joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429c8a
Capabilities:
Get http content length

Disassembly:
push 0x14
mov eax, 0x526a4c
call fcn.004fa4d4
push 0
lea eax, [ebp - 0x10]
push eax
lea edi, [esi + 0x70]
push edi
push 0x20000005
push dword [esi + 0x2c]
mov dword [esi + 0x6c], 0
mov dword [edi], 0
mov dword [ebp - 0x10], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x429d17
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.CCoreWininet::InitFileSize
call fcn.00401769
and dword [ebp - 4], 0
push 0x3b7
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str..CoreWininet.cpp
call fcn.00401769
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.wininet:_HttpQueryInfo_for_file_size_failed_
call fcn.00401769
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
or dword [ebp - 4], 0xffffffff
call fcn.00411585
mov eax, dword [edi]
mov ecx, dword [esi + 0x68]
cmp ecx, eax
jae 0x429d25
mov eax, dword [edi]
mov dword [esi + 0x68], eax
call fcn.004fa5ac
ret
Function at 0x42a22d
Capabilities:
Write file on windows

Disassembly:
push 8
mov eax, 0x51bdd0
call fcn.004fa4d4
mov eax, dword [esi + 0x44]
cmp eax, 0xffffffff
jne 0x42a295
push 1
push 0x45f
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str.CCoreWininet::WriteOutput
call fcn.00401769
and dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.wininet:_WriteOutput_failed_because_output_file_is_not_open_
call fcn.00401769
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.inetwriteout
call fcn.00401769
mov byte [ebp - 4], 2
mov eax, dword [esi]
push 6
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [eax + 0x14]
xor eax, eax
jmp 0x42a302
push 0
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42a2ff
push 1
push 0x464
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str.CCoreWininet::WriteOutput
call fcn.00401769
mov dword [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.wininet:_WriteFile_failed_
call fcn.00401769
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.inetwritefile
call fcn.00401769
mov byte [ebp - 4], 5
mov eax, dword [esi]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [eax + 0x1c]
jmp 0x42a291
xor eax, eax
inc eax
call fcn.004fa5ac
ret 8

Function at 0x42a42d
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004f5f50
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
add esp, 0xc
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
neg eax
sbb eax, eax
neg eax
leave
ret
Function at 0x42ae9b
Capabilities:
Resume thread

Disassembly:
push 0xc
mov eax, 0x532e36
call fcn.004fa4d4
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x2c
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
mov edi, str.CPing::Start
push edi
call fcn.00401769
mov byte [ebp - 4], 1
mov byte [ebp - 4], bl
call fcn.004147ed
cmp dword [esi + 0x94], ebx
jne 0x42af37
push 1
push 0x30
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push edi
call fcn.00401769
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Called_with_NULL_WrapperConfig_
call fcn.00401769
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.pingnoconfig
call fcn.00401769
mov byte [ebp - 4], 4
lea ecx, [esi + 0x9c]
mov eax, dword [ecx]
push 1
mov byte [ebp - 4], bl
call dword [eax + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401898
xor eax, eax
call fcn.004fa5ac
ret 4
cmp dword [esi + 0x98], ebx
jne 0x42af7d
push 1
push 0x36
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00401769
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Called_with_NULL_DetectionManager_
call fcn.00401769
mov byte [ebp - 4], 6
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.pingnodetection
call fcn.00401769
mov byte [ebp - 4], 7
jmp 0x42af11
lea eax, [ebp + 8]
lea ecx, [esi + 0x1a4]
push eax
call fcn.004044ef
mov dword [esi + 0x1ac], ebx
cmp dword [esi + 0x19c], ebx
je 0x42afdb
push 1
push 0x41
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00401769
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Ping_download_thread_is_not_NULL_in_StartDownload_
call fcn.00401769
mov byte [ebp - 4], 9
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.threadnotnull
call fcn.00401769
mov byte [ebp - 4], 0xa
jmp 0x42af11
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Starting_ping_download...
call fcn.00401769
mov byte [ebp - 4], 0xb
push 4
mov byte [ebp - 4], bl
call fcn.0041485d
push ebx
push 4
push ebx
push ebx
push esi
push 0x42b0ae
call fcn.004dd93c
mov dword [esi + 0x19c], eax
cmp eax, ebx
jne 0x42b079
push 1
push 0x4d
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00401769
mov byte [ebp - 4], 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.AfxBeginThread_failed_
call fcn.00401769
mov byte [ebp - 4], 0xd
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.beginthread
call fcn.00401769
mov byte [ebp - 4], 0xe
add esi, 0x9c
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov byte [ebp - 4], bl
mov ecx, esi
call dword [edi + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401898
mov eax, ebx
jmp 0x42af2f
mov dword [eax + 0x28], ebx
mov esi, dword [esi + 0x19c]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.__ping_download_thread_started.
call fcn.00401769
mov byte [ebp - 4], 0xf
push 4
mov byte [ebp - 4], bl
call fcn.0041485d
xor ebx, ebx
inc ebx
jmp 0x42b066
Function at 0x42ced8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x520f4a
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x597790]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push 0x5481e4
push eax
call fcn.00414f1c
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov eax, dword [esi]
add eax, 0x74
push ebx
or dword [esp + 0x34], 0xffffffff
mov ecx, esi
call dword [eax]
push ecx
push ecx
mov edi, eax
mov eax, esp
mov dword [esp + 0x1c], esp
push str.items
push eax
mov dword [esp + 0x20], ebx
call fcn.00414f1c
inc ebx
mov dword [esp + 0x30], ebx
mov eax, dword [esi]
add eax, 0x74
push edi
or dword [esp + 0x34], 0xffffffff
mov ecx, esi
call dword [eax]
and dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp dword [eax + 0x18], 0
jle 0x42cffd
lea ecx, [eax + 0x10]
mov eax, dword [esp + 0xc]
call fcn.004081b8
mov edi, dword [eax]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x18c]
test eax, eax
je 0x42cfe6
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x194]
test eax, eax
je 0x42cfe6
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1dc]
test eax, eax
je 0x42cfe6
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push str.item
push eax
mov dword [esp + 0x20], ebx
call fcn.00414f1c
mov dword [esp + 0x30], 2
mov eax, dword [esi]
push dword [esp + 0x1c]
add eax, 0x74
or dword [esp + 0x34], 0xffffffff
mov ecx, esi
call dword [eax]
mov edx, dword [edi]
push eax
push esi
mov ecx, edi
call dword [edx + 0x1e4]
inc dword [esp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0xc]
cmp ecx, dword [eax + 0x18]
jl 0x42cf71
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43cb05
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x525f36
call fcn.004fa4d4
xor ebx, ebx
mov dword [ebp - 4], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.__Postback_using_Shell...
call fcn.00401769
mov byte [ebp - 4], 1
push 2
mov byte [ebp - 4], bl
call fcn.0041485d
push ecx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
mov dword [eax], vtable.CFlags_enum_WebArgFlag_.0
mov dword [eax + 4], 1
mov byte [ebp - 4], 2
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.0040184e
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 0xc]
call fcn.0042d629
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp + 8]
call fcn.004044ef
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.00401898
push str.ShellExecuteEx:
lea ecx, [ebp + 0xc]
call fcn.00401769
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
lea edx, [ebp + 8]
push edx
push eax
push ecx
call fcn.0040417b
add esp, 0xc
mov byte [ebp - 4], 6
push 4
mov byte [ebp - 4], 5
call fcn.0041485d
mov byte [ebp - 4], bl
lea ecx, [ebp + 0xc]
call fcn.00401898
push 0x3c
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.004f5f50
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x440
mov dword [ebp - 0x48], 0x546b84
mov dword [ebp - 0x38], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x43cc68
push 1
push 0x18f
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.CWebManager::PostbackShell
call fcn.00401769
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.ShellExecuteEx_failed_
call fcn.00401769
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.postshell
call fcn.00401769
mov byte [ebp - 4], 9
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov byte [ebp - 4], bl
call dword [eax + 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401898
mov eax, ebx
call fcn.004fa5ac
ret 0xc
cmp dword [ebp - 0x1c], ebx
je 0x43cc84
push 0xbb8
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
jmp 0x43cc52
Function at 0x44560f
Capabilities:
Read file on windows

Disassembly:
push 8
mov eax, 0x514045
call fcn.004fa4d4
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x445638
push ebx
push ebx
push 2
xor ecx, ecx
pop eax
call fcn.00446b4e
xor al, al
jmp 0x4457a2
call fcn.00444fbe
or dword [edi + 8], 0xffffffff
or dword [edi + 4], 0xffffffff
push 2
push ebx
push dword [ebp + 0xc]
call fcn.004f819b
push dword [ebp + 0xc]
call fcn.004f8e5d
push ebx
push ebx
push dword [ebp + 0xc]
mov esi, eax
call fcn.004f819b
add esp, 0x1c
cmp esi, ebx
jg 0x445671
push ebx
push ebx
push 0xd
jmp 0x445629
mov ebx, 0x59f0ac
mov dword [ebp - 0x10], ebx
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00446204
lea eax, [esi + 1]
push eax
call fcn.004d333c
push dword [ebp + 0xc]
mov edi, eax
push 1
push esi
push edi
mov dword [ebp - 0x14], edi
mov byte [edi], 0
call fcn.004f8ba9
add esp, 0x14
cmp eax, 1
je 0x4456e0
push edi
call fcn.004d336b
mov edi, dword [ebp + 8]
pop ecx
push 0
push 0
push 2
xor ecx, ecx
pop eax
call fcn.00446b4e
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], ebx
je 0x445631
push dword [ebp - 0x10]
call fcn.004d336b
pop ecx
jmp 0x445631
mov ebx, edi
mov eax, ebx
mov byte [eax + esi], 0
cmp byte [eax], 0
je 0x445745
mov al, byte [ebx]
cmp al, 0xa
jne 0x445705
mov eax, ebx
sub eax, edi
inc eax
push eax
push edi
lea edi, [ebp - 0x10]
call fcn.00446304
inc ebx
jmp 0x44573b
cmp al, 0xd
jne 0x44573f
mov eax, ebx
sub eax, edi
test eax, eax
jle 0x44571b
push eax
push edi
lea edi, [ebp - 0x10]
call fcn.00446304
push 1
lea eax, [ebp + 0xc]
push eax
lea edi, [ebp - 0x10]
mov byte [ebp + 0xc], 0xa
call fcn.00446304
lea eax, [ebx + 1]
cmp byte [eax], 0xa
jne 0x445739
inc ebx
inc ebx
jmp 0x44573b
mov ebx, eax
mov edi, ebx
jmp 0x445740
inc ebx
cmp byte [ebx], 0
jne 0x4456ed
sub ebx, edi
je 0x445753
push ebx
push edi
lea edi, [ebp - 0x10]
call fcn.00446304
push dword [ebp - 0x14]
call fcn.004d336b
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
pop ecx
push 0
push 0
lea ecx, [edi + 8]
push ecx
mov ecx, esi
call dword [eax + 8]
cmp byte [esi + 0x2c], 0
je 0x44578d
or dword [ebp - 4], 0xffffffff
cmp edi, 0x59f0ac
je 0x445631
push edi
jmp 0x4456d5
or dword [ebp - 4], 0xffffffff
cmp edi, 0x59f0ac
je 0x4457a0
push edi
call fcn.004d336b
pop ecx
mov al, 1
call fcn.004fa5ac
ret 8
Function at 0x44850b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xa4
mov eax, 0x518f52
call fcn.004fa507
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov ecx, dword [esi + 0x74]
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x78], eax
cmp eax, ebx
jne 0x448546
mov dword [ebp - 0x1c], edi
push 0x56da98
lea eax, [ebp - 0x1c]
push eax
call fcn.004fa5de
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
je 0x44855a
mov ecx, dword [esi + 0x74]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov dword [esi + 0x3c], eax
call fcn.00448099
mov eax, dword [esi + 0x18]
call fcn.0044c001
mov eax, dword [esi + 0x2c]
dec eax
mov dword [esi + 0x30], eax
push ebx
push 0xe
mov ecx, esi
call fcn.00448853
cmp dword [esi + 0x24], edi
jne 0x4485af
lea edi, [esi + 0x20]
cmp dword [edi], ebx
jne 0x44858b
call fcn.00447cda
jmp 0x44858d
mov eax, dword [edi]
lea ebx, [esi + 0x40]
call fcn.004478d5
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 1
jae 0x4485a9
call fcn.00447cf4
inc dword [ebp - 0x14]
jmp 0x448599
and dword [esi + 0x1c], 0
jmp 0x4485dd
lea eax, [ebp - 0x50]
push eax
xor edx, edx
call fcn.00447850
mov byte [ebp - 4], 2
lea ebx, [esi + 0x40]
lea eax, [ebp - 0x50]
call fcn.004478d5
mov dword [esi + 0x1c], 4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x50]
push eax
call fcn.0041973a
and dword [ebp - 4], 0
jmp 0x4486a3
add esi, 0x40
push esi
push dword [ebp + 0xc]
call fcn.00447898
and dword [ebp - 4], 0
or dword [ebp - 0x18], 1
mov eax, dword [ebp + 0xc]
call fcn.004fa5ac
ret 8
Function at 0x45c39a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x597790]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x138], 0
jne 0x45c446
mov eax, dword [esi + 4]
cmp eax, 0x100
jb 0x45c446
xor ebx, ebx
inc ebx
cmp eax, 0x101
jbe 0x45c3df
add eax, 0xfffffefc
cmp eax, ebx
ja 0x45c446
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x45c446
mov ecx, dword [esi + 8]
lea eax, [ecx - 0x70]
cmp eax, 0xb
jbe 0x45c442
cmp ecx, 0x2f
je 0x45c442
mov al, byte [ebp - 0xf3]
and al, 0x80
je 0x45c40f
cmp ecx, 0x4e
je 0x45c442
test al, al
je 0x45c42a
cmp ecx, 0x50
je 0x45c442
test al, al
je 0x45c42a
cmp ecx, 0x44
je 0x45c442
test al, al
je 0x45c42a
cmp ecx, 0x46
je 0x45c442
mov al, byte [ebp - 0xf2]
and al, 0x80
je 0x45c439
cmp ecx, 0x25
je 0x45c442
test al, al
je 0x45c446
cmp ecx, 0x27
jne 0x45c446
mov eax, ebx
jmp 0x45c44e
push esi
mov ecx, edi
call fcn.004d3e57
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4e9c
leave
ret 4
Function at 0x46aa73
Capabilities:
Persist via run registry key

Disassembly:
push 0x10
mov eax, 0x52e51c
call fcn.004fa4d4
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
mov ecx, edi
call fcn.00404433
and dword [ebp - 4], 0
xor esi, esi
inc esi
push esi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x544cbc
mov dword [ebp - 0x10], esi
call fcn.00401769
mov dword [ebp - 4], esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401769
mov byte [ebp - 4], 2
push SysReAllocStringLen
mov byte [ebp - 4], 0
call fcn.004217be
add esp, 0x14
test eax, eax
jne 0x46aaec
push str._windows_Desktop
mov ecx, edi
call fcn.00401732
push esi
call fcn.0041db3b
pop ecx
mov eax, edi
call fcn.004fa5ac
ret 4
Function at 0x46c6f6
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, dword [esp + 4]
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edi + edx*4]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edi + edx*4]
pop esi
mov dword [ecx + 8], eax
mov eax, dword [esp + 4]
ret

Function at 0x46c771
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x597790]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
inc dword [0x59f158]
cmp dword [0x59f158], 1
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ebx
jne 0x46c7ba
push 0
call fcn.004f9e21
xor eax, 0xbb40e64e
push eax
call fcn.004f9d09
pop ecx
pop ecx
push edi
mov ecx, ebx
mov eax, esi
call fcn.0046c739
add esp, 4
xor esi, esi
call fcn.004f9d1b
mov ebx, eax
mov eax, dword [ebp - 0x14]
sar ebx, 7
and ebx, 0xff
call fcn.0046c6d9
mov ecx, dword [ebp - 0x14]
push ebx
mov dword [ebp - 0x18], eax
call fcn.0046c6f6
xor bl, byte [ebp - 0x18]
add esp, 4
mov byte [ebp + esi - 0x10], bl
inc esi
cmp esi, 0xa
jl 0x46c7c9
mov eax, dword [ebp - 0x20]
push edi
call fcn.0046c739
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
add esp, 4
xor esi, esi
sub eax, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
call fcn.0046c6d9
mov bl, byte [ebp + esi - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
movzx eax, bl
push eax
call fcn.0046c6f6
xor bl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x20]
add eax, esi
add esp, 4
inc esi
cmp esi, 0xa
mov byte [ebp + eax - 0x10], bl
jl 0x46c816
mov eax, ecx
call fcn.0046c6d9
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
shr ebx, 0x10
mov eax, ebx
and eax, 0xff
push eax
call fcn.0046c6f6
xor bl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov byte [eax + esi], bl
mov eax, ecx
inc esi
call fcn.0046c6d9
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
shr ebx, 0x18
push ebx
mov dword [ebp - 0x18], eax
call fcn.0046c6f6
xor bl, byte [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
add esp, 8
mov byte [eax + esi], bl
pop edi
lea eax, [esi + 1]
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4e9c
leave
ret
Function at 0x46ceca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [esi + 0x4090], eax
je 0x46cf2a
cmp dword [esi + 0x6c], eax
jbe 0x46cf2a
push ebx
mov dword [ebp - 4], 0xffffff78
sub dword [ebp - 4], esi
push edi
lea ebx, [esi + 0x88]
lea edx, [esi + 0x4094]
mov eax, edx
call fcn.0046c6d9
mov edi, dword [esi + 0x40a0]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx]
push eax
mov ecx, edx
call fcn.0046c6f6
mov al, byte [ebp - 0xc]
xor byte [ebx], al
mov eax, dword [ebp - 4]
add esp, 4
inc ebx
add eax, ebx
cmp eax, dword [esi + 0x6c]
jb 0x46cef4
pop edi
pop ebx
push dword [esi + 0x6c]
lea eax, [esi + 0x88]
push eax
push dword [esi + 0x20]
push dword [esi + 0x1c]
call dword [esi + 8]
add esp, 0x10
cmp eax, dword [esi + 0x6c]
je 0x46cf49
or dword [ebp - 8], 0xffffffff
and dword [esi + 0x6c], 0
mov eax, dword [ebp - 8]
leave
ret
Function at 0x46d02c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push edi
xor edi, edi
mov dword [esp + 4], edi
mov dword [esp + 8], edi
cmp ebx, edi
jne 0x46d046
push 0xffffffffffffff9a
pop eax
jmp 0x46d1f7
cmp dword [ebx + 0x2c], edi
je 0x46d03e
cmp dword [ebx + 0x80], 8
push ebp
push esi
mov dword [ebx + 0x34], edi
jne 0x46d0a2
cmp dword [ebx + 0x84], edi
jne 0x46d0a2
lea ebp, [ebx + 0x30]
cmp dword [ebx + 0x40], 0
jne 0x46d081
mov esi, ebx
call fcn.0046ceca
lea eax, [ebx + 0x88]
mov dword [ebx + 0x40], 0x4000
mov dword [ebx + 0x3c], eax
mov esi, dword [ebx + 0x44]
push 4
mov edi, ebp
call fcn.0046e916
mov edi, eax
mov eax, dword [ebx + 0x44]
sub eax, esi
add dword [ebx + 0x6c], eax
test edi, edi
je 0x46d064
cmp edi, 1
jne 0x46d0a2
xor edi, edi
cmp dword [ebx + 0x6c], 0
jbe 0x46d0ba
test edi, edi
jne 0x46d0ba
mov esi, ebx
call fcn.0046ceca
cmp eax, 0xffffffff
jne 0x46d0ba
or edi, eax
cmp dword [ebx + 0x80], 8
jne 0x46d0da
cmp dword [ebx + 0x84], 0
jne 0x46d0f4
lea esi, [ebx + 0x30]
call fcn.0046f00a
and dword [ebx + 0x68], 0
mov edi, eax
cmp dword [ebx + 0x84], 0
jne 0x46d0f4
mov eax, dword [ebx + 0x408c]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x10], eax
mov esi, dword [ebx + 0x74]
mov ebp, dword [ebx + 0x40a4]
mov ecx, dword [esp + 0xc]
add ebp, dword [ebx + 0x44]
push 4
add esi, 0x10
pop edx
call fcn.0046c99c
mov esi, dword [ebx + 0x74]
push 4
add esi, 0x14
pop edx
mov ecx, ebp
call fcn.0046c99c
xor ecx, ecx
inc ecx
cmp dword [ebx + 0x5c], ecx
jne 0x46d135
mov esi, dword [ebx + 0x74]
push 2
add esi, 0x24
pop edx
call fcn.0046c99c
mov esi, dword [ebx + 0x74]
mov ecx, dword [esp + 0x10]
push 4
add esi, 0x18
pop edx
call fcn.0046c99c
test edi, edi
jne 0x46d15d
push dword [ebx + 0x78]
lea edi, [ebx + 0x24]
push dword [ebx + 0x74]
call fcn.0046c8c5
pop ecx
pop ecx
mov edi, eax
push dword [ebx + 0x74]
call fcn.004f8474
pop ecx
test edi, edi
jne 0x46d1e9
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x70]
push edi
add eax, 0xe
push eax
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0x10]
add esp, 0x18
test eax, eax
je 0x46d194
or edi, 0xffffffff
jmp 0x46d1d0
push dword [ebx + 0x20]
mov ecx, dword [esp + 0x10]
push 4
pop esi
mov edi, ebx
call fcn.0046c953
mov edi, eax
pop ecx
test edi, edi
jne 0x46d1d0
push dword [ebx + 0x20]
mov ecx, ebp
mov edi, ebx
call fcn.0046c953
mov edi, eax
pop ecx
test edi, edi
jne 0x46d1d0
push dword [ebx + 0x20]
mov ecx, dword [esp + 0x14]
mov edi, ebx
call fcn.0046c953
pop ecx
mov edi, eax
push 0
push dword [esp + 0x18]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call dword [ebx + 0x10]
add esp, 0x10
test eax, eax
je 0x46d1e9
or edi, 0xffffffff
inc dword [ebx + 0x40b0]
and dword [ebx + 0x2c], 0
pop esi
mov eax, edi
pop ebp
pop edi
add esp, 0xc
ret