joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4300a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
push edi
mov edi, dword [ebp + 8]
jb 0x4301f5
add dword [ebp + 0xc], 5
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + ecx - 4]
push ebx
mov dword [ebp - 8], ecx
push esi
lea esi, [eax + edi]
jmp 0x4300e5
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x4300ea
inc esi
cmp esi, dword [ebp - 8]
jb 0x4300dc
mov eax, esi
sub eax, edi
cmp esi, dword [ebp - 8]
jae 0x4301d6
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x430169
xor edx, edx
mov cl, byte [esi + 4]
test cl, cl
mov dword [ebp - 4], eax
je 0x430116
cmp cl, 0xff
jne 0x430198
xor ebx, ebx
mov bh, cl
movzx ecx, byte [esi + 2]
mov bl, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
sub edi, eax
sub edi, dword [ebp + 0xc]
test edx, edx
mov ebx, edi
mov dword [ebp - 0xc], ebx
je 0x4301a9
movzx edi, byte [edx + 0x444ae8]
push 0x18
shl edi, 3
pop ecx
sub ecx, edi
shr ebx, cl
test bl, bl
je 0x430159
cmp bl, 0xff
jne 0x4301a6
push 0x20
pop ecx
sub ecx, edi
xor edi, edi
inc edi
shl edi, cl
dec edi
xor edi, dword [ebp - 0xc]
jmp 0x430131
dec ecx
shl edx, cl
and edx, 7
je 0x430103
movzx ecx, byte [edx + 0x444ae8]
mov ebx, esi
sub ebx, ecx
cmp byte [edx + 0x444ae0], 0
mov cl, byte [ebx + 4]
je 0x430195
test cl, cl
je 0x430195
cmp cl, 0xff
jne 0x430103
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x4300d7
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
mov byte [esi + 1], bl
add eax, 5
jmp 0x4300d7
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
and ecx, edx
mov edx, dword [ebp + 0x10]
pop esi
mov dword [edx], ecx
pop ebx
pop edi
leave
ret

Function at 0x4301f8
Capabilities:
Hash data using sha256

Disassembly:
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x4304df
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
movzx ecx, byte [eax + 0x44f330]
mov byte [ecx + 0x455018], al
inc eax
cmp eax, 0x100
jb 0x4304e7
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov esi, 0xff
movzx ebx, byte [edi + 0x44f330]
mov eax, ebx
and al, 0x80
neg al
lea ecx, [ebx + ebx]
sbb eax, eax
and eax, 0x1b
xor eax, ecx
and eax, esi
mov ecx, eax
mov edx, ecx
xor edx, ebx
mov dword [ebp - 8], edx
shl edx, 8
or edx, ebx
shl edx, 8
or edx, ebx
shl edx, 8
or edx, ecx
mov eax, edi
shl eax, 2
mov dword [eax + 0x453018], edx
mov edx, ebx
shl edx, 8
mov edi, edx
or edi, ebx
or edx, ecx
shl edi, 8
or edi, ecx
shl edx, 8
or edx, dword [ebp - 8]
shl edi, 8
or edi, dword [ebp - 8]
shl ecx, 8
or ecx, dword [ebp - 8]
shl edx, 8
shl ecx, 8
mov dword [eax + 0x453418], edi
mov edi, dword [ebp - 0x10]
movzx ebx, byte [edi + 0x44f330]
or edx, ebx
or ecx, ebx
mov dword [eax + 0x453818], edx
shl ecx, 8
or ecx, ebx
mov dword [eax + 0x453c18], ecx
movzx ecx, byte [edi + 0x455018]
mov edx, ecx
and dl, 0x80
neg dl
lea ebx, [ecx + ecx]
mov dword [ebp - 0x18], ecx
sbb edx, edx
and edx, 0x1b
xor edx, ebx
and edx, esi
mov ebx, edx
and bl, 0x80
neg bl
mov dword [ebp - 0x10], edx
sbb ebx, ebx
and ebx, 0x1b
add edx, edx
xor ebx, edx
and ebx, esi
mov edx, ebx
and bl, 0x80
neg bl
mov dword [ebp - 0x14], edx
sbb ebx, ebx
add edx, edx
and ebx, 0x1b
xor ebx, edx
and ebx, esi
mov edx, ebx
xor edx, ecx
mov dword [ebp - 8], edx
mov edx, ebx
xor edx, dword [ebp - 0x10]
xor edx, ecx
mov dword [ebp - 0xc], edx
shl edx, 8
mov ecx, ebx
xor ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
xor ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
or edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0x10]
shl edx, 8
or edx, dword [ebp - 8]
shl edx, 8
or edx, ecx
mov dword [eax + 0x454018], edx
mov edx, dword [ebp - 4]
shl edx, 8
or edx, dword [ebp - 8]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, dword [ebp - 0xc]
mov dword [eax + 0x454418], edx
mov edx, dword [ebp - 8]
shl edx, 8
or edx, ecx
shl ecx, 8
or ecx, dword [ebp - 0xc]
shl edx, 8
or edx, dword [ebp - 0xc]
shl ecx, 8
or ecx, dword [ebp - 4]
shl edx, 8
or edx, dword [ebp - 4]
shl ecx, 8
or ecx, dword [ebp - 8]
inc edi
cmp edi, 0x100
mov dword [eax + 0x454818], edx
mov dword [eax + 0x454c18], ecx
mov dword [ebp - 0x10], edi
jb 0x430509
mov dword [0x456408], 0x430454
mov dword [0x456410], 0x4304ad
mov dword [0x45640c], 0x430530
call fcn.00410b34
test eax, eax
pop edi
pop esi
pop ebx
je 0x4306b9
mov dword [0x456408], 0x431143
mov dword [0x456410], 0x431148
mov dword [0x45640c], 0x43114d
leave
ret
Function at 0x4319b9
Capabilities:
Create thread

Disassembly:
push esi
mov esi, eax
push edi
lea edi, [esi + 4]
mov eax, edi
call fcn.00421cb8
test al, al
je 0x4319d0
pop edi
xor al, al
pop esi
ret
push 0xc
call fcn.00432f0e
test eax, eax
pop ecx
je 0x4319eb
push esi
push 0x430d6c
mov esi, eax
call fcn.0040fafe
jmp 0x4319ed
xor eax, eax
push ebx
mov ebx, eax
call fcn.0040cb95
mov eax, edi
call fcn.0041e17c
pop ebx
pop edi
pop esi
jmp fcn.0040fba9
Function at 0x411f70
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
xor eax, eax
test edi, edi
je 0x411fae
push esi
mov esi, dword [esp + 0x10]
movsx ecx, byte [esi]
xor edx, edx
and ecx, 0xff
mov dl, ah
inc esi
xor edx, ecx
xor ecx, ecx
mov cx, word [edx*2 + 0x47fbb8]
mov edx, ecx
xor ecx, ecx
mov ch, al
and ecx, 0xffff
xor edx, ecx
dec edi
mov eax, edx
jne 0x411f80
pop esi
pop edi
ret

Function at 0x412070
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
ret

Function at 0x412b70
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x412c20
Capabilities:
Encode data using xor
Encrypt data using hc-128

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x124
mov ecx, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x34]
add eax, 0x29
mov edi, 0x10
xor ecx, ecx
xor edx, edx
mov ch, byte [eax - 1]
mov dl, byte [eax + 1]
mov cl, byte [eax]
add eax, 4
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax - 2]
add esi, 4
shl ecx, 8
or ecx, edx
dec edi
mov dword [esi - 4], ecx
jne 0x412c47
lea edx, [esp + 0x6c]
mov esi, 0x30
mov ecx, dword [edx]
mov eax, dword [edx - 0x34]
mov edi, ecx
mov ebx, ecx
shr edi, 0x11
shl ebx, 0xf
or edi, ebx
mov ebx, ecx
mov ebp, ecx
add edx, 4
shr ebx, 0x13
shl ebp, 0xd
or ebx, ebp
mov ebp, eax
xor edi, ebx
mov ebx, eax
shr ecx, 0xa
xor edi, ecx
mov ecx, eax
shr ecx, 0x12
shl ebx, 0xe
or ecx, ebx
mov ebx, eax
shl ebx, 0x19
shr ebp, 7
or ebx, ebp
mov ebp, dword [edx - 0x3c]
xor ecx, ebx
mov ebx, dword [edx - 0x18]
shr eax, 3
xor ecx, eax
add edi, ecx
add edi, ebp
add edi, ebx
dec esi
mov dword [edx + 4], edi
jne 0x412c77
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
xor esi, esi
mov dword [esp + 0x10], esi
mov eax, ecx
mov ebx, ecx
shl eax, 0x15
shr ebx, 0xb
or eax, ebx
mov ebx, ecx
mov ebp, ecx
shl ebx, 0x1a
shr ebp, 6
or ebx, ebp
mov ebp, ecx
xor eax, ebx
mov ebx, ecx
shr ebx, 0x19
shl ebp, 7
or ebx, ebp
mov ebp, dword [esp + 0x2c]
xor eax, ebx
mov ebx, ecx
not ebx
and ebx, ebp
mov ebp, dword [esp + 0x28]
and ebp, ecx
xor ebx, ebp
mov ebp, dword [esi + 0x47fdb8]
add eax, ebx
mov ebx, dword [esp + esi + 0x34]
add eax, ebp
mov ebp, dword [esp + 0x30]
add eax, ebx
mov esi, edx
mov ebx, edx
add eax, ebp
shl esi, 0x13
shr ebx, 0xd
or esi, ebx
mov ebx, edx
mov ebp, edx
shr ebx, 0x16
shl ebp, 0xa
or ebx, ebp
mov ebp, edx
xor esi, ebx
mov ebx, edx
shl ebx, 0x1e
shr ebp, 2
or ebx, ebp
mov ebp, dword [esp + 0x1c]
xor esi, ebx
mov ebx, edi
xor ebx, edx
and ebx, ebp
mov ebp, edi
and ebp, edx
xor ebx, ebp
add esi, ebx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
mov edi, edx
lea edx, [esi + eax]
mov esi, dword [esp + 0x10]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x20]
add esi, 4
add ecx, eax
cmp esi, 0x100
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], esi
jl 0x412ce1
mov eax, dword [esp + 0x138]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edi
sub ecx, eax
mov edx, 8
mov esi, dword [ecx + eax]
mov ebx, dword [eax]
add ebx, esi
mov dword [eax], ebx
add eax, 4
dec edx
jne 0x412dcb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret
Function at 0x418580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp + 0xc], eax
mov esi, dword [ebp + 8]
xor ecx, ecx
xor eax, eax
mov al, byte [0x49de10]
xor ebx, ebx
mov bl, byte [0x49de11]
inc al
mov ch, byte [eax + 0x49dd10]
add bl, ch
mov cl, byte [ebx + 0x49dd10]
mov byte [ebx + 0x49dd10], ch
mov byte [eax + 0x49dd10], cl
add cl, ch
xor ch, ch
push eax
mov al, byte [ecx + 0x49dd10]
xor byte [esi], al
pop eax
inc esi
dec dword [ebp + 0xc]
jne 0x41859f
mov byte [0x49de10], al
mov byte [0x49de11], bl
pop esi
pop ebx
pop ebp
ret

Function at 0x41b000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x475f4f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0041e5d0
mov ecx, dword [0x49aec0]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x20], ecx
mov edx, dword [0x49aec0]
mov dword [esi + 0x24], edx
mov cl, byte [esp + 7]
mov dword [esi + 0x34], eax
mov byte [esi + 0x30], cl
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 3
call fcn.0041eb80
mov edx, dword [0x49aec0]
mov dword [esi + 0x60], edx
mov ecx, esi
mov byte [esp + 0x14], 5
mov dword [esi], 0x47fff4
call fcn.0041b2a0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x14], 3
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x420e50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, ecx
push esi
push edi
mov al, byte [ebp + 0x24]
test al, al
je 0x420edb
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
cmp al, 1
jne 0x420e88
mov edx, edi
xor eax, eax
and edx, 0xffff
jle 0x420e88
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, edx
mov cl, byte [ecx + 0x49993c]
mov byte [eax + esi - 1], cl
jl 0x420e74
cmp byte [ebp + 0x24], 2
jne 0x420edb
xor ecx, ecx
and edi, 0xffff
jle 0x420edb
mov eax, dword [esp + 0x18]
mov edx, eax
shr edx, 0x10
xor eax, edx
mov dl, byte [ecx + esi]
add dl, al
and edx, 0xff
mov dl, byte [edx + 0x49973c]
add dl, ah
and edx, 0xff
mov dl, byte [edx + 0x49983c]
sub dl, ah
and edx, 0xff
mov dl, byte [edx + 0x49993c]
sub dl, al
inc eax
mov byte [ecx + esi], dl
inc ecx
cmp ecx, edi
jl 0x420e9c
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x425330
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4772b7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
push 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0
call fcn.00425810
mov ecx, 0x40
xor eax, eax
mov edi, 0x49e070
rep stosd dword es:[edi], eax
mov ecx, 0x40
mov edi, 0x49df70
rep stosd dword es:[edi], eax
mov ecx, 0x40
mov edi, 0x49de70
rep stosd dword es:[edi], eax
mov edi, 0x499b18
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x49e070
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x49aec0]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 1
xor ecx, ecx
mov edx, 0x49e070
mov al, byte [edx]
test al, al
mov byte [ecx + 0x49de70], al
je 0x4253d5
and eax, 0xff
inc edx
mov ecx, eax
jmp 0x4253bf
pushal
mov edi, 0x49df70
mov ebx, 0x49de70
movzx eax, byte [edi]
xlatb
cmp al, 0
je 0x4253ec
mov byte [edi], al
jmp 0x4253f0
xlatb
stosb byte es:[edi], al
jmp 0x4253e0
popal
push 0x49df70
call dword [fcn.004f41e0]
cmp eax, 3
jg 0x425427
mov edx, dword [0x49aec0]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x49df70
mov dword [ecx], edx
call fcn.0046661b
mov ecx, dword [ebp - 0x14]
call fcn.00425690
test eax, eax
jne 0x425436
jmp 0x4253d5
push 0x498ca8
lea ecx, [ebp - 0x10]
call fcn.0046661b
jmp 0x425467
mov eax, dword [0x49aec0]
push 0x49df70
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.0046661b
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
push ecx
lea ecx, [ebp - 0x10]
call fcn.004665cb
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00466492
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
mov ecx, esi
call fcn.00466207
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.00466492
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x425690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x477338
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa0
push ebp
push esi
push edi
mov ebp, ecx
mov ecx, 0x12
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x5c]
mov dword [esp + 0x58], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xbc]
mov eax, dword [ebp + 0x28]
push 0x40
lea edx, [esp + 0x10]
mov esi, dword [eax + ebp + 0x30]
push ecx
push edx
mov dword [esp + 0xc0], 0
call dword [fcn.004f4324]
lea eax, [esp + 0xc]
push eax
call dword [fcn.004f41e0]
mov dword [esp + eax + 0xc], esi
mov byte [esp + eax + 0x10], 0x80
mov eax, dword [esp + 0xc]
test eax, eax
je 0x425737
lea eax, [esp + 0xc]
lea esi, [esp + 0xc]
push eax
add esi, 4
call fcn.00425800
mov ecx, dword [esi]
add esp, 4
test ecx, ecx
mov eax, esi
jne 0x425723
mov ecx, dword [esp + 0xbc]
lea esi, [esp + 0xc]
lea edi, [esp + 0x6c]
lea edx, [esp + 0x58]
mov eax, dword [ecx - 8]
mov ecx, 0x10
add al, 4
push edx
shl al, 3
mov byte [esp + 0x4c], al
rep movsd dword es:[edi], dword [esi]
call fcn.00423380
lea eax, [esp + 0x5c]
push eax
call fcn.004233b0
add esp, 8
lea esi, [esp + 0x58]
mov edi, 5
push esi
call fcn.00425800
add esp, 4
add esi, 4
dec edi
jne 0x425779
mov edx, dword [ebp + 0x28]
mov ecx, 5
lea edi, [esp + 0x58]
xor eax, eax
lea esi, [edx + ebp + 0x34]
mov dword [esp + 0xb4], 0xffffffff
repe cmpsd dword [esi], dword es:[edi]
pop edi
pop esi
pop ebp
lea ecx, [esp + 0xb0]
je 0x4257d1
call fcn.00466492
xor eax, eax
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
add esp, 0xac
ret 4
call fcn.00466492
mov ecx, dword [esp + 0xa0]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0xac
ret 4
Function at 0x425810
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov eax, dword [ebx + 0x18]
push edi
sub eax, 5
je 0x425851
mov edi, dword [esp + 0x20]
mov ecx, dword [ebx + 0x14]
push 5
add ecx, esi
push 0x499b54
push ecx
call fcn.00443520
add esp, 0xc
test eax, eax
jne 0x425846
mov edx, edi
dec edi
test edx, edx
je 0x425851
mov eax, dword [ebx + 0x18]
inc esi
sub eax, 5
cmp esi, eax
jb 0x425826
mov eax, dword [ebx + 0x18]
lea ecx, [eax - 5]
cmp esi, ecx
jb 0x425887
push 0
push 6
lea ecx, [esp + 0x14]
call fcn.00411da0
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0x48bdf8
push ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
call fcn.004425d1
add esi, 5
dec eax
cmp esi, eax
mov dword [ebx + 0x20], esi
jae 0x4258d3
mov ecx, dword [ebx + 0x20]
mov edx, esi
sub edx, ecx
cmp edx, 0x2000
jae 0x4258d3
mov eax, dword [ebx + 0x14]
mov al, byte [eax + esi]
cmp al, 0x22
je 0x4258d3
mov edi, dword [ebx + 0x20]
mov ecx, esi
sub ecx, edi
push eax
shr ecx, 1
lea edi, [ecx + ebx + 0x2c]
call fcn.004259e0
mov dl, byte [edi]
add esp, 4
shl dl, 4
add al, dl
inc esi
mov byte [edi], al
mov eax, dword [ebx + 0x18]
dec eax
cmp esi, eax
jb 0x425892
mov ecx, dword [ebx + 0x14]
cmp byte [ecx + esi], 0x22
je 0x425908
push 0
push 6
lea ecx, [esp + 0x1c]
call fcn.00411da0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push 0x48bdf8
push ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call fcn.004425d1
mov cl, byte [ebx + 0x2e]
push ebp
mov ebp, dword [ebx + 0x20]
mov al, byte [ebx + 0x2f]
sub esi, ebp
lea ebp, [ebx + 0x2c]
mov dl, cl
mov byte [esp + 0x24], al
xor dl, byte [ebp]
shr esi, 1
add dl, byte [ebx + 0x2d]
mov dword [ebx + 0x1c], esi
xor dl, al
mov eax, esi
cmp eax, 4
mov byte [ebx + 0x2f], dl
jbe 0x42595c
mov edi, 0xffffffd4
lea esi, [ebx + 0x30]
sub edi, ebx
mov dl, byte [esi - 1]
mov al, byte [esi]
add dl, cl
mov cl, byte [esp + 0x24]
xor dl, al
mov byte [esp + 0x24], al
mov byte [esi], dl
mov edx, dword [ebx + 0x1c]
inc esi
lea eax, [edi + esi]
cmp eax, edx
jb 0x42593e
mov ecx, dword [ebx + 0x1c]
xor eax, eax
add ecx, 0xfffffffd
test ecx, ecx
mov dword [esp + 0x24], ecx
jbe 0x425999
mov edx, ebp
mov ecx, 3
mov edi, 0x49e170
mov esi, edx
xor ebp, ebp
repe cmpsb byte [esi], byte es:[edi]
je 0x42598c
mov ecx, dword [esp + 0x24]
inc eax
inc edx
cmp eax, ecx
jb 0x42596e
jmp 0x425999
xor ecx, ecx
mov cl, byte [eax + ebx + 0x2b]
mov dword [ebx + 0x24], ecx
mov ecx, dword [esp + 0x24]
cmp eax, ecx
pop ebp
jb 0x4259ca
push 0
push 6
lea ecx, [esp + 0x1c]
call fcn.00411da0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push 0x48bdf8
push ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call fcn.004425d1
add eax, 3
pop edi
mov dword [ebx + 0x28], eax
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4343a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x479300
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [0x49aec0]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
push ecx
mov ebx, 2
mov esi, esp
mov dword [esp + 0x28], esp
push ecx
mov byte [esp + 0x38], bl
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x49a630
call fcn.00466500
push esi
call fcn.004336f0
add esp, 8
lea eax, [esp + 0x1c]
push eax
call fcn.00433a90
add esp, 8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 3
call fcn.004665cb
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.00466492
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
cmp ecx, edi
je 0x434570
mov eax, ecx
push 5
add eax, 0xfffffff9
lea ecx, [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.00463fc2
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 4
call fcn.004665cb
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.00466492
mov edx, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x10]
mov esi, dword [edx - 8]
call fcn.004668c2
push eax
push esi
call fcn.00411f70
mov ecx, eax
and eax, 0xff
xor edx, edx
mov esi, 0x3e
div esi
xor eax, eax
add esp, 8
mov al, ch
mov ecx, esi
and eax, 0xff
push 1
mov byte [esp + 0x20], dl
xor edx, edx
div ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], dl
mov edx, dword [esp + 0x1c]
and edx, 0xff
mov al, byte [edx + 0x49a2f8]
push eax
call fcn.00463c9a
mov esi, eax
mov ecx, dword [esp + 0x1c]
push 1
and ecx, 0xff
mov byte [esp + 0x34], 5
mov dl, byte [ecx + 0x49a2f8]
lea ecx, [esp + 0x24]
push edx
call fcn.00463c9a
push esi
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x38], 6
push eax
call fcn.004666c1
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 7
call fcn.004665cb
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 6
call fcn.00466492
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 5
call fcn.00466492
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], bl
call fcn.00466492
lea ecx, [esp + 0x24]
push ebx
push ecx
lea ecx, [esp + 0x18]
call fcn.00464058
mov eax, dword [eax]
mov edx, dword [esp + 0x14]
push eax
push edx
call fcn.0044260b
add esp, 8
lea ecx, [esp + 0x24]
test eax, eax
sete bl
call fcn.00466492
test bl, bl
je 0x434570
mov eax, dword [esp + 0xc]
push eax
call fcn.00442745
add esp, 4
mov edi, eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.00466492
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.00466492
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
call fcn.00466492
mov ecx, dword [esp + 0x28]
mov ax, di
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret
Function at 0x439b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47a0f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, ecx
push edi
push 0x49d94c
lea ecx, [esi + 0x4fc]
call fcn.00469a31
lea eax, [esp + 0xc]
push 0x802d
push eax
call fcn.00434a80
add esp, 8
xor edi, edi
push 0x91
push eax
lea ecx, [esi + 0x540]
mov dword [esp + 0x30], edi
call fcn.0040cae0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00466492
push edi
mov ecx, esi
mov dword [esi + 0x3ba0], edi
call fcn.00439220
mov edx, dword [esi + 0x1c]
mov ebp, dword [fcn.004f4504]
lea ecx, [esp + 0x10]
push ecx
push edx
call ebp
mov al, byte [0x49e368]
test al, 1
jne 0x439c4d
mov ecx, dword [esp + 0x14]
mov dl, al
mov eax, dword [esp + 0x10]
or dl, 1
mov byte [0x49e368], dl
mov edx, dword [esp + 0x18]
mov dword [0x49e358], eax
mov eax, dword [esp + 0x1c]
push 0x4391a0
mov dword [0x49e35c], ecx
mov dword [0x49e360], edx
mov dword [0x49e364], eax
call fcn.00442438
add esp, 4
mov ecx, dword [esi + 0x764]
mov edi, dword [0x4f455c]
push ecx
call edi
test eax, eax
jne 0x439c98
mov edx, dword [esi + 0x1418]
push edx
call edi
test eax, eax
jne 0x439c98
mov eax, dword [esi + 0x2d58]
push eax
call edi
test eax, eax
jne 0x439c98
mov ecx, dword [esi + 0x3364]
push ecx
call edi
test eax, eax
jne 0x439c98
mov edx, dword [esi + 0x3574]
push edx
call edi
test eax, eax
je 0x439d8b
mov eax, dword [0x49e364]
mov ecx, dword [esp + 0x1c]
push ebx
mov ebx, dword [0x49e35c]
sub eax, ebx
mov ebx, dword [esp + 0x18]
sub eax, ecx
push 1
add eax, ebx
cdq
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x18]
sar edi, 1
add ecx, edi
sub ebx, edi
mov dword [esp + 0x24], ecx
sub ecx, ebx
push ecx
mov ecx, dword [esp + 0x24]
sub ecx, eax
mov dword [esp + 0x20], ebx
push ecx
push ebx
push eax
mov ecx, esi
call fcn.00469aa2
mov eax, dword [esi + 0x614]
lea edx, [esp + 0x14]
push edx
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.0046d0a9
lea edx, [edi + edi]
lea eax, [esp + 0x14]
push edx
push 0
push eax
call dword [0x4f44e8]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub ecx, eax
push 1
push ecx
mov ecx, dword [esp + 0x1c]
sub edx, ecx
push edx
push eax
push ecx
lea ecx, [esi + 0x5f8]
call fcn.00469aa2
push 1
push 0
push 0
push 0
push 0
push 0xe8ff
push 0xe800
mov ecx, esi
call fcn.004686bf
push 0
lea ecx, [esi + 0x748]
call fcn.00469b32
push 0
lea ecx, [esi + 0x13fc]
call fcn.00469b32
push 0
lea ecx, [esi + 0x2d3c]
call fcn.00469b32
push 0
lea ecx, [esi + 0x3348]
call fcn.00469b32
push 0
lea ecx, [esi + 0x3558]
call fcn.00469b32
pop ebx
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret