joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42315c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x474b66
call fcn.0046f140
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.00402d90
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00402d90
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi], fcn.00422935
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x423cd7
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x474bf5
call fcn.0046f140
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], bl
mov byte [esi + 0xb], bl
call fcn.004026d9
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004026d9
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004026d9
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.004026d9
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42647e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x474faa
call fcn.0046f140
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.00402ea8
and dword [ebp - 4], 0
lea eax, [edi + 0x1c]
push eax
lea ecx, [esi + 0x1c]
call fcn.00426682
mov eax, dword [edi + 0x28]
add edi, 0x34
mov dword [esi + 0x28], eax
mov al, byte [edi - 8]
mov byte [esi + 0x2c], al
mov al, byte [edi - 7]
mov byte [esi + 0x2d], al
mov eax, dword [edi - 4]
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov dword [esi + 0x30], eax
call fcn.00426613
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4264ff
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x474fdd
call fcn.0046f140
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004265dd
mov al, byte [edi + 8]
and dword [ebp - 4], 0
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov al, byte [edi + 0xa]
mov byte [esi + 0xa], al
mov al, byte [edi + 0xb]
mov byte [esi + 0xb], al
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00402735
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00402735
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.00402735
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.00402735
mov eax, dword [edi + 0x40]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42c670
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4754ed
call fcn.0046f140
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
mov byte [esi + 0x14], bl
mov byte [esi + 0x15], bl
mov byte [esi + 0x16], bl
mov byte [esi + 0x17], bl
call fcn.00402d90
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.00402d90
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
call fcn.00402d90
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 6
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov word [esi + 0x4c], bx
mov byte [esi + 0x4e], bl
mov byte [esi + 0x4f], bl
call fcn.00421962
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 7
call fcn.00421962
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42c8b4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x47556e
call fcn.0046f140
push ecx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esi], 0x47b45c
mov dword [esi + 4], 0x47b3dc
mov dword [esi + 8], 0x47b44c
mov dword [esi + 0xc], 0x47a644
mov dword [esi + 0x10], 0x47b320
mov dword [esi + 0x14], eax
mov byte [esi + 0x18], al
mov dword [ebp - 0x10], esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
call fcn.00402d90
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.00402d90
lea edi, [esi + 0x60]
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00406529
lea ecx, [edi + 0x28]
call fcn.00402d90
lea ecx, [esi + 0x98]
mov byte [ebp - 4], 5
call fcn.00416efc
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x47b438
mov dword [esi + 4], 0x47b424
mov dword [esi + 8], 0x47b414
mov dword [esi + 0xc], 0x47b404
mov dword [esi + 0x10], 0x47b3f0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42cfc1
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x475631
call fcn.0046f140
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.00402ea8
and dword [ebp - 4], 0
lea eax, [edi + 0x1c]
push eax
lea ecx, [esi + 0x1c]
call fcn.00402ea8
mov eax, dword [edi + 0x28]
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
lea eax, [edi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00402ea8
lea eax, [edi + 0x3c]
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00402ea8
mov al, byte [edi + 0x48]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x48], al
mov al, byte [edi + 0x49]
mov byte [esi + 0x49], al
mov al, byte [edi + 0x4a]
mov byte [esi + 0x4a], al
mov al, byte [edi + 0x4b]
mov byte [esi + 0x4b], al
mov al, byte [edi + 0x4c]
mov byte [esi + 0x4c], al
mov al, byte [edi + 0x4d]
mov byte [esi + 0x4d], al
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
mov al, byte [edi + 0x6c]
mov byte [esi + 0x6c], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42d16c
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x4756b9
call fcn.0046f140
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
test eax, eax
mov dword [ebx], eax
je 0x42d190
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
test eax, eax
mov dword [ebx + 4], eax
je 0x42d1a4
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 8]
mov byte [ebp - 4], 1
test eax, eax
mov dword [ebx + 8], eax
je 0x42d1b8
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 0xc]
mov byte [ebp - 4], 2
test eax, eax
mov dword [ebx + 0xc], eax
je 0x42d1cc
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov al, byte [esi + 0x10]
lea ecx, [ebx + 0x18]
mov byte [ebx + 0x10], al
mov al, byte [esi + 0x11]
mov byte [ebx + 0x11], al
mov al, byte [esi + 0x12]
mov byte [ebx + 0x12], al
mov al, byte [esi + 0x13]
mov byte [ebx + 0x13], al
mov al, byte [esi + 0x14]
mov byte [ebx + 0x14], al
mov al, byte [esi + 0x15]
mov byte [ebx + 0x15], al
mov al, byte [esi + 0x16]
mov byte [ebx + 0x16], al
mov al, byte [esi + 0x17]
mov byte [ebx + 0x17], al
lea eax, [esi + 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.00402ea8
lea eax, [esi + 0x24]
lea ecx, [ebx + 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.00402ea8
lea eax, [esi + 0x30]
lea ecx, [ebx + 0x30]
push eax
mov byte [ebp - 4], 5
call fcn.00402ea8
mov eax, dword [esi + 0x3c]
add esi, 0x44
mov dword [ebx + 0x3c], eax
mov eax, dword [esi - 4]
lea edi, [ebx + 0x44]
mov dword [ebx + 0x40], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x78]
mov byte [ebp - 4], 6
mov eax, dword [esi + 0x50]
mov dword [ebx + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [ebx + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [ebx + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [ebx + 0x5c], eax
mov al, byte [esi + 0x60]
mov byte [ebx + 0x60], al
mov eax, dword [esi + 0x68]
mov dword [ebx + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [ebx + 0x6c], eax
mov eax, dword [esi + 0x70]
mov dword [ebx + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [ebx + 0x74], eax
lea eax, [esi + 0x78]
push eax
call fcn.0042d2cb
lea eax, [esi + 0xa8]
lea ecx, [ebx + 0xa8]
push eax
mov byte [ebp - 4], 7
call fcn.0042d2cb
mov eax, dword [esi + 0xd8]
pop edi
mov dword [ebx + 0xd8], eax
mov eax, dword [esi + 0xdc]
mov dword [ebx + 0xdc], eax
mov eax, ebx
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x439b58
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x47643b
call fcn.0046f140
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.00402d90
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.0041315b
lea ecx, [esi + 0x30]
call fcn.00402d90
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4461f2
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4773e3
call fcn.0046f140
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x28], 0x40000000
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x18], al
mov byte [esi + 0x19], al
mov dword [esi + 0x1c], 1
mov byte [esi + 0x20], al
mov byte [esi + 0x21], 1
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
call fcn.00402d90
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44f2d7
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x200
jb 0x44f38f
cmp word [ecx], 0x5a4d
jne 0x44f38f
mov eax, dword [ecx + 0x3c]
cmp eax, 0x1000
jae 0x44f38f
push esi
lea esi, [eax + 0x200]
cmp esi, edx
pop esi
ja 0x44f38f
test al, 7
jne 0x44f38f
add eax, ecx
cmp dword [eax], 0x4550
jne 0x44f38f
movzx ecx, word [eax + 4]
add eax, 4
sub ecx, 0x14c
je 0x44f365
sub ecx, 0x74
je 0x44f35e
dec ecx
dec ecx
je 0x44f35e
dec ecx
dec ecx
je 0x44f357
sub ecx, 0x3c
je 0x44f350
sub ecx, 0x8464
je 0x44f365
sub ecx, 0x2400
jne 0x44f38f
push 0xa
pop ecx
jmp 0x44f36a
mov ecx, 0x3030401
jmp 0x44f36a
mov ecx, 0x3030701
jmp 0x44f36a
mov ecx, 0x3030501
jmp 0x44f36a
mov ecx, 0x3030103
cmp word [eax + 0x10], 0x400
ja 0x44f38f
movzx eax, word [eax + 0x14]
cmp eax, 0x10b
je 0x44f384
cmp eax, 0x20b
jne 0x44f38f
mov eax, dword [esp + 4]
push 1
mov dword [eax], ecx
pop eax
jmp 0x44f391
xor eax, eax
ret 4
Function at 0x4537a0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x477e24
call fcn.0046f140
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0044e907
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea eax, [esi + 0x3c]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 2
call fcn.00446896
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x78]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 7
call fcn.00446896
lea eax, [esi + 0x90]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 9
call fcn.00446896
lea eax, [esi + 0xa8]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0xb
call fcn.00446896
lea ebx, [esi + 0xc0]
mov byte [ebp - 4], 0xc
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.00446896
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xd
call fcn.00446896
lea ebx, [esi + 0xd8]
mov byte [ebp - 4], 0xe
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.00446896
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xf
call fcn.00446896
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x45399c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x477e83
call fcn.0046f140
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00453b6d
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00453c22
mov al, byte [edi + 0x18]
add edi, 0x34
mov byte [esi + 0x18], al
mov al, byte [edi - 0x1b]
mov byte [esi + 0x19], al
mov eax, dword [edi - 0x18]
mov dword [esi + 0x1c], eax
mov al, byte [edi - 0x14]
mov byte [esi + 0x20], al
mov al, byte [edi - 0x13]
mov byte [esi + 0x21], al
mov eax, dword [edi - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [edi - 8]
mov dword [esi + 0x2c], eax
mov al, byte [edi - 4]
mov byte [esi + 0x30], al
mov al, byte [edi - 3]
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x31], al
call fcn.00402ea8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x45ada0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub esp, 0xac
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x1c]
call fcn.0046e910
mov ebp, 0x3e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.0046ef30
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.0046ef30
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x45ae3b
push str.SystemFunction036
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45ae34
lea ecx, [esp + 0x9c]
push 0x20
push ecx
call eax
test al, al
je 0x45ae34
push 0x20
lea edx, [esp + 0xa0]
lea ecx, [esp + 0x20]
mov ebp, 0x64
call fcn.0046ef30
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x45ae5f
push 8
lea edx, [esp + 0x18]
lea ecx, [esp + 0x20]
call fcn.0046ef30
call ebx
push 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.0046ef30
mov edi, 0x64
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.0046efc0
lea ecx, [esp + 0x1c]
call fcn.0046e910
push 0x20
mov edx, esi
lea ecx, [esp + 0x20]
call fcn.0046ef30
dec edi
jne 0x45ae79
dec ebp
jne 0x45ae41
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.0046efc0
mov byte [esi + 0x20], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret
Function at 0x462d50
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
or edx, 0x100
push ebx
lea esp, [esp]
mov ecx, edx
and ecx, 1
shr edx, 1
movzx ebx, word [edi + edx*2]
neg ecx
shr ecx, 4
shr ebx, 4
and ecx, 0x7f
xor ebx, ecx
add eax, dword [esi + ebx*4]
cmp edx, 2
jae 0x462d60
pop ebx
ret

Function at 0x462d90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
shr ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x462da0
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4630a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor edx, edx
push esi
mov esi, edx
shr esi, 1
mov ebp, esi
and ebp, 1
mov eax, edx
shr eax, 2
movzx ecx, word [ebx + eax*2 + 4]
neg ebp
shr ebp, 4
neg eax
shr ecx, 4
and ebp, 0x7f
xor ecx, ebp
movzx ebp, word [ebx + 2]
mov ecx, dword [edi + ecx*4]
and eax, 0x7f0
xor eax, ebp
shr eax, 4
add ecx, dword [edi + eax*4]
movzx eax, word [ebx + esi*2 + 8]
add ecx, dword [esp + 0xc]
mov esi, eax
shr esi, 4
mov ebp, dword [edi + esi*4]
mov esi, dword [esp + 0x10]
xor eax, 0x7f0
add ebp, ecx
shr eax, 4
mov dword [esi + edx*4], ebp
mov eax, dword [edi + eax*4]
add eax, ecx
mov dword [esi + edx*4 + 4], eax
add edx, 2
cmp edx, 8
jb 0x4630a4
pop esi
pop ebp
ret 8
Function at 0x463120
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov edi, eax
movzx eax, word [ebp]
mov ecx, eax
xor ecx, 0x7f0
shr ecx, 4
mov edx, dword [edi + ecx*4]
movzx ecx, word [ebp + 0x10]
shr eax, 4
mov eax, dword [edi + eax*4]
mov dword [esp + 0x18], eax
shr ecx, 4
mov eax, dword [edi + ecx*4]
add eax, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], edx
test eax, eax
je 0x4631a5
mov esi, dword [esp + 0x24]
add esi, 4
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x18]
push esi
push edx
mov ebx, ebp
call fcn.004630a0
mov ecx, dword [esp + 0x1c]
lea eax, [esi + 0x20]
push eax
push ecx
lea ebx, [ebp + 0x10]
call fcn.004630a0
add esi, 0x440
add ebp, 0x20
dec dword [esp + 0x14]
jne 0x463170
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov esi, dword [eax]
cmp esi, 0x10
jbe 0x463277
movzx ecx, word [ebp + 0x10]
xor ecx, 0x7f0
add esi, 0xfffffff1
shr esi, 1
shr ecx, 4
add edx, dword [edi + ecx*4]
lea eax, [ebp + esi*2 + 0x300]
mov dword [esp + 0x10], edx
mov dword [esp + 0x2c], eax
jmp 0x4631e4
mov edx, dword [esp + 0x10]
dec esi
sub dword [esp + 0x2c], 2
lea ecx, [esi + 0x80]
mov eax, ecx
and eax, 1
shr ecx, 1
movzx ebx, word [ebp + ecx*2 + 0x200]
neg eax
shr eax, 4
shr ebx, 4
and eax, 0x7f
xor ebx, eax
add edx, dword [edi + ebx*4]
cmp ecx, 2
jae 0x4631f0
mov ecx, dword [esp + 0x2c]
movzx eax, word [ecx]
mov ebx, dword [esp + 0x24]
mov ecx, eax
shr ecx, 4
mov ecx, dword [edi + ecx*4]
xor eax, 0x7f0
add ebx, 0x44
add ecx, edx
shr eax, 4
mov dword [ebx + esi*8], ecx
mov eax, dword [edi + eax*4]
add eax, edx
mov dword [ebx + esi*8 + 4], eax
test esi, esi
jne 0x4631e0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ebp, dword [ecx]
lea ebp, [ebp*4 - 0x40]
cmp eax, 1
jbe 0x463277
lea esi, [ecx + 0x484]
lea edi, [eax - 1]
push ebp
push ebx
push esi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add esi, 0x440
dec edi
jne 0x463263
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x465d20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
xor ebx, ebx
mov dword [edx + 0x2c], ebx
push esi
push edi
mov edi, 1
mov dword [edx + 0x44], edi
mov dword [edx + 0x40], edi
mov dword [edx + 0x3c], edi
mov dword [edx + 0x38], edi
mov eax, dword [edx + 0x78]
mov dword [edx + 0x70], eax
mov eax, 0x400
movzx ecx, ax
mov dword [edx + 0x58], 0xffffffff
mov dword [edx + 0x5c], ebx
mov dword [edx + 0x60], ebx
mov dword [edx + 0x64], ebx
mov dword [edx + 0x68], ebx
mov dword [edx + 0x6c], ebx
mov dword [edx + 0x80], ebx
mov dword [edx + 0x84], ebx
mov dword [edx + 0x88], ebx
mov eax, ecx
shl ecx, 0x10
or eax, ecx
mov dword [edx + 0x1e30], eax
mov dword [edx + 0x1e34], eax
mov dword [edx + 0x1e38], eax
mov dword [edx + 0x1e3c], eax
mov dword [edx + 0x1e40], eax
mov dword [edx + 0x1e44], eax
mov dword [edx + 0x1e48], eax
mov dword [edx + 0x1e4c], eax
lea ecx, [edx + 0x1e68]
lea eax, [edx + 0x2030]
mov dword [esp + 0xc], 0xc
push ebp
lea esp, [esp]
mov esi, 0x10
jmp 0x465dd0
mov ebp, 0x400
mov word [eax - 0x180], bp
mov word [eax], bp
add eax, 2
sub esi, edi
jne 0x465dd0
mov esi, ebp
mov word [ecx - 0x18], si
mov word [ecx], si
mov word [ecx + 0x18], si
mov word [ecx + 0x30], si
add ecx, 2
sub dword [esp + 0x10], edi
jne 0x465dc0
mov eax, esi
movzx esi, ax
mov eax, esi
shl esi, 0x10
or eax, esi
lea edi, [edx + 0x21b0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov eax, ebp
movzx esi, ax
mov eax, esi
shl esi, 0x10
or eax, esi
lea edi, [edx + 0x23b0]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov ecx, dword [edx + 0x98]
add ecx, dword [edx + 0x94]
mov edi, dword [edx + 0x50]
mov eax, 0x300
shl eax, cl
cmp eax, ebx
jbe 0x465e63
mov ecx, eax
mov eax, ebp
movzx esi, ax
mov eax, esi
shl esi, 0x10
or eax, esi
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, ebp
movzx ebp, ax
mov eax, ebp
shl ebp, 0x10
or eax, ebp
mov ecx, 0x80
lea edi, [edx + 0x24b0]
rep stosd dword es:[edi], eax
mov eax, 0x400
movzx esi, ax
mov eax, esi
shl esi, 0x10
or eax, esi
lea edi, [edx + 0x26b0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov eax, 0x400
movzx ebp, ax
mov eax, ebp
shl ebp, 0x10
or eax, ebp
mov ecx, 0x80
lea edi, [edx + 0x28b0]
rep stosd dword es:[edi], eax
mov eax, 0x400
movzx esi, ax
mov eax, esi
shl esi, 0x10
or eax, esi
lea edi, [edx + 0x2ab0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov dword [edx + 0x1c], ebx
mov dword [edx + 0x18], ebx
lea eax, [edx + 0xbcb8]
mov ecx, 0x800
pop ebp
mov dword [eax], 0x40000000
add eax, 0x20
dec ecx
jne 0x465ee2
mov ecx, dword [edx + 0x9c]
mov eax, 1
shl eax, cl
mov ecx, dword [edx + 0x98]
mov esi, 0x100
pop edi
dec eax
mov dword [edx + 0x4c], eax
mov eax, 0x100
shl eax, cl
mov ecx, dword [edx + 0x94]
shr esi, cl
mov dword [edx + 0x34], ebx
sub eax, esi
pop esi
mov dword [edx + 0x48], eax
pop ebx
pop ecx
ret