joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44dd60
push eax
mov dword fs:[0], esp
sub esp, 0x88
push esi
mov esi, ecx
lea eax, [esi + 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov dword [esi + 8], ecx
test ecx, ecx
je 0x43a965
mov eax, dword [esi + 0x10]
pop esi
test eax, eax
je 0x43a955
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x43a995
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.cannot_create_thread
lea ecx, [ebp - 0x24]
call fcn.00406b90
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x68]
call fcn.00439b40
push 0x477140
lea eax, [ebp - 0x68]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.cannot_set_thread_priority
lea ecx, [ebp - 0x3c]
call fcn.00406b90
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x94]
call fcn.00439b40
push 0x477140
lea eax, [ebp - 0x94]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x42deb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x24000]
push edi
jmp 0x42deca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42ded1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42dec0
mov eax, 1
add ebx, ebx
jne 0x42dee3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42def4
jne 0x42df13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42df13
dec eax
add ebx, ebx
jne 0x42df00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x42ded8
add ebx, ebx
jne 0x42df0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x42df65
xor ecx, ecx
sub eax, 3
jb 0x42df2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42df9a
sar eax, 1
mov ebp, eax
jmp 0x42df36
add ebx, ebx
jne 0x42df36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42df04
inc ecx
add ebx, ebx
jne 0x42df44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42df04
add ebx, ebx
jne 0x42df51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42df46
jne 0x42df62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42df46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42df84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42df76
jmp 0x42dec6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42df84
add edi, ecx
jmp 0x42dec6
pop esi
mov edi, esi
mov ecx, 0x3cf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42dfa2
cmp byte [edi], 7
jne 0x42dfa2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42dfa7
lea edi, [esi + 0x2b000]
mov eax, dword [edi]
or eax, eax
je 0x42e016
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x427e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4284c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42dfd4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x42854]
or eax, eax
je 0x42e010
mov dword [ebx], eax
add ebx, 4
jmp 0x42dff1
call dword [esi + 0x42850]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x42e047
cmp al, 0xef
ja 0x42e03a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x42e01c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x42e029
mov ebp, dword [esi + 0x42858]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42e07b
sub esp, 0xffffff80
jmp 0x401540
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x425634]
push ebx
push ebp
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
mov dword [0x425638], eax
call fcn.00408d46
xor ebx, ebx
pop ecx
test eax, eax
je 0x401053
push str.Windows_original_main_args:_n
call fcn.00408c02
xor esi, esi
pop ecx
cmp dword [0x425628], ebx
jle 0x401053
mov eax, dword [0x42562c]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00408c02
add esp, 0xc
inc esi
cmp esi, dword [0x425628]
jl 0x401034
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040f35a
call fcn.00403941
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call fcn.004039c3
pop ecx
pop ecx
mov esi, eax
call fcn.00403947
xor ecx, ecx
cmp edi, ebx
jle 0x40108d
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x401082
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
mov edx, eax
cmp eax, ebx
jne 0x40109d
mov edx, dword [esi]
mov ebp, dword [0x42400c]
cmp ebp, ebx
jne 0x4010a9
mov ebp, dword [esi]
mov eax, dword [0x425420]
push ebx
xor ecx, ecx
inc ecx
push ecx
push ecx
cmp eax, ebx
setne bl
movzx ebx, bl
push ebx
push edx
push ebp
push 0x41c254
push 0x41c244
push dword [0x425424]
push ecx
push eax
push ecx
push esi
push edi
call fcn.00403485
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x403e42
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403ee5
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040f35a
pop ecx
pop ecx
test eax, eax
je 0x403ece
test ebx, ebx
je 0x403ec2
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0040f35a
pop ecx
pop ecx
test eax, eax
jle 0x403ece
push ebx
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403e8f
xor edi, edi
cmp ebx, edi
jne 0x403ee9
xor eax, eax
jmp 0x403f55
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403f18
call fcn.00403a2b
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403ee5
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403ee5
call fcn.00403a2b
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f08
cmp dword [ebp - 0x70], edi
je 0x403f4b
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.00403a0a
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409908
add ebp, 0x9c
leave
ret
Function at 0x409908
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x409912
repz ret
jmp fcn.0041156c

Function at 0x71dfd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2d5000]
push edi
jmp 0x71dfea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x71dff1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x71dfe0
mov eax, 1
add ebx, ebx
jne 0x71e003
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x71e014
jne 0x71e033
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x71e033
dec eax
add ebx, ebx
jne 0x71e020
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x71dff8
add ebx, ebx
jne 0x71e02f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x71e085
xor ecx, ecx
sub eax, 3
jb 0x71e04b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x71e0ba
sar eax, 1
mov ebp, eax
jmp 0x71e056
add ebx, ebx
jne 0x71e056
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x71e024
inc ecx
add ebx, ebx
jne 0x71e064
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x71e024
add ebx, ebx
jne 0x71e071
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x71e066
jne 0x71e082
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x71e066
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x71e0a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x71e096
jmp 0x71dfe6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x71e0a4
add edi, ecx
jmp 0x71dfe6
pop esi
mov edi, esi
mov ecx, 0x3bf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x71e0c2
cmp byte [edi], 7
jne 0x71e0c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x71e0c7
lea edi, [esi + 0x31b000]
mov eax, dword [edi]
or eax, eax
je 0x71e136
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3a82c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3a8304]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x71e0f4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3a830c]
or eax, eax
je 0x71e130
mov dword [ebx], eax
add ebx, 4
jmp 0x71e111
call dword [esi + 0x3a8308]
mov ebp, dword [esi + 0x3a8310]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x257]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x71e16a
sub esp, 0xffffff80
jmp 0x40125d
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x7a620c5a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x65a864c2
nop
nop
nop
nop
nop
test eax, eax
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10008763
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100087a2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100087a2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100087a2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100087a2
cmp dword [ecx + 0x74], 0xe
jbe 0x100087a2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000b41f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000b4bc
push ebx
push esi
call fcn.1000b3e8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000b37c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000b469
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b4bb
push edi
push eax
call fcn.1000c3da
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000b489
call fcn.10009ec4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000b4ba
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000b37c
add esp, 0x20
test eax, eax
jne 0x1000b4a8
push edi
call fcn.10009ec4
jmp 0x1000b4b0
push ebx
call fcn.10009ec4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000b729
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10013678
push 0x10013670
push str.FlsAlloc
push 0x1f
call fcn.1000b645
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b75d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001214c]
call esi
jmp 0x1000b763
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000b7a7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10013688
push 0x10013680
push str.FlsGetValue
push 0x21
call fcn.1000b645
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b7de
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001214c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000b7e6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10013690
push 0x10013688
push str.FlsSetValue
push 0x22
call fcn.1000b645
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000b820
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001214c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10010ea0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10010ecd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10010ecd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x2a32394c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x2a32395b
pop dword [ebp - 0xc]
mov eax, 0x2a32395b
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x3dd6d7f8
add dword [ebp - 0x1c], 0x107b6d53
mov dword [ebp - 0x18], 0xd70bfdee
add dword [ebp - 0x18], 0x5b274e57
mov dword [ebp - 0x14], 0xea451b89
sub dword [ebp - 0x14], 0x9df8d75b
mov dword [ebp - 0x10], 0xe32b8913
sub dword [ebp - 0x10], 0xe32b8913
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x57b9ac84
sub eax, 0x2d842c00
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x3fb576d3
sub dword [ebp - 0x1c], 0xcb430d7d
mov dword [ebp - 0x18], 0x401f72eb
sub dword [ebp - 0x18], 0xfeb31176
mov dword [ebp - 0x14], 0xbfc8cb5b
add dword [ebp - 0x14], 0xa3a6a111
mov dword [ebp - 0x10], 0x710acba7
add dword [ebp - 0x10], 0x8ef53459
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xa86dd4bd
add eax, 0x81c7abcf
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x4be5c
push 0
call eax
mov ecx, 0xb35683e7
add ecx, 0x4ca9c9ca
mov edx, eax
mov ebx, 0x2a37f600
add ebx, dword [ebp - 0xc]
mov edi, 0x39c4c23b
sub edi, 0x738dd7f9
add dword [ebp - 4], edx
mov esi, dword [ebx]
xor dword [ebp - 8], 0x60c3a494
sub esi, edi
sub dword [ebp - 4], 0xd68865ce
mov dword [edx], esi
xor dword [ebp - 8], edx
add edx, 0xf7f01864
add edx, 0x80fe7a0
add ebx, 0x9a4c0304
sub ebx, 0x9a4c0300
loop 0x2a323a72
add eax, 0x8aee04cb
sub eax, 0x8aecdb34
mov ebx, eax
add eax, 0x66a376fb
add eax, 0x995c890a
mov ecx, 0x9589697c
sub ecx, 0x6b59697c
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x47eaa2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x47eab1
pop dword [ebp - 0x1c]
mov eax, 0x47eab1
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x657ae
push 0
mov eax, 0x4a8cd031
add eax, 0xb5b34067
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x207bcc01
sub ecx, 0x207b7c6a
mov ebx, eax
mov edi, 0x1c65501d
add edi, 0xe3ebf3e3
add edi, dword [ebp - 0x1c]
mov edx, 0x4e3ae757
add edx, 0x64645a4f
xor dword [ebp - 0x18], ebx
mov esi, dword [edi]
add dword [ebp - 0xc], ebx
add esi, edx
xor dword [ebp - 0x14], esi
mov dword [ebx], esi
sub dword [ebp - 0x18], edi
add ebx, 0x7c8f258b
sub ebx, 0x7c8f2587
add edi, 4
loop 0x47eb0b
add eax, 0x73f7e273
sub eax, 0x73f6b144
mov ebx, eax
add eax, 5
mov ecx, 0xe085338
sub ecx, 0xdc85338
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x40404c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00404d04
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004041ac
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x404196
test ebx, ebx
jl 0x40413a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcba4b0
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40415b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x40414d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00405b1c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00405b1c
add esp, 8
mov ebx, 0x80070057
jmp 0x40413a
Function at 0x41ae1c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0041bad4
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0041af7c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41af66
test ebx, ebx
jl 0x41af0a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcd1280
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41af2b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x41af1d
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0041c8ec
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0041c8ec
add esp, 8
mov ebx, 0x80070057
jmp 0x41af0a
Function at 0x431cac
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00432964
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00431e0c
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x431df6
test ebx, ebx
jl 0x431d9a
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce8110
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x431dbb
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x431dad
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0043377c
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0043377c
add esp, 8
mov ebx, 0x80070057
jmp 0x431d9a