joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4348f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x434915
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x43492d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x43495c
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x43499e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x434a72
sub edx, 0x10000
js 0x434a72
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x434984
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x434984
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x4349f5
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x4349f2
add edx, 8
jne 0x4349d9
jmp 0x434a63
add edx, 4
test eax, 0xffff
jne 0x434a02
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x434a63
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x434a36
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x434984
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x434a72
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x434984
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x434a83
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4425ae
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
mov ebp, ecx
push edi
mov edi, dword [esp + 0x48]
lea ecx, [esp + 0x2c]
push 0x14
sub esi, edi
mov dword [esp + 0x14], ebp
mov edx, edi
sub ecx, edi
pop ebx
mov al, byte [esi + edx]
xor al, byte [edx]
mov byte [ecx + edx], al
inc edx
dec ebx
jne 0x4425d0
xor esi, esi
cmp dword [ebp + 4], esi
jle 0x44263e
lea edx, [esp + 0x18]
mov ebx, esi
sub edx, edi
mov dword [esp + 0x14], edx
mov eax, dword [ebp]
mov ecx, edi
add eax, 8
add eax, ebx
sub eax, edi
push 0x14
mov dword [esp + 0x48], eax
mov edi, eax
pop ebp
mov al, byte [edi + ecx]
xor al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
dec ebp
jne 0x442604
mov edi, dword [esp + 0x48]
lea eax, [esp + 0x18]
mov ebp, dword [esp + 0x10]
push 0x14
push eax
lea eax, [esp + 0x34]
push eax
call dword [0x467524]
add esp, 0xc
test eax, eax
js 0x44264b
mov edx, dword [esp + 0x14]
inc esi
add ebx, 0x38
cmp esi, dword [ebp + 4]
jl 0x4425ef
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 8
mov eax, esi
jmp 0x442641

Function at 0x4429fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
push 0x40
mov edi, edx
mov esi, ecx
push ebx
push edi
call dword [0x4670fc]
test eax, eax
je 0x442a8b
mov ecx, dword [esi + 0x3c]
mov eax, edi
sub eax, esi
add ecx, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
lea edx, [eax + ebx]
push edx
push eax
push dword [ecx + 0x34]
mov dword [ebp - 8], edx
mov ecx, esi
mov edx, esi
call fcn.00450e96
xor ecx, ecx
mov edx, ecx
test ebx, ebx
je 0x442a68
and dword [ebp + 8], 0
movzx eax, cl
mov al, byte [ebp + eax + 0xc]
xor byte [edx + edi], al
inc cl
cmp cl, 4
movzx eax, cl
cmove eax, dword [ebp + 8]
inc edx
mov cl, al
cmp edx, ebx
jb 0x442a47
push dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov ecx, esi
push dword [ebp - 0xc]
push esi
mov edx, dword [edx + 0x34]
call fcn.00450e96
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [0x4670fc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x448f26
Capabilities:
Encode data using xor

Disassembly:
push esi
movzx esi, cx
xor eax, eax
push edi
mov edi, edx
xor edx, edx
cmp ax, word [esi*8 + 0x428d22]
jae 0x448f5f
mov eax, dword [esi*8 + 0x428d24]
movzx ecx, dx
mov al, byte [eax + ecx]
xor al, byte [esi*8 + 0x428d20]
xor al, dl
inc edx
mov byte [ecx + edi], al
cmp dx, word [esi*8 + 0x428d22]
jb 0x448f3b
movzx eax, word [esi*8 + 0x428d22]
mov byte [eax + edi], 0
pop edi
pop esi
ret

Function at 0x448f6e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
movzx esi, cx
xor eax, eax
push edi
xor edi, edi
mov ebx, edx
cmp ax, word [esi*8 + 0x428d22]
jae 0x448fb8
mov eax, dword [esi*8 + 0x428d24]
movzx edx, di
movsx cx, byte [eax + edx]
mov eax, 0xff
xor cx, di
and cx, ax
movzx eax, byte [esi*8 + 0x428d20]
xor cx, ax
inc edi
mov word [ebx + edx*2], cx
cmp di, word [esi*8 + 0x428d22]
jb 0x448f84
movzx eax, word [esi*8 + 0x428d22]
xor ecx, ecx
pop edi
pop esi
mov word [ebx + eax*2], cx
pop ebx
ret
Function at 0x44c28f
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xor edx, edx
mov dword [0x4650e0], ecx
inc edx
mov ecx, 0x4650e0
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x465a9c
jl 0x44c29d
mov dword [0x465aa0], edx
ret

Function at 0x44c2c2
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [0x465aa0]
cmp esi, 0x270
jl 0x44c387
xor esi, esi
push ebx
mov edx, esi
mov ebx, 0x7fffffff
mov ecx, dword [edx*4 + 0x4650e4]
xor ecx, dword [edx*4 + 0x4650e0]
and ecx, ebx
xor ecx, dword [edx*4 + 0x4650e0]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x42bff4]
xor ecx, dword [edx*4 + 0x465714]
mov dword [edx*4 + 0x4650e0], ecx
inc edx
cmp edx, 0xe3
jl 0x44c2df
cmp edx, 0x26f
jge 0x44c358
push edi
lea edi, [edx*4 + 0x4650e0]
mov ecx, dword [edi]
xor ecx, dword [edi + 4]
and ecx, ebx
xor ecx, dword [edi]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [eax*4 + 0x42bff4]
xor eax, dword [edi - 0x38c]
xor eax, ecx
mov dword [edi], eax
add edi, 4
cmp edi, 0x465a9c
jl 0x44c32b
pop edi
mov ecx, dword [0x4650e0]
xor ecx, dword [0x465a9c]
and ecx, ebx
xor ecx, dword [0x465a9c]
mov eax, ecx
shr ecx, 1
and eax, 1
pop ebx
xor ecx, dword [eax*4 + 0x42bff4]
xor ecx, dword [0x465710]
mov dword [0x465a9c], ecx
mov ecx, dword [esi*4 + 0x4650e0]
mov eax, ecx
shr eax, 0xb
inc esi
xor ecx, eax
mov dword [0x465aa0], esi
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
ret
Function at 0x44e713
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
cmp dword [esp + 4], 0
mov eax, ecx
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebp, edx
mov bl, byte [edi + 0x100]
mov bh, byte [edi + 0x101]
jbe 0x44e772
sub eax, ebp
mov dword [esp + 0x14], eax
push esi
inc bl
movzx esi, bl
mov dl, byte [esi + edi]
add bh, dl
movzx ecx, bh
mov al, byte [ecx + edi]
mov byte [esi + edi], al
mov byte [ecx + edi], dl
movzx ecx, byte [esi + edi]
movzx eax, dl
add ecx, eax
and ecx, 0xff
mov al, byte [ecx + edi]
mov ecx, dword [esp + 0x18]
xor al, byte [ecx + ebp]
mov byte [ebp], al
inc ebp
dec dword [esp + 0x14]
jne 0x44e738
pop esi
mov byte [edi + 0x100], bl
mov byte [edi + 0x101], bh
pop edi
pop ebp
pop ebx
ret 8

Function at 0x44e784
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x44e7ae
push ebx
mov ebx, dword [esp + 0x14]
sub ecx, edx
mov al, byte [ecx + edx]
xor al, byte [esi + ebx]
inc esi
mov byte [edx], al
xor eax, eax
cmp esi, dword [esp + 0x18]
cmove esi, eax
inc edx
dec edi
jne 0x44e797
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x44e7b3
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
mov ebx, ecx
push edi
mov edi, edx
cmp ebx, esi
jne 0x44e7cd
or eax, 0xffffffff
jmp 0x44e8fd
mov eax, dword [esp + 0x24]
mov edx, esi
add eax, esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
push ebp
test edi, edi
je 0x44e8f8
lea eax, [esp + 0x14]
sub ebx, eax
push 3
xor dl, dl
lea ecx, [esp + 0x18]
pop ebp
test edi, edi
je 0x44e803
mov al, byte [ebx + ecx]
dec edi
inc dl
mov byte [ecx], al
jmp 0x44e806
mov byte [ecx], 0
inc ecx
dec ebp
jne 0x44e7f5
movzx ecx, byte [esp + 0x14]
add ebx, 3
movzx ebp, byte [esp + 0x15]
mov eax, ecx
shr eax, 2
and ecx, 3
shl ecx, 4
mov byte [esp + 0x24], dl
mov edx, dword [esp + 0x18]
mov al, byte [eax + 0x42c0d0]
mov byte [esp + 0x12], al
mov eax, ebp
shr eax, 4
or eax, ecx
mov cl, byte [esp + 0x24]
mov al, byte [eax + 0x42c0d0]
mov byte [esp + 0x13], al
cmp cl, 1
jbe 0x44e866
movzx eax, byte [esp + 0x16]
and ebp, 0xf
shr eax, 6
shl ebp, 2
or eax, ebp
mov ch, byte [eax + 0x42c0d0]
jmp 0x44e868
mov ch, 0x3d
mov byte [esp + 0x24], ch
cmp cl, 2
jbe 0x44e881
movzx eax, byte [esp + 0x16]
and eax, 0x3f
mov cl, byte [eax + 0x42c0d0]
jmp 0x44e883
mov cl, 0x3d
cmp byte [esp + 0x2c], 0
mov byte [esp + 0x28], cl
je 0x44e8ca
mov ecx, edx
add edx, 8
mov dword [esp + 0x18], edx
cmp edx, dword [esp + 0x1c]
ja 0x44e906
mov al, byte [esp + 0x12]
movzx eax, al
mov word [ecx], ax
mov al, byte [esp + 0x13]
movzx eax, al
mov word [ecx + 2], ax
mov al, byte [esp + 0x24]
movzx eax, al
mov word [ecx + 4], ax
mov al, byte [esp + 0x28]
movzx eax, al
mov word [ecx + 6], ax
jmp 0x44e8f0
mov eax, edx
add edx, 4
mov dword [esp + 0x18], edx
cmp edx, dword [esp + 0x1c]
ja 0x44e906
mov dl, byte [esp + 0x12]
mov byte [eax], dl
mov dl, byte [esp + 0x13]
mov byte [eax + 1], dl
mov edx, dword [esp + 0x18]
mov byte [eax + 2], ch
mov byte [eax + 3], cl
test edi, edi
jne 0x44e7ec
sub edx, esi
mov eax, edx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
or eax, 0xffffffff
jmp 0x44e8fc

Function at 0x44eb12
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub eax, 0
je 0x44eb88
dec eax
je 0x44eb72
dec eax
je 0x44eb5d
dec eax
je 0x44eb59
dec eax
je 0x44eb2d
or eax, 0xffffffff
jmp 0x44eb9d
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
cmp eax, 1
jbe 0x44eb56
push edi
lea edx, [ecx + 1]
sub esi, ecx
lea edi, [eax - 1]
mov cl, byte [esi + edx]
xor cl, byte [edx - 1]
mov byte [edx], cl
inc edx
dec edi
jne 0x44eb49
pop edi
pop esi
jmp 0x44eb9d
push 0
jmp 0x44eb5f
push 1
push dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
call fcn.0044e7b3
jmp 0x44eb9d
push dword [ecx + 8]
mov edx, dword [ebp + 0x10]
push dword [ecx + 4]
mov ecx, dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.0044e784
jmp 0x44eb9a
mov edx, dword [ebp + 0x10]
lea eax, [ecx + 4]
mov ecx, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0044e713
mov eax, dword [ebp + 0xc]
pop ebp
ret 0x10
Function at 0x44ec43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
push esi
sub eax, 0
je 0x44ecc2
dec eax
je 0x44eca6
dec eax
je 0x44ec91
dec eax
je 0x44ec8d
dec eax
jne 0x44ecca
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x14], esi
jb 0x44ecca
push edi
mov edi, dword [ebp + 0x10]
cmp dword [ebp + 8], edi
je 0x44ec79
push esi
push dword [ebp + 8]
push edi
call dword [0x46751c]
add esp, 0xc
lea eax, [esi - 1]
test eax, eax
je 0x44ec8a
mov cl, byte [eax + edi - 1]
xor byte [eax + edi], cl
dec eax
jne 0x44ec80
pop edi
jmp 0x44ecdf
push 0
jmp 0x44ec93
push 1
push dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
call fcn.0044e90b
jmp 0x44ece1
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x14], esi
jb 0x44ecca
push dword [ecx + 8]
mov edx, dword [ebp + 0x10]
push dword [ecx + 4]
mov ecx, dword [ebp + 8]
push esi
call fcn.0044e784
jmp 0x44ecdf
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x14], esi
jae 0x44eccf
or eax, 0xffffffff
jmp 0x44ece1
mov edx, dword [ebp + 0x10]
add ecx, 4
push ecx
mov ecx, dword [ebp + 8]
push esi
call fcn.0044e713
mov eax, esi
pop esi
pop ebp
ret 0x14
Function at 0x450cb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, edx
mov dword [esp + 0x14], ecx
mov edx, dword [ecx + 0x3c]
push esi
push edi
xor esi, esi
mov edi, dword [edx + ecx + 0x78]
add edi, ecx
mov dword [esp + 0x18], edi
mov ebx, dword [edi + 0x1c]
add ebx, ecx
mov dword [esp + 0x2c], ebx
cmp ebp, 0xffff
jbe 0x450d75
mov eax, dword [edi + 0x24]
mov ebx, esi
add eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0x20]
add eax, ecx
mov dword [esp + 0x20], eax
cmp dword [edi + 0x18], ebx
jbe 0x450d97
movzx edx, byte [ebp]
mov dword [esp + 0x24], edx
mov eax, dword [eax + ebx*4]
add eax, ecx
mov dword [esp + 0x14], eax
mov al, byte [eax]
mov byte [esp + 0x13], al
movzx eax, al
sub edx, eax
jne 0x450d44
mov edi, dword [esp + 0x14]
mov esi, ebp
mov cl, byte [esp + 0x13]
sub esi, edi
test cl, cl
je 0x450d3a
inc edi
mov cl, byte [edi]
movzx edx, byte [esi + edi]
movzx eax, cl
sub edx, eax
je 0x450d28
mov edi, dword [esp + 0x18]
xor esi, esi
mov ecx, dword [esp + 0x1c]
test edx, edx
js 0x450d54
xor eax, eax
inc eax
test edx, edx
cmovg edx, eax
test edx, edx
je 0x450d64
inc ebx
cmp ebx, dword [edi + 0x18]
jae 0x450d94
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x450d06
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
movzx eax, word [eax + ebx*2]
mov eax, dword [edx + eax*4]
jmp 0x450d8d
movzx edx, bp
cmp edx, dword [edi + 0x10]
jb 0x450dac
mov eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
cmp edx, eax
ja 0x450dac
sub edx, dword [edi + 0x10]
mov eax, dword [ebx + edx*4]
test eax, eax
je 0x450dac
lea esi, [eax + ecx]
mov edx, dword [ecx + 0x3c]
cmp esi, edi
jb 0x450da8
mov ecx, dword [edx + ecx + 0x7c]
xor eax, eax
add ecx, edi
cmp esi, ecx
cmovb esi, eax
mov eax, esi
jmp 0x450dae
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x459fc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi + 4]
sub eax, esi
je 0x45a016
dec eax
je 0x45a00f
dec eax
je 0x459fdf
xor al, al
jmp 0x45a065
mov ecx, dword [edi + 8]
cmp dword [esp + 0x14], esi
jbe 0x45a008
mov edx, dword [esp + 0x10]
movzx eax, byte [esi + edx]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x465ba0]
inc esi
cmp esi, dword [esp + 0x14]
jb 0x459fec
mov dword [edi + 8], ecx
mov al, 1
jmp 0x45a065
mov ebp, 0x8004
jmp 0x45a01b
mov ebp, 0x8003
call fcn.00459f1e
test al, al
je 0x459fd8
push ebx
lea ebx, [edi + 0xc]
cmp dword [ebx], esi
jne 0x45a043
push ebx
push esi
push esi
push ebp
push dword [edi + 8]
call dword [0x46700c]
test eax, eax
jne 0x45a043
mov dword [ebx], esi
xor al, al
jmp 0x45a064
cmp dword [esp + 0x18], esi
jne 0x45a04d
mov al, 1
jmp 0x45a064
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [ebx]
call dword [0x467008]
dec eax
neg eax
sbb eax, eax
inc eax
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x45a362
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x463170
call fcn.004363a4
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [0x4671ec]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x45a3c6
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x45a3c6
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x45a3c6
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x45a3c6
or dword [ebp - 4], 0xffffffff
mov al, 1
jmp 0x45a3cc
or dword [ebp - 4], 0xffffffff
xor al, al
call fcn.004363df
ret

Function at 0x45b5da
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push esi
push edi
cld
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
mov ecx, 0x18
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x45b5fd
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x45b5f4
cmp edi, 0x6a4abc5b
mov eax, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x45b5ea
pop edi
pop esi
ret

Function at 0x45bbe8
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, 0x598
mov esi, ecx
push edi
push 0x41a3e0
push esi
call dword [0x46751c]
mov ecx, dword [0x465004]
add esp, 0xc
add ecx, dword [0x4649ac]
sub ecx, esi
mov al, byte [ecx + esi]
xor byte [esi], al
inc esi
dec edi
jne 0x45bc0f
pop edi
pop esi
ret
Function at 0x45bcea
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x12c
push ebx
push ebp
push esi
push edi
mov ebp, 0x114
mov dword [esp + 0x24], 0x73db8844
push ebp
lea eax, [esp + 0x2c]
mov edi, edx
push 0x42a8a8
push eax
mov ebx, ecx
call dword [0x46751c]
add esp, 0xc
xor ecx, ecx
xor edx, edx
mov al, byte [esp + ecx + 0x24]
xor byte [esp + edx + 0x28], al
inc ecx
xor eax, eax
cmp ecx, 4
cmove ecx, eax
inc edx
cmp edx, ebp
jb 0x45bd1d
push 1
lea ecx, [esp + 0x14]
call fcn.00459f4a
and dword [esp + 0x20], 0
lea eax, [esp + 0x28]
push ecx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0x42aa64
call fcn.004371be
test al, al
je 0x45bda0
lea ecx, [esp + 0x10]
call fcn.0043720a
mov esi, eax
test esi, esi
je 0x45bda0
cmp edi, esi
jbe 0x45bda0
sub edi, esi
lea ecx, [esp + 0x10]
push edi
push ebx
call fcn.00459fc4
test al, al
je 0x45bda0
push ecx
push esi
lea eax, [edi + ebx]
push eax
lea ecx, [esp + 0x1c]
call fcn.0043724b
test al, al
je 0x45bda0
lea ecx, [esp + 0x10]
call fcn.0043719e
jmp 0x45bdab
lea ecx, [esp + 0x10]
call fcn.0043719e
xor esi, esi
push ebp
lea eax, [esp + 0x2c]
push 0
push eax
call dword [0x467520]
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12c
ret

Function at 0x45c889
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6b4
push ebx
push esi
push edi
push 0x10
lea eax, [esp + 0x14]
push 0x464df4
push eax
call dword [0x46751c]
mov eax, dword [ebp + 8]
add esp, 0xc
xor dword [esp + 0x10], eax
xor word [esp + 0x14], ax
shr eax, 0x10
xor word [esp + 0x16], ax
xor edi, edi
push 4
mov ecx, edi
mov edx, edi
pop ebx
mov al, byte [ebp + ecx + 0xc]
xor byte [esp + edx + 0x18], al
inc ecx
xor eax, eax
cmp ecx, ebx
cmove ecx, eax
inc edx
cmp edx, 8
jb 0x45c8ca
lea ecx, [esp + 0x128]
call fcn.0045bbe8
lea eax, [esp + 0x152]
mov dword [esp + 0x20], edi
push eax
lea ecx, [esp + 0x24]
call fcn.0044ea94
push 0x10
lea eax, [esp + 0x14]
push eax
push 0x10
push eax
lea ecx, [esp + 0x30]
call fcn.0044eb12
mov eax, dword [ebp + 0x14]
movzx eax, al
dec eax
je 0x45c92c
dec eax
je 0x45c925
mov ecx, dword [ebp + 0x10]
jmp 0x45c93e
push 5
pop ebx
push 7
jmp 0x45c92e
push 6
mov esi, dword [ebp + 0x10]
mov ecx, ebx
pop edi
mov edx, esi
call fcn.00448f6e
lea ecx, [esi + edi*2]
push 0x32
pop eax
sub eax, edi
push eax
push ecx
lea eax, [esp + 0x18]
push eax
call dword [0x467588]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4011b5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a11c]
jne 0x4011bf
repz ret
jmp fcn.00402702

Function at 0x403145
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00401f23
and dword [ebp - 4], 0
cmp dword [0x40b660], 0
mov ebx, eax
jne 0x4031f6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4032a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4032a7
push eax
call fcn.00401eb1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b660], eax
call esi
push eax
call fcn.00401eb1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b664], eax
call esi
push eax
call fcn.00401eb1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b668], eax
call esi
push eax
call fcn.00401eb1
pop ecx
mov dword [0x40b670], eax
test eax, eax
je 0x4031f6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00401eb1
pop ecx
mov dword [0x40b66c], eax
mov eax, dword [0x40b66c]
cmp eax, ebx
je 0x40324e
cmp dword [0x40b670], ebx
je 0x40324e
push eax
call fcn.00401f2c
push dword [0x40b670]
mov esi, eax
call fcn.00401f2c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40324e
test edi, edi
je 0x40324e
call esi
test eax, eax
je 0x403245
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403245
test byte [ebp - 0xc], 1
jne 0x40324e
or dword [ebp + 0x10], 0x200000
jmp 0x403287
mov eax, dword [0x40b664]
cmp eax, ebx
je 0x403287
push eax
call fcn.00401f2c
pop ecx
test eax, eax
je 0x403287
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403287
mov eax, dword [0x40b668]
cmp eax, ebx
je 0x403287
push eax
call fcn.00401f2c
pop ecx
test eax, eax
je 0x403287
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b660]
call fcn.00401f2c
pop ecx
test eax, eax
je 0x4032a7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4032a9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408962
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
dec eax
call fcn.0040898f
xor dword [edi], esi
mov edx, eax
inc edx
add edi, 1
add eax, 0xa8e13fa6
mov edx, 0x157c6cb3
cmp edi, ecx
jne fcn.00408962
ret
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
xor byte [0x75f644c3], ah
and eax, 0x75f644c3
stosb byte es:[edi], al
sal byte [ecx + 0x70], 0x4b
leave
loopne 0x4153df
add dword [ecx - 0x45d79a6], esp
mov word [esi - reloc.uxtheme.dll_HitTestThemeBackground], cs
neg dword [edi - 0x31]
leave
dec edx
add dword [ebx + 0x70], edi
invalid