joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443640
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x443678]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x443659
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x443668
or bl, 4
test esi, 0x20000000
je 0x443673
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x449d20
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x449d32
add esp, 0xfffffff0
call fcn.00403538
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419c00
mov eax, dword [0x44fdf4]
mov dword [eax + 4], ebx
mov dword [eax], 0x44a0c4
mov eax, dword [0x44fe00]
mov dword [eax + 4], ebx
mov dword [eax], 0x44a0d0
mov eax, ebx
call fcn.0044a0dc
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411ef8]
call fcn.004031fc
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411ef8]
call fcn.004031fc
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411ef8]
call fcn.004031fc
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411ef8]
call fcn.004031fc
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411ef8]
call fcn.004031fc
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4464f8
push eax
push 0
push 0
mov eax, dword [0x44ff44]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41b624]
call fcn.0041ca68
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41b624]
call fcn.0041ca68
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41b624]
call fcn.0041ca68
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044a4fc
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44a3d8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44a3d8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44a3d8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x449e6f
call fcn.00403590
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44a1bc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44a367
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44a348
mov dl, 1
mov eax, dword [0x412314]
call fcn.004031fc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403f64
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44a337
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004381f0
test al, al
je 0x44a32a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44a378
lea eax, [ebp - 0x254]
call fcn.00408938
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44a32a
xor eax, eax
push ebp
push 0x44a323
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44a3b0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44a30c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004041d4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44a30c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004041d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a32a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44a22d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415df0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a36e
lea eax, [ebp - 0x260]
call fcn.00403f64
ret

Function at 0x44ac9c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x451bb0]
cmp byte [eax + 0xa5], 0
jne 0x44ad0d
cmp dword [0x451bc8], 0
jne 0x44acce
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44ac58
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x451bc8], eax
cmp dword [0x451bc4], 0
jne 0x44ace9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x451bc4], eax
cmp dword [0x451bcc], 0
jne 0x44ad0d
push esp
push 0
push 0
push 0x44abfc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x451bcc], eax
pop edx
ret
Function at 0x44ae04
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44ae1b
add esp, 0xfffffff0
call fcn.00403538
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419c00
mov eax, dword [0x44ff30]
cmp word [eax + 2], 0
jne 0x44ae43
mov eax, dword [0x44ff30]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044c4dc
mov eax, dword [0x44ffdc]
cmp word [eax + 2], 0
jne 0x44ae5d
mov eax, dword [0x44ffdc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044c6d4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411ef8]
call fcn.004031fc
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411ef8]
call fcn.004031fc
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41bdd4]
call fcn.00421a1c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44afe4
mov eax, dword [0x44fe54]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00421dec
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44cc84
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x44fe54]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040bf74
test eax, eax
je 0x44af52
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040832c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040bf9c
test eax, eax
je 0x44af66
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004041d4
mov eax, dword [0x44fd58]
cmp byte [eax], 0
jne 0x44af9a
mov eax, ebx
call fcn.0044b10c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044ce60
mov eax, ebx
call fcn.0044d824
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44afda
call fcn.00403590
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b38c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x451bb0]
cmp dword [eax + 0x30], 0
je 0x44b436
cmp dword [ebx + 0x94], 0
jne 0x44b430
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44b31c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44b430
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44b3f6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44b430
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414260
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44b405
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44bf98
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44bfcd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404054
jmp 0x44bfda
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403fb8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44d03c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44d07d
mov eax, esi
call fcn.004339f8
test al, al
je 0x44d07d
mov eax, dword [ebx + 0x84]
call fcn.00433798
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44d07d
push 0
mov eax, dword [ebx + 0x84]
call fcn.00433798
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x44e098
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404414
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x44e204
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0044db70
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.0044db90
jmp 0x44e1d0
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004041d4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408208
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004079ec
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004079ec
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404370
je 0x44e1b0
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004041d4
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004079ec
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004079ec
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404370
jne 0x44e1c7
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.0044dbb0
test eax, eax
jne 0x44e111
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e20b
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00403f88
lea eax, [ebp - 4]
call fcn.00403f64
ret
Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x422a08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc

Function at 0x40de42
Capabilities:
Encode data using xor

Disassembly:
cmp byte [edx - 0x55b755c0], ch
push eax
stosb byte es:[edi], al
pop eax
stosb byte es:[edi], al
pushal
stosb byte es:[edi], al
push 0x78aa70aa
stosb byte es:[edi], al
sub byte [edx - 0x556f5578], 0x98
stosb byte es:[edi], al
mov al, byte [0xb0aaa8aa]
stosb byte es:[edi], al
mov eax, 0xc8aac0aa
stosb byte es:[edi], al
shr byte [edx - 0x551f5528], 1
call 0xf8ebcf1d
stosb byte es:[edi], al
add byte [ebx - 0x54ef54f8], ch
sbb byte [ebx - 0x54d754e0], ch
xor byte [ebx - 0x54bf54c8], ch
dec eax
stosd dword es:[edi], eax
push eax
stosd dword es:[edi], eax
pop eax
stosd dword es:[edi], eax
pushal
stosd dword es:[edi], eax
push 0x78ab70ab
stosd dword es:[edi], eax
sub byte [ebx - 0x546f5478], 0x98
stosd dword es:[edi], eax
mov al, byte [0xb0aba8ab]
stosd dword es:[edi], eax
mov eax, 0xc8abc0ab
stosd dword es:[edi], eax
shr byte [ebx - 0x541f5428], 1
call 0xf8eccf5e
stosd dword es:[edi], eax
add byte [eax + ecx + 0x18ac10ac], ch
lodsb al, byte [esi]
and byte [eax + ebp + 0x38ac30ac], ch
lodsb al, byte [esi]
inc eax
lodsb al, byte [esi]
dec eax
lodsb al, byte [esi]
push eax
lodsb al, byte [esi]
pop eax
lodsb al, byte [esi]
pushal
lodsb al, byte [esi]
push 0x78ac70ac
lodsb al, byte [esi]
sub byte [eax + ecx*4 - 0x67536f54], 0xac
mov al, byte [0xb0aca8ac]
lodsb al, byte [esi]
mov eax, 0xc8acc0ac
lodsb al, byte [esi]
shr byte [eax + ebx*8 - 0x17531f54], 1
lodsb al, byte [esi]
invalid
Function at 0x928a44
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
mov dword [ebp - 4], eax
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
jne 0x928a81
mov ecx, 0x928aa4
mov dl, 1
mov eax, dword [0x41bf8c]
call fcn.00429670
call fcn.004096a0
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x208]
mov ecx, pe_nt_image_headers32
call fcn.0040ae80
mov esp, ebp
pop ebp
ret

Function at 0x92aa14
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040a0b8
xor eax, eax
push ebp
push 0x92ab62
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.0040adc4
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x92ab3f
mov eax, dword [ebp - 0x10]
call fcn.0040679c
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x92ab38
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040adc4
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x92ab70
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
shr eax, 0x10
movzx eax, ax
call fcn.0042356c
push dword [ebp - 0x24]
push 0x92ab80
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x20]
movzx eax, word [eax + 8]
call fcn.0042356c
push dword [ebp - 0x28]
push 0x92ab80
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
shr eax, 0x10
movzx eax, ax
call fcn.0042356c
push dword [ebp - 0x2c]
push 0x92ab80
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x20]
movzx eax, word [eax + 0xc]
call fcn.0042356c
push dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
mov edx, 7
call fcn.0040b0b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x92ab3f
mov eax, dword [ebp - 0x18]
call fcn.004067b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x92ab69
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.0040a034
lea eax, [ebp - 8]
call fcn.00409fd4
ret
Function at 0x401230
Capabilities:
Write file on windows

Disassembly:
call fcn.0042a104
add eax, 0x20
push eax
push 0x33
push 1
push str.Lua_5.4.6__Copyright__C__1994_2023_Lua.org__PUC_Rio
call fcn.0042a410
call fcn.0042a104
add eax, 0x20
push eax
push 1
push 1
push 0x446408
call fcn.0042a410
call fcn.0042a104
add eax, 0x20
push eax
call fcn.00429f9c
add esp, 0x24
ret
Function at 0x40a800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
mov eax, dword [0x458290]
xor eax, esp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x94]
push ebx
push ebp
push esi
mov esi, ecx
mov cl, byte [edi + 6]
mov dword [esp + 0x14], eax
xor eax, eax
xor ebp, ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
test cl, cl
jns 0x40a8f0
mov eax, dword [edi + 8]
lea edx, [eax - 1]
test eax, edx
je 0x40a8f0
mov edx, eax
shr edx, 1
or eax, edx
mov edx, eax
shr edx, 2
or eax, edx
mov edx, eax
shr edx, 4
or eax, edx
mov edx, eax
shr edx, 8
or eax, edx
mov edx, eax
shr edx, 0x10
or edx, eax
inc edx
jmp 0x40a8f3
mov edx, dword [edi + 8]
lea eax, [esp + 0x18]
push eax
and cl, 0x7f
push edi
mov dword [edi + 8], edx
mov byte [edi + 6], cl
call fcn.00409c40
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
push edi
mov dword [esp + 0x20], eax
mov ebx, eax
call fcn.00409cc0
add esp, 0x14
add ebx, eax
cmp byte [esi + 8], 3
jne 0x40a963
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, edx
add ecx, 0xffffffff
adc eax, 0xffffffff
cmp eax, ebp
ja 0x40a95d
jb 0x40a943
cmp ecx, 0xfffffff
jae 0x40a95d
cmp edx, ebp
je 0x40a95d
push edx
call fcn.00408700
lea eax, [esp + eax*4 + 0x1c]
add esp, 4
inc dword [eax]
mov eax, 1
jmp 0x40a95f
xor eax, eax
add dword [esp + 0xc], eax
inc ebx
xor ecx, ecx
mov dword [esp + 0x10], ebp
mov eax, 1
lea esi, [esp + 0x18]
mov edx, eax
shr edx, 1
cmp dword [esp + 0xc], edx
jbe 0x40a990
add ecx, dword [esi]
cmp ecx, edx
jbe 0x40a989
mov ebp, eax
mov dword [esp + 0x10], ecx
add esi, 4
add eax, eax
jne 0x40a973
sub ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push ebx
push ebp
push edi
push eax
call fcn.0040a5b0
mov ecx, dword [esp + 0xa8]
add esp, 0x10
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042a974
add esp, 0x90
ret
Function at 0x40b700
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0xc]
movzx ecx, byte [eax + 8]
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push esi
and ecx, 0x3f
push edi
mov edi, dword [esp + 0x28]
cmp ecx, 6
je 0x40b749
mov edi, edi
cmp ecx, 0x16
je 0x40b851
cmp ecx, 0x26
je 0x40b838
push eax
push ebx
call fcn.0040b330
movzx ecx, byte [eax + 8]
and ecx, 0x3f
add esp, 8
inc edi
cmp ecx, 6
jne 0x40b720
mov edx, dword [eax]
mov ecx, dword [edx + 0xc]
mov edx, dword [ebx + 0x18]
sub edx, dword [ebx + 0xc]
mov esi, dword [esp + 0x2c]
push ebp
movzx ebp, byte [ecx + 8]
mov dword [esp + 0x18], ecx
movzx ecx, byte [ecx + 6]
mov dword [esp + 0x14], ebp
sub ebp, esi
sar edx, 4
mov dword [esp + 0x10], ecx
cmp edx, ebp
jg 0x40b7a6
sub eax, dword [ebx + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [ebx + 0x10]
cmp dword [eax + 0xc], 0
jle 0x40b78f
push ebx
call fcn.0040f420
add esp, 4
push 1
push ebp
push ebx
call fcn.0040af50
mov eax, dword [ebx + 0x1c]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
add eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
neg esi
shl esi, 4
add dword [ebp], esi
test edi, edi
jle 0x40b7e6
xor esi, esi
mov dword [esp + 0x28], edi
lea esp, [esp]
mov edx, dword [eax]
mov ecx, dword [ebp]
mov dword [ecx + esi], edx
mov edx, dword [eax + 4]
mov dword [ecx + esi + 4], edx
mov dl, byte [eax + 8]
mov byte [ecx + esi + 8], dl
add esi, 0x10
add eax, 0x10
dec dword [esp + 0x28]
jne 0x40b7c0
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp]
cmp edi, ecx
jg 0x40b809
mov eax, edi
sub ecx, edi
add eax, eax
inc ecx
lea eax, [edx + eax*8 + 8]
add edi, ecx
lea ebx, [ebx]
mov byte [eax], 0
add eax, 0x10
dec ecx
jne 0x40b800
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ecx
shl ecx, 4
add ecx, edx
mov dword [ebp + 4], ecx
mov ecx, dword [eax + 0x34]
or word [ebp + 0x22], 0x20
shl edi, 4
add edi, edx
mov dword [ebp + 0x10], ecx
pop ebp
mov dword [ebx + 0xc], edi
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push edx
push 0xffffffffffffffff
mov esi, ebx
call fcn.0040b5c0
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
push ecx
push 0xffffffffffffffff
mov esi, ebx
call fcn.0040b5c0
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x4143f0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
xor eax, dword [esp + 0xc]
test ecx, ecx
je 0x41441e
mov edx, dword [esp + 4]
push esi
push edi
movzx esi, byte [edx + ecx - 1]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
xor eax, esi
dec ecx
jne 0x414404
pop edi
pop esi
ret

Function at 0x414420
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
cmp byte [edx + 6], 0
mov eax, dword [edx + 8]
jne 0x414461
mov ecx, dword [edx + 0xc]
xor eax, ecx
test ecx, ecx
je 0x41445a
push esi
push edi
jmp 0x414440
movzx esi, byte [edx + ecx + 0xf]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
xor eax, esi
dec ecx
jne 0x414440
pop edi
pop esi
mov dword [edx + 8], eax
mov byte [edx + 6], 1
ret