joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414800
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x6101c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [ebx + 4], 0x100
jne 0x41493c
cmp dword [ebx + 8], 0xd
jne 0x41493c
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push eax
call fcn.00582f70
add esp, 0xc
lea eax, [ebp - 0x204]
push 0x100
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClassNameW]
lea ecx, [ebp - 0x204]
mov eax, str.MacromediaFlashPlayerActiveX
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x414896
test dx, dx
je 0x414892
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x414896
add eax, 4
add ecx, 4
test dx, dx
jne 0x414870
xor eax, eax
jmp 0x41489b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4148df
mov ecx, 0x5e4538
lea eax, [ebp - 0x204]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4148d6
test dx, dx
je 0x4148d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4148d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4148b0
xor eax, eax
jmp 0x4148db
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41493c
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x1c0001
push 0xd
push 0x100
push dword [ebx]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call esi
push 0x11c0001
push 0xd
push 0x102
push dword [ebx]
call edi
push 0xa
call esi
push 0x1c0001
push 0xd
push 0x101
push dword [ebx]
call edi
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057f187
mov esp, ebp
pop ebp
ret 4
push ebx
mov ecx, esi
call fcn.004671da
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0057f187
mov esp, ebp
pop ebp
ret 4
Function at 0x419d90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b263
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6101c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00457680
mov dword [ebp - 4], 0
mov dword [esi], vtable.CTCMemDC.0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], vtable.CBitmap.0
mov edi, dword [ebp + 8]
lea ebx, [esi + 0x20]
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], 0
cmp dword [edi + 0xc], eax
sete al
mov dword [esi + 0x30], eax
test eax, eax
je 0x419e8d
mov eax, dword [edi]
mov ecx, edi
push ebx
call dword [eax + 0x50]
push dword [edi + 4]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, esi
call fcn.00457ea7
mov ecx, dword [ebx + 0xc]
sub ecx, dword [ebx + 4]
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
push ecx
push eax
push dword [edi + 4]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esi + 0x10]
call fcn.00457edd
lea eax, [esi + 0x10]
test eax, eax
je 0x419e5d
mov eax, dword [eax + 4]
push eax
push dword [esi + 4]
call fcn.00458541
push dword [esi + 0x24]
mov dword [esi + 0x18], eax
mov ecx, esi
push dword [ebx]
lea eax, [ebp - 0x18]
push eax
call fcn.004588cd
push dword [edi + 8]
call dword [sym.imp.GDI32.dll_GetBkColor]
push eax
push ebx
mov ecx, esi
call fcn.0046c1e6
jmp 0x419e9f
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41a570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x6101c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 3
push eax
mov dword [ebp - 0x218], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41a5e1
cmp dword [ebp - 0x208], 1
jne 0x41a5ba
cmp dword [ebp - 0x210], 0
je 0x41a5e1
push 0
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x68
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057f187
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x220]
push eax
push 1
push 0
push str.Control_PanelDesktop
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a65a
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x100
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x228]
push eax
push 0
push str.WheelScrollLines
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a64e
push 0xa
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.005805c9
add esp, 0xc
mov dword [ebp - 0x21c], eax
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
xor ecx, ebp
call fcn.0057f187
mov esp, ebp
pop ebp
ret
Function at 0x433350
Capabilities:
Log keystrokes via application hook

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x88]
cmp eax, 1
jne 0x433386
cmp dword [0x61e678], 0
jne 0x4333ad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x433220
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x61e678], eax
jmp 0x4333ad
cmp eax, 2
jne 0x433406
cmp dword [0x61e67c], 0
jne 0x4333ad
push 0
push 0
push 0
push 0
push 0
push 0x433410
call fcn.0046ff28
mov dword [0x61e67c], eax
mov ecx, dword [0x61e8e8]
xor eax, eax
push edi
test ecx, ecx
jle 0x4333d4
mov edi, dword [0x61e8e4]
test eax, eax
js 0x43340a
cmp eax, ecx
jge 0x43340a
mov edx, dword [edi + eax*4]
cmp edx, esi
je 0x4333e5
inc eax
cmp eax, ecx
jl 0x4333c0
push esi
push ecx
mov ecx, 0x61e8e0
call fcn.0046fcf3
pop edi
mov al, 1
pop esi
ret
movzx eax, word [esi + 0x84]
mov word [edx + 0x84], ax
movzx eax, word [esi + 0x82]
pop edi
mov word [edx + 0x82], ax
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
call fcn.00454bf1
int3

Function at 0x43b900
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59d1a1
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x6101c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00456c6f
push dword [edi + 0x120e8]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push pe_nt_image_headers32
push dword [edi + 0x20]
call esi
push dword [edi + 0x120e8]
push 0
push pe_nt_image_headers32
push dword [edi + 0x20]
call esi
push 0
push 0
push 0
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push reloc.WS2_32.dll_closesocket
push 0
push str.tooltips_class32
push 8
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x5b6604
mov dword [0x61e8a8], eax
call fcn.0047cbe2
mov dword [0x61e8ac], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 7
push str.debuger
push eax
call fcn.0058022c
add esp, 0xc
test eax, eax
jne 0x43b9c7
mov byte [edi + 0x120e4], 1
jmp 0x43b9ce
mov byte [edi + 0x120e4], 0
push 0x5e8cb8
jmp 0x6b80a2
Function at 0x43c250
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59d22b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x6101c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [0x61e888], 0
je 0x43c296
lea eax, [esi + 0x120f8]
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov eax, dword [esi + 0x120d0]
sub eax, 0x10
push eax
call fcn.0040dfb0
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x21c], esi
mov dword [ebp - 4], 0
cmp dword [esi - 0xc], 0
je 0x43c2ca
push 0
push esi
call dword [0x61e898]
add esp, 8
add esi, 0xfffffff0
or ecx, 0xffffffff
mov dword [ebp - 4], ecx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43c2e7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call dword [0x61e89c]
push dword [0x61e88c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00582f70
mov eax, dword [0x61e8f4]
lea edx, [ebp - 0x218]
add esp, 0xc
sub edx, eax
lea ebx, [ebx]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x43c330
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43c350
sub ecx, edx
sar ecx, 1
je 0x43c3a4
lea eax, [ebp - 0x218]
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x234], eax
mov eax, 0x614
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x23c]
push eax
mov dword [ebp - 0x238], 3
mov dword [ebp - 0x230], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057f187
mov esp, ebp
pop ebp
ret
Function at 0x44da50
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_Explorer_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], 0x270f
call edi
test eax, eax
je 0x44da89
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push 0x50
call fcn.00454311
add esp, 4
mov dword [ebp - 0x18], 1
mov ebx, eax
mov dword [ebp - 0x14], 0x50
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push 0
push str.Version
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x44dac9
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
mov al, byte [ebx]
cmp al, 8
jbe 0x44dae4
mov dword [ebp - 0xc], 0x2710
jmp 0x44daf1
jne 0x44db9d
mov dword [ebp - 0xc], 0x1f40
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
push SysReAllocString
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x44db74
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x44db74
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
push SysReAllocString
call edi
test eax, eax
jne 0x44db74
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.FEATURE_BROWSER_EMULATION
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x44dbb2
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push dword [ebp - 0x1c]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
jne 0x44dba6
call esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x44db9d
push eax
call esi
pop esi
pop ebx
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
call esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x44dbb2
push eax
call esi
pop esi
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x456552
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00467747
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x456589
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004565aa
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45aceb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x45ad30
call fcn.00467747
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x45ad30
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x45ad4c
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00482ae9
mov ebx, eax
test edi, edi
je 0x45ad4a
test esi, esi
je 0x45ad4a
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4a26c6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00455014
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4a2702
call fcn.004a28e5
mov dword [esi + 0xc], 1
jmp 0x4a2707
call fcn.004a28e5
cmp dword [esi], 0
je 0x4a2750
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x4a272a
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0042f450
jmp 0x4a273b
push 0xff
mov ecx, esi
call fcn.0040de50
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0042fa60
jmp 0x4a2774
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x4a2774
push dword [esi]
push dword [ebp - 4]
call fcn.0048317d
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4a283a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.004a28e5
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4a2882
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0042f450
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0042fa60
jmp 0x4a288d
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0048317d
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x512de6
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00568a5a
call fcn.0046779b
cmp dword [eax + 0x14], 0
jne 0x512e01
mov ecx, esi
pop esi
jmp fcn.005121ec
pop esi
ret

Function at 0x56826f
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00401c40
call fcn.0046779b
cmp dword [eax + 0x14], 0
jne 0x56828a
mov ecx, esi
pop esi
jmp fcn.00567b58
pop esi
ret
Function at 0x594180
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6101c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00587e93
mov dword [ebp - 0x14], eax
cmp dword [0x61c544], esi
jne 0x594273
push 0x800
push esi
push 0x5e0160
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x594200
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x594353
push esi
push esi
push 0x5e0160
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x594353
push 0x5e0178
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x594353
push eax
call ebx
push 0x5e0184
push edi
mov dword [0x61c544], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x5e0194
push edi
mov dword [0x61c548], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x61c54c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x61c554], eax
test eax, eax
je 0x594270
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x61c550], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x594298
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x59428b
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x5942ad
push 4
pop eax
jmp 0x594355
cmp dword [ebp - 0x14], esi
je 0x5942ad
push dword [0x61c544]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x594292
mov eax, dword [0x61c550]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x59430b
cmp dword [0x61c554], edi
je 0x59430b
push eax
call ebx
push dword [0x61c554]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x59430b
test eax, eax
je 0x59430b
call ecx
test eax, eax
je 0x594300
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x594300
test byte [ebp - 8], 1
jne 0x59430b
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x59433b
mov eax, dword [0x61c548]
cmp eax, edi
je 0x594338
push eax
call ebx
test eax, eax
je 0x594338
call eax
mov esi, eax
test esi, esi
je 0x594338
mov eax, dword [0x61c54c]
cmp eax, edi
je 0x594338
push eax
call ebx
test eax, eax
je 0x594338
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x61c544]
call ebx
test eax, eax
je 0x594353
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x594355
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057f187
mov esp, ebp
pop ebp
ret
Function at 0x404c8d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x404c9c
pop dword [ebp - 0x24]
mov eax, 0x446318c0
add eax, 0xbbdd33dc
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x4db4d
push 0
mov eax, 0x5c596644
sub eax, 0x5c12fe6c
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x1e85b143
sub ecx, 0x1e856910
mov edx, eax
mov ebx, 0x300f8e9c
add ebx, 0xd0395164
add ebx, dword [ebp - 0x24]
mov edi, 0x1081be98
sub edi, 0x5acaa1e0
add dword [ebp - 0x1c], 0x2ad5369a
mov esi, dword [ebx]
xor dword [ebp - 0x20], 0x214ba1dc
xor esi, edi
sub dword [ebp - 4], ebx
mov dword [edx], esi
xor dword [ebp - 4], ecx
add edx, 0x544eef1
sub edx, 0x544eeed
add ebx, 0x20565365
sub ebx, 0x20565361
loop 0x404cfb
add eax, 0xbac3ab1b
add eax, 0x453d6884
mov ebx, eax
add eax, 0x21f17a30
sub eax, 0x21f17a2b
mov ecx, 0x96188021
add ecx, 0x6a277fdf
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x4230b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [esp + 0xc], edi
mov byte [esp + 8], 0
mov eax, dword [esi + edi*4 + 0xe8]
test eax, eax
jne 0x423255
xor ecx, ecx
call fcn.00422610
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
push 0
push ecx
mov ecx, dword [esp + 0x78]
mov dword [esi + edi*4 + 0xe8], eax
mov edi, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x74]
push ecx
push edi
mov ecx, eax
call fcn.00421340
cmp edi, 1
jne 0x42323d
mov ecx, esi
call fcn.004228f0
cmp al, 1
jne 0x423236
cmp dword [esi + 0x18], 2
jne 0x423130
push 3
mov edx, 0x46e248
mov ecx, esi
call fcn.004226a0
push 0
jmp 0x423148
push 7
mov edx, 0x46e248
mov ecx, esi
call fcn.004226a0
mov eax, dword [esi + 0x120]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [esi + 0x11c]
mov ecx, dword [esi + 0x118]
mov eax, dword [edx + 4]
mov edx, dword [ecx + 4]
push eax
push edx
lea edx, [esp + 0x1c]
mov ecx, esi
call fcn.00422a40
mov ecx, dword [0x47b280]
lea edx, [esp + 0x10]
push ebx
push ebp
call fcn.00418cc0
mov eax, dword [esi + 0x118]
xor edi, edi
lea ebp, [esi + 0xe8]
mov ebx, dword [eax + 4]
mov ecx, dword [ebp]
test ecx, ecx
je 0x42319d
cmp edi, dword [esp + 0x14]
je 0x42319d
mov edx, ebx
call fcn.00421680
inc edi
add ebp, 4
cmp edi, 0xb
jl 0x423189
cmp dword [esi + 0x18], 2
je 0x4231c9
mov ecx, dword [esi + 0x120]
push 0
push 0
push 0
mov edx, dword [ecx + 4]
mov ecx, dword [esi + 0x118]
push 0
push edx
call fcn.00442430
mov ecx, esi
call fcn.00422930
mov eax, dword [esi + 0x11c]
lea edi, [esi + 0xe8]
mov ebp, 0xb
mov ebx, dword [eax + 4]
mov ecx, dword [edi]
test ecx, ecx
je 0x4231f1
mov edx, ebx
call fcn.00421680
add edi, 4
dec ebp
jne 0x4231e4
mov edx, dword [0x46e238]
lea ecx, [esi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [0x46e23c]
mov dword [ecx + 4], eax
mov edx, dword [0x46e240]
mov dword [ecx + 8], edx
mov eax, dword [0x46e244]
mov byte [esi + 0x15], 1
mov dword [ecx + 0xc], eax
mov edi, dword [0x47b280]
call dword [0x462168]
mov dword [edi + 0x1a8], eax
pop ebp
pop ebx
jmp 0x423244
mov ecx, esi
call fcn.00422930
mov byte [esi + 0xcc], 0
push 0x46e238
mov ecx, esi
call fcn.00411de0
mov byte [esp + 8], 1
mov eax, dword [esp + 8]
pop edi
and eax, 0xff
pop esi
add esp, 0x5c
ret 0x14