joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409a50
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push str.Picasa2
push str.ytWindow
call edi
test eax, eax
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x10], eax
jne 0x409a90
lea eax, [esp + 0x10]
push eax
push 0x409790
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409a99
push 0
push 0
push 0x10
push eax
call esi
push str.Picasa_Media_Detector
push str.ytWindow
call edi
test eax, eax
mov dword [esp + 0x10], eax
je 0x409ac3
push 0
push 0
push 0x10
push eax
call esi
mov ecx, dword [esp + 0x10]
push 0
push 0
push 2
push ecx
call esi
push 0x67b9f0
push str.ytWindow
call edi
test eax, eax
mov dword [esp + 0x10], eax
jne 0x409aeb
lea edx, [esp + 0x10]
push edx
push 0x43b330
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x409b01
push 0
push 0
push 0x10
push eax
call esi
mov eax, dword [esp + 0x10]
push 0
push 0
push 2
push eax
call esi
mov esi, str.Picasa2
mov dword [0x6fa030], 0
call fcn.00409990
mov esi, str.Picasa_Media_Detector
call fcn.00409990
mov esi, str.Slingshot
call fcn.00409990
call fcn.004099f0
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x40ed80
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x40ed96
lea esi, [eax + 4]
test esi, esi
jne 0x40ed9a
xor ebp, ebp
jmp 0x40edc6
mov cl, byte [esi]
test cl, cl
mov edx, esi
mov eax, 0x12345678
je 0x40edc4
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 2
movsx ecx, cl
add esi, edi
add esi, ecx
mov cl, byte [edx + 1]
add edx, 1
xor eax, esi
test cl, cl
jne 0x40eda7
mov ebp, eax
mov ebx, dword [esp + 0x18]
add ebx, 0xc
cmp dword [ebx + 0xc], 0
jne 0x40edd8
call fcn.004b40e0
mov eax, dword [ebx + 0x24]
shr eax, 1
jne 0x40ede3
xor esi, esi
jmp 0x40edee
mov edx, dword [ebx + 0x20]
add eax, 0xffffffff
and eax, ebp
lea esi, [edx + eax*8]
cmp dword [ebx + 0xc], 0
jne 0x40edf9
call fcn.004b40e0
mov eax, dword [ebx + 0x1c]
shr eax, 1
jne 0x40ee04
xor eax, eax
jmp 0x40ee0f
mov ecx, dword [ebx + 0x18]
add eax, 0xffffffff
and eax, ebp
lea eax, [ecx + eax*8]
test esi, esi
je 0x40ee1a
mov ecx, dword [esi + 4]
shr ecx, 1
jmp 0x40ee1c
xor ecx, ecx
test eax, eax
je 0x40ee27
mov eax, dword [eax + 4]
shr eax, 1
jmp 0x40ee29
xor eax, eax
add eax, ecx
xor edi, edi
test eax, eax
mov dword [esp + 0x10], eax
jbe 0x40ef4c
lea esp, [esp]
cmp dword [ebx + 0xc], 0
mov esi, edi
jne 0x40ee4d
call fcn.004b40e0
mov eax, dword [ebx + 0x24]
shr eax, 1
je 0x40ee78
mov edx, dword [ebx + 0x20]
add eax, 0xffffffff
and eax, ebp
lea eax, [edx + eax*8]
test eax, eax
je 0x40ee78
mov ecx, dword [eax + 4]
shr ecx, 1
cmp edi, ecx
jae 0x40ee74
mov eax, dword [eax]
movzx esi, word [eax + edi*2]
jmp 0x40eeac
mov esi, edi
sub esi, ecx
cmp dword [ebx + 0xc], 0
jne 0x40ee83
call fcn.004b40e0
mov eax, dword [ebx + 0x1c]
shr eax, 1
je 0x40eea9
mov ecx, dword [ebx + 0x18]
add eax, 0xffffffff
and eax, ebp
lea eax, [ecx + eax*8]
test eax, eax
je 0x40eea9
mov edx, dword [eax + 4]
shr edx, 1
cmp esi, edx
jae 0x40eea9
mov eax, dword [eax]
mov esi, dword [eax + esi*4]
jmp 0x40eeac
or esi, 0xffffffff
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov eax, dword [eax]
test eax, eax
mov edx, dword [ecx + 4]
lea edx, [edx + esi*4]
je 0x40eec5
lea ecx, [eax + 4]
jmp 0x40eec7
xor ecx, ecx
mov eax, dword [edx]
test eax, eax
je 0x40ef20
lea edx, [eax + 4]
test edx, edx
je 0x40ef0e
test ecx, ecx
je 0x40ef0e
test eax, eax
je 0x40eee1
lea edx, [eax + 4]
jmp 0x40eee3
xor edx, edx
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40ef05
test al, al
je 0x40eeff
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40ef05
add ecx, 2
add edx, 2
test al, al
jne 0x40eee3
xor eax, eax
test eax, eax
jmp 0x40ef38
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jmp 0x40ef38
test eax, eax
je 0x40ef20
test dword [eax], 0xffffff00
je 0x40ef20
cmp byte [eax + 4], 0
jne 0x40ef33
test ecx, ecx
je 0x40ef29
cmp byte [ecx], 0
jne 0x40ef3f
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
add eax, 4
cmp eax, ecx
sete al
test al, al
jne 0x40ef29
add edi, 1
cmp edi, dword [esp + 0x10]
jb 0x40ee40
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
Function at 0x422b80
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
movzx eax, byte [esi]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov byte [ebp], al
movzx ecx, byte [esi + 1]
mov byte [ebp + 1], cl
movzx edx, byte [esi + 2]
mov byte [ebp + 2], dl
movzx eax, byte [esi + 3]
mov byte [ebp + 3], al
movzx ecx, byte [esi + 4]
mov byte [ebp + 4], cl
movzx edx, byte [esi + 5]
mov byte [ebp + 5], dl
movzx eax, byte [esi + 6]
mov byte [ebp + 6], al
mov ecx, dword [esi + 8]
mov dword [ebp + 8], ecx
mov edx, dword [esi + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [esi + 0x10]
mov dword [ebp + 0x10], eax
mov ecx, dword [esi + 0x14]
mov dword [ebp + 0x14], ecx
mov edx, dword [esi + 0x18]
mov dword [ebp + 0x18], edx
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
fld dword [esi + 0x1c]
push edi
fstp dword [ebp + 0x1c]
mov eax, dword [esi + 0x20]
mov dword [ebp + 0x20], eax
mov ecx, dword [esi + 0x24]
mov dword [ebp + 0x24], ecx
mov edx, dword [esi + 0x28]
mov dword [ebp + 0x28], edx
mov eax, dword [esi + 0x2c]
mov dword [ebp + 0x2c], eax
mov ecx, dword [esi + 0x30]
mov dword [ebp + 0x30], ecx
mov edx, dword [esi + 0x34]
mov dword [ebp + 0x34], edx
mov eax, dword [esi + 0x38]
mov dword [ebp + 0x38], eax
mov ecx, dword [esi + 0x3c]
mov dword [ebp + 0x3c], ecx
mov edx, dword [ebp + 0x40]
cmp edx, dword [esi + 0x40]
lea edi, [ebp + 0x40]
je 0x422c4c
call fcn.00401700
mov eax, dword [esi + 0x40]
test eax, eax
mov dword [edi], eax
je 0x422c4c
movzx ecx, byte [eax]
cmp ecx, 0x80
jae 0x422c45
push eax
call ebx
and eax, 0xff
cmp eax, 0xff
jne 0x422c4c
mov eax, edi
call fcn.00459380
mov edx, dword [ebp + 0x44]
cmp edx, dword [esi + 0x44]
lea edi, [ebp + 0x44]
je 0x422c86
call fcn.00401700
mov eax, dword [esi + 0x44]
test eax, eax
mov dword [edi], eax
je 0x422c86
movzx ecx, byte [eax]
cmp ecx, 0x80
jae 0x422c7f
push eax
call ebx
and eax, 0xff
cmp eax, 0xff
jne 0x422c86
mov eax, edi
call fcn.00459380
mov edx, dword [ebp + 0x48]
cmp edx, dword [esi + 0x48]
lea edi, [ebp + 0x48]
je 0x422cc0
call fcn.00401700
mov eax, dword [esi + 0x48]
test eax, eax
mov dword [edi], eax
je 0x422cc0
movzx ecx, byte [eax]
cmp ecx, 0x80
jae 0x422cb9
push eax
call ebx
and eax, 0xff
cmp eax, 0xff
jne 0x422cc0
mov eax, edi
call fcn.00459380
mov edx, dword [ebp + 0x4c]
cmp edx, dword [esi + 0x4c]
lea edi, [ebp + 0x4c]
je 0x422cfa
call fcn.00401700
mov eax, dword [esi + 0x4c]
test eax, eax
mov dword [edi], eax
je 0x422cfa
movzx ecx, byte [eax]
cmp ecx, 0x80
jae 0x422cf3
push eax
call ebx
and eax, 0xff
cmp eax, 0xff
jne 0x422cfa
mov eax, edi
call fcn.00459380
mov edx, dword [ebp + 0x50]
cmp edx, dword [esi + 0x50]
lea edi, [ebp + 0x50]
je 0x422d34
call fcn.00401700
mov eax, dword [esi + 0x50]
test eax, eax
mov dword [edi], eax
je 0x422d34
movzx ecx, byte [eax]
cmp ecx, 0x80
jae 0x422d2d
push eax
call ebx
and eax, 0xff
cmp eax, 0xff
jne 0x422d34
mov eax, edi
call fcn.00459380
lea eax, [esi + 0x54]
lea ebx, [ebp + 0x54]
call fcn.00479500
pop edi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x4394a0
Capabilities:
Check mutex on windows

Disassembly:
push str.Slingshot
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x6fa044], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4394c9
cmp eax, 5
je 0x4394c9
xor eax, eax
ret
or eax, 0xffffffff
ret

Function at 0x43b1b0
Capabilities:
Inspect load icon resource

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
call fcn.0046be20
mov edi, 0x7c
call fcn.00457990
mov esi, eax
test esi, esi
je 0x43b224
mov eax, 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, 0x67b9f0
mov ecx, str.slingshot::window_name
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call fcn.0046ed20
mov eax, dword [eax]
test eax, eax
je 0x43b202
add eax, 4
jmp 0x43b204
xor eax, eax
mov bl, byte [esp + 0x2c]
neg bl
push 0
sbb bl, bl
push 0
push eax
push esi
mov al, 1
lea ecx, [esp + 0x20]
and ebx, 2
call fcn.004b7fc0
mov ebx, eax
jmp 0x43b226
xor ebx, ebx
mov ecx, ebx
call fcn.004b80c0
cmp byte [ebx + 0x29], 1
mov esi, eax
je 0x43b23c
add dword [0x6fa07c], 1
mov eax, dword [0x6f521c]
test eax, eax
mov byte [ebx + 0x29], 1
jne 0x43b24e
mov eax, dword [0x6fa0bc]
push 0x66
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, ebx
call fcn.0045eb90
mov eax, dword [ebx + 0x5c]
mov ecx, dword [esi + 0x5c]
push 0x47537331
push 0
push eax
mov dword [0x6fa0cc], eax
mov dword [0x6fa0c8], ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edi, dword [0x6fa0bc]
push 0
mov eax, 0x32
call fcn.0045ef20
push eax
mov eax, 0x31
call fcn.0045ef20
push eax
push 1
push 0x66
push edi
call dword [sym.imp.USER32.dll_LoadImageA]
mov ecx, ebx
call fcn.0045eb90
mov edi, 0x1e18
call fcn.00457990
test eax, eax
je 0x43b2c6
push ebx
push eax
call fcn.00430f90
mov edi, eax
jmp 0x43b2c8
xor edi, edi
push 0
call fcn.0045e700
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push edx
push eax
push edi
call fcn.00435860
mov esi, eax
mov eax, ebx
call fcn.0045e750
test esi, esi
jne 0x43b309
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push 1
mov ecx, ebx
call eax
push esi
call fcn.0046cba0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x18
ret
mov edx, dword [edi]
mov eax, dword [edx + 0x84]
mov ecx, edi
call eax
mov ecx, dword [ebx + 0x5c]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x43b3c0
Capabilities:
Enumerate gui resources

Disassembly:
push ecx
mov eax, 0x67b9f0
mov ecx, str.slingshot::window_name
call fcn.0046ed20
mov eax, dword [eax]
test eax, eax
je 0x43b3db
add eax, 4
jmp 0x43b3dd
xor eax, eax
push eax
push str.ytWindow
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
mov dword [esp], eax
jne 0x43b402
lea eax, [esp]
push eax
push 0x43b330
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp]
pop ecx
ret
Function at 0x43f200
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x43f207
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp 0x43f210
push esi
mov esi, edx
test esi, esi
not eax
je 0x43f242
lea esp, [esp]
test cl, 3
je 0x43f242
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x6a3e48]
add ecx, 1
sub esi, 1
jne 0x43f220
cmp esi, 0x20
push ebx
push edi
jb 0x43f42c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x6a4248]
xor edx, dword [ebx*4 + 0x6a4648]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x6a3e48]
add ecx, 4
xor edx, dword [eax*4 + 0x6a4a48]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x6a4248]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x6a4648]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x6a3e48]
add ecx, 4
xor eax, dword [edx*4 + 0x6a4a48]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x6a4248]
xor edx, dword [ebx*4 + 0x6a4648]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x6a3e48]
xor edx, dword [eax*4 + 0x6a4a48]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x6a4248]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x6a4648]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x6a3e48]
xor eax, dword [edx*4 + 0x6a4a48]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x6a4248]
xor edx, dword [ebx*4 + 0x6a4648]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x6a3e48]
xor edx, dword [eax*4 + 0x6a4a48]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x6a4248]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x6a4648]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x6a3e48]
and edx, 0xff
xor eax, dword [edx*4 + 0x6a4a48]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x6a4248]
xor edx, dword [ebx*4 + 0x6a4648]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x6a3e48]
add ecx, 4
xor edx, dword [eax*4 + 0x6a4a48]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x6a4248]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x6a4648]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x6a3e48]
and edx, 0xff
xor eax, dword [edx*4 + 0x6a4a48]
sub edi, 1
jne 0x43f252
cmp esi, 4
jb 0x43f479
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x6a4248]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x6a4648]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x6a3e48]
and eax, 0xff
xor edi, dword [eax*4 + 0x6a4a48]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x43f436
test esi, esi
pop edi
pop ebx
je 0x43f49d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x6a3e48]
add ecx, 1
sub esi, 1
jne 0x43f480
not eax
pop esi
ret
Function at 0x44c650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
sub esp, 0x20
push ebp
mov ebp, dword [esp + 0x30]
mov ax, word [ebp + 0x1fe]
push esi
mov esi, dword [edx + 8]
mov word [ebp + 0x200], ax
mov eax, dword [ecx + 8]
cmp eax, esi
push edi
jbe 0x44c680
mov dword [esp + 0xc], esi
jmp 0x44c686
mov dword [esp + 0xc], eax
mov esi, eax
mov eax, dword [edx + 0xc]
mov edi, dword [ecx + 0xc]
cmp edi, eax
mov dword [esp + 0x10], eax
ja 0x44c698
mov dword [esp + 0x10], edi
xor eax, eax
cmp dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
jbe 0x44c838
push ebx
lea esp, [esp]
mov edi, dword [edx + 4]
mov ebx, dword [edx + 0x10]
imul edi, eax
lea edi, [ebx + edi*4]
mov ebx, dword [ecx + 0x10]
mov dword [esp + 0x20], edi
mov edi, dword [ecx + 4]
imul edi, eax
test esi, esi
lea ebx, [ebx + edi*4]
mov dword [esp + 0x3c], esi
je 0x44c826
jmp 0x44c6e0
movzx ecx, byte [ebx + 2]
movzx esi, word [ebp + ecx*2]
movzx eax, byte [ebx]
movzx ecx, word [ebp + eax*2]
movzx edx, byte [ebx + 1]
movzx edi, word [ebp + edx*2]
mov eax, dword [0x6fa390]
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x6fa394]
add eax, eax
mov edx, dword [eax + eax + 0x6fa780]
add eax, eax
add ecx, ecx
mov dword [0x6fa390], edx
mov edx, dword [ecx + ecx + 0x6fa780]
add ecx, ecx
mov dword [0x6fa394], edx
mov ecx, dword [ecx + 0x6fa398]
xor dword [eax + 0x6fa398], ecx
movzx edx, byte [eax + 0x6fa398]
movzx eax, byte [ebx + 2]
movzx ecx, word [ebp + eax*2 + 2]
movzx eax, byte [ebx + 1]
sub ecx, esi
mov dword [esp + 0x28], esi
movzx esi, word [ebp + eax*2 + 2]
movzx eax, byte [ebx]
sub esi, edi
mov dword [esp + 0x2c], edi
movzx edi, word [ebp + eax*2 + 2]
sub edi, dword [esp + 0x1c]
mov eax, ecx
imul eax, edx
sub dword [esp + 0x3c], 1
sar ecx, 1
mov dword [esp + 0x18], edx
shr eax, 8
sub eax, ecx
add eax, dword [esp + 0x28]
mov edx, esi
imul edx, dword [esp + 0x18]
mov ecx, edi
imul ecx, dword [esp + 0x18]
shr edx, 8
shr ecx, 8
sar esi, 1
sar edi, 1
sub edx, esi
add edx, dword [esp + 0x2c]
sub ecx, edi
add ecx, dword [esp + 0x1c]
sar eax, 8
sar edx, 8
sar ecx, 8
test eax, eax
jge 0x44c7b6
xor eax, eax
jmp 0x44c7c2
cmp eax, 0xff
jle 0x44c7c2
mov eax, 0xff
test edx, edx
jge 0x44c7ca
xor edx, edx
jmp 0x44c7d7
cmp edx, 0xff
jle 0x44c7d7
mov edx, 0xff
test ecx, ecx
jge 0x44c7df
xor ecx, ecx
jmp 0x44c7ec
cmp ecx, 0xff
jle 0x44c7ec
mov ecx, 0xff
or eax, 0xffffff00
shl eax, 8
or eax, edx
shl eax, 8
or eax, ecx
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
add ecx, 4
add ebx, 4
cmp dword [esp + 0x3c], 0
mov dword [esp + 0x20], ecx
jne 0x44c6e0
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
add eax, 1
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
jb 0x44c6b0
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20
ret
Function at 0x44c840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x1c
push ebp
mov ebp, dword [esp + 0x28]
mov ax, word [ebp + 0x1fe]
mov word [ebp + 0x200], ax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 8]
push esi
mov esi, dword [eax + 0xc]
xor edx, edx
test esi, esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], edx
jbe 0x44c9ec
push ebx
push edi
lea esp, [esp]
mov edi, dword [eax + 4]
mov ebx, dword [eax + 0x10]
imul edi, edx
test ecx, ecx
lea ebx, [ebx + edi*4]
mov dword [esp + 0x34], ecx
je 0x44c9db
jmp 0x44c8a0
movzx ecx, byte [ebx + 2]
movzx esi, word [ebp + ecx*2]
movzx eax, byte [ebx]
movzx ecx, word [ebp + eax*2]
movzx edx, byte [ebx + 1]
movzx edi, word [ebp + edx*2]
mov eax, dword [0x6fa390]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x6fa394]
add eax, eax
mov edx, dword [eax + eax + 0x6fa780]
add eax, eax
add ecx, ecx
mov dword [0x6fa390], edx
mov edx, dword [ecx + ecx + 0x6fa780]
add ecx, ecx
mov dword [0x6fa394], edx
mov ecx, dword [ecx + 0x6fa398]
xor dword [eax + 0x6fa398], ecx
movzx edx, byte [eax + 0x6fa398]
movzx eax, byte [ebx + 2]
movzx ecx, word [ebp + eax*2 + 2]
movzx eax, byte [ebx + 1]
sub ecx, esi
mov dword [esp + 0x1c], esi
movzx esi, word [ebp + eax*2 + 2]
movzx eax, byte [ebx]
sub esi, edi
mov dword [esp + 0x20], edi
movzx edi, word [ebp + eax*2 + 2]
sub edi, dword [esp + 0x14]
mov eax, ecx
imul eax, edx
sub dword [esp + 0x34], 1
sar ecx, 1
mov dword [esp + 0x10], edx
shr eax, 8
sub eax, ecx
add eax, dword [esp + 0x1c]
mov edx, esi
imul edx, dword [esp + 0x10]
mov ecx, edi
imul ecx, dword [esp + 0x10]
shr edx, 8
shr ecx, 8
sar esi, 1
sar edi, 1
sub edx, esi
add edx, dword [esp + 0x20]
sub ecx, edi
add ecx, dword [esp + 0x14]
sar eax, 8
sar edx, 8
sar ecx, 8
test eax, eax
jge 0x44c976
xor eax, eax
jmp 0x44c982
cmp eax, 0xff
jle 0x44c982
mov eax, 0xff
test edx, edx
jge 0x44c98a
xor edx, edx
jmp 0x44c997
cmp edx, 0xff
jle 0x44c997
mov edx, 0xff
test ecx, ecx
jge 0x44c99f
xor ecx, ecx
jmp 0x44c9ac
cmp ecx, 0xff
jle 0x44c9ac
mov ecx, 0xff
or eax, 0xffffff00
shl eax, 8
or eax, edx
shl eax, 8
or eax, ecx
mov dword [ebx], eax
add ebx, 4
cmp dword [esp + 0x34], 0
jne 0x44c8a0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x28]
add edx, 1
cmp edx, esi
mov dword [esp + 0x18], edx
jb 0x44c880
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x4513b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
xor ebx, ebx
mov dword [esi], vtable.FilterDesc.0
mov dword [esi + 4], ebx
mov dword [esi + 8], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea eax, [esi + 0x18]
mov byte [esi + 0x14], bl
mov byte [esi + 0x15], bl
mov byte [esi + 0x16], bl
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
push ebp
mov byte [esi + 0x28], bl
mov byte [esi + 0x70], bl
mov byte [esi + 0x71], bl
mov dword [esi + 0x74], ebx
mov byte [esi + 0x7c], bl
mov byte [esi + 0xac], bl
mov byte [esi + 0xad], bl
mov byte [esi + 0xae], bl
mov ebp, eax
mov dword [esp + 8], 4
push edi
mov edi, edi
mov edi, dword [ebp]
cmp edi, ebx
je 0x451463
movzx eax, byte [edi]
cmp eax, 0x80
jae 0x451460
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x7f
jne 0x451450
movzx ecx, byte [edi]
cmp ecx, 0x80
jae 0x45144b
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
jmp 0x451450
mov eax, 0xff
cmp eax, ebx
jne 0x451460
mov edx, dword [ebp]
push edx
call fcn.0045da90
add esp, 4
mov dword [ebp], ebx
mov dword [ebp], ebx
add ebp, 4
sub dword [esp + 0xc], 1
jne 0x451410
fldz
xor ecx, ecx
lea eax, [esi + 0x3c]
pop edi
fst dword [eax - 0x10]
add ecx, 1
fst dword [eax]
add eax, 4
cmp ecx, 4
fst dword [eax + 0xc]
fst dword [eax + 0x1c]
mov byte [esi + ecx + 0x6b], bl
jb 0x451478
fst dword [esi + 0x80]
pop ebp
fst dword [esi + 0x84]
mov eax, esi
fst dword [esi + 0x88]
fst dword [esi + 0x8c]
fst dword [esi + 0x90]
fstp dword [esi + 0x94]
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0x78], 0xffffffff
pop ebx
pop ecx
ret
Function at 0x453ef0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
sub esp, 0x60
push ebx
push ebp
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x453f09
add eax, 4
jmp 0x453f0b
xor eax, eax
push 0x2000
push 0x67b484
lea esi, [esp + 0x28]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x31], bl
mov byte [esp + 0x30], bl
mov dword [esp + 0x38], ebx
call fcn.004865f0
mov esi, dword [esp + 0x24]
cmp esi, ebx
mov dword [esp + 0x2c], eax
jne 0x453f71
mov edi, eax
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x453f5c
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
jne 0x453f65
lea esi, [esp + 0x20]
call fcn.00457970
lea ebx, [esp + 0x20]
call fcn.00486bd0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 4
push esi
call fcn.00609413
add esp, 4
push 2
push ebx
push esi
mov ebp, eax
call fcn.006081d8
add esp, 0xc
push esi
call fcn.00609413
add esp, 4
push ebx
push ebp
push esi
mov edi, eax
call fcn.006081d8
add esp, 0xc
lea eax, [esp + 0x18]
call fcn.00487150
mov edi, dword [esp + 0x1c]
cmp edi, ebx
je 0x453fc4
mov ebp, dword [esp + 0x18]
push esi
push ebp
push 1
push edi
call fcn.0060860a
add esp, 0x10
cmp eax, ebp
je 0x454001
lea esi, [esp + 0x18]
call fcn.00487190
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x453fe9
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
jne 0x453ff2
lea esi, [esp + 0x20]
call fcn.00457970
lea ebx, [esp + 0x20]
call fcn.00486bd0
mov eax, 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 4
mov ecx, dword [esp + 0x74]
add ecx, 0x1454
push ecx
lea edx, [esp + 0x18]
push edx
lea esi, [esp + 0x3c]
mov dword [esp + 0x1c], ebx
call fcn.00451c90
push ebp
push edi
call fcn.004ca720
lea edi, [esp + 0x5c]
mov ebp, eax
mov dword [esp + 0x34], vtable.CImageFilterRegistrar.0
call fcn.00401700
mov ecx, esi
mov dword [esp + 0x5c], ebx
call fcn.004ca6a0
lea edi, [esp + 0x14]
call fcn.00401700
lea esi, [esp + 0x18]
call fcn.00487190
cmp ebp, ebx
mov eax, dword [esp + 0x20]
je 0x45408a
cmp eax, ebx
je 0x454075
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
jne 0x45407e
lea esi, [esp + 0x20]
call fcn.00457970
lea ebx, [esp + 0x20]
call fcn.00486bd0
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 4
cmp eax, ebx
je 0x4540a2
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
jne 0x4540ab
lea esi, [esp + 0x20]
call fcn.00457970
lea ebx, [esp + 0x20]
call fcn.00486bd0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x60
ret 4