joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4233c0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x58a578
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
call fcn.00423a40
test al, al
je 0x423507
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x1c]
test esi, esi
jne 0x423457
push 9
push str.Software_
jmp 0x42345e
push 0x15
push str.SoftwareWow6432Node_
call fcn.00404a80
push 0xa
push 0x5aa39c
lea ecx, [esp + 0x24]
call fcn.00404880
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x18]
push ecx
push 0x20006
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x4234cb
push str.Value
push dword [esp + 0x1c]
call edi
push str.Value2
push dword [esp + 0x1c]
call edi
push str.Value3
push dword [esp + 0x1c]
call edi
push 0x5ab3e0
push dword [esp + 0x1c]
call edi
push dword [esp + 0x18]
call ebx
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x4234e6
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
inc esi
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
cmp esi, 2
jb 0x423413
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00564de8
add esp, 0x30
ret
Function at 0x423530
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x58a578
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
call fcn.00423a40
test al, al
je 0x423677
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x1c]
test esi, esi
jne 0x4235c7
push 9
push str.Software_
jmp 0x4235ce
push 0x15
push str.SoftwareWow6432Node_
call fcn.00404a80
push 6
push 0x5a9b6c
lea ecx, [esp + 0x24]
call fcn.00404880
cmp dword [esp + 0x30], 8
lea ecx, [esp + 0x18]
push ecx
push 0x20006
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x42363b
push str.Value
push dword [esp + 0x1c]
call edi
push str.Value2
push dword [esp + 0x1c]
call edi
push str.Value3
push dword [esp + 0x1c]
call edi
push 0x5ab3e0
push dword [esp + 0x1c]
call edi
push dword [esp + 0x18]
call ebx
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x423656
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
inc esi
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
cmp esi, 2
jb 0x423583
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00564de8
add esp, 0x30
ret
Function at 0x4237c0
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x58a618
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
push 9
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
lea ecx, [esp + 0xc]
push 0x5a96f4
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
call fcn.00404a80
mov dword [esp + 0x40], 0
lea ecx, [esp + 8]
call fcn.004c9680
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x1c], 8
jb 0x423846
push dword [esp + 8]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x1c], 7
push 0xc
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], eax
push 0x5ab44c
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], eax
mov word [esp + 0x28], ax
call fcn.00404a80
mov dword [esp + 0x40], 1
lea ecx, [esp + 0x20]
call fcn.004c9680
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x34], 8
jb 0x4238b2
push dword [esp + 0x20]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 7
push 8
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], eax
push 0x5ab468
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], eax
mov word [esp + 0x10], ax
call fcn.00404a80
mov dword [esp + 0x40], 2
lea ecx, [esp + 8]
call fcn.004c9680
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x1c], 8
jb 0x42391e
push dword [esp + 8]
call fcn.00564de3
add esp, 4
sub esp, 0x18
mov dword [esp + 0x34], 7
mov ecx, esp
mov dword [esp + 0x1c], esp
xor eax, eax
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
push 9
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], eax
push 0x5a96f4
mov word [ecx], ax
call fcn.00404a80
mov dword [esp + 0x58], 3
mov dword [esp + 0x58], 0xffffffff
call fcn.004236a0
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0xc
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x5ab47c
mov word [ecx], ax
call fcn.00404a80
mov dword [esp + 0x58], 4
mov dword [esp + 0x58], 0xffffffff
call fcn.004236a0
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0xc
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x5ab498
mov word [ecx], ax
call fcn.00404a80
mov dword [esp + 0x58], 5
mov dword [esp + 0x58], 0xffffffff
call fcn.004236a0
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x1c], esp
push 8
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x5ab4b4
mov word [ecx], ax
call fcn.00404a80
mov dword [esp + 0x58], 6
mov dword [esp + 0x58], 0xffffffff
call fcn.004236a0
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
add esp, 0x40
ret
Function at 0x42cb70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0xc], eax
cmp dword [edx + 0x14], 8
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 8], 0
jb 0x42cb98
mov edx, dword [edx]
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42cc17
mov eax, dword [esp + 8]
test eax, eax
je 0x42cc17
push ebx
xor bl, bl
mov dword [esp + 0x14], 4
cmp dword [esi + 0x14], 8
mov dword [esp + 0x10], 4
jb 0x42cbd7
mov esi, dword [esi]
lea ecx, [esp + 0x10]
push ecx
push edi
lea ecx, [esp + 0x1c]
push ecx
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0xc]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00564de8
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.00564de8
add esp, 0x10
ret

Function at 0x42cc30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x214], eax
cmp byte [esp + 0x220], 0
mov eax, 0x20019
push ebp
mov ebp, dword [esp + 0x228]
push esi
mov esi, dword [esp + 0x224]
push edi
mov edi, 0x20119
mov dword [esp + 0xc], 0
cmovne eax, edi
cmp dword [edx + 0x14], 8
jb 0x42cc7a
mov edx, dword [edx]
lea edi, [esp + 0xc]
push edi
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42cd21
mov edi, dword [esp + 0xc]
test edi, edi
je 0x42cd21
push ebx
push 0x206
push eax
mov word [esp + 0x24], ax
xor bl, bl
lea eax, [esp + 0x26]
push eax
call fcn.0056cbb0
add esp, 0xc
mov dword [esp + 0x18], 1
cmp dword [esi + 0x14], 8
mov dword [esp + 0x14], 0x208
jb 0x42ccd1
mov esi, dword [esi]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42ccfc
lea eax, [esp + 0x1c]
mov ecx, ebp
push eax
call fcn.0040bc40
mov bl, 1
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00564de8
add esp, 0x218
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x220]
xor al, al
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00564de8
add esp, 0x218
ret
Function at 0x42dd20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x588b88
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.00404960
mov dword [esp + 0x18], 0
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov al, byte [esi + 0x30]
mov byte [edi + 0x30], al
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x42dfc0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x58b6d6
mov eax, dword fs:[0]
push eax
sub esp, 0x3e8
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x3e0], eax
push ebx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x3f8]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x10]
xor bl, bl
push 0x5ac964
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
test esi, esi
je 0x42e037
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
je 0x42e054
push 0x10
push 0x5ac964
push 0x5ac980
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x42e112
push 0x4cd210
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x3d8
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0056cbb0
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.0042d940
mov dword [esp + 0x400], 0
test edi, edi
mov edx, 0x5a87c4
cmovne edx, edi
sub esp, 0x18
mov esi, esp
mov dword [esp + 0x28], esp
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [edx], ax
jne 0x42e0b6
xor ecx, ecx
jmp 0x42e0cf
mov ecx, edx
lea edi, [ecx + 2]
jmp 0x42e0c0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42e0c0
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00404a80
mov byte [esp + 0x418], 1
mov byte [esp + 0x418], 0
lea ecx, [esp + 0x2c]
call fcn.0042de60
push ecx
call fcn.004c3cc0
mov ecx, eax
call fcn.004c5420
mov dword [esp + 0x400], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0042ddc0
xor eax, eax
mov ecx, dword [esp + 0x3f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3e0]
xor ecx, esp
call fcn.00564de8
mov esp, ebp
pop ebp
ret 0x10
Function at 0x434a90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x434abd
lea ecx, [ecx]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x5ad690]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x434aa0
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x434b30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, edx
mov ebp, ecx
mov ecx, 0x80
push edi
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [ebp]
jne 0x434b5e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x7e1750]
test eax, eax
je 0x434b69
call eax
lea eax, [esi*8]
push eax
call fcn.00430ea0
mov ecx, dword [0x7e1754]
add esp, 4
mov ebx, eax
mov dword [esp + 0x18], ebx
test ecx, ecx
je 0x434b8b
call ecx
test ebx, ebx
je 0x434b54
push dword [ebp + 0xc]
call fcn.00431190
add esp, 4
mov dword [ebp + 0xc], ebx
push ebx
call dword [0x5e3f6c]
shr eax, 3
add esp, 4
mov dword [esp + 0x14], eax
mov dword [ebp], eax
lea ecx, [eax*8]
push ecx
push 0
push ebx
call fcn.0056cbb0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebp + 8], 0
test ecx, ecx
je 0x434c6c
mov esi, dword [ecx + 0x10]
xor edi, edi
mov ebx, dword [ecx + 0xc]
test esi, esi
jle 0x434bff
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
dec esi
movzx edx, byte [eax + 0x5ad690]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test esi, esi
jg 0x434be2
xor edx, edx
mov ebx, dword [ecx]
mov eax, edi
div dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea esi, [eax + edx*8]
test esi, esi
je 0x434c49
mov eax, dword [esi]
test eax, eax
je 0x434c1f
mov edx, dword [esi + 4]
jmp 0x434c21
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x434c49
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x434c41
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x434c62
mov dword [ebp + 8], ecx
mov dword [edx + 4], ecx
jmp 0x434c62
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x434c58
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [ebp + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x434bd6
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x434d90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
cmp dword [ecx + 0xc], 0
mov eax, edx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
je 0x434de5
push ebx
push esi
xor esi, esi
mov ebx, eax
push edi
mov edi, ebp
test ebp, ebp
jle 0x434dd6
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x5ad690]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x434db5
mov ecx, dword [esp + 0x10]
mov eax, esi
xor edx, edx
div dword [ecx]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
jmp 0x434de7
xor edx, edx
push edx
push ebp
mov edx, eax
call fcn.00434c80
add esp, 8
pop ebp
test eax, eax
je 0x434dff
mov eax, dword [eax + 8]
add esp, 8
ret
xor eax, eax
add esp, 8
ret
Function at 0x434e10
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [esp + 0x10], edi
cmp dword [esi], 0
je 0x434e5c
mov eax, dword [esp + 0x18]
mov ebp, edi
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x434e4e
movzx eax, byte [ebp]
lea ecx, [edi*8]
dec ebx
lea ebp, [ebp + 1]
movzx edx, byte [eax + 0x5ad690]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x434e30
mov eax, edi
xor edx, edx
div dword [esi]
mov edi, dword [esp + 0x10]
mov ebp, edx
jmp 0x434e5e
xor ebp, ebp
push ebp
push dword [esp + 0x1c]
mov edx, edi
mov ecx, esi
call fcn.00434c80
add esp, 8
test eax, eax
je 0x434ea1
mov ecx, dword [esp + 0x1c]
mov ebx, dword [eax + 8]
test ecx, ecx
jne 0x434e93
push ebp
mov edx, eax
mov ecx, esi
call fcn.00434d30
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x434f37
push 0x14
call fcn.00430ea0
mov edi, eax
add esp, 4
test edi, edi
je 0x434e99
mov eax, dword [esp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebx
inc dword [esi + 4]
mov edx, dword [esi + 4]
cmp edx, 0xa
jb 0x434f01
mov eax, dword [esi]
add eax, eax
cmp edx, eax
jbe 0x434f01
add edx, edx
mov ecx, esi
call fcn.00434b30
test eax, eax
je 0x434f01
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
call fcn.00434a90
xor edx, edx
div dword [esi]
mov ebp, edx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x434f1e
push edi
lea edx, [eax + ebp*8]
mov ecx, esi
call fcn.00434ad0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x434f2d
mov dword [eax + 4], edi
mov dword [edi + 4], 0
mov dword [esi + 8], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x462510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc8
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0xc4], eax
mov eax, dword [edx + 0xc]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], 0
movdqu xmm0, xmmword [eax]
mov ecx, dword [edx + 0x14]
lea edx, [esp + 0x9c]
movdqu xmmword [esp + 0x9c], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [esp + 0xac], xmm0
movdqu xmm0, xmmword [eax + 0x20]
lea eax, [esp + 0x3c]
mov byte [esp + 0xc], 0x45
mov dword [esp + 0x18], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x48], eax
movdqu xmmword [esp + 0xbc], xmm0
mov byte [esp + 0x3c], 0x50
mov eax, dword [ecx + 8]
mov eax, dword [eax]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x78], eax
mov byte [esp + 0x6c], 0x4e
mov eax, dword [ecx + 8]
mov ecx, esi
mov eax, dword [eax + 0x18]
mov dword [esp + 0x7c], eax
lea eax, [esp + 8]
push eax
call fcn.004620a0
mov cl, byte [esp + 0xa0]
lea edx, [esp + 0x10]
and dword [esp + 0xa4], 0xffffefff
add esp, 4
cmp dword [esp + 0xd8], 0
mov byte [esp + 0xc2], cl
mov ecx, esi
mov byte [esp + 0x9c], 0x84
push dword [esp + 0xdc]
mov dword [esp + 0xbc], eax
push dword [esp + 0xd8]
je 0x46260a
call fcn.00462680
jmp 0x46260f
call fcn.00462950
mov edx, dword [esp + 0x10]
add esp, 8
test edx, edx
je 0x46265a
mov bl, byte [esi + 0x13]
cmp bl, 8
jae 0x46265a
xor ecx, ecx
lea eax, [esi + 0x68]
cmp dword [eax + 0x10], edx
je 0x462656
inc ecx
add eax, 0x18
cmp ecx, 0xa
jl 0x462627
movzx eax, bl
mov dword [esi + eax*4 + 0x1c], edx
inc byte [esi + 0x13]
pop esi
pop ebx
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.00564de8
add esp, 0xc8
ret
mov byte [eax + 8], 1
mov ecx, dword [esp + 0xcc]
pop esi
pop ebx
xor ecx, esp
call fcn.00564de8
add esp, 0xc8
ret
Function at 0x466f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
xor eax, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov ebx, edx
mov dword [esp + 4], eax
push edi
test edx, edx
je 0x466f3d
cmp byte [edx], al
je 0x466f35
lea ecx, [ecx]
inc ebx
cmp byte [ebx], al
jne 0x466f30
sub ebx, edx
and ebx, 0x3fffffff
xor edi, edi
cmp dword [ecx + 0x14], eax
jle 0x466fe8
push ebp
push esi
lea ebx, [ebx]
mov ebp, edi
cmp edi, 2
jge 0x466f5a
xor ebp, 1
mov eax, dword [esp + 0x20]
test eax, eax
je 0x466fb1
mov ecx, dword [ecx + 0x10]
mov edx, ebp
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x466f91
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x5ad690]
cmp cl, byte [edx + 0x5ad690]
jne 0x466f91
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x466f74
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x5ad690]
movzx ecx, byte [ecx + 0x5ad690]
sub eax, ecx
jne 0x466fd0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x10]
add ebp, ebp
push ebx
mov ecx, dword [eax + ebp*8 + 0xc]
add ecx, 8
call fcn.00434d90
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x466fe6
jmp 0x466fd4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc edi
mov edx, dword [esp + 0x18]
cmp edi, dword [ecx + 0x14]
jl 0x466f50
pop esi
pop ebp
pop edi
pop ebx
add esp, 0xc
ret

Function at 0x467100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor ebp, ebp
mov dword [esp + 8], edx
mov ebx, edx
push edi
test edx, edx
je 0x467125
cmp byte [edx], 0
je 0x46711d
inc ebx
cmp byte [ebx], 0
jne 0x467117
sub ebx, edx
and ebx, 0x3fffffff
mov eax, dword [ecx + 0x14]
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x4671dc
mov ecx, dword [ecx + 0x10]
mov dword [esp + 0x18], ecx
push esi
mov edi, edi
mov eax, edi
cmp edi, 2
jge 0x46714a
xor eax, 1
add eax, eax
lea esi, [ecx + eax*8]
mov ecx, dword [esp + 0x24]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x4671ad
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x467191
jmp 0x467170
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x5ad690]
cmp cl, byte [edx + 0x5ad690]
jne 0x46718d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x467170
mov edx, dword [esp + 0x10]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x5ad690]
movzx ecx, byte [ecx + 0x5ad690]
sub eax, ecx
jne 0x4671bf
mov eax, dword [esp + 0x14]
push ebx
lea ecx, [eax + 0x18]
call fcn.00434d90
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4671d2
mov edx, dword [esp + 0x10]
inc edi
mov ecx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x18]
jl 0x467140
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4671f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
add edx, edx
mov ecx, dword [esp + 0x24]
mov esi, ecx
mov dword [esp + 0x14], edi
mov eax, dword [edi + 0x10]
mov ebp, dword [eax + edx*8 + 0xc]
add ebp, 0x18
mov dword [esp + 0x1c], ebp
test ecx, ecx
je 0x46722e
cmp byte [ecx], 0
je 0x467226
lea esp, [esp]
inc esi
cmp byte [esi], 0
jne 0x467220
sub esi, ecx
and esi, 0x3fffffff
mov eax, dword [ebp]
xor ebx, ebx
mov dword [esp + 0x18], eax
test eax, eax
je 0x467276
mov ebp, esi
test esi, esi
jle 0x467268
mov edi, ecx
movzx eax, byte [edi]
lea ecx, [ebx*8]
dec ebp
lea edi, [edi + 1]
movzx edx, byte [eax + 0x5ad690]
xor edx, ecx
xor ebx, edx
test ebp, ebp
jg 0x467243
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
mov eax, ebx
mov ebp, dword [esp + 0x1c]
xor edx, edx
div dword [esp + 0x18]
mov ebx, edx
push ebx
mov edx, ecx
mov ecx, ebp
push esi
call fcn.00434c80
add esp, 8
test eax, eax
je 0x4672e4
mov esi, dword [eax + 8]
mov edx, eax
push ebx
mov ecx, ebp
call fcn.00434d30
add esp, 4
test esi, esi
je 0x4672e4
mov edx, dword [esi + 0xc]
mov ecx, dword [edx + 8]
cmp ecx, esi
jne 0x4672ae
mov eax, dword [esi + 0x14]
mov dword [edx + 8], eax
jmp 0x4672c7
test ecx, ecx
je 0x4672c7
mov eax, dword [ecx + 0x14]
cmp eax, esi
je 0x4672c1
mov ecx, eax
test ecx, ecx
jne 0x4672b2
jmp 0x4672c7
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov edx, dword [esi + 0x24]
mov ecx, edi
call fcn.0045eaf0
mov edx, dword [esi + 0x10]
mov ecx, edi
call fcn.00431230
mov edx, esi
mov ecx, edi
call fcn.00431230
or dword [edi + 0x18], 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret