joyce8/EMBER2024-capa huggingface dataset:
Function at 0x547c38
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5b9460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0053a5b5
mov dword [ebp - 0x14], eax
cmp dword [0x5c1f54], edi
jne 0x547d29
push 0x800
push edi
push 0x590ac0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x547cb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x547e09
push 0x590ac0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x547e09
push 0x590ad8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x547e09
push eax
call ebx
push 0x590ae4
push esi
mov dword [0x5c1f54], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x590af4
push esi
mov dword [0x5c1f58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x5c1f5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5c1f64], eax
test eax, eax
je 0x547d26
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5c1f60], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x547d4e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x547d41
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x547d63
push 4
pop eax
jmp 0x547e0b
cmp dword [ebp - 0x14], edi
je 0x547d63
push dword [0x5c1f54]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x547d48
mov eax, dword [0x5c1f60]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x547dc1
cmp dword [0x5c1f64], esi
je 0x547dc1
push eax
call ebx
push dword [0x5c1f64]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x547dc1
test eax, eax
je 0x547dc1
call ecx
test eax, eax
je 0x547db6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x547db6
test byte [ebp - 8], 1
jne 0x547dc1
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x547df1
mov eax, dword [0x5c1f58]
cmp eax, esi
je 0x547dee
push eax
call ebx
test eax, eax
je 0x547dee
call eax
mov edi, eax
test edi, edi
je 0x547dee
mov eax, dword [0x5c1f5c]
cmp eax, esi
je 0x547dee
push eax
call ebx
test eax, eax
je 0x547dee
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x5c1f54]
call ebx
test eax, eax
je 0x547e09
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x547e0b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00532a3d
leave
ret
Function at 0x4231dc
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x423240
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x423229
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x423218
xor ecx, eax
xor edx, ebx
dec edi
jne 0x423209
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x434ef1
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x43513e
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x43503b
cmp byte [edx + edi], 0xd
jne 0x43503b
cmp byte [edx + edi + 1], 0xa
je 0x435074
mov al, byte [edx + edi]
cmp al, 0xa
je 0x435074
cmp al, 0x3d
jne 0x435050
inc ecx
cmp ecx, 2
ja 0x43514c
cmp al, 0x7f
ja 0x43514c
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x43514c
cmp al, 0x40
jae 0x435073
test ecx, ecx
jne 0x43514c
inc esi
inc edx
cmp edx, ebx
jb 0x435025
test esi, esi
je 0x43513e
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x43515d
cmp dword [ecx], eax
jb 0x43515d
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x43512d
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x435129
cmp al, 0xa
je 0x435129
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x435129
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x435114
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x435121
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x435129
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x4350c5
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x440f28
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x440f4b
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x440f4b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x440f55
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x440f97
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x440ff9
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x440ff4
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x440fdf
test dl, dl
je 0x440fdb
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x440fdf
add ecx, 2
add eax, 2
test dl, dl
jne 0x440fbf
xor eax, eax
jmp 0x440fe4
sbb eax, eax
or eax, 1
test eax, eax
je 0x441005
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x440fac
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x44108a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4410ad
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4410ad
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4410b7
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4410f9
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44115b
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x441156
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x441141
test dl, dl
je 0x44113d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x441141
add ecx, 2
add eax, 2
test dl, dl
jne 0x441121
xor eax, eax
jmp 0x441146
sbb eax, eax
or eax, 1
test eax, eax
je 0x441167
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x44110e
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4411f9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x44121c
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x44121c
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x441226
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x441268
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4412ca
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4412c5
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4412b0
test dl, dl
je 0x4412ac
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4412b0
add ecx, 2
add eax, 2
test dl, dl
jne 0x441290
xor eax, eax
jmp 0x4412b5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4412d6
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x44127d
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x441363
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x441386
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x441386
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x441390
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4413d2
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x441434
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x44142f
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x44141a
test dl, dl
je 0x441416
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x44141a
add ecx, 2
add eax, 2
test dl, dl
jne 0x4413fa
xor eax, eax
jmp 0x44141f
sbb eax, eax
or eax, 1
test eax, eax
je 0x441440
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4413e7
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4414d9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4414fc
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4414fc
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x441506
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x441548
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4415aa
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4415a5
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x441590
test dl, dl
je 0x44158c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x441590
add ecx, 2
add eax, 2
test dl, dl
jne 0x441570
xor eax, eax
jmp 0x441595
sbb eax, eax
or eax, 1
test eax, eax
je 0x4415b6
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x44155d
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x44164a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x44166d
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x44166d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x441677
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4416b9
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44171b
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x441716
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x441701
test dl, dl
je 0x4416fd
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x441701
add ecx, 2
add eax, 2
test dl, dl
jne 0x4416e1
xor eax, eax
jmp 0x441706
sbb eax, eax
or eax, 1
test eax, eax
je 0x441727
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4416ce
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4417b9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4417dc
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4417dc
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4417e6
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x441828
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44188a
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x441885
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x441870
test dl, dl
je 0x44186c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x441870
add ecx, 2
add eax, 2
test dl, dl
jne 0x441850
xor eax, eax
jmp 0x441875
sbb eax, eax
or eax, 1
test eax, eax
je 0x441896
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x44183d
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x441928
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x44194b
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x44194b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x441955
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x441997
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4419f9
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4419f4
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4419df
test dl, dl
je 0x4419db
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4419df
add ecx, 2
add eax, 2
test dl, dl
jne 0x4419bf
xor eax, eax
jmp 0x4419e4
sbb eax, eax
or eax, 1
test eax, eax
je 0x441a05
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4419ac
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x45bce4
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x48
push ebp
mov ebp, dword [esp + 0x5c]
mov dword [esp + 0xc], 0x44434241
mov dword [esp + 0x10], 0x48474645
mov dword [esp + 0x14], 0x4c4b4a49
mov dword [esp + 0x18], 0x504f4e4d
mov dword [esp + 0x1c], 0x54535251
mov dword [esp + 0x20], 0x58575655
mov dword [esp + 0x24], 0x62615a59
mov dword [esp + 0x28], 0x66656463
mov dword [esp + 0x2c], 0x6a696867
mov dword [esp + 0x30], 0x6e6d6c6b
mov dword [esp + 0x34], 0x7271706f
mov dword [esp + 0x38], 0x76757473
mov dword [esp + 0x3c], 0x7a797877
mov dword [esp + 0x40], 0x33323130
mov dword [esp + 0x44], 0x37363534
mov dword [esp + 0x48], 0x2f2b3938
test ebp, ebp
jne 0x45bd7d
xor eax, eax
pop ebp
add esp, 0x48
ret 0x10
lea ecx, [ebp*8]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
lea ecx, [ebp*8]
lea eax, [edx + edx*2]
add eax, eax
sub ecx, eax
sub ecx, 2
je 0x45bdab
sub ecx, 2
jne 0x45bdae
add edx, 2
jmp 0x45bdae
add edx, 3
push edi
mov edi, dword [esp + 0x58]
inc edx
cmp dword [edi], edx
jae 0x45bdc5
mov dword [edi], edx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x48
ret 0x10
mov ecx, dword [esp + 0x54]
mov eax, 0xaaaaaaab
mul ebp
shr edx, 1
push ebx
mov ebx, dword [esp + 0x60]
lea edx, [edx + edx*2]
xor eax, eax
push esi
test edx, edx
je 0x45be5d
dec edx
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
shr eax, 1
inc eax
mov dword [esp + 0x10], eax
mov ebp, eax
lea eax, [eax + eax*2]
mov dword [esp + 0x14], eax
movzx edx, byte [ebx]
movzx esi, byte [ebx + 1]
movzx edi, byte [ebx + 2]
mov eax, edx
sar eax, 2
and eax, 0x3f
shl edx, 4
movzx eax, byte [esp + eax + 0x18]
mov byte [ecx], al
mov eax, esi
sar eax, 4
add eax, edx
and eax, 0x3f
add ebx, 3
movzx eax, byte [esp + eax + 0x18]
mov byte [ecx + 1], al
mov eax, edi
sar eax, 6
and edi, 0x3f
lea eax, [eax + esi*4]
and eax, 0x3f
add ecx, 4
movzx eax, byte [esp + eax + 0x18]
mov byte [ecx - 2], al
movzx eax, byte [esp + edi + 0x18]
mov byte [ecx - 1], al
dec ebp
jne 0x45bdfb
mov ebp, dword [esp + 0x68]
mov edi, dword [esp + 0x60]
mov eax, dword [esp + 0x14]
cmp eax, ebp
jae 0x45beb7
movzx esi, byte [ebx]
inc eax
mov dword [esp + 0x68], eax
cmp eax, ebp
jae 0x45be73
movzx edx, byte [ebx + 1]
jmp 0x45be75
xor edx, edx
mov eax, esi
sar eax, 2
and eax, 0x3f
shl esi, 4
movzx eax, byte [esp + eax + 0x18]
mov byte [ecx], al
mov eax, edx
sar eax, 4
add eax, esi
and eax, 0x3f
movzx eax, byte [esp + eax + 0x18]
mov byte [ecx + 1], al
cmp dword [esp + 0x68], ebp
jae 0x45beab
and edx, 0xf
mov al, byte [esp + edx*4 + 0x18]
mov byte [ecx + 2], al
jmp 0x45beaf
mov byte [ecx + 2], 0x3d
add ecx, 3
inc ecx
mov byte [ecx - 1], 0x3d
mov eax, ecx
sub eax, dword [esp + 0x5c]
pop esi
mov dword [edi], eax
pop ebx
pop edi
mov byte [ecx], 0
xor eax, eax
pop ebp
add esp, 0x48
ret 0x10

Function at 0x46365c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
jmp fcn.00e209a3