joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b3d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ae9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4bcc80
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x40b460
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x40b427
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [0x4bb0e8]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x40b451
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.0045b8cc
jmp 0x40b466
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.0045b8cc
jmp 0x40b466
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4bcc14
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.0045b818
mov ecx, esi
mov dword [edi], 0x4bc630
mov dword [esp + 0x1c], 0xffffffff
call fcn.0045b8ae
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x41bbb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b104b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4beef0
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x41bc40
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x41bc07
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [0x4bb0e8]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x41bc31
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.0045b8cc
jmp 0x41bc46
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.0045b8cc
jmp 0x41bc46
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x4bcc14
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.0045b818
mov ecx, esi
mov dword [edi], 0x4bc630
mov dword [esp + 0x1c], 0xffffffff
call fcn.0045b8ae
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x427250
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b250d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ebx, [esi + 4]
mov ecx, ebx
call fcn.0045b416
xor edi, edi
lea ecx, [esi + 8]
mov dword [esp + 0x20], edi
call fcn.0045b416
lea ecx, [esi + 0xc]
mov byte [esp + 0x20], 1
call fcn.0045b416
lea ecx, [esi + 0x10]
mov byte [esp + 0x20], 2
call fcn.0045b416
lea ecx, [esi + 0x44]
mov byte [esp + 0x20], 3
call fcn.0045b416
lea ebp, [esi + 0x48]
push 0x400
mov ecx, ebp
mov byte [esp + 0x24], 4
mov dword [esp + 0x18], ebp
call fcn.0045bfc8
push 0xa
lea ecx, [ebp + 0x28]
mov byte [esp + 0x24], 5
call fcn.0045bb8a
mov dword [ebp], 0x4be320
lea ebp, [esi + 0x8c]
mov dword [esp + 0x14], ebp
mov dword [ebp + 4], edi
lea ecx, [ebp + 8]
mov byte [esp + 0x20], 7
call fcn.0045b416
mov dword [ebp], 0x4bf494
mov dword [esi + 0x98], edi
lea ecx, [esi + 0xa0]
mov byte [esp + 0x20], 9
call fcn.0045b416
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], 0xa
mov dword [esi + 0xa8], 0x4bf480
push 0x534e14
mov ecx, ebx
mov byte [esp + 0x24], 0xb
mov dword [esi], 0x4be3a4
call fcn.0045b5a8
push 0x534e14
lea ecx, [esi + 8]
call fcn.0045b5a8
push 0x534e14
lea ecx, [esi + 0xc]
call fcn.0045b5a8
push 0x534e14
lea ecx, [esi + 0x10]
call fcn.0045b5a8
mov ebp, 2
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], edi
mov dword [esi + 0x1c], edi
mov ebx, 1
push 0x534e14
lea ecx, [esi + 0x44]
mov dword [esi + 0x2c], ebx
call fcn.0045b5a8
mov dword [esi + 0x34], ebx
mov word [esi + 0x30], di
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], ebx
push 0x534e14
lea ecx, [esi + 0xa0]
mov dword [esi + 0x9c], ebp
call fcn.0045b5a8
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x427890
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2546
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x534e14
lea ecx, [esi + 4]
mov dword [ebp - 4], ebx
call fcn.0045b5a8
push 0x534e14
lea ecx, [esi + 8]
call fcn.0045b5a8
push 0x534e14
lea ecx, [esi + 0xc]
call fcn.0045b5a8
push 0x534e14
lea ecx, [esi + 0x10]
call fcn.0045b5a8
mov dword [esi + 0x1c], ebx
push 0x534e14
lea ecx, [esi + 0x44]
mov dword [esi + 0x1c], ebx
call fcn.0045b5a8
mov dword [esi + 0x34], 1
mov word [esi + 0x30], bx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov edi, dword [esi + 0x90]
cmp edi, ebx
je 0x4279af
lea eax, [edi + 0x14]
push eax
call fcn.005a6a03
nop
test eax, eax
jne 0x4279a9
cmp edi, ebx
mov dword [ebp - 0x1c], edi
je 0x4279a9
mov edx, dword [edi + 4]
lea ebx, [edi + 4]
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
mov byte [ebp - 4], 2
call dword [edx + 0x18]
mov eax, dword [eax]
push 0x534e14
push eax
call dword [0x4bbff0]
add esp, 8
lea ecx, [ebp - 0x18]
test eax, eax
setne byte [ebp - 0x11]
call fcn.0045b3ec
mov al, byte [ebp - 0x11]
test al, al
je 0x427976
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x54]
push 0
mov ecx, edi
call fcn.0045b530
mov eax, dword [edi]
push eax
call dword [0x4bb310]
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0045b53c
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0045b3ec
push edi
call fcn.0045b51e
add esp, 4
xor ebx, ebx
mov dword [esi + 0x90], ebx
mov edi, dword [esi + 0x98]
cmp edi, ebx
je 0x427a4b
lea eax, [edi + 0x14]
push eax
call fcn.0057d475
nop
test eax, eax
jne 0x427a45
cmp edi, ebx
mov dword [ebp - 0x18], edi
je 0x427a45
mov edx, dword [edi + 4]
lea ebx, [edi + 4]
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
mov byte [ebp - 4], 4
call dword [edx + 0x18]
mov eax, dword [eax]
push 0x534e14
push eax
call dword [0x4bbff0]
add esp, 8
lea ecx, [ebp - 0x1c]
test eax, eax
setne byte [ebp - 0x11]
call fcn.0045b3ec
mov al, byte [ebp - 0x11]
test al, al
je 0x427a12
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x54]
push 0
mov ecx, edi
call fcn.0045b530
mov eax, dword [edi]
push eax
call dword [0x4bb310]
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0045b53c
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.0045b3ec
push edi
call fcn.0045b51e
add esp, 4
xor ebx, ebx
mov dword [esi + 0x98], ebx
push 0x534e14
lea ecx, [esi + 0xa0]
mov dword [esi + 0x9c], 2
call fcn.0045b5a8
mov eax, dword [esi + 0xc4]
cmp eax, ebx
je 0x427a7e
push eax
call fcn.0045b51e
add esp, 4
mov dword [esi + 0xc4], ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ac10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b3ea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
push eax
call fcn.005d470d
nop
mov esi, dword [esp + 0x30]
test esi, esi
je 0x43ac53
mov eax, dword [esi]
jmp 0x43ac55
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x38]
push edx
push eax
push edi
call dword [ecx + 0x74]
test eax, eax
jge 0x43ac76
push 0x52aab8
push edi
push eax
call fcn.0045c65e
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, edi
test esi, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov word [esp + 0xc], 0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
je 0x43acd6
lea eax, [esi + 8]
push eax
call fcn.005d2ed8
nop
test eax, eax
jne 0x43acd6
mov eax, dword [esi]
test eax, eax
je 0x43acbd
push eax
call fcn.005c2bc9
nop
mov eax, dword [esi + 4]
test eax, eax
je 0x43accd
push eax
call fcn.0045b51e
add esp, 4
push esi
call fcn.0045b51e
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x4416d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b446b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.00441830
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x534e14
call fcn.005b1bd1
nop
mov al, byte [esi]
mov ecx, dword [0x4bbea0]
mov byte [esp + 0x24], al
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov edx, dword [ecx]
lea ecx, [esp + 0x24]
push edx
push ebx
push esi
mov byte [esp + 0x48], 1
call fcn.005ba49e
nop
mov eax, dword [0x4bbdf4]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x44177b
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x441772
cmp al, 0xff
je 0x441772
dec al
mov byte [ecx], al
jmp 0x44177b
push ecx
call fcn.0045b51e
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.004a96d0
mov eax, dword [esp + 0x28]
mov ecx, dword [0x4bbdf4]
cmp eax, ebx
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x18], ecx
je 0x4417c7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4417be
cmp al, 0xff
je 0x4417be
dec al
mov byte [ecx], al
jmp 0x4417c7
push ecx
call fcn.0045b51e
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.005bc3f7
nop
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x4510a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov cl, byte [eax + 0x4cf260]
xor cl, 0x7d
mov byte [eax + 0x546d3c], cl
inc eax
cmp eax, 0x6fb5
jb 0x4510a2
mov eax, 0x546d3c
ret
Function at 0x46a030
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x40
push ebx
push ebp
mov ebp, ecx
mov ebx, dword [esp + 0x50]
mov ecx, dword [eax]
cmp ebx, 1
mov dword [ebp], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 4], edx
mov ecx, dword [eax]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 0xc], edx
jae 0x46a071
lea eax, [esp + 0x54]
push 0x51b810
push eax
mov dword [esp + 0x5c], str.Incorrect_key_length
call fcn.0045c53e
cmp ebx, 0x38
jbe 0x46a07b
mov ebx, 0x38
mov ecx, ebx
push esi
mov esi, dword [esp + 0x50]
mov edx, ecx
push edi
lea edi, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp + 0x10]
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x12
mov esi, 0x4ff918
mov edi, edx
mov dword [esp + 0x58], 0x12
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp + 0x58]
mov ecx, 0x400
mov esi, 0x4ff960
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18]
mov esi, edx
xor edx, edx
mov dword [esp + 0x5c], 4
mov edi, edx
xor edx, edx
mov dl, byte [ecx]
shl edi, 8
or edx, edi
inc ecx
inc eax
cmp eax, ebx
jne 0x46a0e6
xor eax, eax
lea ecx, [esp + 0x18]
mov edi, dword [esp + 0x5c]
dec edi
mov dword [esp + 0x5c], edi
jne 0x46a0cf
mov edi, dword [esi]
add esi, 4
xor edi, edx
mov edx, dword [esp + 0x58]
mov dword [esi - 4], edi
dec edx
mov dword [esp + 0x58], edx
jne 0x46a0c5
xor edi, edi
lea esi, [ebp + 0x10]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.0046a190
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi], ecx
add esi, 4
inc edi
mov dword [esi], edx
inc edi
add esi, 4
cmp edi, 0x12
jb 0x46a113
lea eax, [ebp + 0x58]
mov dword [esp + 0x5c], 4
mov ebx, eax
xor edi, edi
mov esi, ebx
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.0046a190
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi], ecx
add esi, 4
inc edi
mov dword [esi], edx
inc edi
add esi, 4
cmp edi, 0x100
jl 0x46a149
mov eax, dword [esp + 0x5c]
add ebx, 0x400
dec eax
mov dword [esp + 0x5c], eax
jne 0x46a145
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
Function at 0x46d580
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4b8028
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0046c2d0
mov dword [esi], fcn.0046d030
mov eax, dword [str.CheckBox]
push eax
lea ecx, [esi + 4]
mov dword [esp + 0x20], 0
call fcn.0045b5a8
mov ebx, dword [0x4bbfe0]
mov byte [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov byte [esi + 0xb1], 1
mov eax, dword [0x579cd4]
test eax, eax
jne 0x46d64d
push 0x5297c4
push str.checkbox_checked.ico
call fcn.005d57ec
nop
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x46d628
xor edi, edi
xor ecx, ecx
push ebp
mov cl, byte [edi + 0x501f20]
xor ecx, 0x7d
push ecx
call ebx
add esp, 8
inc edi
cmp edi, 0x316
jb 0x46d603
push ebp
call fcn.00589c88
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push str.checkbox_checked.ico
push 0
call fcn.00596326
nop
push str.checkbox_checked.ico
mov dword [0x579cd4], eax
call dword [0x4bb310]
mov eax, dword [0x579cd8]
test eax, eax
jne 0x46d6bb
push 0x5297c4
push str.checkbox_unchecked.ico
call fcn.0058a0d9
nop
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x46d696
xor edi, edi
xor edx, edx
push ebp
mov dl, byte [edi + 0x502238]
xor edx, 0x7d
push edx
call ebx
add esp, 8
inc edi
cmp edi, 0x316
jb 0x46d671
push ebp
call fcn.0057bf03
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push str.checkbox_unchecked.ico
push 0
call fcn.0058317d
nop
push str.checkbox_unchecked.ico
mov dword [0x579cd8], eax
call dword [0x4bb310]
mov eax, dword [0x579ccc]
test eax, eax
jne 0x46d729
push 0x5297c4
push str.checkbox_disabled_checked.ico
call fcn.0059ff4a
nop
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x46d704
xor edi, edi
xor eax, eax
push ebp
mov al, byte [edi + 0x502550]
xor eax, 0x7d
push eax
call ebx
add esp, 8
inc edi
cmp edi, 0x316
jb 0x46d6df
push ebp
call fcn.0059a4f9
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push str.checkbox_disabled_checked.ico
push 0
call fcn.005a7c87
nop
push str.checkbox_disabled_checked.ico
mov dword [0x579ccc], eax
call dword [0x4bb310]
mov eax, dword [0x579cd0]
test eax, eax
jne 0x46d797
push 0x5297c4
push str.checkbox_disabled_unchecked.ico
call fcn.005898bf
nop
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x46d772
xor edi, edi
xor ecx, ecx
push ebp
mov cl, byte [edi + str.pp_kUpg_]
xor ecx, 0x7d
push ecx
call ebx
add esp, 8
inc edi
cmp edi, 0x316
jb 0x46d74d
push ebp
call fcn.00598f18
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push str.checkbox_disabled_unchecked.ico
push 0
call fcn.005aee05
nop
push str.checkbox_disabled_unchecked.ico
mov dword [0x579cd0], eax
call dword [0x4bb310]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x46ebe0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b822e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x24], ebp
call fcn.0046c2d0
mov al, byte [esp + 0x13]
lea esi, [ebp + 0xb0]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [ebp], fcn.0046d030
mov ecx, dword [str.ListBox]
push ecx
lea ecx, [ebp + 4]
mov byte [esp + 0x34], 1
call fcn.0045b5a8
mov eax, 0x78
mov ecx, 0x64
mov dword [ebp + 0x1c], eax
mov dword [ebp + 0x20], ecx
push str.list1
lea ecx, [esp + 0x18]
mov dword [ebp + 0xc0], 0xffffffff
call fcn.0045b692
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
sub edx, eax
mov byte [esp + 0x30], 2
sar edx, 2
cmp edx, 1
mov edi, eax
jae 0x46ed4b
mov edx, dword [esi + 4]
cmp edx, ebx
je 0x46ec93
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
ja 0x46ec98
mov ecx, 1
cmp edx, ebx
jne 0x46eca0
xor eax, eax
jmp 0x46eca5
sub eax, edx
sar eax, 2
add eax, ecx
cmp eax, ebx
mov dword [esp + 0x20], eax
jge 0x46ecb1
xor eax, eax
shl eax, 2
push eax
call fcn.0045b52a
mov dword [esp + 0x20], eax
mov ebx, eax
mov eax, dword [esi + 4]
add esp, 4
cmp eax, edi
mov dword [esp + 0x18], eax
je 0x46ecf0
jmp 0x46ecd4
mov eax, dword [esp + 0x18]
push eax
push ebx
call fcn.004503b0
mov eax, dword [esp + 0x20]
add esp, 8
add eax, 4
add ebx, 4
cmp eax, edi
mov dword [esp + 0x18], eax
jne 0x46ecd0
lea ecx, [esp + 0x14]
push ecx
push 1
push ebx
mov ecx, esi
call fcn.00471d40
mov edx, dword [esi + 8]
add ebx, 4
push ebx
push edx
push edi
mov ecx, esi
call fcn.0044fe30
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
mov ecx, esi
call fcn.0044fe00
mov eax, dword [esi + 4]
push eax
call fcn.0045b51e
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
add esp, 4
mov ecx, esi
lea eax, [edi + edx*4]
mov dword [esi + 0xc], eax
call fcn.0041fc50
lea ecx, [edi + eax*4 + 4]
mov dword [esi + 4], edi
mov dword [esi + 8], ecx
jmp 0x46edc8
mov edx, eax
sub edx, edi
sar edx, 2
cmp edx, 1
jae 0x46ed97
lea ecx, [edi + 4]
push ecx
push eax
push edi
mov ecx, esi
call fcn.0044fe30
mov eax, dword [esi + 8]
lea edx, [esp + 0x14]
mov ecx, eax
push edx
sub ecx, edi
mov edx, 1
sar ecx, 2
sub edx, ecx
mov ecx, esi
push edx
push eax
call fcn.00471d40
mov ecx, dword [esi + 8]
lea eax, [esp + 0x14]
push eax
push ecx
push edi
call fcn.00471e60
add esp, 0xc
jmp 0x46edc4
push eax
push eax
add eax, 0xfffffffc
mov ecx, esi
push eax
call fcn.0044fe30
mov eax, dword [esi + 8]
push eax
add eax, 0xfffffffc
push eax
push edi
call fcn.00471e90
lea edx, [esp + 0x20]
lea eax, [edi + 4]
push edx
push eax
push edi
call fcn.00471e60
add esp, 0x18
add dword [esi + 8], 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.0045b3ec
push 5
call fcn.005b3714
nop
mov ecx, dword [esp + 0x28]
mov dword [ebp + 0x70], eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x46f450
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4b8288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0046c2d0
push str.OptionBox
lea ecx, [esi + 4]
mov dword [esp + 0x20], 0
mov dword [esi], 0x503a78
call fcn.0045b5a8
mov ebx, dword [0x4bbfe0]
mov byte [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov byte [esi + 0xb1], 1
mov eax, dword [0x579ce4]
test eax, eax
jne 0x46f51c
push 0x5297c4
push str.radiobox_checked.ico
call fcn.0059be26
nop
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x46f4f7
xor edi, edi
xor eax, eax
push ebp
mov al, byte [edi + 0x502b80]
xor eax, 0x7d
push eax
call ebx
add esp, 8
inc edi
cmp edi, 0x2ae
jb 0x46f4d2
push ebp
call fcn.005bcb3e
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push str.radiobox_checked.ico
push 0
call fcn.005a1791
nop
push str.radiobox_checked.ico
mov dword [0x579ce4], eax
call dword [0x4bb310]
mov eax, dword [0x579ce8]
test eax, eax
jne 0x46f58a
push 0x5297c4
push str.radiobox_unchecked.ico
call fcn.0058175e
nop
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x46f565
xor edi, edi
xor ecx, ecx
push ebp
mov cl, byte [edi + 0x502e30]
xor ecx, 0x7d
push ecx
call ebx
add esp, 8
inc edi
cmp edi, 0x2ae
jb 0x46f540
push ebp
call fcn.005830dd
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push str.radiobox_unchecked.ico
push 0
call fcn.005829ef
nop
push str.radiobox_unchecked.ico
mov dword [0x579ce8], eax
call dword [0x4bb310]
mov eax, dword [0x579cdc]
test eax, eax
jne 0x46f5f8
push 0x5297c4
push str.radiobox_disabled_checked.ico
call fcn.0059e42a
nop
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x46f5d3
xor edi, edi
xor edx, edx
push ebp
mov dl, byte [edi + 0x5030e0]
xor edx, 0x7d
push edx
call ebx
add esp, 8
inc edi
cmp edi, 0x2ae
jb 0x46f5ae
push ebp
call fcn.005b5af8
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push str.radiobox_disabled_checked.ico
push 0
call fcn.005bc2d3
nop
push str.radiobox_disabled_checked.ico
mov dword [0x579cdc], eax
call dword [0x4bb310]
mov eax, dword [0x579ce0]
test eax, eax
jne 0x46f666
push 0x5297c4
push str.radiobox_disabled_unchecked.ico
call fcn.0058fd59
nop
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x46f641
xor edi, edi
xor eax, eax
push ebp
mov al, byte [edi + str.qq_]
xor eax, 0x7d
push eax
call ebx
add esp, 8
inc edi
cmp edi, 0x2ae
jb 0x46f61c
push ebp
call fcn.0057f559
nop
add esp, 4
push 0x10
push 0
push 0
push 1
push str.radiobox_disabled_unchecked.ico
push 0
call fcn.005b1ccb
nop
push str.radiobox_disabled_unchecked.ico
mov dword [0x579ce0], eax
call dword [0x4bb310]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x470910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b84b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x24], esi
call fcn.0046c2d0
mov al, byte [esp + 0x13]
lea edi, [esi + 0xb0]
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov byte [edi], al
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
jmp loc.005b79a8

Function at 0x471150
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4b8548
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edi
call fcn.0046c2d0
mov dword [edi], fcn.0046d030
mov eax, dword [str.Timer]
xor esi, esi
push eax
lea ecx, [edi + 4]
mov dword [esp + 0x18], esi
call fcn.0045b5a8
mov eax, 0x18
mov dword [edi + 0xb0], esi
mov ecx, eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], ecx
mov eax, dword [0x579cc0]
cmp eax, esi
jne 0x47122d
push ebx
push 0x5297c4
push str.timer_icon.ico
call fcn.005ccf21
nop
mov ebx, eax
add esp, 8
cmp ebx, esi
je 0x4711f4
push ebp
mov ebp, dword [0x4bbfe0]
xor ecx, ecx
push ebx
mov cl, byte [esi + 0x500960]
xor ecx, 0x7d
push ecx
call ebp
add esp, 8
inc esi
cmp esi, 0xcbe
jb 0x4711ce
push ebx
call fcn.005cd189
nop
add esp, 4
pop ebp
push 0x10
push 0
push 0
push 1
push str.timer_icon.ico
push 0
call fcn.00584da8
nop
push str.timer_icon.ico
mov dword [0x579cc0], eax
call dword [0x4bb310]
mov eax, edi
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret