527
push dword [esi + 0x3c]
push eax
fild qword [esp]
pop edx
pop edx
pop esi
ret
pop esi
fldz
ret
mov edx, eax
pop esi
fldz
jmp fcn.0044ea4b

Function at 0x4527ff
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00455959
test eax, eax
jns 0x452818
add eax, ecx
test edx, edx
je 0x452858
jns 0x452823
add edx, ecx
js 0x452858
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x45282c
xor ecx, ecx
cmp ecx, eax
jb 0x452832
mov ecx, eax
call fcn.004558fd
jb 0x45285c
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00456343
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x452846
pop edi
pop esi
jmp fcn.0044ea56

Function at 0x452863
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00455959
test eax, eax
jns 0x45287b
add eax, ecx
cmp eax, ecx
jae 0x4528a7
xchg ecx, eax
call fcn.004558fd
jb 0x4528ab
sub eax, ecx
add esi, eax
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00456343
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
ret
pop edi
pop esi
pop ecx
jmp fcn.0044ea56

Function at 0x4528cd
Capabilities:
Terminate process

Disassembly:
call fcn.00452957
push 0
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
call fcn.0045bc61
jb 0x4528e9
add esp, 0x114
ret
add esp, 0x114
jmp fcn.0044ea4b

Function at 0x452957
Capabilities:
Terminate process

Disassembly:
pop ecx
sub esp, 0x114
mov edx, esp
call fcn.0045245d
test ah, ah
jne 0x45296b
jmp ecx
add esp, 0x114
mov edx, 0x4c
jmp fcn.0044ea4b

Function at 0x455314
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, eax
call fcn.004558fd
jb 0x455346
xor eax, eax
jmp 0x455333

Function at 0x455323
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, eax
call fcn.004558fd
jb 0x455346
mov eax, 0x20202020
cld
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
call fcn.0045b704
pop edi
pop ecx
ret
pop edi
pop ecx
call fcn.0045b702
jmp fcn.0044ea56
Function at 0x45536b
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, 1
call fcn.004558fd
jb 0x455346
mov byte [edi], 0
call fcn.0045b704
pop edi
pop ecx
ret

Function at 0x4553c5
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov ax, word [ebp - 0x46]
call fcn.00455a0f
jb 0x4553ea
mov esi, dword [ebp + esi - 0x6c]
call fcn.00455959
jecxz 0x4553ea
mov edx, ecx
call fcn.0045b321
pushfd
call fcn.0045bc48
popfd
jb 0x45545e
pop edi
pop esi
ret
pop edi
pop esi
jmp fcn.0044ea56

Function at 0x4554b7
Capabilities:
Terminate process

Disassembly:
push edi
xchg ecx, ebx
call fcn.004558fd
jb 0x4554d7
call fcn.0045b704
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
ret
call fcn.0045b702
pop edi
jmp fcn.0044ea56

Function at 0x45570f
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00455959
call fcn.00455a0f
jb 0x45576b
mov al, byte [edi + 0xc]
test al, 0x20
je 0x45576f
push 0
lea edx, [edi + 0x3c]
push edx
push ecx
push esi
push dword [edi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_WriteFile]
call fcn.0045bc61
jb 0x455767
test byte [edi + 0xc], 4
jne 0x45575a
mov eax, dword [edi + 0x3c]
add dword [edi + 0x14], eax
adc dword [edi + 0x18], 0
and word [edi + 0x2c], 0xfffd
call fcn.0045bc48
pop edi
pop esi
ret
mov al, dl
mov dx, 0x34b0
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x3db0
mov dx, 0x3fb0
call fcn.0045bc48
pop edi
pop esi
jmp fcn.0044ea56

Function at 0x456419
Capabilities:
Terminate process

Disassembly:
call fcn.0045b7f6
jb 0x456421
ret
jmp fcn.0044ea56

Function at 0x456a9d
Capabilities:
Terminate process

Disassembly:
fldcw word [0x44e76e]
mov edx, eax
call fcn.0044eb1e
jb 0x456aaf
mov dword [eax + 0x38], edx
mov eax, edx
test eax, eax
js 0x456ab6
ret
mov edx, 0x63
jmp fcn.0044ea4b
Function at 0x4578b2
Capabilities:
Terminate process

Disassembly:
sub esp, 0x330
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push ebx
push ebp
push esi
push edi
mov ebp, esp
call fcn.004579d4
call fcn.00457c21
test ebx, ebx
je 0x4579b2
lea eax, [ebp + 0x6c]
push eax
push 0x800
mov eax, dword [ebp + 0x64]
inc eax
push eax
lea eax, [ebp + 0x300]
push eax
lea eax, [ebp + 0x20]
push eax
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x14]
call fcn.00457cfd
js 0x4579b2
mov eax, 0xfffffffd
xchg dword [ebp + 0x6c], eax
mov dword [ebp + 0x68], eax
cmp dword [ebp + 0x390], 2
jbe 0x45795c
sub dword [ebp + 0x5c], 4
inc dword [ebp + 0x60]
inc dword [ebp + 0x64]
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x30]
push eax
push 0
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x390]
push 0x800
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x68]
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x18]
dec dword [ebp + 0x64]
dec dword [ebp + 0x60]
jmp 0x45798f
mov ecx, dword [ebp + 0x388]
jecxz 0x457967
lea ecx, [ebp + 0x10]
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x30]
push eax
push ecx
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x390]
push 0x800
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x68]
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x18]
call fcn.00457cfd
js 0x4579b2
call fcn.00457aed
call fcn.00457c39
mov ecx, dword [ebp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x374
pop edx
add esp, ecx
jmp edx
call fcn.00457aed
call fcn.00457c39
mov al, 0x63
mov ecx, dword [ebp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x374
pop edx
add esp, ecx
push edx
jmp fcn.0044ea56

Function at 0x458088
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push ecx
mov esi, edx
mov ecx, dword [esi - 4]
shl ecx, 1
je 0x4580a5
call fcn.004558fd
jb 0x4580a9
cld
xor eax, eax
shr ecx, 1
lodsb al, byte [esi]
stosw word es:[edi], ax
loop 0x4580a0
pop ecx
pop edi
pop esi
ret
pop ecx
pop edi
pop esi
jmp fcn.0044ea56

Function at 0x45885d
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [0x45d3e0]
mov ecx, eax
jecxz 0x4588b7
cld
lodsb al, byte [esi]
test al, al
je 0x4588b3
cmp al, 0x20
je 0x45886b
cmp al, 0x22
je 0x458893
lea edi, [esi - 1]
lodsb al, byte [esi]
test al, al
je 0x458888
cmp al, 0x20
jne 0x45887b
loop 0x45886b
jmp 0x45888a
loop 0x4588b3
lea ecx, [esi - 1]
mov esi, edi
sub ecx, esi
jmp 0x4588c6
mov edi, esi
lodsb al, byte [esi]
test al, al
je 0x4588a8
cmp al, 0x22
jne 0x458895
cmp byte [esi - 2], 0x22
je 0x45886b
loop 0x45886b
jmp 0x4588aa
loop 0x4588b3
lea ecx, [esi - 1]
mov esi, edi
sub ecx, esi
jmp 0x4588c6
xor ecx, ecx
jmp 0x4588c6
push esi
mov ecx, 0xffffffff
dec esi
inc ecx
inc esi
test byte [esi], 0xff
jne 0x4588be
pop esi
call fcn.0045b74b
pop edi
pop esi
pop ecx
jb 0x4588d1
ret
jmp fcn.0044ea56
Function at 0x4589b1
Capabilities:
Terminate process

Disassembly:
xor edx, edx
jmp 0x458a06
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x68]
call fcn.00455959
mov edi, dword [ebp + edi - 0x6c]
call fcn.0045596c
jecxz 0x4589ad
test eax, eax
je 0x4589ad
jns 0x4589d8
add eax, ecx
inc eax
dec eax
sub ecx, eax
jbe 0x4589ad
push eax
add esi, eax
call fcn.00459670
pop edx
jae 0x4589ec
test edx, edx
je 0x458a1f
mov ecx, esi
mov esi, eax
sub ecx, eax
call fcn.004558fd
jb 0x458a26
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045bc48
call fcn.00456343
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0045bc48
jmp 0x458a1a
call fcn.0045bc48
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.0044ea4b

Function at 0x458af6
Capabilities:
Terminate process

Disassembly:
mov edx, 0x34
jmp fcn.0044ea4b
push esi
or eax, eax
je 0x458b5f
dec eax
je 0x458b6e
dec eax
je 0x458b7b
dec eax
je 0x458b87
cmp eax, 0xfffffffc
je 0x458b53
cmp eax, 0xfffffffb
je 0x458b46
cmp eax, 0xfffffffa
je 0x458b39
cmp eax, 0xfffffff9
je 0x458b2d
cmp eax, 0xfffffff8
jne 0x458b5f
call fcn.00458b90
jb 0x458b97
mov eax, dword [esi + 0x34]
jmp 0x458b8e
call fcn.00458b90
jb 0x458b97
mov eax, dword [esi + 0x30]
jmp 0x458b8e
call fcn.00458b90
jb 0x458b97
movzx eax, word [esi + 0xa]
jmp 0x458b8e
call fcn.00458b90
jb 0x458b97
movzx eax, word [esi + 0x2e]
jmp 0x458b8e
call fcn.00458b90
jb 0x458b97
mov eax, dword [esi + 0x1c]
jmp 0x458b8e
call fcn.00458b90
mov eax, 0
jb 0x458b8e
dec eax
jmp 0x458b8e
call fcn.00458b90
jb 0x458b97
movzx eax, word [esi + 0xc]
jmp 0x458b8e
call fcn.00458b90
jb 0x458b97
mov eax, dword [esi + 6]
jmp 0x458b8e
mov eax, ecx
call fcn.00455aed
pop esi
ret
pop esi
xor eax, eax
jmp 0x44ea31

Function at 0x458d4c
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00455959
je 0x458d93
mov al, 0x20
cmp byte [esi], al
je 0x458d6d
jmp 0x458d93
cmp byte [esi], al
jne 0x458d70
inc esi
loop 0x458d69
call fcn.004558fd
jb 0x458d98
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00456343
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
pop eax
ret
mov edx, eax
pop edi
pop esi
pop ecx
pop eax
jmp fcn.0044ea4b

Function at 0x458da3
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00455959
je 0x458d93
lea edi, [esi - 1]
add edi, ecx
mov al, 0x20
cmp byte [edi], al
je 0x458dc9
jmp 0x458d93
cmp byte [edi], al
jne 0x458d70
dec edi
loop 0x458dc5
jmp 0x458d70