joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409e8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x409e9b
pop dword [ebp - 0x3c]
mov eax, 0xf616d9ee
sub eax, 0xf5d63b53
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x56aefce3
add dword [ebp - 0x4c], 0xf7a34868
mov dword [ebp - 0x48], 0xc19fe1a9
add dword [ebp - 0x48], 0x70936a9c
mov dword [ebp - 0x44], 0xf8c10bd0
add dword [ebp - 0x44], 0x538b385e
mov dword [ebp - 0x40], 0xefe3ea92
add dword [ebp - 0x40], 0x101c156e
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x3b4c2941
add eax, 0xc4f4a713
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x77cfc39f
sub dword [ebp - 0x4c], 0x35d5a49
mov dword [ebp - 0x48], 0x34d211a2
add dword [ebp - 0x48], 0xc9a4fd3
mov dword [ebp - 0x44], 0xcb65c9ee
add dword [ebp - 0x44], 0x9809a27e
mov dword [ebp - 0x40], 0x3b72351f
sub dword [ebp - 0x40], 0x3b72351f
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c79e
push 0
call eax
mov ecx, 0x535c
xor esi, esi
add esi, eax
mov edx, 0x2f54edbc
sub edx, 0x2f133dbc
add edx, dword [ebp - 0x3c]
mov edi, 0xfdc4366
sub edi, 0x9d7cc6c4
sub dword [ebp - 0x14], esi
mov ebx, dword [edx]
add dword [ebp - 0x14], 0x2578b4dc
xor ebx, edi
add dword [ebp - 4], 0x4a738360
mov dword [esi], ebx
xor dword [ebp - 0x34], edx
add esi, 4
add edx, 0xf62acadb
sub edx, 0xf62acad7
loop 0x409fb4
add eax, 0x14043
xor ebx, ebx
add ebx, eax
add eax, 0x42773785
add eax, 0xbd88c880
mov ecx, 0xdcf6f236
add ecx, 0x23490dca
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x42de46
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x42de55
pop dword [ebp - 0x28]
mov eax, 0x42de55
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x4da20
push 0
mov eax, 0x4d3e46d1
add eax, 0xb3066beb
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x38d2d31d
add ecx, 0xc72d6bb1
xor edi, edi
add edi, eax
mov edx, 0x487e00
add edx, dword [ebp - 0x28]
mov esi, 0x9be6e7c4
sub esi, 0x9d9eb68d
xor dword [ebp - 0x1c], ecx
mov ebx, dword [edx]
xor dword [ebp - 8], 0x2eb63d78
sub ebx, esi
add dword [ebp - 0xc], ecx
mov dword [edi], ebx
add edi, 4
add edx, 4
loop 0x42deab
add eax, 0x7b91dadf
sub eax, 0x7b90ecd4
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x105ca058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105ca1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105ca07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105ca06a
add dl, dl
jne 0x105ca089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105ca0dc
xor eax, eax
add dl, dl
jne 0x105ca096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105ca17d
add dl, dl
jne 0x105ca0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105ca0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105ca0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105ca0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105ca0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105ca075
mov eax, 1
add dl, dl
jne 0x105ca0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105ca0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105ca0e1
sub eax, ebx
mov ebx, 1
jne 0x105ca128
mov ecx, 1
add dl, dl
jne 0x105ca10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105ca119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105ca105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105ca075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x105ca13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105ca14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105ca136
cmp eax, 0x7d00
jae 0x105ca16d
cmp eax, 0x500
jb 0x105ca168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105ca075
cmp eax, 0x7f
ja 0x105ca170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105ca075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105ca19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105ca075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x44665f
Capabilities:
Encode data using xor

Disassembly:
push ss
idiv dword [ebx - 0x7fb95558]
mov bl, 0x20
in al, 0xfe
add dword [esi], eax
jae 0x4465e2
int 0x53
sbb dword [ecx], edx
xchg byte [edi + edx*4 + 0x20109efc], ah
xchg edi, eax
cld
sahf
adc byte [eax], ah
sti
adc dword [esi], 0x728647e4
in al, 0x47
xchg byte [edx - 9], dh
add eax, 0xb15e10c0
pop esp
mov dh, 0x82
adc dword [edi - 0x3f], esp
cmp dword [edi - 0x5f], ebp
pop esp
test byte [ecx], 0x1a
pop edi
mov dword [ecx - 0x78], eax
imul dword [eax - 0x5df8efe9]
mov dword [0x4200f190], eax

Function at 0x4bc605
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c4438
cmp edx, dword [eax]
je 0x4bc627
add eax, 8
inc ecx
cmp eax, 0x4c44c8
jl 0x4bc618
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c4438]
jne 0x4bc755
mov eax, dword [0x4c8e14]
cmp eax, 1
je 0x4bc72f
test eax, eax
jne 0x4bc658
cmp dword [0x4c4360], 1
je 0x4bc72f
cmp edx, 0xfc
je 0x4bc755
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bc68f
lea eax, [ebp - 0x1a4]
push 0x4c19e0
push eax
call fcn.004bcff0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd480
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bc6d2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd480
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c19dc
push edi
call fcn.004bf350
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c19c0
push eax
call fcn.004bcff0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd000
lea eax, [ebp - 0xa0]
push 0x4c19bc
push eax
call fcn.004bd000
push dword [esi + 0x4c443c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd000
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c1994
push eax
call fcn.004bf2c4
add esp, 0x2c
pop edi
jmp 0x4bc755
lea eax, [ebp + 8]
lea esi, [esi + 0x4c443c]
push 0
push eax
push dword [esi]
call fcn.004bd480
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10666058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.106661a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1066607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1066606a
add dl, dl
jne 0x10666089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106660dc
xor eax, eax
add dl, dl
jne 0x10666096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1066617d
add dl, dl
jne 0x106660a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106660b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106660bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106660c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106660d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10666075
mov eax, 1
add dl, dl
jne 0x106660ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106660f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106660e1
sub eax, ebx
mov ebx, 1
jne 0x10666128
mov ecx, 1
add dl, dl
jne 0x1066610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10666119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10666105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10666075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1066613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1066614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10666136
cmp eax, 0x7d00
jae 0x1066616d
cmp eax, 0x500
jb 0x10666168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10666075
cmp eax, 0x7f
ja 0x10666170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10666075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1066619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10666075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x85a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0085a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x85a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85a06a
add dl, dl
jne 0x85a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85a0dc
xor eax, eax
add dl, dl
jne 0x85a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85a17d
add dl, dl
jne 0x85a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x85a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x85a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x85a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x85a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x85a075
mov eax, 1
add dl, dl
jne 0x85a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x85a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x85a0e1
sub eax, ebx
mov ebx, 1
jne 0x85a128
mov ecx, 1
add dl, dl
jne 0x85a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x85a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x85a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x85a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x85a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x85a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x85a136
cmp eax, 0x7d00
jae 0x85a16d
cmp eax, 0x500
jb 0x85a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x85a075
cmp eax, 0x7f
ja 0x85a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x85a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x85a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x85a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4168c0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x416ad4
sub esp, 0x18
mov eax, dword [0xa9fd78]
test eax, eax
jne 0x416abd
nop
lea eax, [0xa9fd60]
mov dword [esp], eax
call fcn.0040ac10
mov eax, dword [0xa9fd64]
test eax, eax
je 0x416909
cmp dword [eax + 8], 0xcc
jne 0x41697f
mov edx, dword [0xa9fd58]
test edx, edx
jne 0x416961
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0xaa4118]
mov dword [esp + 8], eax
call fcn.0040d100
mov eax, dword [esp + 0xc]
mov dword [0xa9fd58], eax
mov ecx, dword [0xa9fd14]
mov dword [eax], ecx
mov eax, dword [0xa9fd58]
mov dword [0xa9fd14], eax
movzx eax, byte [0xaa0320]
test al, al
jne 0x416961
xor eax, eax
jmp 0x416a69
mov edx, dword [0xa9fd58]
mov ebx, dword [edx + 4]
mov dword [0xa9fd58], ebx
mov ebx, dword [0xa9fd64]
mov dword [edx + 4], ebx
mov dword [0xa9fd64], edx
mov edx, dword [0xa9fd64]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x416a51
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004027f0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0xaa0030]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x4169dd
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x4169ea
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.004648d0
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0xaa0030]
test edx, edx
jne 0x416a16
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x416a37
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.004648d0
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.004648d0
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.004648d0
mov byte [0xa9fbf7], 1
nop
lea eax, [0xa9fd60]
mov dword [esp], eax
call fcn.0040ae10
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00464960
lea esi, [0xaa0320]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x416961
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x416ab3
lea edx, [0x79a280]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x416a5b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00464950
mov ecx, 5
call fcn.00464950
lea eax, [0x83d61a]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004372c0
nop
call fcn.004634e0
jmp fcn.004168c0
Function at 0x4294b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4295cc
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x429545
cmp cl, 2
je 0x4294ed
cmp cl, 3
jne 0x4295b5
mov byte [eax + 8], 1
jmp 0x4295b1
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042eae0
nop
lea eax, [0xa8425c]
mov dword [esp], eax
call fcn.0040ac10
nop
mov eax, dword [0xa84228]
sub eax, dword [0xa8420c]
mov dword [0xa84228], eax
mov eax, dword [0xa84218]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xa84218], ecx
nop
lea eax, [0xa8425c]
mov dword [esp], eax
call fcn.0040ae10
jmp 0x4295b1
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.004168c0
nop
lea eax, [0xa8425c]
mov dword [esp], eax
call fcn.0040ac10
nop
mov eax, dword [0xa84200]
sub eax, dword [0xa841e4]
mov dword [0xa84200], eax
mov eax, dword [0xa841f0]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xa841f0], ecx
nop
nop
lea eax, [0xa8425c]
mov dword [esp], eax
call fcn.0040ae10
add esp, 0x14
ret
lea eax, [0x8395e3]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004372c0
nop
call fcn.004634e0
jmp fcn.004294b0
Function at 0x4412b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, dword [eax + 0x18]
inc dword [ecx + 0x78]
mov dword [eax + 8], 0xfffffade
mov byte [eax + 0x6b], 1
mov ecx, dword [esp + 0x1c]
mov dword [esp], ecx
mov edx, dword [esp + 0x20]
mov dword [esp + 4], edx
call fcn.00441250
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x38], eax
mov edx, dword [esp + 0x1c]
mov dword [ecx + 0x3c], edx
mov dword [esp], ecx
mov dword [esp + 4], 2
mov dword [esp + 8], 3
call fcn.0043bb40
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x38]
cmp dword [eax], ecx
ja 0x441323
cmp dword [eax + 4], ecx
jae 0x441351
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea ecx, [0x441480]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10]
mov dword [esp], ecx
call fcn.004633d0
mov eax, dword [esp + 0xc]
movzx ecx, byte [0xa842a8]
test cl, cl
je 0x44137e
lea eax, [0x852858]
mov dword [esp], eax
call fcn.004633d0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00441250
lea eax, [0xa7a6dc]
mov dword [esp], eax
call fcn.004026a0
mov eax, dword [esp + 4]
test eax, eax
je 0x4413b6
lea eax, [0x85272c]
mov dword [esp], eax
call fcn.004633d0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00441250
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
test byte [ecx], al
mov ecx, dword [ecx + 0x1178]
test ecx, ecx
je 0x4413f2
lea eax, [0x852810]
mov dword [esp], eax
call fcn.004633d0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00441250
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x54]
mov edx, dword [edx + 0x10]
mov dword [ecx + 0x160], edx
mov byte [eax + 0x6f], 1
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x54]
mov dword [ecx + 0x2c], 0
mov edx, dword [eax + 0x18]
mov ebx, ecx
mov dword [edx + 0x5c], ecx
mov ecx, dword [eax + 0x18]
mov dword [ecx + 0x54], 0
lea ecx, [ebx + 4]
mov dword [esp], ecx
mov dword [esp + 4], 2
call fcn.004028b0
mov eax, dword [0xa7a6d0]
test eax, eax
je 0x441463
lea eax, [0x852728]
mov dword [esp], eax
call fcn.004633d0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00441250
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
dec dword [eax + 0x78]
add esp, 0x18
ret
Function at 0x4497a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44999e
sub esp, 0x30
mov eax, dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.004027f0
mov eax, dword [esp + 0x20]
shr eax, 3
mov ecx, eax
mov eax, 0x828cbfbf
mul ecx
shr edx, 7
imul eax, edx, 0xfb
sub ecx, eax
shl ecx, 6
mov dword [esp + 0x1c], ecx
lea eax, [0xa7bda0]
lea edx, [eax + ecx + 8]
mov dword [esp + 0x2c], edx
mov dword [esp], edx
call fcn.004026a0
mov eax, dword [esp + 4]
test eax, eax
je 0x449983
mov eax, dword [esp + 0x1c]
lea ecx, [0xa7bda0]
lea edx, [ecx + eax]
mov dword [esp + 0x28], edx
mov dword [esp], edx
call fcn.0040ac10
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.004026a0
mov eax, dword [esp + 4]
test eax, eax
je 0x449971
mov eax, dword [esp + 0x1c]
lea ecx, [0xa7bda0]
add eax, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.00449db0
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test eax, eax
je 0x449894
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call fcn.004027f0
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0040ae10
mov eax, dword [esp + 0x24]
test eax, eax
je 0x44996d
mov ecx, dword [eax + 0x10]
test ecx, ecx
setne dl
mov ebx, dword [eax + 0x14]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x4498f1
mov eax, dword [esp + 0x14]
sub eax, ecx
mov ecx, dword [esp + 0x18]
sbb ecx, ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 3]
mov dword [esp + 8], ecx
call fcn.004602b0
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x20]
test ecx, ecx
jne 0x449987
movzx ecx, byte [esp + 0x38]
test cl, cl
je 0x44992b
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.004499b0
movzx eax, byte [esp + 4]
test al, al
je 0x449927
mov eax, dword [esp + 0x24]
mov dword [eax + 0x20], 1
jmp 0x44992b
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov ecx, dword [esp + 0x3c]
add ecx, 5
mov dword [esp + 4], ecx
call fcn.00449420
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x20], 1
jne 0x44996d
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x78]
test eax, eax
jne 0x44996d
lea eax, [0x85278c]
mov dword [esp], eax
call fcn.00463370
add esp, 0x30
ret
nop
nop
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0040ae10
add esp, 0x30
ret
add esp, 0x30
ret
lea eax, [0x83e44e]
mov dword [esp], eax
mov dword [esp + 4], 0x1a
call fcn.004372c0
nop
call fcn.004634e0
jmp fcn.004497a0