joyce8/EMBER2024-capa huggingface dataset:
Function at 0x677a20
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x87
enter 0xffffffffffffff1e, 0xffffffffffffffa0
and eax, 0xc0c52735
mov word [ebx], cs
shl dword [ebx], 1
in eax, dx
das
add bh, byte [edi + 0x960ab82]
dec ecx
cmpsd dword [esi], dword es:[edi]
cld
add al, 0x69
stc
adc al, 0xe6
lodsb al, byte [esi]
out 0x4a, al
cdq
out 0x16, eax
cmp ecx, edx
and bh, ah
cmc
cmp bl, byte [ebp - 0x1d]
pop edi
or eax, 0xc054fbd1
pop eax
popal
jl 0x6779b6
call 0x997cc9bc
dec edi
xchg dword [edx - 0x64], ecx
adc ah, byte [0x74666d70]
push edi
invalid
je 0x677a58
fld dword [edx - 0x2d34eeaf]
inc eax
out 0x88, eax
jbe 0x677a81
fnstcw word [esi + ebp*4 - 0x420d3474]
inc esp
sbb byte [eax - 0x21], bl
mov esp, 0x7c2f1244
ja 0x6779f2
jge 0x6779fe
push ebp
inc edx
ror byte [ebp + 0x7c5ea47], 0x2e
jns 0x677a2b
lea eax, [edi - 0x16]
lds eax, [edi]
jns 0x677a2b
sti
xor byte [ecx - 0x26], cl
movaps xmmword [0x29f335ba], xmm6
mov bh, 0xd5
jae 0x6779ed
add ch, byte [eax]
fld xword [esi + edi*4 + 0x49a75ab8]
invalid
invalid
shl eax, 0xf1
xchg ebx, eax
rol bl, cl
mov dh, 0x4b
jns 0x677a21
adc al, 0x98
inc edi
cmp dword [ebp + 0x22], ebx
jno 0x677a23
out 0x81, al
dec eax
enter 0x6567, 0x26
sbb dword [ebx], 0x4d0ea94d
dec ebp
test eax, 0x1d9c4d0e
xor bh, ch
paddw mm7, mm2
pushfd
sbb eax, 0xfd0ffd32
cli
stosb byte es:[edi], al
enter 0xffffffffffff9fd3, 0xfffffffffffffff3
aaa
push cs
adc al, 0x75
shr byte [edx - 0x40], cl
sub dh, byte [edi - 0x2017653b]
imul ecx, dword [ebx + 0x6b], 0x84915007
jno 0x677a9c
dec eax
sbb al, 0x3c
ljmp 0x88b1

Function at 0x6823a0
Capabilities:
Encode data using xor

Disassembly:
adc cl, al
or ah, byte [eax]
sbb al, 0xfd
and byte [ecx + ebx*4 + 0x41], al
push edi
xor dword [edi - 0x60], ecx
pop ebx
adc eax, 0xabde8848
cmp dl, bh
out 0xe4, eax
mov word [ebx], cs
fild qword [eax + edi*8 + 0x12d2b684]
enter 0x200a, 0x1c
std
and byte [ebp + edi*2 + 0x29], al
cmp eax, 0xb3db1fae
pop esi
in eax, dx
cmp dword [edx + edx*2 - 0x6bf12eb], 0x697338e6
invalid
cli
push ecx
or al, 0x61
mov edi, dword [edx + edx*2 - 0x5e0f577c]
add edx, eax
wait
jl 0x682358
mov fs, word [esi + 0x45e96084]
add ebp, dword gs:[esi - 0x115947cb]
xor ecx, esi
rol eax, 0x99
mov ebp, 0xe429bb4a
mov bl, 0x86
add byte [ebx + 0x6d], dh
fsub st(0)
cmp al, 0x75
ficom word [ecx - 0x38]
test al, 0x4c
retf 0xb733
Function at 0x68db30
Capabilities:
Encode data using xor

Disassembly:
and dh, bl
sar dword [edi + 8], 1
jae 0x68db90
retf
bswap ebp
push ds
mov edi, dword [ebx]
sub al, ah
inc ebp
cmp eax, 0xb8bfc551
push ebp
wait
cwde
cmp ebx, edx
iretd
js 0x68dba7
push edi
mov al, 0xcf
push 0x584521cc
retf 0x7c2
sbb dl, dl
sti
mov es, word [esi]
loope 0x68db63
scasd eax, dword es:[edi]
fild word [eax + 0x28]
imul edx, dword [eax + 0x55ebe152], 0x7fb4e60
push edx
rcr dword [ebx - 0x6c8c8293], 1
pop ds
mov word [edx + 0x58], cs
xor ebp, edx
pop es
mov dword [0xea88351a], eax
adc byte [ebx - 0x472aed3b], 0x3d
xor al, 0x6f
add dword [edi - 0x56acfb6b], 0x23
shl dword [edx - 0x3bcac763], 0xf
lds esp, [ecx]
aad 0x3f
inc esi
push ds
sbb ebx, dword [eax]
nop
mov cl, 0x40
outsd dx, dword [esi]
leave
fcomp dword [edx]
jle 0x68dbc3
fadd qword [edx + edx + 0x2f]
jl 0x68dc74
aam 0x7d
ficom word [ecx]
sbb eax, 0x2ea0588a
cld
stc
cmpsd dword [esi], dword es:[edi]
mov ebx, dword [esi + 0x6ca6b409]
adc eax, 0xd40fa9fe
rcr dword [edi + 0x55], 1
fdivr qword [edi - 8]
mov ebp, 0x9f450a3a
popfd
mov ebp, 0x7da29c07
push esi
xchg edi, eax
clc
or bl, byte [0x37996840]
sbb eax, 0x37996840
fsubr qword [edi]
cmp esi, edx
lcall 0xaa8b, 0xc1362076
scasb al, byte es:[edi]
or cl, byte [ebx - 0x425b5836]
aad 0x65
lea ebx, [ecx - 0x3d]
aad 0x6f
xchg al, dl
int3
add byte [esi + 9], bl
push ss
jg 0x68dc2a
pop ss
push cs
fsubr dword [edx + 0x1f92b487]
in al, 0xdb
dec eax
lcall 0x8484, 0xd37145d3
stosb byte es:[edi], al
inc ecx
arpl word [ecx - 0x37a14a28], sp
invalid

Function at 0x6955d0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
enter 0x200a, 0x1c
std
and byte [esp + edx*4 + 6], al
pop esi
retf
movsb byte es:[edi], byte [esi]
xor dl, byte [ebp - 0x3fe5e853]
movhlps xmm1, xmm0
or ah, byte [eax]
sbb al, 0xfd
and byte [ebp + ebx - 0x29], al
xchg edx, eax
and dword [eax + 0x122f468b], ebx
enter 0x200a, 0x1c
std
and byte [edx + edi + 7], al
in eax, dx
sti
test eax, 0x125c4c51
enter 0x200a, 0x1c
std
and byte [ebx + eax*2 - 0xd], al
cmp edi, dword [edi + edi*4 - 0x2182627]
inc ecx
inc edi
push eax
aam 0xda
ror byte [eax + 0x27], 1
mov edx, 0x3d99733
loope 0x695549
adc cl, al
or ah, byte [eax]
sbb al, 0xfd
and byte [edi + edi*4 + 0x4b], al
mov edi, 0x4c61b44b
mov edi, 0x4c61b44b
sbb al, 0x81
ja 0x695614
adc eax, 0x953d5495
jle 0x695580
int 0x38
int3
imul ebp, dword [ebx - 0x16], 0x45
or al, 0xf4
add edi, dword [eax - 0x1b]
and byte [eax - 0x71], ah
invalid
Function at 0x72d650
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x7ab948
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
mov esi, dword [esp + 0x30]
mov eax, dword [esi + 0x50]
test eax, eax
push edi
mov ebp, ecx
je 0x72d8ab
cmp dword [esi + 0x4c], 0x2d
jne 0x72d68c
mov ecx, dword [ebp + 0x1c]
push 0
call fcn.0040a390
mov ecx, dword [0x8284d4]
mov eax, dword [esi + 0x1d0]
mov esi, dword [ecx + 8]
push eax
mov ecx, esi
call fcn.004dc380
push eax
mov ecx, esi
call fcn.004dbff0
test eax, eax
mov dword [esp + 0xc], eax
je 0x72d8ab
mov edx, dword [0x8284d4]
mov esi, dword [edx + 8]
mov ecx, esi
call fcn.004dc3a0
push eax
mov ecx, esi
call fcn.004dc000
mov esi, eax
test esi, esi
je 0x72d704
mov ecx, dword [esi + 0x1198]
push 0
call fcn.005ee720
movzx eax, al
imul eax, eax, 0x32
cmp eax, 0xfa
jg 0x72d704
mov ecx, dword [esi + 0x1198]
push 0
call fcn.005ee720
movzx edi, al
imul edi, edi, 0x32
jmp 0x72d709
mov edi, 0xfa
mov esi, dword [esp + 0xc]
mov ecx, esi
call fcn.0055c6e0
and eax, 0xfffffffe
cmp eax, 2
jae 0x72d723
mov eax, 1
jmp 0x72d72c
mov ecx, esi
call fcn.0055c6e0
shr eax, 1
test eax, eax
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
jge 0x72d73e
fadd dword [0x7b5778]
test edi, edi
fmul dword [ebp + 0x33f4]
mov dword [esp + 0xc], edi
fild dword [esp + 0xc]
jge 0x72d756
fadd dword [0x7b5778]
fcompp
fnstsw ax
test ah, 5
jp 0x72d8a3
mov ecx, dword [0x8284d4]
mov ecx, dword [ecx + 4]
call fcn.006388e0
mov esi, dword [eax + 0xa0]
lea ecx, [esp + 0x14]
call fcn.005ff150
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.00630cd0
mov ecx, dword [0x8284e0]
push eax
push 0
mov byte [esp + 0x34], 1
call fcn.0041ef40
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.00630d30
mov ecx, dword [0x8284e4]
push 0
push 0
push 0
push 0x1e4d4
lea edx, [esp + 0x2c]
push edx
call fcn.0057f240
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 2
call fcn.00630d60
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 0
call fcn.00630d30
push 1
mov ecx, esi
call fcn.00677a20
sub esp, 8
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.00630c10
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x70]
mov eax, dword [esp + 0x34]
push eax
push 0x72be80
push ebp
mov ecx, esi
call fcn.00675e60
mov edx, dword [0x826e28]
mov eax, dword [0x826e2c]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [0x826e30]
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
mov ecx, dword [0x826e88]
mov edx, dword [0x826e8c]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [0x826e90]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov ecx, esi
call fcn.00675bf0
mov edx, dword [0x8284d4]
mov ecx, dword [edx + 4]
push 1
push 1
push esi
call fcn.00638ca0
mov ecx, eax
call fcn.0040bfd0
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00630d30
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret 4
push esi
mov ecx, ebp
call fcn.0072bd10
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x24
ret 4
Function at 0x80c000
Capabilities:
Access peb ldr_data

Disassembly:
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
call fcn.0080c8bd
mov dword [ebx], eax
mov ecx, dword [eax + 0x3c]
add ecx, 0x78
mov edx, dword [ecx + eax]
add edx, eax
xor ebx, ebx
add edx, 0x20
mov ebx, dword [edx]
add ebx, eax
add ebx, 4
push ecx
call fcn.0080c0b2
inc dword [ecx]
pop ecx
mov esi, dword [ebx]
add esi, eax
push ecx
call fcn.0080c096
lea edi, [ecx]
pop ecx
mov ecx, 0xe
repe cmpsb byte [esi], byte es:[edi]
jne 0x80c02f
xor ebx, ebx
add edx, 4
mov ebx, dword [edx]
add ebx, eax
mov edi, eax
xor eax, eax
mov al, 2
mov esi, edx
push ecx
call fcn.0080c0b2
mul word [ecx]
mov dword [ecx], eax
xor eax, eax
add ebx, dword [ecx]
pop ecx
mov ax, word [ebx]
sub esi, 8
mov ecx, dword [esi]
add ecx, edi
xor ebx, ebx
mov ebx, eax
mov eax, 4
mul ebx
add ecx, eax
mov ecx, dword [ecx]
add ecx, edi
call fcn.0080caba
mov dword [eax], ecx
jmp 0x80c0c3
nop
nop
call fcn.0080c8a3
push ebx
call fcn.0080c8bd
mov ebx, dword [ebx]
push ebx
call fcn.0080caba
mov eax, dword [eax]
call eax
call fcn.0080c8a3
mov dword [ebx], eax
call fcn.0080c8f8
push ebx
call fcn.0080c8bd
mov ebx, dword [ebx]
push ebx
call fcn.0080caba
mov eax, dword [eax]
call eax
call fcn.0080c8f8
mov dword [ebx], eax
call fcn.0080ca85
push ebx
call fcn.0080c8bd
mov ebx, dword [ebx]
push ebx
call fcn.0080caba
mov eax, dword [eax]
call eax
call fcn.0080ca85
mov dword [ebx], eax
call fcn.0080c9ec
push ebx
call fcn.0080c8bd
mov ebx, dword [ebx]
push ebx
call fcn.0080caba
mov eax, dword [eax]
call eax
call fcn.0080c9ec
mov dword [ebx], eax
call fcn.0080c876
push ebx
call fcn.0080c8bd
mov ebx, dword [ebx]
push ebx
call fcn.0080caba
mov eax, dword [eax]
call eax
call fcn.0080c876
mov dword [ebx], eax
call fcn.0080c890
push ebx
call fcn.0080c8bd
mov ebx, dword [ebx]
push ebx
call fcn.0080caba
mov eax, dword [eax]
call eax
call fcn.0080c890
mov dword [ebx], eax
call fcn.0080c9a8
push ebx
call fcn.0080c8bd
mov ebx, dword [ebx]
push ebx
call fcn.0080caba
mov eax, dword [eax]
call eax
call fcn.0080c9a8
mov dword [ebx], eax
call fcn.0080c9ca
push ebx
call eax
call fcn.0080c97f
push ebx
push eax
call fcn.0080caba
mov eax, dword [eax]
call eax
call fcn.0080c97f
mov dword [ebx], eax
call fcn.0080c8a3
mov edi, dword [ebx]
nop
nop
push 0x40
push 0x103000
mov eax, 0x99999
push eax
push 0
call edi
nop
nop
mov esi, eax
mov edi, eax
add edi, 0x31000
call 0x80c1fc
mov edx, 0x2263
add edx, 0x30000
mov ebx, dword [ecx]
mov dword [eax], ebx
inc eax
inc ecx
dec edx
cmp edx, 0
jne 0x80c1ec
nop
nop
jmp esi
Function at 0x130f4f6
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x9b
shld ecx, edi, 0
xchg dword [esp], ebx
push ebx
nop
xchg dword [esp + 4], ebx
sub dword [esp], 0x99
push dword [esp]
xchg dword [esp], eax
mov eax, dword [eax]
sub esp, 0x14
mov dword [esp + 0x10], 0x9bc81177
mov dword [esp + 0xc], 0x2003a
mov dword [esp + 8], edi
mov edi, 0x130f4c4
mov dword [esp + 4], ebp
mov dword [esp + 0x10], edi
xor edi, edi
push eax
pop eax
mov ebp, dword [esp + 0x10]
mov ebp, dword [ebp]
xor edi, ebp
add dword [esp + 0x10], 4
sar ebx, 0
dec word [esp + 0xc]
jne 0x130f53f
nop
mov ebp, dword [esp + 4]
mov dword [esp + 4], esp
mov ecx, ecx
add dword [esp + 4], 0x14
sub eax, edi
mov edi, dword [esp + 8]
mov esp, dword [esp + 4]
shrd edx, edx, 0
bt edx, 0x11
xchg dword [esp], eax
mov dword [esp + 4], 0x350004c2
jmp 0x130f582
ret 4
Function at 0x1312110
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
xor ecx, ecx
xor eax, eax
movsx edx, byte [eax + 0x16e42b8]
dec edx
cmp edx, ecx
je 0x131212e
inc eax
cmp eax, 0x20
jl 0x131211a
jmp 0x1312132
mov byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 0x20
jl 0x1312118
and dword [ebp - 8], 0
push ebx
lea eax, [ebp - 0x2c]
push esi
mov dword [ebp - 0xc], eax
mov eax, 0x16e27c0
push edi
xor edx, edx
mov dword [ebp - 4], eax
mov eax, edx
sar eax, 1
mov ecx, edx
and ecx, 1
shl ecx, 4
and eax, 0xf
or eax, ecx
mov ecx, edx
and ecx, 0x20
or eax, ecx
mov ecx, dword [ebp - 8]
movsx edi, byte [ecx + eax + 0x16e40b8]
xor ebx, ebx
xor esi, esi
push 8
pop eax
mov ecx, esi
sar eax, cl
test edi, eax
je 0x1312194
mov eax, dword [ebp - 0xc]
movsx eax, byte [eax + esi]
push 0x1f
pop ecx
sub ecx, eax
xor eax, eax
inc eax
shl eax, cl
or ebx, eax
inc esi
cmp esi, 4
jl 0x1312176
mov eax, dword [ebp - 4]
add dword [ebp - 4], 4
inc edx
cmp edx, 0x40
mov dword [eax], ebx
jl 0x131214f
mov eax, dword [ebp - 4]
add dword [ebp - 8], 0x40
add dword [ebp - 0xc], 4
cmp eax, 0x16e2fc0
jl 0x131214a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0xbc3d00], 1
mov dword [0xbc3cfc], 1
mov dword [0xbc3cf8], 1
mov dword [0xbc3cf0], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x5be014], eax
mov eax, dword [0xbc3d0c]
test eax, eax
je 0x4010b0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0xbc3d20]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0xbc3d08]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x57e8a4], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060
Function at 0x40275f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xec
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0
je 0x402787
cmp dword [ebp - 0x1c], 1
je 0x4028fd
jmp 0x4028f8
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp + 0x34]
mov ebx, dword [eax]
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp + 0x24]
mov esi, dword [eax]
mov dword [ebp - 0x38], esi
mov eax, dword [ebp + 0x14]
mov edi, dword [eax]
mov dword [ebp - 0x3c], edi
mov eax, dword [ebp + 0x34]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x30]
mov ecx, dword [eax]
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp + 0x3c]
mov esi, dword [eax]
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp + 0x34]
mov edi, dword [eax]
mov dword [ebp - 0x50], edi
mov eax, dword [ebp + 0x38]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp + 0x20]
mov edi, dword [eax]
mov eax, dword [ebp + 0x40]
mov esi, dword [eax]
mov eax, dword [ebp + 0x1c]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0x94], edx
fld qword [0x586b20]
fstp qword [esp + 0x8c]
fld qword [0x586b28]
fstp qword [esp + 0x84]
fld qword [0x586b08]
fstp qword [esp + 0x7c]
mov edx, dword [ebp - 0x2c]
mov dword [esp + 0x78], edx
mov edx, dword [ebp - 0x30]
mov dword [esp + 0x74], edx
fld qword [0x586b08]
fstp qword [esp + 0x6c]
mov edx, dword [ebp - 0x34]
mov dword [esp + 0x68], edx
mov edx, dword [ebp - 0x38]
mov dword [esp + 0x64], edx
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0x60], edx
mov edx, dword [ebp - 0x40]
mov dword [esp + 0x5c], edx
mov edx, dword [ebp - 0x44]
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], 4
mov edx, dword [ebp - 0x48]
mov dword [esp + 0x50], edx
fld qword [0x586b20]
fstp qword [esp + 0x48]
mov edx, dword [ebp - 0x4c]
mov dword [esp + 0x44], edx
mov edx, dword [ebp - 0x50]
mov dword [esp + 0x40], edx
mov edx, dword [ebp - 0x54]
mov dword [esp + 0x3c], edx
fld qword [0x586b20]
fstp qword [esp + 0x34]
mov dword [esp + 0x30], 0
mov edx, dword [ebp - 0x58]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], 6
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
fldz
fstp qword [esp + 8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym._ByteFree
mov dword [ebp - 0x1c], 1
nop
jmp 0x402772
nop
add esp, 0xec
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405d3a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x405e85
cmp dword [ebp - 0xc], 1
jne 0x405e7f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0x94], 6
mov dword [esp + 0x90], 0
mov dword [esp + 0x8c], 0
fld qword [0x586b10]
fstp qword [esp + 0x84]
mov dword [esp + 0x80], 8
mov dword [esp + 0x7c], 5
mov dword [esp + 0x78], 4
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], 2
mov dword [esp + 0x6c], 8
mov dword [esp + 0x68], 7
fldz
fstp qword [esp + 0x60]
mov dword [esp + 0x5c], 6
mov dword [esp + 0x58], 0x57f136
mov dword [esp + 0x54], eax
fld qword [0x586b40]
fstp qword [esp + 0x4c]
fld qword [0x586b20]
fstp qword [esp + 0x44]
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 8
mov dword [esp + 0x34], 6
mov dword [esp + 0x30], 3
mov dword [esp + 0x2c], 4
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 6
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
fld qword [0x586b40]
fstp qword [esp + 0xc]
mov dword [esp + 8], 5
fldz
fstp qword [esp]
call sym._AddCryptoWallets
mov dword [ebp - 0xc], 0
jmp 0x405e80
nop
jmp 0x405d4a
nop
leave
ret
Function at 0x405e88
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x405fbf
cmp dword [ebp - 0xc], 1
jne 0x405fb9
mov eax, dword [ebp + 0x8c]
mov dword [esp + 0x84], eax
mov eax, dword [ebp + 0x88]
mov dword [esp + 0x80], eax
mov eax, dword [ebp + 0x84]
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 0x80]
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x7c]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x70], eax
mov eax, dword [ebp + 0x74]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0x70]
mov dword [esp + 0x68], eax
mov eax, dword [ebp + 0x6c]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x58]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x54]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x44]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.___super_fnc__2168
mov dword [ebp - 0xc], 0
jmp 0x405fba
nop
jmp 0x405e98
nop
leave
ret
Function at 0x406c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xdc
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0
je 0x406dda
cmp dword [ebp - 0x1c], 1
jne 0x406dd4
mov eax, dword [ebp + 0x14]
mov edx, dword [eax]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x20]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
mov esi, dword [eax]
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov edi, dword [eax]
mov dword [ebp - 0x30], edi
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov edi, dword [eax]
mov dword [ebp - 0x38], edi
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov edi, dword [eax]
mov dword [ebp - 0x40], edi
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x2c]
mov edi, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0x94], 0
fld qword [0x586b10]
fstp qword [esp + 0x8c]
mov dword [esp + 0x88], edx
mov dword [esp + 0x84], ecx
fld qword [0x586b08]
fstp qword [esp + 0x7c]
mov dword [esp + 0x78], ebx
mov dword [esp + 0x74], 5
mov dword [esp + 0x70], esi
fld qword [0x586b38]
fstp qword [esp + 0x68]
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], 0
fld qword [0x586b28]
fstp qword [esp + 0x58]
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x50], 0
mov ebx, dword [ebp - 0x30]
mov dword [esp + 0x4c], ebx
fld qword [0x586b08]
fstp qword [esp + 0x44]
fld1
fstp qword [esp + 0x3c]
mov esi, dword [ebp - 0x34]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], 6
mov edx, dword [ebp - 0x38]
mov dword [esp + 0x30], edx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], str.afbcbjpbpfadlkmhmclhkeeodmamcflc
mov dword [esp + 0x20], 0
mov ebx, dword [ebp - 0x40]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov esi, dword [ebp - 0x44]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], 9
mov dword [esp + 4], eax
mov dword [esp], 4
call sym._StrCmpiW
mov edx, dword [ebp + 0x24]
mov dword [edx], eax
mov dword [ebp - 0x1c], 0
jmp 0x406dd5
nop
jmp 0x406c63
nop
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret