joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401090
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4010bb
xor eax, eax
pop edi
pop ecx
ret
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov dword [esp + 0xc], eax
call fcn.004a1b2e
mov edx, dword [esp + 0xc]
add esp, 4
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
push eax
push esi
call section..text
add esp, 8
test esi, esi
mov edi, eax
je 0x40110c
push esi
call fcn.004a206d
add esp, 4
pop esi
mov eax, edi
pop edi
pop ecx
ret

Function at 0x401120
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x12c
mov eax, dword [0x4c51e0]
push ebx
push 0
push 2
mov dword [esp + 0x134], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401159
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x128]
call fcn.004a256f
add esp, 0x12c
ret
push esi
push edi
lea eax, [esp + 0xc]
push eax
push ebx
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401195
mov edi, str.asktao.mod
lea esi, [esp + 0x30]
mov ecx, 0xb
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4011b7
lea eax, [esp + 0xc]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401172
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x128]
call fcn.004a256f
add esp, 0x12c
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x134]
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.004a256f
add esp, 0x12c
ret
Function at 0x401430
Capabilities:
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x30c
mov eax, dword [0x4c51e0]
push esi
push edi
mov edi, dword [esp + 0x320]
push edi
mov dword [esp + 0x314], eax
push 0x100
lea eax, [esp + 0x18]
push eax
call fcn.00401210
lea ecx, [esp + 0x10]
push ecx
push 0xdd12
call fcn.004a18b0
add esp, 4
push eax
lea edx, [esp + 0x118]
push 0x100
push edx
call fcn.00401340
mov ecx, dword [0x4c6164]
add esp, 0x10
lea eax, [esp + 0x110]
push eax
push 0x3ea
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x4b025c
push edi
call fcn.004a2840
mov ecx, dword [esp + 0x320]
add esp, 8
mov esi, eax
test esi, esi
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
jne 0x401575
push edi
push ecx
call fcn.00404ee0
add esp, 0x10
test eax, eax
jne 0x4015aa
push 0x4b0258
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
push 0x100
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00403cf0
lea edx, [esp + 0x21c]
push edx
call fcn.00403d50
add esp, 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x40152d
and eax, 0xfffffffe
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [esp + 0x10]
push 0x4b0254
push edx
call fcn.004a281f
mov esi, eax
add esp, 8
test esi, esi
je 0x4015aa
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push eax
push 1
push ecx
call fcn.004a2777
push esi
call fcn.004a261f
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x308]
call fcn.004a256f
add esp, 0x30c
ret
add esi, 5
push esi
push ecx
call fcn.00404ee0
add esp, 0x10
test eax, eax
jne 0x4015aa
mov edi, dword [esp + 0x31c]
push esi
push edi
call fcn.00405680
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push edx
push eax
push esi
push edi
call fcn.00405280
add esp, 0x1c
mov ecx, dword [esp + 0x310]
pop edi
pop esi
call fcn.004a256f
add esp, 0x30c
ret
Function at 0x4015c0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x4c51e0]
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push 0xdd13
mov dword [esp + 0x21c], eax
call fcn.004a18b0
add esp, 4
push eax
lea eax, [esp + 0x118]
push 0x100
push eax
call fcn.00401340
mov edx, dword [0x4c6164]
add esp, 0x10
lea ecx, [esp + 0x110]
push ecx
push 0x3ea
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x4b025c
push esi
call fcn.004a2840
add esp, 8
test eax, eax
jne 0x40169c
mov byte [esp + 8], al
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x10]
push eax
call fcn.00401210
push 0x4b0258
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x40167d
and eax, 0xfffffffe
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 8]
push ecx
call fcn.004a28c6
add esp, 4
mov ecx, dword [esp + 0x214]
call fcn.004a256f
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
add eax, 5
push eax
push edx
call fcn.00405680
mov ecx, dword [esp + 0x21c]
add esp, 8
call fcn.004a256f
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401c50
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x4c51e0]
push ebx
push esi
push edi
push str.temp.txt
mov dword [esp + 0x448], eax
call fcn.00401090
mov esi, eax
add esp, 4
test esi, esi
mov dword [esp + 0x14], esi
jne 0x401cc2
push eax
push 0xdd15
call fcn.004a18b0
add esp, 4
push eax
push 0xdd14
call fcn.004a18b0
add esp, 4
push eax
mov eax, dword [0x4c6164]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, dword [esp + 0x444]
call fcn.004a256f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.00403310
xor ecx, ecx
test eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
jbe 0x401e72
mov ebx, dword [sym.imp.SHLWAPI.dll_StrTrimA]
jmp 0x401ce7
mov esi, dword [esp + 0x14]
push ecx
mov ecx, esi
call fcn.00403340
push 4
mov esi, eax
mov ecx, dword [esi + 0x14]
push str.copy
push ecx
push 0
mov ecx, esi
call fcn.004012c0
test eax, eax
jne 0x401dea
mov byte [esp + 0x20], al
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x128], 0
mov ecx, 0x40
lea edi, [esp + 0x129]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [esi + 0x34], 0x10
jb 0x401d45
mov esi, dword [esi + 0x20]
jmp 0x401d48
add esi, 0x20
push esi
lea edx, [esp + 0x24]
push 0x4b02a0
push edx
call fcn.004a292a
add esp, 0xc
push 0x4b0258
lea eax, [esp + 0x24]
push eax
call ebx
push 0x104
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00403cf0
lea eax, [esp + 0x134]
add esp, 0xc
lea edx, [eax + 1]
jmp 0x401d90
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401d90
sub eax, edx
mov dword [esp + 0x1c], eax
je 0x401daf
lea eax, [esp + 0x128]
push eax
call fcn.00403d50
add esp, 4
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x33c]
push str.download_global__s
push edx
call fcn.004a292a
lea eax, [esp + 0x2c]
push eax
call fcn.004a28c6
add esp, 0x10
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x340]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x401e5d
mov eax, dword [esi + 0x14]
push 3
push 0x4b0264
push eax
push 0
mov ecx, esi
call fcn.004012c0
test eax, eax
jne 0x401e5d
mov byte [esp + 0x230], al
mov ecx, 0x40
lea edi, [esp + 0x231]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [esi + 0x34], 0x10
jb 0x401e25
mov esi, dword [esi + 0x20]
jmp 0x401e28
add esi, 0x20
push esi
lea ecx, [esp + 0x234]
push 0x4b02a0
push ecx
call fcn.004a292a
add esp, 0xc
push 0x4b0258
lea edx, [esp + 0x234]
push edx
call ebx
lea eax, [esp + 0x230]
push eax
call fcn.004a28c6
add esp, 4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
inc ecx
cmp ecx, eax
mov dword [esp + 0x10], ecx
jb 0x401ce3
push str.temp.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [0x4c6164]
push 0
push ecx
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [esp + 0x444]
xor eax, eax
call fcn.004a256f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402710
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4af63c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b4
mov eax, dword [0x4c51e0]
push ebp
mov ebp, dword [esp + 0x1c8]
test ebp, ebp
mov dword [esp + 0x1b4], eax
jne 0x40274a
xor eax, eax
jmp 0x402932
mov eax, ebp
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402750
sub eax, edx
push esi
mov esi, eax
cmp esi, 4
jge 0x402768
xor eax, eax
jmp 0x402931
push ebp
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
push ebp
jne 0x40277f
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x402931
lea ecx, [esp + 0x60]
call fcn.004024b0
cmp byte [esi + ebp - 1], 0x5c
mov dword [esp + 0x1c4], 0
je 0x4027a7
push 0x5c
push 1
lea ecx, [esp + 0x64]
call fcn.00401f20
push ebx
push 0x4b02c4
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x4c]
push ecx
call fcn.00402660
add esp, 0xc
mov eax, dword [esp + 0x5c]
mov ebx, 0x10
cmp eax, ebx
mov eax, dword [esp + 0x48]
mov byte [esp + 0x1c8], 1
jae 0x4027dc
lea eax, [esp + 0x48]
push edi
lea edx, [esp + 0x80]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40280c
lea ecx, [esp + 0x48]
call fcn.00401900
lea ecx, [esp + 0x64]
call fcn.00401900
xor eax, eax
jmp 0x40292f
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov byte [esp + 0x1cc], 2
nop
cmp byte [esp + 0xac], 0x2e
je 0x4028eb
lea eax, [esp + 0xac]
push eax
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00402660
add esp, 0xc
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x1d8], 3
call fcn.00402130
cmp dword [esp + 0x28], ebx
mov byte [esp + 0x1cc], 2
jb 0x402889
mov eax, dword [esp + 0x14]
push eax
call fcn.004a206d
add esp, 4
test byte [esp + 0x80], bl
mov eax, dword [esp + 0x44]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
je 0x4028c2
cmp eax, ebx
mov eax, dword [esp + 0x30]
jae 0x4028b7
lea eax, [esp + 0x30]
push eax
call fcn.00402710
add esp, 4
jmp 0x4028eb
cmp eax, ebx
mov eax, dword [esp + 0x30]
jae 0x4028ce
lea eax, [esp + 0x30]
push 0x80
push eax
call esi
cmp dword [esp + 0x44], ebx
mov eax, dword [esp + 0x30]
jae 0x4028e4
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x80]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402830
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.00401900
lea ecx, [esp + 0x48]
call fcn.00401900
lea ecx, [esp + 0x64]
call fcn.00401900
mov eax, esi
pop edi
pop ebx
pop esi
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x1b4]
pop ebp
call fcn.004a256f
add esp, 0x1c0
ret
Function at 0x403070
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x160
mov eax, dword [0x4c51e0]
mov dword [esp + 0x15c], eax
call fcn.00401120
test eax, eax
jne 0x4030c7
push eax
push 0xdd02
call fcn.004a18b0
add esp, 4
push eax
push 0xdd01
call fcn.004a18b0
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, dword [esp + 0x15c]
call fcn.004a256f
add esp, 0x160
ret 0x10
push esi
push edi
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 0
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov edx, dword [esp + 0x174]
push 0x100
lea ecx, [esp + 0x68]
push ecx
push edx
call fcn.00403ea0
mov esi, eax
lea eax, [esp + 0x70]
push 0x4b025c
push eax
call fcn.004a2840
add esp, 0x14
test eax, eax
je 0x4031d9
push 0x10
call fcn.004a1b0a
add esp, 4
test eax, eax
je 0x403133
lea ecx, [esp + 0x64]
push ecx
mov ecx, eax
call fcn.00404700
jmp 0x403135
xor eax, eax
test esi, esi
mov dword [0x4c6160], eax
je 0x4031ab
push 0x4b0370
push esi
call fcn.004a2840
add esp, 8
test eax, eax
je 0x4031ab
call fcn.00402a40
test eax, eax
jne 0x4031ab
push eax
push 0xdd04
call fcn.004a18b0
add esp, 4
push eax
push 0xdd03
call fcn.004a18b0
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x4c6160]
test ecx, ecx
je 0x4032db
mov esi, ecx
call fcn.004029b0
push esi
call fcn.004a206d
add esp, 4
mov dword [0x4c6160], 0
jmp 0x4032db
mov ecx, dword [0x4c6160]
call fcn.004011e0
test eax, eax
je 0x403245
mov edx, dword [esp + 0x16c]
push 0
push 0x403020
push 0
push 0x65
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x403245
lea eax, [esp + 0x64]
push str.temp.txt
push eax
call fcn.004a2840
add esp, 8
test eax, eax
je 0x403245
push 0xdd00
xor esi, esi
call fcn.004a18b0
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
add esp, 4
push eax
push str.32770
call edi
test eax, eax
je 0x40323e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 3
jge 0x40323d
push 0x3e8
call ebx
push 0xdd00
inc esi
call fcn.004a18b0
add esp, 4
push eax
push str.32770
call edi
test eax, eax
jne 0x403217
pop ebx
push 0
call fcn.00401c50
push str.BitComet
call fcn.00402710
push str.update
call fcn.00402710
mov ecx, dword [0x4c6160]
add esp, 8
test ecx, ecx
je 0x403280
mov esi, ecx
call fcn.004029b0
push esi
call fcn.004a206d
add esp, 4
mov dword [0x4c6160], 0
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 8], ecx
lea edx, [esp + 8]
push edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x24]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push str.AutoUpdate.exe_restartupdate
push str.AutoUpdate.exe
mov dword [esp + 0x48], 0x44
mov dword [esp + 0x3c], ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
xor eax, eax
call fcn.004a256f
add esp, 0x160
ret 0x10
Function at 0x405d60
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00407870
mov esi, dword [esp + 8]
push eax
push esi
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_bzip.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__15_February_2005._n_n
push 0x4c5258
call fcn.004a3478
add esp, 0x10
cmp esi, 0x3ef
pop esi
jne 0x405d99
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
push 0x4c5258
call fcn.004a3478
add esp, 8
push 3
call fcn.004a3438
Function at 0x4062f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov edi, dword [eax + 0x38]
mov cl, byte [eax + 0x34]
test edi, edi
mov byte [esp + 0x10], cl
jle 0x406331
mov esi, dword [esp + 0x10]
and esi, 0xff
mov edx, dword [eax + 0x260]
mov ebx, edx
shr ebx, 0x18
xor ebx, esi
shl edx, 8
mov ebx, dword [ebx*4 + 0x4b7968]
xor ebx, edx
dec edi
mov dword [eax + 0x260], ebx
jne 0x40630f
mov edx, dword [eax + 0x34]
mov bl, 1
mov byte [eax + edx + 0x58], bl
mov edx, dword [eax + 0x38]
mov esi, edx
dec esi
je 0x4063df
dec esi
je 0x4063be
dec esi
je 0x4063a4
mov byte [edx + eax + 0x54], bl
mov edx, dword [eax + 0x24]
mov esi, dword [eax + 0x44]
mov byte [edx + esi], cl
mov esi, dword [eax + 0x44]
inc esi
mov dword [eax + 0x44], esi
mov edx, esi
mov esi, dword [eax + 0x24]
mov byte [esi + edx], cl
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
inc edx
mov dword [eax + 0x44], edx
mov byte [esi + edx], cl
mov ebx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
inc ebx
mov edx, ebx
mov dword [eax + 0x44], ebx
mov byte [esi + edx], cl
mov edi, dword [eax + 0x44]
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x24]
inc edi
sub dl, 4
mov ecx, edi
mov dword [eax + 0x44], edi
pop edi
mov byte [esi + ecx], dl
mov ecx, dword [eax + 0x44]
inc ecx
pop esi
mov dword [eax + 0x44], ecx
pop ebx
ret
mov edx, dword [eax + 0x24]
mov esi, dword [eax + 0x44]
mov byte [edx + esi], cl
mov esi, dword [eax + 0x44]
inc esi
mov dword [eax + 0x44], esi
mov edx, esi
mov esi, dword [eax + 0x24]
mov byte [esi + edx], cl
jmp 0x4063c7
mov edx, dword [eax + 0x24]
mov esi, dword [eax + 0x44]
mov byte [edx + esi], cl
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
inc edx
pop edi
mov dword [eax + 0x44], edx
mov byte [esi + edx], cl
mov ecx, dword [eax + 0x44]
inc ecx
pop esi
mov dword [eax + 0x44], ecx
pop ebx
ret
mov edx, dword [eax + 0x24]
mov esi, dword [eax + 0x44]
pop edi
mov byte [edx + esi], cl
mov ecx, dword [eax + 0x44]
inc ecx
pop esi
mov dword [eax + 0x44], ecx
pop ebx
ret
Function at 0x439f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [ecx + 0x3c]
mov edx, dword [ecx]
lea ebx, [eax*8]
push esi
mov eax, ebx
push edi
mov edi, dword [ecx + 0x20]
add eax, ebp
mov dword [esp + 0x10], edx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x439fa1
xor ebp, ebp
xor esi, esi
jmp 0x439fda
lea esi, [ecx + eax]
xor ebp, ebp
cmp esi, ebp
je 0x439fda
mov ecx, dword [esp + 0x1c]
push esi
push ecx
call fcn.0047b360
add esp, 8
test eax, eax
jne 0x439fce
mov eax, dword [esi + 0x2c]
cmp eax, 0xffffffff
je 0x439fca
add esi, eax
je 0x439fd6
jmp 0x439faa
xor esi, esi
jmp 0x439fd6
cmp esi, ebp
jne 0x43a117
mov edx, dword [esp + 0x10]
cmp dword [esp + 0x24], ebp
je 0x43a117
mov esi, dword [edi + 0x24]
cmp esi, 0xffffffff
je 0x439ff4
lea esi, [esi + edi + 0x24]
cmp esi, ebp
jne 0x43a008
push str.locker_entries
push edx
call fcn.0047b440
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x2c]
cmp eax, 0xffffffff
je 0x43a025
mov ecx, dword [esi + 0x30]
sub ecx, eax
mov dword [eax + esi + 0x30], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
add eax, esi
add dword [eax], ecx
jmp 0x43a03d
mov ecx, dword [esi + 0x30]
mov eax, esi
sub eax, edi
lea eax, [eax + ecx - 0x24]
mov dword [edi + 0x28], eax
mov ecx, dword [esi + 0x30]
mov dword [esi + ecx], 0xffffffff
mov eax, dword [edi + 0x78]
mov ecx, dword [edi + 0x7c]
inc eax
cmp eax, ecx
mov dword [edi + 0x78], eax
jbe 0x43a04e
mov dword [edi + 0x7c], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esi + 8]
mov dword [esi], eax
lea eax, [esi + 4]
push ecx
push eax
push edx
call dword [edx + 0xf8]
mov ecx, dword [esp + 0x24]
or edx, 0xffffffff
mov dword [esi + 0xc], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], edx
mov dword [esi + 0x54], ebp
mov dword [esi + 0x3c], edx
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x40], ebp
mov eax, dword [ecx + 0x3c]
add ebx, eax
add esp, 0xc
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, edx
je 0x43a0bf
sub ecx, esi
add ecx, eax
cmp ecx, edx
mov dword [esi + 0x2c], ecx
jne 0x43a0b0
mov ecx, dword [eax]
xor ebx, ebx
mov dword [ecx + eax + 0x30], ebx
jmp 0x43a0cc
mov ebx, 0x2c
sub ebx, ecx
mov ecx, dword [eax]
mov dword [ecx + eax + 0x30], ebx
jmp 0x43a0cc
mov ecx, esi
sub ecx, eax
add ecx, 0x2c
mov dword [eax + 4], ecx
mov dword [esi + 0x2c], edx
mov ecx, esi
sub ecx, eax
mov dword [eax], ecx
sub eax, esi
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
cmp eax, edx
je 0x43a0fb
sub eax, esi
lea eax, [eax + edi + 0x34]
cmp eax, edx
mov dword [esi + 0x34], eax
je 0x43a0f2
mov ebp, 0x34
sub ebp, eax
mov edx, dword [edi + 0x34]
mov dword [edx + edi + 0x6c], ebp
jmp 0x43a105
mov eax, esi
sub eax, edi
mov dword [edi + 0x38], eax
mov dword [esi + 0x34], edx
mov ecx, esi
sub ecx, edi
sub ecx, 0x34
mov dword [edi + 0x34], ecx
sub edi, esi
add edi, 0x34
mov dword [esi + 0x38], edi
mov edx, dword [esp + 0x28]
pop edi
xor eax, eax
mov dword [edx], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x43c1f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xf0
mov ecx, 0x10
xor eax, eax
push esi
push edi
lea edi, [esp + 8]
mov esi, dword [esp + 0xfc]
rep stosd dword es:[edi], eax
mov ecx, 0x10
mov eax, 0x36363636
lea edi, [esp + 0x78]
rep stosd dword es:[edi], eax
mov ecx, 0x10
mov eax, 0x5c5c5c5c
lea edi, [esp + 0xb8]
rep stosd dword es:[edi], eax
mov ecx, 5
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
pop edi
xor eax, eax
pop esi
mov cl, byte [esp + eax]
mov dl, byte [esp + eax + 0x70]
xor dl, cl
mov byte [esp + eax + 0x70], dl
mov dl, byte [esp + eax + 0xb0]
xor dl, cl
mov byte [esp + eax + 0xb0], dl
inc eax
cmp eax, 0x40
jl 0x43c23e
lea eax, [esp]
push eax
call fcn.0047d780
lea ecx, [esp + 0x74]
push 0x40
lea edx, [esp + 8]
push ecx
push edx
call fcn.0047d7b0
mov eax, dword [esp + 0x10c]
mov ecx, dword [esp + 0x108]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.0047d7b0
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x78]
push eax
push ecx
call fcn.0047d870
lea edx, [esp + 0x24]
push edx
call fcn.0047d780
lea eax, [esp + 0xd8]
push 0x40
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.0047d7b0
lea edx, [esp + 0x90]
push 0x14
lea eax, [esp + 0x38]
push edx
push eax
call fcn.0047d7b0
mov edx, dword [esp + 0x140]
add esp, 0x40
lea ecx, [esp]
push ecx
push edx
call fcn.0047d870
add esp, 0xf8
ret