joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ad80
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, eax
test edi, edi
je 0x47af3e
mov ebp, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push edi
call ebp
mov dword [esp + 0x1c], eax
cmp eax, dword [0x4cc498]
je 0x47adb7
mov esi, edi
call fcn.0047be90
test al, al
jne 0x47af3e
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push edi
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x47add3
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, ebx
jne 0x47ade1
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp byte [0x4cb648], 0
jne 0x47adfb
push ebx
call fcn.0047ad20
add esp, 4
test eax, eax
jne 0x47af40
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
test ebx, ebx
je 0x47ae5e
push 0
push ebx
call ebp
mov ebp, eax
mov dword [esp + 0x20], ebp
test ebp, ebp
je 0x47ae5e
cmp dword [0x4cc498], ebp
je 0x47ae41
mov esi, ebx
call fcn.0047be90
test al, al
jne 0x47ae41
mov eax, dword [0x4cc498]
push 1
push ebp
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x16]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x47ae5e
cmp ebp, eax
je 0x47ae5e
push 1
push eax
push ebp
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x17]
mov esi, dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [esp + 0x18], 0
push edi
call esi
push 1
push 0xa
mov dword [0x4c795c], 0
call fcn.00401430
add esp, 8
mov dword [0x4c795c], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
cmp ebp, edi
jne 0x47ae9f
mov ebp, edi
jmp 0x47aeb0
cmp ebp, ebx
je 0x47aeb4
push 4
push ebp
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x47aeb4
test ebp, ebp
jne 0x47aef5
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, 5
jl 0x47ae6c
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.004114d0
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.004114d0
push ebx
call fcn.0047ad20
add esp, 0x34
mov ebp, eax
cmp byte [esp + 0x16], 0
je 0x47af10
mov ecx, dword [esp + 0x20]
mov edx, dword [0x4cc498]
push 0
push ecx
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [esp + 0x17], 0
je 0x47af29
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ebp, ebp
je 0x47af3e
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x47b040
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [esp + 8], 0
je 0x47b050
mov eax, esi
call fcn.00456710
jmp 0x47b05d
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 4]
test eax, eax
js 0x47b0b8
je 0x47b0b8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
push 1
push 0x8000012f
mov edi, eax
call fcn.00401430
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call ebx
test eax, eax
je 0x47b0b5
add edi, dword [esp + 0x10]
call ebp
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x47b0b5
push 1
push 0x8000012f
call fcn.00401430
add esp, 8
push esi
call ebx
test eax, eax
jne 0x47b094
pop edi
pop ebp
pop ebx
mov eax, esi
ret
Function at 0x47b2c0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.0049bb30
mov eax, dword [esp + 0x11c70]
push ebx
push ebp
mov ebp, dword [esp + 0x11c74]
push esi
mov esi, ecx
movzx ecx, word [edx]
xor ebx, ebx
cmp ecx, 0x41
je 0x47b2ec
cmp ecx, 0x61
jne 0x47b34e
cmp word [edx + 2], bx
jne 0x47b34e
cmp word [edi], bx
jne 0x47b34e
cmp word [eax], bx
jne 0x47b34e
cmp word [esi], bx
jne 0x47b34e
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x47b32f
cmp byte [ebp + 0xea], bl
jne 0x47b32f
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x47b32d
push esi
call fcn.0047bf10
add esp, 4
test al, al
je 0x47b32f
xor esi, esi
cmp byte [esp + 0x11c84], bl
je 0x47b342
cmp esi, ebx
je 0x47b342
mov dword [ebp + 0xc4], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
cmp cx, bx
jne 0x47b373
cmp word [edi], bx
jne 0x47b373
cmp word [eax], bx
jne 0x47b373
cmp word [esi], bx
jne 0x47b373
mov eax, ebp
call fcn.0047b4c0
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x102c], 0x4a4890
mov byte [esp + 0x1849], bl
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1850], ebx
mov dword [esp + 0x1854], ebx
mov dword [esp + 0x1858], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov dword [esp + 0x186c], ebx
mov dword [esp + 0x1870], ebx
call fcn.0047c070
test eax, eax
je 0x47b474
test byte [esp + 0x10], 2
mov al, byte [esp + 0x11c80]
mov byte [esp + 0x1839], al
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
je 0x47b480
mov eax, dword [esp + 0x102c]
cmp eax, 0xffff
je 0x47b44c
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47b474
cmp byte [ebp + 0xea], bl
jne 0x47b445
mov esi, dword [esp + 0x102c]
call fcn.0047bf80
cmp al, bl
jne 0x47b445
mov ecx, dword [esp + 0x102c]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x47b474
mov eax, dword [esp + 0x102c]
cmp dword [esp + 0x1860], eax
je 0x47b465
lea esi, [esp + 0x10]
mov dword [esp + 0x1860], eax
call fcn.0047c4d0
push ebx
lea edx, [esp + 0x14]
push edx
call fcn.0047c590
test eax, eax
jne 0x47b490
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
lea eax, [esp + 0x10]
push eax
push 0x47b540
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x1840]
cmp byte [esp + 0x11c84], bl
je 0x47b4aa
cmp eax, ebx
je 0x47b4aa
mov dword [ebp + 0xc4], eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
Function at 0x47c4d0
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0x1850]
test ecx, ecx
je 0x47c58e
mov eax, dword [esi]
test eax, eax
je 0x47c58e
push edi
test al, 1
jne 0x47c4fa
mov eax, dword [esi + 0x100c]
cmp word [eax], 0
je 0x47c516
push 0x7fff
lea edi, [esi + 0x1858]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x47c516
xor ecx, ecx
mov word [edi], cx
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x47c531
mov eax, dword [esi + 0x1850]
lea edx, [esi + 0x1854]
push edx
push eax
call edi
test byte [esi], 0x20
je 0x47c56f
mov edx, dword [esi + 0x1850]
lea ecx, [esp + 4]
push ecx
push edx
call edi
test eax, eax
je 0x47c56f
movzx eax, byte [esi + 0x1828]
mov ecx, dword [esp + 4]
push eax
lea eax, [esi + 0x11a58]
call fcn.004525c0
add esp, 4
test eax, eax
jne 0x47c56f
xor ecx, ecx
mov word [esi + 0x11a58], cx
test byte [esi], 8
pop edi
je 0x47c58e
mov eax, dword [esi + 0x1850]
push 0x101
lea edx, [esi + 0x11856]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
pop ecx
ret

Function at 0x47cdd0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c64
call fcn.0049bb30
mov eax, dword [esp + 0x11c68]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x47ce7d
mov dword [esp + 0x1848], eax
lea eax, [esp + 8]
push eax
push 0x47d5f0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x101c], 0x4a4890
mov byte [esp + 0x1839], bl
mov dword [esp + 0x183c], ebx
mov dword [esp + 0x1840], ebx
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov byte [esp + 0x1854], cl
mov dword [esp + 0x1858], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x1838], ebx
je 0x47ce7d
mov ecx, dword [0x4c7a54]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x47ce7d
push 1
push eax
call fcn.00401430
add esp, 8
mov eax, 1
pop ebx
add esp, 0x11c64
ret 4
Function at 0x47ce90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x47ceac
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4c7a54]
push eax
push esi
mov ecx, edi
call fcn.0047d3f0
cmp byte [edi], 0
je 0x47cedf
test eax, eax
jne 0x47cee7
mov edx, dword [esp + 0x1c]
push eax
push edx
push edi
call fcn.0047cfc0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x47cf88
test esi, esi
je 0x47cf62
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.00401430
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x47cf45
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x47cf45
push 1
push 0x8000012f
call fcn.00401430
add esp, 8
push esi
call edi
test eax, eax
jne 0x47cf20
mov edx, dword [0x4c7a54]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47cf5e
push 1
push eax
call fcn.00401430
add esp, 8
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x47cfa2
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
je 0x47cf88
mov ecx, dword [0x4c7a54]
push ecx
push eax
mov ecx, edi
call fcn.0047d3f0
test eax, eax
jne 0x47ce9f
cmp byte [edi], 0
je 0x47cfa2
mov edx, dword [esp + 0x1c]
push 0
push edx
push edi
call fcn.0047cfc0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x1c]
push eax
mov ecx, edi
call fcn.0047d1c0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x47cfc0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.0049bb30
mov eax, dword [esp + 0x11c74]
push ebx
push ebp
mov ebp, dword [esp + 0x11c74]
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x47cfe4
mov dword [eax], edi
cmp dword [ebp + 8], edi
je 0x47d184
mov cl, 1
mov eax, ebp
call fcn.0047d360
test eax, eax
je 0x47d1aa
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4c7a54]
push eax
push esi
mov ecx, ebp
call fcn.0047d3f0
test eax, eax
setne cl
mov byte [esp + 0x17], cl
test cl, cl
jne 0x47d02a
xor eax, eax
mov dword [0x4cc490], eax
jmp 0x47d02f
mov eax, dword [0x4cc490]
cmp byte [esp + 0x11c80], 0
mov dword [esp + 0x1844], edi
mov dword [esp + 0x1848], edi
mov dword [esp + 0x184c], edi
mov dword [esp + 0x1858], edi
mov dword [esp + 0x1864], edi
mov dword [esp + 0x1868], edi
je 0x47d06f
mov byte [esp + 0x1841], 0
test cl, cl
je 0x47d077
mov byte [esp + 0x1841], 1
mov edx, dword [0x4cc48c]
mov ecx, 0x4a4890
mov dword [esp + 0x1024], ecx
mov dword [esp + 0x102c], ecx
mov dword [esp + 0x1030], ecx
mov ecx, dword [0x4c7a54]
cmp eax, edi
mov dword [esp + 0x1028], edi
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1850], edx
mov dword [esp + 0x1854], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x103c], ebp
mov dword [esp + 0x18], 0x10
setg bl
cmp byte [esp + 0x17], 0
je 0x47d0fa
xor ecx, ecx
test eax, eax
jle 0x47d0ea
lea ecx, [ecx]
cmp dword [edx + ecx*4], esi
je 0x47d0fa
inc ecx
cmp ecx, eax
jl 0x47d0e0
cmp eax, 0x1f4
jge 0x47d0fa
mov dword [edx + eax*4], esi
inc eax
mov dword [0x4cc490], eax
lea edx, [esp + 0x18]
push edx
push 0x47b540
mov dword [esp + 0x185c], eax
call edi
mov eax, dword [esp + 0x1848]
test eax, eax
jne 0x47d12b
test bl, bl
je 0x47d196
mov edx, dword [0x4cc48c]
mov dword [0x4cc490], eax
xor bl, bl
jmp 0x47d0d0
call fcn.0047ad80
mov ecx, dword [0x4cc490]
mov edx, dword [esp + 0x1848]
mov esi, dword [0x4cc48c]
xor eax, eax
test ecx, ecx
jle 0x47d15a
lea esp, [esp]
cmp dword [esi + eax*4], edx
je 0x47d16c
inc eax
cmp eax, ecx
jl 0x47d150
cmp ecx, 0x1f4
jge 0x47d16c
mov dword [esi + ecx*4], edx
inc ecx
mov dword [0x4cc490], ecx
mov eax, dword [0x4c7a54]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
jle 0x47d184
push 1
push eax
call fcn.00401430
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 0xc
mov ecx, dword [esp + 0x11c84]
test ecx, ecx
je 0x47d1aa
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x47d1aa
mov dword [ecx], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c68
ret 0xc
Function at 0x47d1c0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.0049bb30
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x47d340
xor cl, cl
mov eax, edi
call fcn.0047d360
test eax, eax
jne 0x47d1f5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4c7a54]
push eax
push ebp
mov ecx, edi
call fcn.0047d3f0
test eax, eax
je 0x47d218
xor eax, eax
mov dword [0x4cc490], eax
jmp 0x47d21d
mov eax, dword [0x4cc490]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1024], 0x4a4890
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1864], ebx
mov dword [esp + 0x1868], ebx
cmp byte [esp + 0x11c7c], bl
je 0x47d263
mov byte [esp + 0x1841], bl
cmp eax, ebx
je 0x47d26b
mov byte [esp + 0x1841], 1
mov ecx, dword [0x4cc48c]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1854], eax
lea eax, [esp + 0x18]
push eax
push 0x47d4c0
mov dword [esp + 0x1858], ecx
mov dword [esp + 0x1860], edx
call esi
mov eax, dword [esp + 0x1848]
cmp eax, ebx
je 0x47d318
lea ecx, [esp + 0x10]
push ecx
push 0x47bde0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x47d2d5
mov edx, dword [esp + 0x1848]
call fcn.0047ca60
mov dword [esp + 0x1848], esi
mov eax, dword [esp + 0x1848]
call fcn.0047ad80
mov edx, dword [esp + 0x1848]
call fcn.0047ca60
mov edx, dword [0x4c7a54]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47d340
push 1
push eax
call fcn.00401430
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
mov eax, dword [0x4cc490]
cmp eax, ebx
je 0x47d340
cmp eax, 1
setg al
mov dword [0x4cc490], ebx
cmp al, bl
je 0x47d340
mov edx, ebp
call fcn.0047ca60
push ebx
mov ecx, edi
call fcn.0047d1c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x11c68
ret 4
Function at 0x4972b6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c6dd0]
jne 0x4972c0
repz ret
jmp fcn.0049b846

Function at 0x499a50
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c6dd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00494192
and dword [ebp - 0x14], 0
cmp dword [0x4c9c74], 0
mov dword [ebp - 0x18], eax
jne 0x499b03
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x499bab
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a4020
push ebx
call edi
test eax, eax
je 0x499bab
mov esi, dword [fcn.00490560]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c9c74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c9c78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c9c7c], eax
call edi
push eax
call esi
mov dword [0x4c9c84], eax
test eax, eax
je 0x499b03
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c9c80], eax
mov eax, dword [0x4c9c80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00490564]
cmp eax, ecx
je 0x499b5c
cmp dword [0x4c9c84], ecx
je 0x499b5c
push eax
call esi
push dword [0x4c9c84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x499b5c
test ebx, ebx
je 0x499b5c
call edi
test eax, eax
je 0x499b53
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x499b53
test byte [ebp - 8], 1
jne 0x499b5c
or dword [ebp + 0x10], 0x200000
jmp 0x499b8f
mov eax, dword [0x4c9c78]
cmp eax, dword [ebp - 0x18]
je 0x499b8f
push eax
call esi
test eax, eax
je 0x499b8f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x499b8f
mov eax, dword [0x4c9c7c]
cmp eax, dword [ebp - 0x18]
je 0x499b8f
push eax
call esi
test eax, eax
je 0x499b8f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c9c74]
call esi
test eax, eax
je 0x499bab
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x499bad
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004972b6
leave
ret
Function at 0x40282f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [0x40803c]
mov ecx, dword [0x408040]
lea eax, [ecx + eax - 9]
mov dword [0x40803c], eax
and dword [ebp - 0x14], 0
jmp 0x40287d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, 0x28
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
jge 0x402a22
push 0
call dword [0x407008]
mov eax, dword [0x408040]
xor edx, edx
push 0xc
pop ecx
div ecx
mov dword [0x408040], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x40297b
mov eax, dword [0x408040]
shl eax, 1
mov dword [0x40803c], eax
mov eax, dword [0x40803c]
imul eax, dword [0x408040]
mov ecx, dword [0x408040]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x40803c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 4], eax
mov eax, dword [0x408040]
xor edx, edx
push 0xc
pop ecx
div ecx
mov dword [0x408040], eax
cmp dword [ebp - 4], 0
jle 0x40296e
mov eax, dword [0x408040]
add eax, 8
mov dword [0x408040], eax
push 4
push 0x1000
push dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [0x407040]
mov dword [ebp - 0xc], eax
mov eax, dword [0x40803c]
mov ecx, dword [0x408040]
lea eax, [ecx + eax - 9]
mov dword [0x40803c], eax
mov eax, dword [0x40803c]
sub eax, 4
mov dword [0x408040], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov eax, dword [0x408040]
shl eax, 3
mov dword [0x408040], eax
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call fcn.004036d5
add esp, 0xc
push 0
call dword [0x407008]
jmp 0x40286d
mov eax, dword [0x408040]
imul eax, dword [0x408040]
sub eax, 3
mov dword [0x40803c], eax
push 4
push 0x1000
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [0x407040]
mov dword [ebp - 0xc], eax
mov eax, dword [0x40803c]
mov ecx, dword [0x408040]
lea eax, [ecx + eax - 9]
mov dword [0x40803c], eax
mov eax, dword [0x40803c]
imul eax, dword [0x408040]
mov ecx, dword [0x408040]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x40803c], eax
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0xc]
jmp 0x41f352
push 0
call dword [0x407008]
mov eax, dword [0x40803c]
imul eax, dword [0x408040]
mov ecx, dword [0x408040]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x40803c], eax
leave
ret
Function at 0x44f7c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x44f7f1
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x44f7e2
and ecx, 3
je 0x44f809
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x44f7f6
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x44f814
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x44f84d
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x44f835
pop esi
and esi, 3
je 0x44f872
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x44f853
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x44f87c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x44f8a8
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x44f899
and ecx, 3
je 0x44f8c0
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x44f8ad
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x44f8c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0x44f8d4
pop edi
pop ebx
ret
Function at 0x4501f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov esi, eax
mov eax, esi
shr eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.0044fe48
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x45032f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
dec edi
test edi, edi
jl 0x45029e
inc edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.0042293c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0044f8c8
lea eax, [ebx + esi]
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
call fcn.0042293c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0044f8c8
lea eax, [ebx + esi]
mov ebx, eax
dec edi
jne 0x45024b
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
cmp esi, edi
jg 0x4502ec
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.0042293c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0044f8c8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov ecx, esi
call fcn.0042293c
lea eax, [ebx + esi]
mov ebx, eax
sub edi, esi
test edi, edi
jle 0x450316
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec edi
test edi, edi
jl 0x450316
inc edi
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dl, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec edi
jne 0x450306
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450336
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0044ffe4
ret