joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a2f0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
push esi
push edi
call dword [0x4556ac]
push 1
push 0x44a130
push edi
call dword [0x4556fc]
push 1
push str.Task
push edi
call dword [0x4556d8]
push 0xffffffffffffffff
push edi
call dword [0x4556ec]
add esp, 0x28
push 0
push 0
push esi
push dword [esp + 0x20]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x44a358
push 0
push 0
push 0
push 0
push edi
call dword [0x455710]
add esp, 0x14
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call dword [0x4556e8]
push 0
push 0xffffffffffffffff
push edi
call dword [0x455690]
push eax
push str.async_error_:__s
push edi
call dword [0x4556cc]
add esp, 0x20
pop edi
pop esi
ret

Function at 0x44ac80
Capabilities:
Initialize winsock library

Disassembly:
push esi
push edi
push 0x45a328
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, dword [esp + 0xc]
push 0x44ac60
push 0x454e00
push 0x454e28
push 0x454f60
push edi
call dword [0x45574c]
mov esi, dword [sym.luart.exe_lua_registerobject]
push 0x454758
push 0x4546b8
push 0x4437f0
push str.Socket
push 0x45aa74
push edi
call esi
push 0x454880
push 0x454810
push 0x446010
push str.Http
push 0x45a318
push edi
call esi
add esp, 0x44
push 0x454d98
push 0x454d18
push 0x449b40
push 0x454f6c
push 0x45a31c
push edi
call esi
add esp, 0x18
mov eax, 1
pop edi
pop esi
ret

Function at 0x44b7e0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push str.AdvAPI32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.CryptDecrypt
push eax
mov dword [0x45a504], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x44b7c0
push 0x4552b8
push 0x455298
push str.crypto
push dword [esp + 0x14]
mov dword [0x45a500], eax
call sym.luart.exe_lua_registermodule
push 0x454fa8
push 0x454f70
push 0x44b260
push str.Cipher
push 0x45aa70
push dword [esp + 0x2c]
call sym.luart.exe_lua_registerobject
add esp, 0x2c
push 0xf0000000
push 0x18
push 0
push 0
push 0x45a4fc
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov eax, 1
ret

Function at 0x44d109
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44d148
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44d148
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44d148
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44d148
cmp dword [ecx + 0x74], 0xe
jbe 0x44d148
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x56c724
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebp
push ebx
push esi
mov dword [esp], eax
test eax, eax
je 0x56c7d1
mov esi, eax
mov edx, dword [esi]
xor eax, eax
mov byte [edx + 0x16], al
mov ecx, dword [esi]
mov byte [ecx + 0x17], al
mov ebx, dword [esi]
mov byte [ebx + 0x18], al
mov ebp, dword [esi]
mov byte [ebp + 0x19], al
mov ebp, dword [esi + 4]
test ebp, ebp
jle 0x56c77b
mov eax, esi
mov edx, dword [eax]
xor ecx, ecx
xor ebx, ebx
movzx esi, byte [edx + ebx]
mov edi, ecx
shl edi, 8
shr ecx, 0x18
xor ecx, esi
mov eax, ecx
mov ecx, edi
xor ecx, dword [eax*4 + 0x592700]
inc ebx
cmp ebx, ebp
jl 0x56c75b
jmp 0x56c781
mov eax, esi
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [esp]
mov edi, dword [eax + 0xc]
test edi, edi
jle 0x56c7af
mov ebp, dword [eax + 8]
xor esi, esi
movzx eax, byte [ebp + esi]
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
xor ecx, eax
mov eax, ecx
mov ecx, ebx
xor ecx, dword [eax*4 + 0x592700]
inc esi
cmp esi, edi
jl 0x56c790
mov esi, dword [esp]
mov byte [edx + 0x16], cl
mov ebp, dword [esi]
mov eax, ecx
shr eax, 8
mov byte [ebp + 0x17], al
mov ebx, dword [esi]
mov edx, ecx
shr edx, 0x10
mov byte [ebx + 0x18], dl
mov edi, dword [esi]
shr ecx, 0x18
mov byte [edi + 0x19], cl
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40896a
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x408988
mov eax, 0x54000f
push eax
push 1
mov ebx, 0x46ff60
call fcn.0046f8ca
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4089b2
mov eax, 0
jmp 0x408a26
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x408a13
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x4089fc
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x4089eb
xor ecx, eax
xor edx, ebx
dec edi
jne 0x4089dc
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x41e2a6
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x41e4f3
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x41e3f0
cmp byte [edx + edi], 0xd
jne 0x41e3f0
cmp byte [edx + edi + 1], 0xa
je 0x41e429
mov al, byte [edx + edi]
cmp al, 0xa
je 0x41e429
cmp al, 0x3d
jne 0x41e405
inc ecx
cmp ecx, 2
ja 0x41e501
cmp al, 0x7f
ja 0x41e501
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x41e501
cmp al, 0x40
jae 0x41e428
test ecx, ecx
jne 0x41e501
inc esi
inc edx
cmp edx, ebx
jb 0x41e3da
test esi, esi
je 0x41e4f3
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x41e512
cmp dword [ecx], eax
jb 0x41e512
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x41e4e2
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x41e4de
cmp al, 0xa
je 0x41e4de
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x41e4de
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x41e4c9
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x41e4d6
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x41e4de
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x41e47a
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x430fee
Capabilities:
Packed with generic packer

Disassembly:
push 0x228bacaf
call fcn.01555504
jmp 0x1216e18

Function at 0x4342a1
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4342d9
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4342c7
mov al, 1
jmp 0x434338
cmp dword [ebx + 0x54], ecx
jne 0x4342d0
mov al, 2
jmp 0x434338
cmp dword [ebx + 0x7c], ecx
jne 0x434338
mov al, 3
jmp 0x434338
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x4342ee
mov al, 4
jmp 0x434338
cmp ecx, 5
jne 0x43430e
cmp ebx, 0
jne 0x4342fc
mov al, 5
jmp 0x434338
cmp ebx, 1
jne 0x434305
mov al, 6
jmp 0x434338
cmp ebx, 2
jne 0x43430e
mov al, 7
jmp 0x434338
cmp ecx, 6
jne 0x434336
cmp ebx, 0
jne 0x43431c
mov al, 8
jmp 0x434338
cmp ebx, 1
jne 0x434323
mov al, 9
cmp ebx, 2
jne 0x43432a
mov al, 0xa
cmp ebx, 3
jne 0x434331
mov al, 0xb
cmp ebx, 4
jne 0x434338
mov al, 0xc
pop ebx
leave
ret
Function at 0x45f6b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x45f6db
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x45f6db
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x45f6e5
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x45f727
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x45f789
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x45f784
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45f76f
test dl, dl
je 0x45f76b
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45f76f
add ecx, 2
add eax, 2
test dl, dl
jne 0x45f74f
xor eax, eax
jmp 0x45f774
sbb eax, eax
or eax, 1
test eax, eax
je 0x45f795
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x45f73c
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x45f81a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x45f83d
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x45f83d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x45f847
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x45f889
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x45f8eb
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x45f8e6
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45f8d1
test dl, dl
je 0x45f8cd
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45f8d1
add ecx, 2
add eax, 2
test dl, dl
jne 0x45f8b1
xor eax, eax
jmp 0x45f8d6
sbb eax, eax
or eax, 1
test eax, eax
je 0x45f8f7
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x45f89e
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x45f989
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x45f9ac
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x45f9ac
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x45f9b6
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x45f9f8
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x45fa5a
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x45fa55
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45fa40
test dl, dl
je 0x45fa3c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45fa40
add ecx, 2
add eax, 2
test dl, dl
jne 0x45fa20
xor eax, eax
jmp 0x45fa45
sbb eax, eax
or eax, 1
test eax, eax
je 0x45fa66
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x45fa0d
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x45faf3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x45fb16
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x45fb16
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x45fb20
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x45fb62
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x45fbc4
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x45fbbf
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45fbaa
test dl, dl
je 0x45fba6
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45fbaa
add ecx, 2
add eax, 2
test dl, dl
jne 0x45fb8a
xor eax, eax
jmp 0x45fbaf
sbb eax, eax
or eax, 1
test eax, eax
je 0x45fbd0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x45fb77
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x45fc69
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x45fc8c
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x45fc8c
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x45fc96
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x45fcd8
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x45fd3a
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x45fd35
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45fd20
test dl, dl
je 0x45fd1c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45fd20
add ecx, 2
add eax, 2
test dl, dl
jne 0x45fd00
xor eax, eax
jmp 0x45fd25
sbb eax, eax
or eax, 1
test eax, eax
je 0x45fd46
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x45fced
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x45fdda
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x45fdfd
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x45fdfd
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x45fe07
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x45fe49
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x45feab
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x45fea6
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45fe91
test dl, dl
je 0x45fe8d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45fe91
add ecx, 2
add eax, 2
test dl, dl
jne 0x45fe71
xor eax, eax
jmp 0x45fe96
sbb eax, eax
or eax, 1
test eax, eax
je 0x45feb7
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x45fe5e
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x45ff49
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x45ff6c
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x45ff6c
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x45ff76
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x45ffb8
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x46001a
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x460015
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x460000
test dl, dl
je 0x45fffc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x460000
add ecx, 2
add eax, 2
test dl, dl
jne 0x45ffe0
xor eax, eax
jmp 0x460005
sbb eax, eax
or eax, 1
test eax, eax
je 0x460026
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x45ffcd
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4600b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4600db
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4600db
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4600e5
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x460127
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x460189
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x460184
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x46016f
test dl, dl
je 0x46016b
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x46016f
add ecx, 2
add eax, 2
test dl, dl
jne 0x46014f
xor eax, eax
jmp 0x460174
sbb eax, eax
or eax, 1
test eax, eax
je 0x460195
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x46013c
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x468f82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x468fa5
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc