joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448e00
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
add esp, 4
and esi, 0xba8
pop esi
push ebx
add ebx, 0x14ee
add ebx, 0x3d1e
add ebx, 0x11a3f
jmp 0x448e25
pop ebx
push esi
push ebx
add esp, 4
sub esi, 0x118a2
pop esi
mov edx, dword [ebp - 0x708]
add edx, dword [ebp - 0x184]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x184]
movsx edx, byte [ebp + ecx - 0x804]
cmp eax, edx
jne 0x448e5f
mov dword [ebp - 0xc40], 0
jmp 0x448ece
push ecx

Function at 0x448e60
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x704]
add edx, 1
mov dword [ebp - 0x704], edx
and ecx, 0x2ac1
pop ecx
push eax
push edx
add esp, 4
or eax, 0xf58d
xor eax, 0x1670f
add eax, 0x9df7
pop eax
push edi
push eax
add esp, 4
or edi, 0xa171
and edi, 0x11828
pop edi
mov eax, dword [ebp - 0x708]
add eax, dword [ebp - 0x184]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x184]
movsx eax, byte [ebp + edx - 0x804]
or eax, 0x20
cmp ecx, eax
jge 0x448ec4
mov dword [ebp - 0xc40], 0xffffffff
jmp 0x448ece
mov dword [ebp - 0xc40], 1
cmp dword [ebp - 0xc40], 0
jne 0x448ee5
mov ecx, dword [ebp - 0x18cc]
mov dword [ebp - 0x4e0], ecx
jmp 0x448ef6
jmp 0x448ccf

Function at 0x448f10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
rol dword [eax - 7], 0
add byte [ecx + 0xb3ccc1], al
add byte [ecx + 0x53adc1], al
add al, ch
or al, byte [eax]
add byte [eax], al
Function at 0x449040
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
or edx, 0x175b6
and edx, 0x174a8
xor edx, 0x11205
adc al, byte [ecx]
add byte [edx + 0x56], bl

Function at 0x449050
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
adc al, byte [ecx]
add byte [edx + 0x56], bl
push ecx
add esp, 4
and esi, 0x17bb9
invalid
Function at 0x449a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x84449a4d
rol byte [ecx], 0x89
test eax, ebp
clc
invalid

Function at 0x449b93
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ecx, 0x88b9
jmp 0x449ba4
pop ecx
push esi
push eax
add esp, 4
jmp 0x449bb0
pop esi
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
cmp ecx, eax
jne 0x449bde
mov dword [ebp - 0xc5c], 0
jmp 0x449c4d
push eax
and eax, 0xadc3
call 0x449bf4
add byte [ecx + 0x45], cl
push eax
dec ebx
cmp byte [eax + 0x44], cl
dec eax
dec ecx
add esp, 4
xor eax, 0x84f4
or eax, 0x141a0
pop eax
push edx
push edx
add esp, 4
xor edx, 0x11669
pop edx
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x188]
movsx ecx, byte [ebp + eax - 0x830]
or ecx, 0x20
cmp edx, ecx
jge 0x449c43
mov dword [ebp - 0xc5c], 0xffffffff
jmp 0x449c4d
mov dword [ebp - 0xc5c], 1
cmp dword [ebp - 0xc5c], 0
jne 0x449c64
mov edx, dword [ebp - 0x18ec]
mov dword [ebp - 0x3c8], edx
jmp 0x449c75
jmp 0x449a4e
cmp dword [ebp - 0x3c8], 0
je 0x449d50
push edx
call 0x449c90
add byte [0x404f344d], dh
dec ebx
inc ebx
add esp, 4
and edx, 0x7609
call 0x449ca8
add byte [esi + 0x43], cl
cmp al, byte [eax + 0x39]
inc edi
cmp edi, dword [eax]
aas
add esp, 4
jmp 0x449cb3
pop edx
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp - 0x18f0], ecx
push ebx
push ecx
add esp, 4
and ebx, 0x153e3
sub ebx, 0xfa67
add ebx, 0x1144f
pop ebx
push eax
and eax, 0x181c7
or eax, 0x181c2
xor eax, 0x123e9
and eax, 0xf47
pop eax
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x449d50
push ebx
xor ebx, 0x3f23
pop ebx
push edi
call 0x449d26
add byte [eax], bh
inc edi
inc ebx
xor bh, byte [esi - 0x3b7cb9c9]
add al, 0xe8
pop es
add byte [eax], al
add byte [eax], al
dec ebp
push ebx
push ecx
add esp, 4
jmp 0x44a449
call 0x44a455
add byte [edi + 0x50], al
inc esi
cmp dword [eax], edi
cmp eax, 0x8104c483
retf
Function at 0x449bf4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ecx, 0x88b9
jmp 0x449ba4
pop ecx
push esi
push eax
add esp, 4
jmp 0x449bb0
pop esi
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
cmp ecx, eax
jne 0x449bde
mov dword [ebp - 0xc5c], 0
jmp 0x449c4d
push eax
and eax, 0xadc3
call 0x449bf4
add byte [ecx + 0x45], cl
push eax
dec ebx
cmp byte [eax + 0x44], cl
dec eax
dec ecx
add esp, 4
xor eax, 0x84f4
or eax, 0x141a0
pop eax
push edx
push edx
add esp, 4
xor edx, 0x11669
pop edx
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x188]
movsx ecx, byte [ebp + eax - 0x830]
or ecx, 0x20
cmp edx, ecx
jge 0x449c43
mov dword [ebp - 0xc5c], 0xffffffff
jmp 0x449c4d
mov dword [ebp - 0xc5c], 1
cmp dword [ebp - 0xc5c], 0
jne 0x449c64
mov edx, dword [ebp - 0x18ec]
mov dword [ebp - 0x3c8], edx
jmp 0x449c75
jmp 0x449a4e
cmp dword [ebp - 0x3c8], 0
je 0x449d50
push edx
call 0x449c90
add byte [0x404f344d], dh
dec ebx
inc ebx
add esp, 4
and edx, 0x7609
call 0x449ca8
add byte [esi + 0x43], cl
cmp al, byte [eax + 0x39]
inc edi
cmp edi, dword [eax]
aas
add esp, 4
jmp 0x449cb3
pop edx
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp - 0x18f0], ecx
push ebx
push ecx
add esp, 4
and ebx, 0x153e3
sub ebx, 0xfa67
add ebx, 0x1144f
pop ebx
push eax
and eax, 0x181c7
or eax, 0x181c2
xor eax, 0x123e9
and eax, 0xf47
pop eax
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x449d50
push ebx
xor ebx, 0x3f23
pop ebx
push edi
call 0x449d26
add byte [eax], bh
inc edi
inc ebx
xor bh, byte [esi - 0x3b7cb9c9]
add al, 0xe8
pop es
add byte [eax], al
add byte [eax], al
dec ebp
push ebx
push ecx
add esp, 4
jmp 0x44a449
call 0x44a455
add byte [edi + 0x50], al
inc esi
cmp dword [eax], edi
cmp eax, 0x8104c483
retf
Function at 0x449c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ecx, 0x88b9
jmp 0x449ba4
pop ecx
push esi
push eax
add esp, 4
jmp 0x449bb0
pop esi
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
cmp ecx, eax
jne 0x449bde
mov dword [ebp - 0xc5c], 0
jmp 0x449c4d
push eax
and eax, 0xadc3
call 0x449bf4
add byte [ecx + 0x45], cl
push eax
dec ebx
cmp byte [eax + 0x44], cl
dec eax
dec ecx
add esp, 4
xor eax, 0x84f4
or eax, 0x141a0
pop eax
push edx
push edx
add esp, 4
xor edx, 0x11669
pop edx
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x188]
movsx ecx, byte [ebp + eax - 0x830]
or ecx, 0x20
cmp edx, ecx
jge 0x449c43
mov dword [ebp - 0xc5c], 0xffffffff
jmp 0x449c4d
mov dword [ebp - 0xc5c], 1
cmp dword [ebp - 0xc5c], 0
jne 0x449c64
mov edx, dword [ebp - 0x18ec]
mov dword [ebp - 0x3c8], edx
jmp 0x449c75
jmp 0x449a4e
cmp dword [ebp - 0x3c8], 0
je 0x449d50
push edx
call 0x449c90
add byte [0x404f344d], dh
dec ebx
inc ebx
add esp, 4
and edx, 0x7609
call 0x449ca8
add byte [esi + 0x43], cl
cmp al, byte [eax + 0x39]
inc edi
cmp edi, dword [eax]
aas
add esp, 4
jmp 0x449cb3
pop edx
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp - 0x18f0], ecx
push ebx
push ecx
add esp, 4
and ebx, 0x153e3
sub ebx, 0xfa67
add ebx, 0x1144f
pop ebx
push eax
and eax, 0x181c7
or eax, 0x181c2
xor eax, 0x123e9
and eax, 0xf47
pop eax
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x449d50
push ebx
xor ebx, 0x3f23
pop ebx
push edi
call 0x449d26
add byte [eax], bh
inc edi
inc ebx
xor bh, byte [esi - 0x3b7cb9c9]
add al, 0xe8
pop es
add byte [eax], al
add byte [eax], al
dec ebp
push ebx
push ecx
add esp, 4
jmp 0x44a449
call 0x44a455
add byte [edi + 0x50], al
inc esi
cmp dword [eax], edi
cmp eax, 0x8104c483
retf
Function at 0x449ca8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ecx, 0x88b9
jmp 0x449ba4
pop ecx
push esi
push eax
add esp, 4
jmp 0x449bb0
pop esi
mov eax, dword [ebp - 0x71c]
add eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x188]
movsx eax, byte [ebp + edx - 0x830]
cmp ecx, eax
jne 0x449bde
mov dword [ebp - 0xc5c], 0
jmp 0x449c4d
push eax
and eax, 0xadc3
call 0x449bf4
add byte [ecx + 0x45], cl
push eax
dec ebx
cmp byte [eax + 0x44], cl
dec eax
dec ecx
add esp, 4
xor eax, 0x84f4
or eax, 0x141a0
pop eax
push edx
push edx
add esp, 4
xor edx, 0x11669
pop edx
mov ecx, dword [ebp - 0x71c]
add ecx, dword [ebp - 0x188]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x188]
movsx ecx, byte [ebp + eax - 0x830]
or ecx, 0x20
cmp edx, ecx
jge 0x449c43
mov dword [ebp - 0xc5c], 0xffffffff
jmp 0x449c4d
mov dword [ebp - 0xc5c], 1
cmp dword [ebp - 0xc5c], 0
jne 0x449c64
mov edx, dword [ebp - 0x18ec]
mov dword [ebp - 0x3c8], edx
jmp 0x449c75
jmp 0x449a4e
cmp dword [ebp - 0x3c8], 0
je 0x449d50
push edx
call 0x449c90
add byte [0x404f344d], dh
dec ebx
inc ebx
add esp, 4
and edx, 0x7609
call 0x449ca8
add byte [esi + 0x43], cl
cmp al, byte [eax + 0x39]
inc edi
cmp edi, dword [eax]
aas
add esp, 4
jmp 0x449cb3
pop edx
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp - 0x18f0], ecx
push ebx
push ecx
add esp, 4
and ebx, 0x153e3
sub ebx, 0xfa67
add ebx, 0x1144f
pop ebx
push eax
and eax, 0x181c7
or eax, 0x181c2
xor eax, 0x123e9
and eax, 0xf47
pop eax
mov edx, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f4], edx
lea eax, [ebp - 0x1628]
push eax
call dword [ebp - 0x18f4]
test eax, eax
jne 0x449d50
push ebx
xor ebx, 0x3f23
pop ebx
push edi
call 0x449d26
add byte [eax], bh
inc edi
inc ebx
xor bh, byte [esi - 0x3b7cb9c9]
add al, 0xe8
pop es
add byte [eax], al
add byte [eax], al
dec ebp
push ebx
push ecx
add esp, 4
jmp 0x44a449
call 0x44a455
add byte [edi + 0x50], al
inc esi
cmp dword [eax], edi
cmp eax, 0x8104c483
retf
Function at 0x449e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0xc68], ecx
push edi
call 0x449e15
add byte [0x4d4e3e40], dh
dec edx
xor al, 0x44
add esp, 4
jmp 0x449e20
add edi, 0x2b4b
call 0x449e34
add byte [eax + 0x4a], al
xor eax, 0x3442453b
add esp, 4
pop edi
cmp dword [ebp - 0xc68], 0
jne 0x449e50
mov dword [ebp - 0x2a8], 0
jmp 0x44a09b
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push edx
add edx, 0x114b9
call 0x44a0b1
add byte [edi], dh
xor cl, byte [ebp + 0x36]
cmp bh, byte ss:[ebx]
cmp dword [esi], esi
add esp, 4
pop edx
push esi
push ecx
add esp, 4
xor esi, 0x1010a
xor esi, 0xdecf
add esi, 0x3507
pop esi
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push ecx
and ecx, 0x36a9
pop ecx
push ecx
push ecx
add esp, 4
xor ecx, 0x23dc
pop ecx
push eax
push ebx
add esp, 4
xor eax, 0xe902
add eax, 0x6b1
or eax, 0x1024e
and eax, 0x124a7
pop eax
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x44a13e
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x44a42f
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x44a166
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x44a42f
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x44a198
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x44a42f
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
jne 0x44a1bd
invalid
xchg ebp, eax
sar al, 1
Function at 0x449e15
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0xc68], ecx
push edi
call 0x449e15
add byte [0x4d4e3e40], dh
dec edx
xor al, 0x44
add esp, 4
jmp 0x449e20
add edi, 0x2b4b
call 0x449e34
add byte [eax + 0x4a], al
xor eax, 0x3442453b
add esp, 4
pop edi
cmp dword [ebp - 0xc68], 0
jne 0x449e50
mov dword [ebp - 0x2a8], 0
jmp 0x44a09b
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push edx
add edx, 0x114b9
call 0x44a0b1
add byte [edi], dh
xor cl, byte [ebp + 0x36]
cmp bh, byte ss:[ebx]
cmp dword [esi], esi
add esp, 4
pop edx
push esi
push ecx
add esp, 4
xor esi, 0x1010a
xor esi, 0xdecf
add esi, 0x3507
pop esi
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push ecx
and ecx, 0x36a9
pop ecx
push ecx
push ecx
add esp, 4
xor ecx, 0x23dc
pop ecx
push eax
push ebx
add esp, 4
xor eax, 0xe902
add eax, 0x6b1
or eax, 0x1024e
and eax, 0x124a7
pop eax
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x44a13e
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x44a42f
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x44a166
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x44a42f
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x44a198
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x44a42f
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
jne 0x44a1bd
invalid
xchg ebp, eax
sar al, 1
Function at 0x449e34
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0xc68], ecx
push edi
call 0x449e15
add byte [0x4d4e3e40], dh
dec edx
xor al, 0x44
add esp, 4
jmp 0x449e20
add edi, 0x2b4b
call 0x449e34
add byte [eax + 0x4a], al
xor eax, 0x3442453b
add esp, 4
pop edi
cmp dword [ebp - 0xc68], 0
jne 0x449e50
mov dword [ebp - 0x2a8], 0
jmp 0x44a09b
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push edx
add edx, 0x114b9
call 0x44a0b1
add byte [edi], dh
xor cl, byte [ebp + 0x36]
cmp bh, byte ss:[ebx]
cmp dword [esi], esi
add esp, 4
pop edx
push esi
push ecx
add esp, 4
xor esi, 0x1010a
xor esi, 0xdecf
add esi, 0x3507
pop esi
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push ecx
and ecx, 0x36a9
pop ecx
push ecx
push ecx
add esp, 4
xor ecx, 0x23dc
pop ecx
push eax
push ebx
add esp, 4
xor eax, 0xe902
add eax, 0x6b1
or eax, 0x1024e
and eax, 0x124a7
pop eax
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x44a13e
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x44a42f
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x44a166
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x44a42f
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x44a198
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x44a42f
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
jne 0x44a1bd
invalid
xchg ebp, eax
sar al, 1
Function at 0x449ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
jmp 0x449e65
xor eax, 0x429b
sub eax, 0x11559
pop eax
push edx
add edx, 0xf93d
pop edx
push ebx
xor ebx, 0x1744c
sub ebx, 0xf397
or ebx, 0x10041
pop ebx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
or edx, 0xa93c
add edx, 0x5409
and edx, 0x182d6
add edx, 0xdfe3
pop edx
push eax
push edx
add esp, 4
or eax, 0x158de
add eax, 0x1283a
sub byte [ecx], al
add byte [ecx + 0x3f0ac0], al
add byte [eax - 0x75], bl
xchg ebp, eax
mov al, byte [0x66fffff3]
mov eax, dword [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
and eax, 0x177b
sub eax, 0x178b2
or eax, 0x9e98
xor eax, 0x75c4
pop eax
push esi
push edx
add esp, 4
sub esi, 0x949
pop esi
push edx
push eax
add esp, 4
xor edx, 0x3dc4
pop edx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x449f90
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x449fea
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x449eb8
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x449eb8
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x449fd4
invalid
test dword [eax - 0x16], ecx
invalid
Function at 0x449f30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
jmp 0x449e65
xor eax, 0x429b
sub eax, 0x11559
pop eax
push edx
add edx, 0xf93d
pop edx
push ebx
xor ebx, 0x1744c
sub ebx, 0xf397
or ebx, 0x10041
pop ebx
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
or edx, 0xa93c
add edx, 0x5409
and edx, 0x182d6
add edx, 0xdfe3
pop edx
push eax
push edx
add esp, 4
or eax, 0x158de
add eax, 0x1283a
sub byte [ecx], al
add byte [ecx + 0x3f0ac0], al
add byte [eax - 0x75], bl
xchg ebp, eax
mov al, byte [0x66fffff3]
mov eax, dword [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push eax
and eax, 0x177b
sub eax, 0x178b2
or eax, 0x9e98
xor eax, 0x75c4
pop eax
push esi
push edx
add esp, 4
sub esi, 0x949
pop esi
push edx
push eax
add esp, 4
xor edx, 0x3dc4
pop edx
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x449f90
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x449fea
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x449eb8
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x449eb8
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x449fd4
invalid
test dword [eax - 0x16], ecx
invalid
Function at 0x44a0b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0xc68], ecx
push edi
call 0x449e15
add byte [0x4d4e3e40], dh
dec edx
xor al, 0x44
add esp, 4
jmp 0x449e20
add edi, 0x2b4b
call 0x449e34
add byte [eax + 0x4a], al
xor eax, 0x3442453b
add esp, 4
pop edi
cmp dword [ebp - 0xc68], 0
jne 0x449e50
mov dword [ebp - 0x2a8], 0
jmp 0x44a09b
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0x4ec], edx
push edx
add edx, 0x114b9
call 0x44a0b1
add byte [edi], dh
xor cl, byte [ebp + 0x36]
cmp bh, byte ss:[ebx]
cmp dword [esi], esi
add esp, 4
pop edx
push esi
push ecx
add esp, 4
xor esi, 0x1010a
xor esi, 0xdecf
add esi, 0x3507
pop esi
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push ecx
and ecx, 0x36a9
pop ecx
push ecx
push ecx
add esp, 4
xor ecx, 0x23dc
pop ecx
push eax
push ebx
add esp, 4
xor eax, 0xe902
add eax, 0x6b1
or eax, 0x1024e
and eax, 0x124a7
pop eax
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x44a13e
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x44a42f
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x44a166
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x44a42f
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x44a198
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x44a42f
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
jne 0x44a1bd
invalid
xchg ebp, eax
sar al, 1
Function at 0x4668d0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539bb3
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5857cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x68], edi
mov dword [edi], vtable.io::AppDataOutputStream::Impl.0
mov eax, dword [edi + 0x28]
push eax
mov dword [ebp - 4], 1
call dword [0x5452b0]
push eax
call fcn.00466300
mov ecx, dword [edi + 0x28]
push ecx
call dword [0x545250]
lea esi, [edi + 0xc]
lea edx, [ebp - 0x64]
push esi
push edx
call fcn.004f3cd0
mov ebx, eax
push str..tmp
lea eax, [ebp - 0x48]
push esi
push eax
mov byte [ebp - 4], 2
call fcn.0040d8a0
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov byte [ebp - 4], 3
call fcn.004f3cd0
mov ecx, 8
add esp, 0x28
cmp dword [ebx + 0x14], ecx
jb 0x466966
mov ebx, dword [ebx]
cmp dword [eax + 0x14], ecx
jb 0x46696d
mov eax, dword [eax]
push 1
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [ebp - 0x18], 8
jb 0x466989
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0052142e
add esp, 4
xor ebx, ebx
xor eax, eax
cmp dword [ebp - 0x34], 0x10
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
jb 0x4669ad
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.0052142e
add esp, 4
cmp dword [ebp - 0x50], 8
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
jb 0x4669cc
mov edx, dword [ebp - 0x64]
push edx
call fcn.0052142e
add esp, 4
xor eax, eax
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x64], ax
jb 0x4669ed
mov eax, dword [esi]
push eax
call fcn.0052142e
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov ecx, edi
mov byte [esi], bl
mov dword [ebp - 4], 0xffffffff
call fcn.004ef470
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00521458
mov esp, ebp
pop ebp
ret