joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4064c5
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x408724
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x412014]
xor eax, ebp
mov dword [ebp + 0x208], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x40c524
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wdupenv_s]
add esp, 0xc
test eax, eax
jne 0x4065bb
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp dword [0x4122a0], 0
pop ecx
je 0x406536
xor eax, eax
inc eax
jmp 0x4065bd
lea eax, [ebp]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
ja 0x4065bb
test eax, eax
je 0x4065bb
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.00401f8e
xor edi, edi
lea ecx, [ebp - 0x10]
push str.JavaDeployReg.log
mov dword [ebp - 4], edi
call fcn.00401f8e
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x14]
call fcn.00402065
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x406588
call fcn.00403a4c
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x406591
mov edi, dword [esi]
push 0x40c5d0
push edi
push 0x4122a0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
test esi, esi
je 0x4065b6
mov ecx, esi
call fcn.00403a4c
lea eax, [edi + 1]
jmp 0x4065bd
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00407028
add ebp, 0x20c
leave
ret
Function at 0x40682b
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1044
call fcn.00407110
mov eax, dword [0x412014]
xor eax, esp
mov dword [esp + 0x1040], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1058]
lea eax, [esp + 0x84c]
push edi
mov edi, dword [esp + 0x1058]
mov ebp, 0x800
push ebp
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push esi
push ebx
push edi
push 0xffffffffffffffff
lea eax, [esp + 0x86c]
push 0x400
push eax
call fcn.00406a24
add esp, 0x24
test eax, eax
jns 0x406893
xor eax, eax
mov word [esp + 0x104e], ax
push 0x40
lea eax, [esp + 0x14]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [esp + 0x1c]
push 0x20
push eax
call fcn.004067a8
push 0x40f810
lea eax, [esp + 0x28]
push 0x20
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push ebp
lea eax, [esp + 0x74]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, edi
add esp, 0x2c
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4068d2
sub ecx, edx
sar ecx, 1
cmp ecx, 6
jbe 0x406922
lea eax, [edi - 0xc]
mov edx, 0x40f814
lea eax, [eax + ecx*2]
mov si, word [eax]
xor ecx, ecx
inc ecx
cmp si, word [edx]
jne 0x40691a
test si, si
je 0x406916
mov si, word [eax + 2]
cmp si, word [edx + 2]
jne 0x40691a
add eax, 4
add edx, 4
test si, si
jne 0x4068f1
mov eax, ebx
jmp 0x40691e
sbb eax, eax
or eax, ecx
test eax, eax
je 0x406924
mov ecx, ebx
lea esi, [esp + 0x10]
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x40692b
sub esi, edx
lea eax, [esp + 0x850]
push eax
sar esi, 1
mov edx, 0x40f834
test ecx, ecx
mov eax, str.Error:
cmove eax, edx
push eax
lea edi, [esi + esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.P:_04d_T:_04d__s_s
mov eax, 0x3ff
sub eax, esi
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x6c]
add eax, edi
push eax
call fcn.00406a05
add esp, 0x20
test eax, eax
jns 0x40699d
mov eax, dword [0x40f860]
mov dword [esp + 0x846], eax
mov eax, dword [0x40f864]
mov dword [esp + 0x84a], eax
push edi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x58]
push eax
call sub.VCRUNTIME140.dll_memcpy
lea edi, [esp + 0x5c]
add esp, 0xc
sub edi, 2
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, bx
jne 0x4069b7
mov eax, dword [0x40f868]
mov dword [edi], eax
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x1050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00407028
add esp, 0x1044
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
sub eax, reloc.winmm.dll_waveOutGetDevCapsA
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430529
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x40
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00430480
add esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x430558
mov eax, 0xea61
jmp 0x4305d6
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x3c], 0
jne 0x430568
mov eax, 0xea62
jmp 0x4305d6
push 0xf8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.00430480
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x4550
je 0x430595
mov eax, 0xea62
jmp 0x4305d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 4]
cmp ecx, 0x14c
je 0x4305ad
mov eax, 0xea65
jmp 0x4305d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x16]
test ch, 0x10
je 0x4305c2
mov eax, 0xea66
jmp 0x4305d6
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x74], 0x10
jbe 0x4305d2
mov eax, 0xea67
jmp 0x4305d6
xor eax, eax
jmp 0x4305d6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
push edx
pop edi
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
or ebx, ebx
je 0x4016d4
push esi
pop edi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
push edi
pop edx
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
push esi
pop ebx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
or ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
push eax
pop esi
mov edx, esi
push ebx
pop ecx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x408928
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop edi
mov edx, 0xdc4b2479
call fcn.0040894c
and edx, eax
xor dword [ecx], edi
sub eax, 0xdbfcebc2
mov eax, eax
inc ecx
cmp ecx, esi
jne fcn.00408928
ret

Function at 0x43f15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x43f168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x43f14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x43f145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x43f145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret
Function at 0x41e2f1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x416410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
test eax, eax
jne 0x41e314
push ebx
call dword [0x42f01c]
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [ebp - 0xc], 0x646f632e
mov dword [ebp - 8], 0x65
movzx edi, word [esi + 0x14]
push dword [esi + 0x88]
add edi, 0x18
push esi
add edi, esi
call fcn.00417824
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x41e3bd
movzx edx, word [esi + 6]
xor ecx, ecx
test edx, edx
jle 0x41e36a
lea eax, [ebp - 0xc]
mov eax, dword [eax]
cmp eax, dword [edi]
jne 0x41e362
lea eax, [ebp - 0xc]
mov eax, dword [eax + 4]
cmp eax, dword [edi + 4]
je 0x41e36a
add edi, 0x28
inc ecx
cmp ecx, edx
jl 0x41e34e
cmp ecx, edx
je 0x41e3bd
mov ecx, dword [esi + 0x34]
add ecx, dword [edi + 0xc]
mov edi, 0x417e30
xor edx, edx
mov eax, dword [ecx + edx*4]
cmp eax, dword [edi + edx*4]
jne 0x41e3bd
inc edx
cmp edx, 4
jne 0x41e37b
xor edx, edx
mov eax, dword [ecx + edx*4 + 0x140]
cmp eax, dword [edi + edx*4]
jne 0x41e3bd
inc edx
cmp edx, 4
jne 0x41e38b
cmp dword [ecx + 0x124], 0
je 0x41e3ad
push 0x41e67c
jmp 0x41e3b2
push 0x41e661
push esi
push ebx
push ecx
call fcn.0041e3ce
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fd46
mov esp, ebp
pop ebp
ret
Function at 0x45f540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.00472f00
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.00472780
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0x45f625
mov ecx, esi
call fcn.00472780
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.00472780
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.00472780
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.00472780
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.0045ccc0
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.00472780
lea ecx, [ebx + eax]
call fcn.0045ccc0
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.00472780
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.0045ccc0
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.004725b0
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.00473a50

Function at 0x45f640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.00472f00
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.00472780
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0x45f725
mov ecx, esi
call fcn.00472780
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.00472780
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.00472780
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.00472780
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.0045cd60
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.00472780
lea ecx, [ebx + eax]
call fcn.0045cd60
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.00472780
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.0045cd60
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.004725b0
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.00473a50
Function at 0x45f740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
mov ecx, ebx
push edi
call fcn.00472f00
mov ecx, ebx
call fcn.00472780
mov edi, eax
add edi, dword [esp + 0x20]
push edi
call dword [0x100df290]
test eax, eax
jne 0x45f7cf
mov ecx, ebx
call fcn.00472f00
cmp dword [edi + 0x28], 0xffffffff
jne 0x45f77b
cmp dword [edi + 0x2c], 0xffffffff
je 0x45f7b9
push esi
mov esi, dword [edi + 0x28]
lea ecx, [esp + 0xc]
mov edi, dword [edi + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
call fcn.0045f4f0
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
call fcn.0045f4f0
pop esi
push dword [esp + 0x24]
mov ecx, ebx
push dword [esp + 0x24]
call fcn.004725b0
mov ecx, ebx
call fcn.00473a50
pop edi
mov ecx, ebx
pop ebx
add esp, 0x10
jmp fcn.00473a50

Function at 0x45f7e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
mov ecx, esi
push edi
call fcn.00472f00
mov ecx, esi
call fcn.00472780
mov edi, eax
add edi, dword [esp + 0x20]
push edi
call dword [0x100df290]
test eax, eax
jne 0x45f862
mov ecx, esi
call fcn.00472f00
cmp dword [edi + 0x28], 0xffffffff
jne 0x45f81b
cmp dword [edi + 0x2c], 0xffffffff
je 0x45f84c
push dword [edi + 0x2c]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push dword [edi + 0x28]
mov dword [esp + 0x18], 0xffffffff
push esi
mov dword [esp + 0x20], 0xffffffff
call fcn.0045b9e0
lea ecx, [esp + 8]
call fcn.0045a0e0
push dword [esp + 0x24]
mov ecx, esi
push dword [esp + 0x24]
call fcn.004725b0
mov ecx, esi
call fcn.00473a50
pop edi
mov ecx, esi
pop esi
add esp, 0x10
jmp fcn.00473a50

Function at 0x45f870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.00472f00
mov ecx, edi
call fcn.00472780
mov esi, eax
add esi, dword [esp + 0x10]
lea ecx, [esi + 4]
push ecx
call dword [0x100df290]
test eax, eax
jne 0x45f90d
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x3c]
cmp ecx, 0xffffffff
jne 0x45f8a7
cmp eax, ecx
je 0x45f8b0
push eax
push ecx
mov ecx, edi
call fcn.004725b0
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
cmp ecx, 0xffffffff
jne 0x45f8bf
cmp eax, ecx
je 0x45f8c8
push eax
push ecx
mov ecx, edi
call fcn.004725b0
cmp dword [esi + 0x18], 0xffffffff
jne 0x45f8d4
cmp dword [esi + 0x1c], 0xffffffff
je 0x45f8e3
push dword [esi + 0x1c]
push dword [esi + 0x18]
push edi
call fcn.0045f540
add esp, 0xc
cmp dword [esi + 0x20], 0xffffffff
jne 0x45f8ef
cmp dword [esi + 0x24], 0xffffffff
je 0x45f8fe
push dword [esi + 0x24]
push dword [esi + 0x20]
push edi
call fcn.0045f640
add esp, 0xc
push dword [esp + 0x14]
mov ecx, edi
push dword [esp + 0x14]
call fcn.004725b0
mov ecx, edi
pop edi
pop esi
jmp fcn.00473a50
Function at 0x45f920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
push edi
call fcn.00472f00
mov ecx, esi
call fcn.00472780
mov edi, eax
add edi, dword [esp + 0x10]
lea ecx, [edi + 4]
push ecx
call dword [0x100df290]
test eax, eax
jne 0x45f984
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
cmp ecx, 0xffffffff
jne 0x45f957
cmp eax, ecx
je 0x45f960
push eax
push ecx
mov ecx, esi
call fcn.004725b0
mov edx, dword [edi + 0x10]
mov eax, edx
mov ecx, dword [edi + 0x14]
or eax, ecx
je 0x45f975
push ecx
push edx
mov ecx, esi
call fcn.004725b0
push dword [esp + 0x14]
mov ecx, esi
push dword [esp + 0x14]
call fcn.004725b0
pop edi
mov ecx, esi
pop esi
jmp fcn.00473a50
Function at 0x506130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
xor ebp, ebp
push edi
test ebx, ebx
je 0x506196
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov dword [esp + 0x14], eax
mov edi, dword [eax + 0x78]
add edi, ebx
cmp dword [edi + 0x18], esi
jbe 0x506196
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x20]
lea eax, [eax + esi*4]
mov ecx, dword [eax + ebx]
add ecx, ebx
test ecx, 0xffff0000
je 0x506185
test edx, 0xffff0000
je 0x506185
push edx
push ecx
call dword [0x100df134]
mov edx, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
jmp 0x50618c
xor eax, eax
cmp ecx, edx
sete al
test eax, eax
jne 0x50619d
inc esi
cmp esi, dword [edi + 0x18]
jb 0x506157
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov ebp, dword [eax + ebx]
add ebp, ebx
cmp ebp, edi
jb 0x506196
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x7c]
add eax, edi
cmp ebp, eax
ja 0x506196
xor ecx, ecx
mov eax, ebp
cmp byte [ebp], cl
je 0x5061d9
lea esp, [esp]
lea eax, [eax + 1]
inc ecx
cmp byte [eax], 0
jne 0x5061d0
lea esi, [ecx + 1]
xor edi, edi
test esi, esi
je 0x5061ed
push esi
call fcn.00500600
add esp, 4
mov edi, eax
push esi
push ebp
push edi
call fcn.00477f90
add esp, 0xc
mov esi, edi
cmp byte [edi], 0
je 0x50620b
nop
cmp byte [esi], 0x2e
je 0x50621d
inc esi
cmp byte [esi], 0
jne 0x506200
push edi
xor esi, esi
call fcn.005005f0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
mov byte [esi], 0
call dword [0x100df1e0]
mov ecx, eax
lea eax, [esi + 1]
push eax
push ecx
call fcn.00506130
add esp, 8
mov esi, eax
push edi
call fcn.005005f0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40c302
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40c311
pop dword [ebp - 0x34]
mov eax, 0xbac3200
sub eax, 0xb6b6eef
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3a306
push 0
mov eax, 0x42377a4
add eax, 0xfc1d6934
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x4a8c
mov ebx, eax
mov esi, 0xf5c8f200
add esi, 0xa7849c4
add esi, dword [ebp - 0x34]
mov edi, 0xcffc2aaa
sub edi, 0x16946c4e
xor dword [ebp - 0x1c], 0x979c48f1
mov edx, dword [esi]
sub dword [ebp - 0x14], ebx
xor edx, edi
mov dword [ebx], edx
mov dword [ebp - 0x14], 0x7cfb984b
add ebx, 4
add esi, 0x8695006c
add esi, 0x796aff98
loop 0x40c36a
add eax, 0x9a756cc0
sub eax, 0x9a744fbd
xor ebx, ebx
add ebx, eax
add eax, 0x93ee1f16
sub eax, 0x93ee1f11
mov ecx, 0x6ef0e218
sub ecx, 0x6eb0e218
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x40839a
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0040854a
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x408498
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x40843b
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x40847e
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x408452
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x40846d
test al, 0x40
je 0x408464
mov ecx, dword [edi + 0x20]
jmp 0x40846b
test al, 0x80
je 0x40847e
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x40847e
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x40840a
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret