joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413ae6
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433733
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x490270]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edx, 0x4f8
mov dword [esi + 4], eax
xor eax, eax
push 7
pop ecx
mov dword [esi], 0x43a430
and dword [esi + 0x18], 0
mov dword [esi + 0x1c], ecx
mov word [esi + 8], ax
and dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov ecx, 0x8dc24f
mov word [esi + 0x20], ax
mov eax, 0x4391f4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], 0x43a238
push eax
push 0x43a2f8
push 0x64
mov dword [ebp - 0x10], 0x43a22c
mov dword [ebp - 0x20], 0x43a250
mov dword [ebp - 0x1c], 0x43a2e0
call fcn.0041219c
push ecx
push ecx
mov ecx, esi
call fcn.00413bf1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4147fc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
push edi
xor edi, edi
mov esi, 0x811c9dc5
test edx, edx
je 0x41481a
movzx eax, byte [edi + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edi
cmp edi, edx
jb 0x414809
pop edi
mov eax, esi
pop esi
ret

Function at 0x41661f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433ba7
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x490270]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], 0x43acf4
and dword [ebp - 4], 0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00416100
cmp byte [esi + 0x58], 0
jne 0x416672
lea ecx, [esi + 0xc]
call fcn.004162d0
lea ecx, [esi + 0x24]
call fcn.00416edd
lea eax, [esi + 0xc]
and dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x416689
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
and dword [0x493c60], ecx
lea ecx, [esi + 0x30]
call fcn.00415edd
lea ecx, [esi + 0x24]
call fcn.00417006
lea ecx, [esi + 0xc]
call fcn.0040ed8d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f208
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433733
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x490270]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edx, 0x4f8
mov dword [esi + 4], eax
xor eax, eax
push 7
pop ecx
mov dword [esi], 0x43da44
and dword [esi + 0x18], 0
mov dword [esi + 0x1c], ecx
mov word [esi + 8], ax
and dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov ecx, 0x8dc24b
mov word [esi + 0x20], ax
mov eax, 0x4391f4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], 0x43a238
push eax
push 0x43d8b8
push 0x64
mov dword [ebp - 0x10], 0x43a22c
mov dword [ebp - 0x20], 0x43a250
mov dword [ebp - 0x1c], 0x439790
call fcn.0041219c
push ecx
push ecx
mov ecx, esi
call fcn.0041f2b8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x423b85
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + edi]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x423b94
mov eax, dword [ecx + 0x18]
pop edi
and eax, esi
pop esi
pop ebp
ret 4

Function at 0x426ea3
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433733
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x490270]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edx, 0x4f8
mov dword [esi + 4], eax
xor eax, eax
push 7
pop ecx
mov dword [esi], 0x43f640
and dword [esi + 0x18], 0
mov dword [esi + 0x1c], ecx
mov word [esi + 8], ax
and dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov ecx, 0x8dc24b
mov word [esi + 0x20], ax
mov eax, 0x4391f4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], 0x43a238
push eax
push 0x43f4d0
push 0x64
mov dword [ebp - 0x10], 0x43a22c
mov dword [ebp - 0x20], 0x43a250
mov dword [ebp - 0x1c], 0x439790
call fcn.0041219c
push ecx
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00426f55
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401176
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
lea eax, [esp + 0x18]
mov edi, ecx
push eax
call fcn.004011f6
xor ebp, ebp
pop ecx
pop ecx
mov ebx, dword [eax]
mov dword [eax], ebp
cmp dword [esp + 0x14], ebp
je 0x4011a5
push 4
push dword [esp + 0x18]
call fcn.004023da
pop ecx
pop ecx
lea esi, [edi + 4]
push esi
push ebp
push ebx
push 0x40115a
push ebp
push ebp
call fcn.00409307
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x4011c7
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 6
mov dword [esi], ebp
call fcn.00402107
int3

Function at 0x4016ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor ebp, ebp
push esi
mov esi, ebp
cmp dword [esp + 0x10], esi
jbe 0x4017da
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
push edi
mov edi, dword [esp + 0x14]
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xe4
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x5d
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x3e
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xd9
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 7
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xa9
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xbf
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x17
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xda
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x19
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x70
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xad
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x55
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xe8
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x86
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x9e
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x59
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xe9
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 9
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0xe1
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x6b
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xc3
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0x67
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xa3
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xc
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xe5
push ebp
push ebp
push ebp
call ebx
xor byte [esi + edi], 0x74
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xf7
push ebp
push ebp
push ebp
call ebx
add byte [esi + edi], 0xf2
inc esi
cmp esi, dword [esp + 0x18]
jb 0x4016c8
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x4017e2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [0x41f00c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40185a
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.00401215
test esi, esi
je 0x401847
cmp dword [esp + 0x38], 3
jbe 0x401847
lea eax, [esp + 0x14]
push 0x14d
push eax
call fcn.004018cf
pop ecx
pop ecx
test eax, eax
je 0x401847
cmp eax, dword [esp + 0x38]
je 0x401872
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00401639
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x401813
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004023e8
add esp, 0x20
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00401639
jmp 0x40185c

Function at 0x4018cf
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
lea eax, [esi + 0x10]
mov edi, dword [eax]
mov ebp, edi
xor ebp, dword [esp + 0x24]
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0x18], eax
jb 0x4018f5
mov esi, dword [esi]
mov dword [esp + 0x20], esi
shr edi, 2
xor ebx, ebx
mov dword [esp + 0x14], edi
test edi, edi
je 0x401952
mov dword [esp + 0x24], esi
push ebx
call dword [sym.imp.ADVAPI32.dll_IsValidAcl]
push 4
lea eax, [esp + 0x28]
push esi
push eax
call fcn.00403030
imul ecx, dword [esp + 0x30], 0x5bd1e991
add esp, 0xc
imul ebp, ebp, 0x5bd1e991
add esi, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebp, eax
mov dword [esp + 0x24], eax
sub edi, 1
jne 0x401906
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
and eax, 3
sub eax, 1
je 0x401978
sub eax, 1
je 0x40196e
sub eax, 1
jne 0x401986
movsx ebx, byte [esi + edi*4 + 2]
shl ebx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ebx, eax
movsx eax, byte [esi + edi*4]
xor eax, ebx
imul eax, eax, 0x5bd1e991
xor ebp, eax
mov eax, ebp
shr eax, 0xd
xor eax, ebp
imul ecx, eax, 0x5bd1e991
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0xc
ret

Function at 0x4019b8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [section..bS1], eax
push 0xda4c2ca8
push dword [section..bS1]
call fcn.004017e2
pop ecx
pop ecx
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
call edx
pop edi
pop esi
leave
ret
Function at 0x402cf5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402d34
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402d34
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402d34
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402d34
cmp dword [ecx + 0x74], 0xe
jbe 0x402d34
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40b2d4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x419944
push 0x41993c
push str.FlsAlloc
push 0x1e
call fcn.0040b155
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b308
push dword [ebp + 8]
mov ecx, esi
call dword [0x417144]
call esi
jmp 0x40b30e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b352
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x419954
push 0x41994c
push str.FlsGetValue
push 0x20
call fcn.0040b155
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b389
push dword [ebp + 8]
mov ecx, esi
call dword [0x417144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40ebb7
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40ec54
push ebx
push esi
call fcn.0040eb80
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040eac9
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40ec01
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ec53
push edi
push eax
call fcn.0040baf0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40ec21
call fcn.0040afe8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ec52
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040eac9
add esp, 0x20
test eax, eax
jne 0x40ec40
push edi
call fcn.0040afe8
jmp 0x40ec48
push ebx
call fcn.0040afe8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x416500
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41652d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41652d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x417f50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section..rdata
lea edi, [esi - 0x14000]
push edi
jmp 0x417f6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417f71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417f60
mov eax, 1
add ebx, ebx
jne 0x417f83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417f78
jne 0x417f94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417f78
xor ecx, ecx
sub eax, 3
jb 0x417fa8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41801a
mov ebp, eax
add ebx, ebx
jne 0x417fb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417fc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417fe4
inc ecx
add ebx, ebx
jne 0x417fd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417fc5
jne 0x417fe1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417fc5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x418004
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417ff5
jmp 0x417f66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x418004
add edi, ecx
jmp 0x417f66
pop esi
mov edi, esi
mov ecx, 0x30c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x418022
cmp byte [edi], 4
jne 0x418022
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x418027
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x41809f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418054
mov ecx, edi
jns 0x418083
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1807c]
or eax, eax
je 0x418099
mov dword [ebx], eax
add ebx, 4
jmp 0x418071
call dword [esi + 0x1808c]
mov ebp, dword [esi + 0x18080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4180d3
sub esp, 0xffffff80
jmp section..text
Function at 0x407502
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x403650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x407520
push eax
call dword [fcn.00403020]
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
movzx eax, word [ebx + 0x14]
push dword [ebx + 0x88]
lea eax, [eax + ebx + 0x18]
push ebx
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
mov dword [ebp - 0x10], eax
call fcn.00404a97
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
je 0x4075e4
movzx eax, word [ebx + 6]
and dword [ebp - 0x14], 0
test eax, eax
push esi
push edi
jle 0x40758f
mov edi, dword [ebp - 0x10]
push 2
pop ecx
lea esi, [ebp - 0xc]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x40758f
add dword [ebp - 0x10], 0x28
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x407574
cmp dword [ebp - 0x14], eax
je 0x4075e2
mov eax, dword [ebp - 0x10]
mov edx, dword [ebx + 0x34]
add edx, dword [eax + 0xc]
push 4
pop ecx
mov edi, 0x404f78
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x4075e2
push 4
pop ecx
mov edi, 0x404f78
lea esi, [edx + 0x140]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x4075e2
cmp dword [edx + 0x124], eax
je 0x4075d0
push 0x407304
jmp 0x4075d5
push 0x4074ea
push ebx
push dword [ebp - 0x18]
push edx
call fcn.004070db
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00408534
leave
ret
Function at 0x41ad30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
xor ebp, ebp
test esi, esi
je 0x41adb0
mov eax, dword [esi + 0x3c]
push ebx
push edi
mov edi, dword [eax + esi + 0x78]
add edi, esi
xor ebx, ebx
cmp dword [edi + 0x18], ebx
jbe 0x41ada9
mov edi, edi
mov ecx, dword [edi + 0x20]
lea edx, [ecx + ebx*4]
mov eax, dword [edx + esi]
mov ecx, dword [esp + 0x18]
add eax, esi
test eax, 0xffff0000
je 0x41ad7f
test ecx, 0xffff0000
je 0x41ad7f
push ecx
push eax
call dword [0x10078068]
neg eax
sbb eax, eax
add eax, 1
jmp 0x41ad88
xor edx, edx
cmp eax, ecx
sete dl
mov eax, edx
test eax, eax
je 0x41ada1
mov eax, dword [edi + 0x24]
lea ecx, [eax + ebx*2]
movzx edx, word [ecx + esi]
mov eax, dword [edi + 0x1c]
lea ecx, [eax + edx*4]
mov ebp, dword [ecx + esi]
add ebp, esi
add ebx, 1
cmp ebx, dword [edi + 0x18]
jb 0x41ad50
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
ret
pop esi
mov eax, ebp
pop ebp
ret
Function at 0x42c920
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi], 0x1007aa44
lea esi, [edi + 4]
push 0x100
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xff
call fcn.0041a960
mov dword [esi], eax
mov ecx, 0x20
mov dword [esi + 4], ebx
add esp, 8
mov byte [eax], bl
mov eax, 1
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xac], ecx
push 0x1007829c
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0x10000
mov dword [esp + 0x24], 0x1007aa3c
mov dword [esp + 0x28], 0x20000
mov dword [esp + 0x2c], 0x1007aa2c
mov dword [esp + 0x30], 0x100000
mov dword [esp + 0x34], 0x1007aa20
mov dword [esp + 0x38], 0x40000
mov dword [esp + 0x3c], 0x1007aa14
mov dword [esp + 0x40], 0x80000
mov dword [esp + 0x44], 0x1007aa08
mov dword [esp + 0x48], 0x80000000
mov dword [esp + 0x4c], 0x1007a9f8
mov dword [esp + 0x50], 0x40000000
mov dword [esp + 0x54], 0x1007a9e8
mov dword [esp + 0x58], 0x20000000
mov dword [esp + 0x5c], 0x1007a9d8
mov dword [esp + 0x60], 0x10000000
mov dword [esp + 0x64], 0x1007a9cc
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0x1007a9bc
mov dword [esp + 0x70], 0x80
mov dword [esp + 0x74], 0x1007a9a4
mov dword [esp + 0x78], 8
mov dword [esp + 0x7c], 0x1007a994
mov dword [esp + 0x80], 2
mov dword [esp + 0x84], 0x1007a984
mov dword [esp + 0x88], 0x100
mov dword [esp + 0x8c], 0x1007a96c
mov dword [esp + 0x90], 0x10
mov dword [esp + 0x94], 0x1007a95c
mov dword [esp + 0x98], 4
mov dword [esp + 0x9c], 0x1007a948
mov dword [esp + 0xa4], 0x1007a938
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], 0x1007a924
mov dword [esp + 0xb4], 0x1007a914
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.0041b370
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.0041b370
cmp ebp, ebx
je 0x42cadf
push ebp
call fcn.0041aa10
add esp, 4
xor ebp, ebp
mov eax, dword [esp + ebp*8 + 0x1c]
test dword [esp + 0x120], eax
je 0x42cb14
not eax
and dword [esp + 0x120], eax
cmp dword [edi + 8], ebx
je 0x42cb08
push 0x1007a910
mov ecx, esi
call fcn.0041d8d0
mov eax, dword [esp + ebp*8 + 0x20]
push eax
mov ecx, esi
call fcn.0041d8d0
add ebp, 1
cmp ebp, 0x13
jb 0x42cae1
cmp dword [edi + 8], ebx
jne 0x42cb63
push 0x1007a908
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.0041b370
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.0041b370
cmp ebp, ebx
je 0x42cb9f
push ebp
call fcn.0041aa10
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
mov eax, dword [esp + 0x120]
cmp eax, ebx
je 0x42cb9f
push eax
lea ecx, [esp + 0x20]
push 0x1007a900
push ecx
call dword [0x10078248]
add esp, 0xc
cmp dword [edi + 8], ebx
je 0x42cb93
push 0x1007a910
mov ecx, esi
call fcn.0041d8d0
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.0041d8d0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
Function at 0x42d0f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x17c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi], 0x1007aa44
lea esi, [edi + 4]
push 0x100
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xff
call fcn.0041a960
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
push 0x1007829c
lea ecx, [esp + 0x14]
mov byte [eax], bl
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x1007acb4
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x2c], 0x1007ac9c
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], 0x1007ac88
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], 0x1007ac70
mov dword [esp + 0x40], 0x800
mov dword [esp + 0x44], 0x1007ac5c
mov dword [esp + 0x48], 8
mov dword [esp + 0x4c], 0x1007ac3c
mov dword [esp + 0x50], 0x10
mov dword [esp + 0x54], 0x1007ac20
mov dword [esp + 0x58], 0x20
mov dword [esp + 0x5c], 0x1007ac00
mov dword [esp + 0x60], 0x80
mov dword [esp + 0x64], 0x1007abe4
mov dword [esp + 0x68], 0x100
mov dword [esp + 0x6c], 0x1007abc8
mov dword [esp + 0x70], 0x200
mov dword [esp + 0x74], 0x1007abb0
mov dword [esp + 0x78], 0x1000
mov dword [esp + 0x7c], 0x1007ab98
mov dword [esp + 0x80], 0x2000
mov dword [esp + 0x84], 0x1007ab80
mov dword [esp + 0x88], 0x4000
mov dword [esp + 0x8c], 0x1007ab64
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.0041b370
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.0041b370
cmp ebp, ebx
je 0x42d247
push ebp
call fcn.0041aa10
add esp, 4
mov ebx, dword [esp + 0x190]
xor ebp, ebp
mov eax, dword [esp + ebp*8 + 0x1c]
test ebx, eax
je 0x42d27a
not eax
and ebx, eax
cmp dword [edi + 8], 0
je 0x42d26e
push 0x1007a910
mov ecx, esi
call fcn.0041d8d0
mov eax, dword [esp + ebp*8 + 0x20]
push eax
mov ecx, esi
call fcn.0041d8d0
add ebp, 1
cmp ebp, 0xe
jb 0x42d250
xor ebp, ebp
cmp dword [edi + 8], ebp
jne 0x42d2cb
push 0x1007a908
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.0041b370
mov ebx, dword [esp + 0x10]
push ebx
mov ecx, esi
call fcn.0041b370
cmp ebx, ebp
je 0x42d306
push ebx
call fcn.0041aa10
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x17c
ret 4
cmp ebx, ebp
je 0x42d306
push ebx
lea ecx, [esp + 0x90]
push 0x1007a900
push ecx
call dword [0x10078248]
add esp, 0xc
cmp dword [edi + 8], ebp
je 0x42d2f7
push 0x1007a910
mov ecx, esi
call fcn.0041d8d0
lea edx, [esp + 0x8c]
push edx
mov ecx, esi
call fcn.0041d8d0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x17c
ret 4