joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d00
Capabilities:
Packed with generic packer

Disassembly:
jne 0x406d03
ret
push ebp
mov ebp, esp
sub esp, 0
push eax
push edx
push ebx
push esi
push edi
jmp loc.00451190

Function at 0x406d40
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 4]
test edx, edx
je 0x406d93
xor eax, eax
mov al, byte [esp + 8]
push edi
mov edi, ecx
cmp edx, 4
jb 0x406d87
neg ecx
and ecx, 3
je 0x406d69
sub edx, ecx
mov byte [edi], al
inc edi
dec ecx
jne 0x406d63
jmp 0x44df93
mov byte [edi], al
inc edi
dec edx
jne 0x406d87
mov eax, dword [esp + 8]
pop edi
ret
mov eax, dword [esp + 4]
ret

Function at 0x407570
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43c220], 0
je fcn.00407582
jmp loc.0044ac77

Function at 0x4078d0
Capabilities:
Packed with generic packer
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43a830], 1
jne fcn.004078e1
jmp loc.004440f0

Function at 0x407a10
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x302c
call fcn.0040b9d0
push edi
mov byte [ebp - 0x3008], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x3007]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x2008], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x2007]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x1000], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0xfff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1004], eax
cmp dword [ebp + 8], 0
jl 0x407a7e
cmp dword [ebp + 8], 3
jl 0x407a86
or eax, 0xffffffff
jmp 0x44cdc8
cmp dword [ebp + 8], 2
jmp 0x44e0d0

Function at 0x408c80
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
jmp loc.00446a61

Function at 0x40aa30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
cmp dword [0x43a954], 0
jne 0x40aa8a
jmp loc.0044e054
cmp dword [0x43a954], 1
jmp loc.00450cf3

Function at 0x40b0ac
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push ebp
push 0
push 0
jmp loc.0044ae8b

Function at 0x40b4e0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0xa
jne 0x40b507
cmp dword [ebp + 8], 0
jge 0x40b507
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
jmp loc.0044fa57
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040b530
add esp, 0x10
mov eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x40b766
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x40b74b
cmp dword [ebp + 0xc], 0
ja loc.0040b6ea
jb 0x40b759
cmp dword [ebp + 8], 0
ja loc.0040b6ea
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x44bcf2

Function at 0x40b7d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
jmp loc.00449b1f

Function at 0x40b8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
jmp loc.0044a66d

Function at 0x40bef0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43aa38], 0
jne 0x40bf17
cmp dword [0x43aa38], 0
jne 0x40bf17
jmp loc.00447c1b
pop ebp
ret

Function at 0x40c7d0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x43aa40]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40c7f0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
add esp, 4
test eax, eax
jne 0x40c7f4
xor eax, eax
jmp 0x40c7f9
jmp 0x44f406
mov esp, ebp
pop ebp
ret

Function at 0x40c820
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0xffffffe0
jbe 0x40c82e
xor eax, eax
jmp 0x40c873
cmp dword [ebp + 8], 0xffffffe0
ja 0x40c845
mov eax, dword [ebp + 8]
push eax
call fcn.0040c880
add esp, 4
mov dword [ebp - 4], eax
jmp 0x40c84c
jmp 0x44e2f1
cmp dword [ebp - 4], 0
jne 0x40c858
cmp dword [ebp + 0xc], 0
jne 0x40c85d
mov eax, dword [ebp - 4]
jmp 0x40c873
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040c7d0
add esp, 4
test eax, eax
jne 0x40c871
xor eax, eax
jmp 0x40c873
jmp 0x40c82e
mov esp, ebp
pop ebp
ret

Function at 0x40c880
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp eax, dword [0x429d40]
ja 0x40c8a9
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040d330
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40c8a9
mov eax, dword [ebp - 4]
jmp 0x40c8d5
cmp dword [ebp + 8], 0
jne 0x40c8b6
jmp 0x44ac9d
mov edx, dword [ebp + 8]
add edx, 0xf
and edx, 0xfffffff0
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, dword [0x43c08c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esp, ebp
pop ebp
ret

Function at 0x40cb50
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x40cb5c
jmp 0x40cb96
mov eax, dword [ebp + 8]
push eax
call fcn.0040cca0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40cb83
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0040cd60
add esp, 8
jmp 0x40cb96
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, dword [0x43c08c]
push ecx
jmp 0x44ed56
mov esp, ebp
pop ebp
ret
Function at 0x40cca0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x43c084]
imul eax, eax, 0x14
mov ecx, dword [0x43c088]
add ecx, eax
mov dword [ebp - 0xc], ecx
mov edx, dword [0x43c088]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jae 0x40ccef
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
sub edx, dword [ecx + 0xc]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x100000
jae 0x40cce4
mov eax, dword [ebp - 8]
jmp 0x40ccf1
jmp 0x45096a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40cd00
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
shr edx, 0xf
mov dword [ebp - 4], edx
mov eax, 0x80000000
mov ecx, dword [ebp - 4]
shr eax, cl
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
and edx, eax
test edx, edx
jne 0x40cd51
mov eax, dword [ebp - 8]
and eax, 0xf
test eax, eax
jne 0x40cd51
mov ecx, dword [ebp - 8]
and ecx, 0xfff
test ecx, ecx
je 0x40cd51
mov dword [ebp - 0xc], 1
jmp 0x40cd58
mov dword [ebp - 0xc], 0
jmp 0x44d28f

Function at 0x40f3f0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43c214], 0
jne fcn.0040f410
push 0xfffffffffffffffd
call fcn.0040ec60
add esp, 4
jmp loc.0044fe26

Function at 0x410580
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
test eax, eax
jle 0x4105c6
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
jmp loc.0044db3c
mov esp, ebp
pop ebp
ret

Function at 0x4105d0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
add ecx, 4
mov edx, dword [ebp + 8]
mov dword [edx], ecx
jmp loc.00447301

Function at 0x410610
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
add ecx, 4
mov edx, dword [ebp + 8]
mov dword [edx], ecx
jmp loc.0044e98d

Function at 0x411bf0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp eax, dword [0x43c1dc]
jmp loc.0044f585

Function at 0x411ec0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x411ed5
push 0
call fcn.00411ff0
add esp, 4
jmp 0x411f11
mov eax, dword [ebp + 8]
push eax
call fcn.00411f20
add esp, 4
test eax, eax
je 0x411eea
or eax, 0xffffffff
jmp 0x411f11
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
and edx, 0x4000
test edx, edx
je 0x411f0f
jmp 0x44c76f
xor eax, eax
pop ebp
ret

Function at 0x411fe0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 1
jmp loc.0044c9b4

Function at 0x4124e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
jmp loc.0044c8be
Function at 0x6d209d16
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea eax, [eax + 0xc]
mov edx, eax
cmp edx, eax
je 0x6d209d70
push eax
push 0x6d20887a
call fcn.6d209dae
push 7
push 0x6d3880bc
push dword [eax + 0x30]
call fcn.6d20a107
cmp eax, 0
jne 0x6d209d4a
inc eax
jmp 0x6d209d72
push 0x6d208892
call fcn.6d209dae
push 7
push 0x6d3880bc
push dword [eax + 0x30]
call fcn.6d20a107
cmp eax, 0
jne 0x6d209d6b
inc eax
jmp 0x6d209d72
pop eax
mov eax, dword [eax]
jmp 0x6d209d24
xor eax, eax
ret

Function at 0x6d209d88
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 0x68]
and al, 0x70
cmp al, 0x70
sete al
movzx eax, al
ret

Function at 0x6d209d9c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
setne al
movzx eax, al
ret

Function at 0x6d209dae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x6d3880bc]
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
xor ax, 0xc7
stosw word es:[edi], ax
cmp ax, 0
jne 0x6d209dbc
pop edi
pop esi
leave
ret 4

Function at 0x6d209dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x6d3880bc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, 0xc7
stosb byte es:[edi], al
cmp al, 0
jne 0x6d209dde
pop edi
pop esi
leave
ret 4

Function at 0x6d20a012
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov edi, dword [edx + ebx]
test edi, edi
je 0x6d20a063
add edi, ebx
xchg esi, eax
push ecx
xor eax, eax
lea ecx, [eax - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg esi, eax
mov esi, dword [ebp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
pop ecx
jne 0x6d20a063
sub ecx, dword [eax + 0x18]
neg ecx
mov edx, dword [eax + 0x24]
add edx, ebx
movzx edx, word [edx + ecx*2]
mov eax, dword [eax + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x6d20a06a
add edx, 4
loop 0x6d20a02a
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x6d20a071
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea ebp, [eax + 0xc]
mov eax, dword [ebp]
mov esi, dword [eax + 0x30]
movzx ecx, word [eax + 0x2e]
mov edi, dword [esp + 0x10]
mov dx, word [esi]
cmp dx, word [edi]
je 0x6d20a0bd
cmp dx, 0x41
jb 0x6d20a0a2
cmp dx, 0x5a
jbe 0x6d20a0a8
cmp dx, 0x61
jb 0x6d20a0b4
cmp dx, 0x7a
ja 0x6d20a0b4
xor dx, 0x20
jmp 0x6d20a0b6
jmp 0x6d20a0d0
cmp dx, word [edi]
je 0x6d20a0bd
jmp 0x6d20a0d0
add edi, 2
add esi, 2
sub ecx, 2
cmp ecx, 0
jne 0x6d20a08e
mov eax, dword [eax + 0x18]
jmp 0x6d20a0d8
mov eax, dword [eax]
cmp ebp, eax
jne 0x6d20a083
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x402530
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4026cd
mov esi, dword [ebp + 8]
test esi, esi
je 0x4026cd
mov dword [esi + 0xf0], 0xa
mov ecx, dword [edi]
mov eax, ecx
rol ecx, 8
and ecx, 0xff00ff
ror eax, 8
and eax, 0xff00ff00
or eax, ecx
mov dword [esi], eax
lea eax, [esi + 4]
mov edx, dword [edi + 4]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [eax], ecx
mov edx, dword [edi + 8]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [esi + 8], ecx
mov ecx, dword [edi + 0xc]
mov edi, 0x602744
push ebx
mov ebx, ecx
rol ecx, 8
and ecx, 0xff00ff
ror ebx, 8
and ebx, 0xff00ff00
or ebx, ecx
mov ecx, ebx
mov dword [esi + 0xc], ebx
shr ecx, 0x10
and ecx, 0xff
mov edx, dword [ecx*4 + 0x603c70]
mov ecx, ebx
shr ecx, 8
xor edx, 0x1000000
and ecx, 0xff
and edx, 0xff000000
mov ecx, dword [ecx*4 + 0x603870]
and ecx, 0xff0000
xor edx, ecx
mov ecx, ebx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x604070]
xor edx, ecx
movzx ecx, bl
mov ecx, dword [ecx*4 + 0x604470]
and ecx, 0xff00
xor edx, ecx
mov ecx, dword [eax]
xor edx, dword [esi]
xor ecx, edx
mov dword [esi + 0x10], edx
mov edx, dword [esi + 8]
xor edx, ecx
mov dword [esi + 0x14], ecx
mov ecx, ebx
mov dword [esi + 0x18], edx
xor ecx, edx
mov dword [esi + 0x1c], ecx
pop ebx
mov edi, edi
mov edx, dword [eax + 0x18]
lea eax, [eax + 0x10]
mov ecx, edx
shr ecx, 8
and ecx, 0xff
mov esi, dword [ecx*4 + 0x603870]
mov ecx, edx
shr ecx, 0x10
and esi, 0xff0000
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x603c70]
and ecx, 0xff000000
xor esi, ecx
mov ecx, edx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x604070]
xor esi, ecx
movzx ecx, dl
mov ecx, dword [ecx*4 + 0x604470]
and ecx, 0xff00
xor esi, ecx
xor esi, dword [eax - 4]
xor esi, dword [edi]
add edi, 4
mov dword [eax + 0xc], esi
mov ecx, dword [eax]
xor ecx, esi
mov dword [eax + 0x10], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
cmp edi, 0x602768
jne 0x402640
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x4026e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00402530
add esp, 4
test eax, eax
js 0x4028cc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x402754
lea esi, [eax + 8]
add eax, 8
lea esi, [esi + edi*4]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x402714
mov ebx, dword [ebp + 8]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x4028c7
lea esi, [ebx + 2]
jmp 0x402770
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + 0x604070]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x603470]
movzx eax, byte [eax*4 + 0x604070]
xor ecx, dword [eax*4 + 0x602c70]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x604070]
xor ecx, dword [eax*4 + 0x602870]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x604070]
xor ecx, dword [eax*4 + 0x603070]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x604070]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x603470]
movzx eax, byte [eax*4 + 0x604070]
xor ecx, dword [eax*4 + 0x602c70]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x604070]
xor ecx, dword [eax*4 + 0x603070]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x604070]
xor ecx, dword [eax*4 + 0x602870]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x604070]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x603470]
movzx eax, byte [eax*4 + 0x604070]
xor ecx, dword [eax*4 + 0x602c70]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x604070]
xor ecx, dword [eax*4 + 0x603070]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x604070]
xor ecx, dword [eax*4 + 0x602870]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x604070]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x603470]
movzx eax, byte [eax*4 + 0x604070]
xor ecx, dword [eax*4 + 0x602c70]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x604070]
xor ecx, dword [eax*4 + 0x603070]
movzx eax, dl
movzx eax, byte [eax*4 + 0x604070]
xor ecx, dword [eax*4 + 0x602870]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x402770
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x403990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3f1a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x630490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.005999a8
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x403a36
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.00577f4a
push 0x62ac3c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.0057d385
push edi
push esi
call fcn.00599c3e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00577e97
mov esp, ebp
pop ebp
ret 4

Function at 0x403fd0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b3fa8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.004047d0
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.00403f00
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x404041
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.00577f4a
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x40406a
push dword [esp + 0xc]
call fcn.0044ffc1
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b4188
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x630490]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x630490]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea edx, [edi + 0x10]
lea ecx, [esp + 0x18]
call fcn.00425650
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x28]
add eax, 0xa
mov dword [edi], eax
add eax, 4
push eax
call fcn.0044ffb8
mov esi, eax
mov dword [esp + 0x14], 0xe
mov eax, dword [edi]
sub esp, 0x14
mov ecx, esp
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
mov eax, dword [edi + 8]
mov dword [esi + 6], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xa], eax
lea eax, [esp + 0x30]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.00405f80
mov ecx, dword [edi]
add esp, 0x1c
add ecx, 4
mov dword [ebx], esi
cmp dword [esp + 0x2c], 0x10
mov dword [ebx + 4], ecx
jb 0x4060fa
push dword [esp + 0x18]
call fcn.0044ffc1
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00577e97
mov esp, ebp
pop ebp
ret 4

Function at 0x4071d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b4358
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x630490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.0059a352
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x28]
mov dword [ebp - 4], 0
mov dword [edi], vtable.std::_LaunchPad_class_std::_Bind_1__void__void____cdecl__const__struct_AgentPack::CreateAgentAppLinkPack___struct_AgentPack::CreateAgentAppLinkPack__.0
push 0xffffffffffffffff
mov eax, dword [esi]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x14], eax
movzx eax, byte [esi + 8]
mov byte [edi + 0x18], al
movzx eax, byte [esi + 9]
mov byte [edi + 0x19], al
mov eax, dword [esi + 0xc]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x10]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x14]
mov dword [edi + 0x24], eax
lea eax, [esi + 0x18]
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047d0
mov ax, word [esi + 0x30]
mov word [edi + 0x40], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4