joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6c4]
add edx, 1
mov dword [ebp - 0x6c4], edx
mov eax, dword [ebp - 0x744]
mov ecx, dword [ebp - 0x6c4]
cmp ecx, dword [eax + 0x18]
jae 0x415498
mov edx, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x1c3c]
mov ecx, dword [ebp - 0x354]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x74c], ecx
mov edx, dword [ebp - 0x6c4]
invalid
dec dword [ebx - 0x1c3f7b]
dec dword [edi]
mov bh, 0xc
push eax
mov edx, dword [ebp - 0x1c44]
mov eax, dword [ebp - 0x354]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1c48], eax
mov dword [ebp - 0x158], 0
jmp 0x4152fc
mov ecx, dword [ebp - 0x158]
add ecx, 1
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x74c]
add edx, dword [ebp - 0x158]
movsx eax, byte [edx]
test eax, eax
je 0x4153ae
mov ecx, dword [ebp - 0x158]
movsx edx, byte [ebp + ecx - 0x850]
test edx, edx
je 0x4153ae
push ebx
push eax
add esp, 4
add ebx, 0x17c4
and ebx, 0xb690
add ebx, 0x17dc
and ebx, 0x8e6a
pop ebx
push ecx
and ecx, 0x159af
sub ecx, 0xe881
add ecx, 0x143c0
pop ecx
mov eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0x158]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x158]
movsx eax, byte [ebp + edx - 0x850]
cmp ecx, eax
je 0x4153a0
mov ecx, dword [ebp - 0x74c]
add ecx, dword [ebp - 0x158]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x158]
movsx ecx, byte [ebp + eax - 0x850]
cmp edx, ecx
jne 0x4153a7
jmp 0x4152ed
jmp 0x4153ae
push edi
or edi, 0x16c97
call fcn.004153c4
add byte [eax], bh
cmp al, byte [edi + 0x3c]
xor dh, byte [edx]
dec eax
xor cl, byte [eax - 0x7d]
add esp, 4
sub edi, 0x9c60
and edi, 0x4b4f
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0xbdf
pop ebx
mov edx, dword [ebp - 0x74c]
add edx, dword [ebp - 0x158]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x158]
movsx edx, byte [ebp + ecx - 0x850]
cmp eax, edx
jne 0x41540d
mov dword [ebp - 0xc6c], 0
jmp 0x41547c
push eax
push esi
add esp, 4
xor eax, 0x48a0
call 0x415425
add byte [eax], bh
cmp al, 0x41
inc edx
xor eax, 0xc4833434
add al, 0xeb
add al, 0x49
cmp byte [ecx + eax*2 + 0x58], cl
push edx
sub edx, 0x15ac5
jmp 0x41543e
pop edx
mov eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0x158]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x158]
movsx eax, byte [ebp + edx - 0x850]
or eax, 0x20
cmp ecx, eax
jge 0x415472
mov dword [ebp - 0xc6c], 0xffffffff
jmp 0x41547c
mov dword [ebp - 0xc6c], 1
cmp dword [ebp - 0xc6c], 0
jne 0x415493
mov ecx, dword [ebp - 0x1c48]
mov dword [ebp - 0x39c], ecx
jmp 0x4154a4
jmp 0x41527d
mov edx, dword [ebp - 0x750]
mov dword [ebp - 0x39c], edx
cmp dword [ebp - 0x39c], 0
je 0x41557f
push edx
push ebx
add esp, 4
call 0x4154c3
add byte [esp + ecx*2], bh
inc ecx
inc ecx
cmp esi, dword [0x8104c483]
ret 0x7b00
Function at 0x4154c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x6c4]
add edx, 1
mov dword [ebp - 0x6c4], edx
mov eax, dword [ebp - 0x744]
mov ecx, dword [ebp - 0x6c4]
cmp ecx, dword [eax + 0x18]
jae 0x415498
mov edx, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x1c3c]
mov ecx, dword [ebp - 0x354]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x74c], ecx
mov edx, dword [ebp - 0x6c4]
invalid
dec dword [ebx - 0x1c3f7b]
dec dword [edi]
mov bh, 0xc
push eax
mov edx, dword [ebp - 0x1c44]
mov eax, dword [ebp - 0x354]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1c48], eax
mov dword [ebp - 0x158], 0
jmp 0x4152fc
mov ecx, dword [ebp - 0x158]
add ecx, 1
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x74c]
add edx, dword [ebp - 0x158]
movsx eax, byte [edx]
test eax, eax
je 0x4153ae
mov ecx, dword [ebp - 0x158]
movsx edx, byte [ebp + ecx - 0x850]
test edx, edx
je 0x4153ae
push ebx
push eax
add esp, 4
add ebx, 0x17c4
and ebx, 0xb690
add ebx, 0x17dc
and ebx, 0x8e6a
pop ebx
push ecx
and ecx, 0x159af
sub ecx, 0xe881
add ecx, 0x143c0
pop ecx
mov eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0x158]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x158]
movsx eax, byte [ebp + edx - 0x850]
cmp ecx, eax
je 0x4153a0
mov ecx, dword [ebp - 0x74c]
add ecx, dword [ebp - 0x158]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x158]
movsx ecx, byte [ebp + eax - 0x850]
cmp edx, ecx
jne 0x4153a7
jmp 0x4152ed
jmp 0x4153ae
push edi
or edi, 0x16c97
call fcn.004153c4
add byte [eax], bh
cmp al, byte [edi + 0x3c]
xor dh, byte [edx]
dec eax
xor cl, byte [eax - 0x7d]
add esp, 4
sub edi, 0x9c60
and edi, 0x4b4f
pop edi
push ebx
push ecx
add esp, 4
add ebx, 0xbdf
pop ebx
mov edx, dword [ebp - 0x74c]
add edx, dword [ebp - 0x158]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x158]
movsx edx, byte [ebp + ecx - 0x850]
cmp eax, edx
jne 0x41540d
mov dword [ebp - 0xc6c], 0
jmp 0x41547c
push eax
push esi
add esp, 4
xor eax, 0x48a0
call 0x415425
add byte [eax], bh
cmp al, 0x41
inc edx
xor eax, 0xc4833434
add al, 0xeb
add al, 0x49
cmp byte [ecx + eax*2 + 0x58], cl
push edx
sub edx, 0x15ac5
jmp 0x41543e
pop edx
mov eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0x158]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x158]
movsx eax, byte [ebp + edx - 0x850]
or eax, 0x20
cmp ecx, eax
jge 0x415472
mov dword [ebp - 0xc6c], 0xffffffff
jmp 0x41547c
mov dword [ebp - 0xc6c], 1
cmp dword [ebp - 0xc6c], 0
jne 0x415493
mov ecx, dword [ebp - 0x1c48]
mov dword [ebp - 0x39c], ecx
jmp 0x4154a4
jmp 0x41527d
mov edx, dword [ebp - 0x750]
mov dword [ebp - 0x39c], edx
cmp dword [ebp - 0x39c], 0
je 0x41557f
push edx
push ebx
add esp, 4
call 0x4154c3
add byte [esp + ecx*2], bh
inc ecx
inc ecx
cmp esi, dword [0x8104c483]
ret 0x7b00
Function at 0x4154df
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x1c4c], eax
push edx
push edx
add esp, 4
sub edx, 0x6dee
jmp 0x415500
jmp 0x415506
pop edx
push eax
and eax, 0x14503
jmp 0x415514
and eax, 0x2e21
add eax, 0x8be
pop eax
mov ecx, dword [ebp - 0x1c4c]
mov dword [ebp - 0x1c50], ecx
lea edx, [ebp - 0x15e8]
push edx
call dword [ebp - 0x1c50]
test eax, eax
jne 0x41557f
push edx
xor edx, 0x5f5a
pop edx
push edi
push eax
add esp, 4
or edi, 0xeb20
xor edi, 0x131fb
pop edi
push esi
push esi
add esp, 4
add esi, 0xe9a7
add esi, 0x10852
and esi, 0xc98f
pop esi
mov dword [ebp - 0xa50], 0
jmp 0x415c69

Function at 0x4157a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop esi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x4157be
movzx ecx, word [ebp - 0x1c0]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x1584], ecx
jmp 0x415818
movzx eax, word [ebp - 0x1c0]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x4156e6
movzx edx, word [ebp - 0x1c0]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x4156e6
movzx ecx, word [ebp - 0x1c0]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x415802
mov dword [ebp - 0x1580], 0xffffffff
mov dword [ebp - 0x1580], 1
Function at 0x41587a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
sub eax, 0x8910
pop eax
push ecx
push edx
add esp, 4
xor ecx, 0xdb6b
and ecx, 0x17da7
pop ecx
push edi
push ebx
add esp, 4
and edi, 0xaeb8
xor edi, 0x2111
and edi, 0xbc43
pop edi
lea edx, [ebp - 0x15e8]
mov dword [ebp - 0xc74], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc70], ecx
xor edx, edx
mov word [ebp - 0x1c0], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
sub edx, 0x18408
pop edx
push eax
sub eax, 0x16964
add eax, 0x14b84
or eax, 0xdf6e
pop eax
push ecx
xor ecx, 0x131d0
pop ecx
push ecx
or ecx, 0xb1e6
add ecx, 0x17580
pop ecx
mov ecx, dword [ebp - 0xc70]
mov dx, word [ecx]
mov word [ebp - 0xfe2], dx
mov eax, dword [ebp - 0xc70]
add eax, 2
mov dword [ebp - 0xc70], eax
mov cx, word [ebp - 0xfe2]
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0xc74]
mov ax, word [edx]
mov word [ebp - 0xfe4], ax
mov ecx, dword [ebp - 0xc74]
add ecx, 2
mov dword [ebp - 0xc74], ecx
mov dx, word [ebp - 0xfe4]
mov word [ebp - 0x34], dx
push edx
xor edx, 0x9a01
pop edx
push eax
or eax, 0x475d
pop eax
push edx
or edx, 0x1754b
and edx, 0x4c41
and edx, 0xaf2c
pop edx
push esi
and esi, 0x7c4e
xor esi, 0x11040
jmp 0x41580c
mov eax, dword [ebp - 0x1580]
mov dword [ebp - 0x1584], eax
cmp dword [ebp - 0x1584], 0
jne 0x415861
push edx
push edx
add esp, 4
or edx, 0x157e8
sub edx, 0x4431
sub edx, 0xfc48
pop edx
push ebx
push eax
add esp, 4
jmp 0x415846
sub ebx, 0x5796
or ebx, 0x13343
pop ebx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x2a0], ecx
jmp 0x4158c9
push esi
push esi
add esp, 4
xor esi, 0x76df
call 0x41587a
add byte [edi], bh
dec ebx
cmp dword [ecx], edi
cmp ecx, dword [esi + 0x3f]
inc ebp
add esp, 4
add esi, 0x176d5
call 0x41588f
add byte [esi + 0x3f], al
xor al, 0x3d
xor edi, dword [ecx]
add esp, 4
pop esi
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc78]
je 0x4158bf
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x41568a
mov dword [ebp - 0x2a0], 0
push edi
add edi, 0x82da
pop edi
push ebx
jmp 0x4158da
add ebx, 0x3cdc
sub ebx, 0x84ee
xor ebx, 0x8be3
pop ebx
push esi
xor esi, 0x12818
sub esi, 0xbc35
pop esi
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x314], ecx
push edx
call 0x415918
add byte [edi], bh
push eax
cmp eax, 0x44433e44
add esp, 4
sub edx, 0xa17
or edx, 0x1658b
pop edx
push edi
xor edi, 0xaece
add edi, 0xbe29
sub edi, 0x16566
pop edi
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x314]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x41596c
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x4dc], eax
jmp 0x415c5d
mov ecx, dword [ebp - 0x1588]
mov edx, dword [ebp - 0x314]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x158c], edx
jne 0x415994
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x4dc], eax
jmp 0x415c5d
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x158c]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1590], ecx
invalid
invalid
jo 0x41599a
Function at 0x41588f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
sub eax, 0x8910
pop eax
push ecx
push edx
add esp, 4
xor ecx, 0xdb6b
and ecx, 0x17da7
pop ecx
push edi
push ebx
add esp, 4
and edi, 0xaeb8
xor edi, 0x2111
and edi, 0xbc43
pop edi
lea edx, [ebp - 0x15e8]
mov dword [ebp - 0xc74], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc70], ecx
xor edx, edx
mov word [ebp - 0x1c0], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
sub edx, 0x18408
pop edx
push eax
sub eax, 0x16964
add eax, 0x14b84
or eax, 0xdf6e
pop eax
push ecx
xor ecx, 0x131d0
pop ecx
push ecx
or ecx, 0xb1e6
add ecx, 0x17580
pop ecx
mov ecx, dword [ebp - 0xc70]
mov dx, word [ecx]
mov word [ebp - 0xfe2], dx
mov eax, dword [ebp - 0xc70]
add eax, 2
mov dword [ebp - 0xc70], eax
mov cx, word [ebp - 0xfe2]
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0xc74]
mov ax, word [edx]
mov word [ebp - 0xfe4], ax
mov ecx, dword [ebp - 0xc74]
add ecx, 2
mov dword [ebp - 0xc74], ecx
mov dx, word [ebp - 0xfe4]
mov word [ebp - 0x34], dx
push edx
xor edx, 0x9a01
pop edx
push eax
or eax, 0x475d
pop eax
push edx
or edx, 0x1754b
and edx, 0x4c41
and edx, 0xaf2c
pop edx
push esi
and esi, 0x7c4e
xor esi, 0x11040
jmp 0x41580c
mov eax, dword [ebp - 0x1580]
mov dword [ebp - 0x1584], eax
cmp dword [ebp - 0x1584], 0
jne 0x415861
push edx
push edx
add esp, 4
or edx, 0x157e8
sub edx, 0x4431
sub edx, 0xfc48
pop edx
push ebx
push eax
add esp, 4
jmp 0x415846
sub ebx, 0x5796
or ebx, 0x13343
pop ebx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x2a0], ecx
jmp 0x4158c9
push esi
push esi
add esp, 4
xor esi, 0x76df
call 0x41587a
add byte [edi], bh
dec ebx
cmp dword [ecx], edi
cmp ecx, dword [esi + 0x3f]
inc ebp
add esp, 4
add esi, 0x176d5
call 0x41588f
add byte [esi + 0x3f], al
xor al, 0x3d
xor edi, dword [ecx]
add esp, 4
pop esi
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc78]
je 0x4158bf
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x41568a
mov dword [ebp - 0x2a0], 0
push edi
add edi, 0x82da
pop edi
push ebx
jmp 0x4158da
add ebx, 0x3cdc
sub ebx, 0x84ee
xor ebx, 0x8be3
pop ebx
push esi
xor esi, 0x12818
sub esi, 0xbc35
pop esi
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x314], ecx
push edx
call 0x415918
add byte [edi], bh
push eax
cmp eax, 0x44433e44
add esp, 4
sub edx, 0xa17
or edx, 0x1658b
pop edx
push edi
xor edi, 0xaece
add edi, 0xbe29
sub edi, 0x16566
pop edi
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x314]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x41596c
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x4dc], eax
jmp 0x415c5d
mov ecx, dword [ebp - 0x1588]
mov edx, dword [ebp - 0x314]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x158c], edx
jne 0x415994
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x4dc], eax
jmp 0x415c5d
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x158c]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1590], ecx
invalid
invalid
jo 0x41599a
Function at 0x415918
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
sub eax, 0x8910
pop eax
push ecx
push edx
add esp, 4
xor ecx, 0xdb6b
and ecx, 0x17da7
pop ecx
push edi
push ebx
add esp, 4
and edi, 0xaeb8
xor edi, 0x2111
and edi, 0xbc43
pop edi
lea edx, [ebp - 0x15e8]
mov dword [ebp - 0xc74], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc70], ecx
xor edx, edx
mov word [ebp - 0x1c0], dx
xor eax, eax
mov word [ebp - 0x34], ax
push edx
sub edx, 0x18408
pop edx
push eax
sub eax, 0x16964
add eax, 0x14b84
or eax, 0xdf6e
pop eax
push ecx
xor ecx, 0x131d0
pop ecx
push ecx
or ecx, 0xb1e6
add ecx, 0x17580
pop ecx
mov ecx, dword [ebp - 0xc70]
mov dx, word [ecx]
mov word [ebp - 0xfe2], dx
mov eax, dword [ebp - 0xc70]
add eax, 2
mov dword [ebp - 0xc70], eax
mov cx, word [ebp - 0xfe2]
mov word [ebp - 0x1c0], cx
mov edx, dword [ebp - 0xc74]
mov ax, word [edx]
mov word [ebp - 0xfe4], ax
mov ecx, dword [ebp - 0xc74]
add ecx, 2
mov dword [ebp - 0xc74], ecx
mov dx, word [ebp - 0xfe4]
mov word [ebp - 0x34], dx
push edx
xor edx, 0x9a01
pop edx
push eax
or eax, 0x475d
pop eax
push edx
or edx, 0x1754b
and edx, 0x4c41
and edx, 0xaf2c
pop edx
push esi
and esi, 0x7c4e
xor esi, 0x11040
jmp 0x41580c
mov eax, dword [ebp - 0x1580]
mov dword [ebp - 0x1584], eax
cmp dword [ebp - 0x1584], 0
jne 0x415861
push edx
push edx
add esp, 4
or edx, 0x157e8
sub edx, 0x4431
sub edx, 0xfc48
pop edx
push ebx
push eax
add esp, 4
jmp 0x415846
sub ebx, 0x5796
or ebx, 0x13343
pop ebx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x2a0], ecx
jmp 0x4158c9
push esi
push esi
add esp, 4
xor esi, 0x76df
call 0x41587a
add byte [edi], bh
dec ebx
cmp dword [ecx], edi
cmp ecx, dword [esi + 0x3f]
inc ebp
add esp, 4
add esi, 0x176d5
call 0x41588f
add byte [esi + 0x3f], al
xor al, 0x3d
xor edi, dword [ecx]
add esp, 4
pop esi
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc78]
je 0x4158bf
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x41568a
mov dword [ebp - 0x2a0], 0
push edi
add edi, 0x82da
pop edi
push ebx
jmp 0x4158da
add ebx, 0x3cdc
sub ebx, 0x84ee
xor ebx, 0x8be3
pop ebx
push esi
xor esi, 0x12818
sub esi, 0xbc35
pop esi
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x314], ecx
push edx
call 0x415918
add byte [edi], bh
push eax
cmp eax, 0x44433e44
add esp, 4
sub edx, 0xa17
or edx, 0x1658b
pop edx
push edi
xor edi, 0xaece
add edi, 0xbe29
sub edi, 0x16566
pop edi
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x314]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x41596c
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x4dc], eax
jmp 0x415c5d
mov ecx, dword [ebp - 0x1588]
mov edx, dword [ebp - 0x314]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x158c], edx
jne 0x415994
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x4dc], eax
jmp 0x415c5d
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x158c]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1590], ecx
invalid
invalid
jo 0x41599a
Function at 0x470d70
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x18
push ebx
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
jne 0x470da2
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 4]
xor ecx, ecx
inc eax
mov edx, 4
mul edx
push ebp
push esi
seto cl
neg ecx
or ecx, eax
push edi
push ecx
call fcn.0046fe15
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x14], 0
mov ebp, eax
mov dword [esp + 0x20], ebp
test ecx, ecx
je 0x470e3c
mov eax, ebx
sub eax, ebp
mov dword [esp + 0x1c], eax
mov ebx, dword [eax + ebp]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push esi
call fcn.0046fe15
add esp, 4
mov edi, eax
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x14]
lea ebp, [ebp + 4]
inc eax
mov dword [ebp - 4], edi
mov ecx, dword [esp + 0x10]
cmp eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
jne 0x470de1
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
push ebx
mov dword [ebp + ecx*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebp
push dword [esp + 0x14]
call fcn.004ad8f0
xor esi, esi
add esp, 8
mov edi, eax
cmp dword [esp + 0x10], esi
je 0x470e7a
mov ecx, dword [ebp + esi*4]
test ecx, ecx
je 0x470e7a
push ecx
call fcn.0046fe1e
inc esi
add esp, 4
cmp esi, dword [esp + 0x10]
jne 0x470e62
push ebp
call fcn.0046fe1e
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x4ae7e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push str.ByDevInterface.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
je 0x4ae8dd
push str.SetDebug
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
push str.InitDevice
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push str.UnInitDevice
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
push str.SetKeyMatrix
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
push str.SetConfig
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
push str.IsDeviceOnline
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
push str.GetPower
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
push str.SetHardwareInfo
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
push str.GetFwVersion
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4ae90a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x14], 0
je 0x4ae90a
mov edx, dword [ebp - 4]
cmp dword [edx + 0x18], 0
je 0x4ae90a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c], 0
je 0x4ae90a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2c], 0
jne 0x4ae90e
xor eax, eax
jmp 0x4ae913
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4b5570
Capabilities:
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d315f
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x599224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call dword [0x4d6960]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
add edx, 0x18
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.ClientHandler::Listener.0
mov ecx, dword [ebp - 0x14]
add ecx, 4
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov dword [edx], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.QCefWebView.1.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], vtable.QCefWebView.0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x18], vtable.QCefWebView.2.0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.004043d0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x2c], 1
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x2d], 0
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp + 0xc]
mov byte [eax + 0x2e], cl
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call dword [0x4d6490]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call dword [0x4d6494]
mov byte [ebp - 4], 4
push 1
push 0x64
mov ecx, dword [ebp - 0x10]
call dword [0x4d6954]
push 1
push 0x65
mov ecx, dword [ebp - 0x10]
call dword [0x4d6954]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b9b20
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
rdtsc
mov dword [ebp - 8], eax
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
rdtsc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
cdq
mov ecx, 0xc350
idiv ecx
mov esp, ebp
pop ebp
ret
Function at 0xe88096
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, bl
xchg edx, eax
xchg byte [esp + 2], bh
push dword [esp + 2]
jmp 0xe88191
lea esp, [esp + 8]
neg edi
mov bx, 0x5e06
add ebx, eax
jmp 0xe88113
btc edx, ebp
js 0xe8812f
mov bh, byte [esp]
xchg ebx, eax
jmp fcn.00e880f9
je 0xe8814e
inc ah
jmp 0xe88150
mov bh, byte [esp]
xchg ebx, eax
jmp fcn.00e880f9
inc ah
add edi, dword [ebp]
rdtsc
jmp 0xe880ea
jle 0xe880b8
jg 0xe880b8
Function at 0xe8a3dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
lea esp, [esp + 2]
mov dword [esp], edi
pushfd

Function at 0xe8be6a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0e773f4
jmp 0xe8bec4
push word [esp + 1]
jmp 0xe8beb4
mov dword [esp], eax
mov dword [esp], edx
lea esp, [esp + 2]
mov dword [esp], edi
jmp 0xe8bebe
lea esp, [esp + 2]
mov dword [esp], edi
jmp 0xe8bebe
je 0xe8be75
mov dword [esp], eax
mov dword [esp], edx
jmp 0xe8be9e
pushfd
jmp 0xe8b9db
rcr bp, 0
jo 0xe8bf00
mov dx, word [esp]
setb bl
xchg dx, cx
jmp 0xe8bf1c
setb bl
xchg dx, cx
jmp 0xe8bf1c
mov dx, word [esp]
jmp 0xe8beea
lea esi, [esp]
rdtsc
mov cx, 0x5467
not cx
cmc
jmp 0xe8bf68
mov edi, dword [esp + 0x2c]
mov edx, dword [esp]
mov ah, dh
not ah
rdtsc
jmp 0xe8bf06
sub esp, 0xc0
mov ebp, esp
bsf cx, dx
jmp 0xe8bf9d
neg ch
cpuid
jno 0xe8bf2b
jo 0xe8bf2b
jl 0xe8bf50
neg ch
cpuid
jmp 0xe8bf54

Function at 0xe8bf4e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebp
call fcn.00e8be63
pop word [esp]
push word [esp]
jne 0xe8be96
mov dword [esp], ebp
jmp 0xe8be99
jmp 0xe8bedb

Function at 0xe90094
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00e8fb89
push eax
call fcn.00e7b065
jmp 0xe8fb84
jmp 0xe90039