joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4154e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x564372
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [esp + 0x20]
push eax
movzx eax, byte [eax + 4]
push eax
mov eax, dword [esp + 0x30]
push 0
push ecx
mov ecx, dword [esp + 0x34]
push edx
push eax
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.004153d0
add esp, 0x20
mov dword [esp + 0x18], 0
mov esi, dword [esp + 8]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00499450
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret 0xc
Function at 0x4189c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x55c27b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
push 8
call sub.mfc90u.dll_new_1
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0
test eax, eax
je 0x418a11
mov ecx, dword [esp + 0x24]
push eax
call fcn.00474300
mov esi, eax
jmp 0x418a13
xor esi, esi
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
push 0x411
call edx
push eax
mov eax, esi
mov ecx, 5
call fcn.0049cb20
mov ecx, dword [edi]
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x10], 0
mov dword [esp + 0x30], 0
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
lea edx, [esp + 0x10]
push edx
call eax
test al, al
je 0x418a97
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x18]
mov eax, dword [esp + 0x28]
mov dword [eax], edx
mov esi, ecx
call fcn.004011e0
push esi
call sub.mfc90u.dll_delete_1
mov ecx, dword [esp + 0x30]
add esp, 4
mov dword [ebp], ecx
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x14
ret 0xc
cmp dword [esp + 0x2c], 0
je 0x418abd
mov ecx, dword [esp + 0xc]
mov esi, ecx
test ecx, ecx
je 0x418ab6
call fcn.004011e0
push esi
call sub.mfc90u.dll_delete_1
add esp, 4
mov edx, dword [esp + 0x2c]
mov dword [ebp], edx
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x14
ret 0xc
Function at 0x436270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55e119
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
lea eax, [esp + 0x28]
push eax
call fcn.00413200
xor ebx, ebx
mov dword [esp + 0x1c], ebx
call fcn.00417450
mov edx, dword [eax + 0xc]
lea ecx, [eax + 0xc]
mov eax, dword [edx + 0x20]
push 0x412
call eax
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x30]
call fcn.0049cb20
mov dword [esp + 0x10], ebx
mov byte [esp + 0x1c], 2
mov dword [esp + 0xc], ebx
mov byte [esp + 0x1c], 4
xor esi, esi
call fcn.00417450
mov edx, dword [eax + 0xc]
mov edx, dword [edx + 0x50]
lea ecx, [eax + 0xc]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
call edx
test al, al
je 0x436303
mov eax, dword [esp + 0x10]
mov esi, dword [eax + 0x18]
jmp 0x436320
cmp dword [esp + 0xc], ebx
je 0x436320
call fcn.00417450
mov edx, dword [eax + 0xc]
mov edx, dword [edx + 0x18]
lea ecx, [eax + 0xc]
mov eax, dword [esp + 0xc]
push 1
push eax
call edx
mov byte [esp + 0x1c], 2
lea eax, [esp + 0xc]
push eax
call fcn.00401a00
mov byte [esp + 0x1c], bl
lea ecx, [esp + 0x10]
push ecx
call fcn.00401a80
mov dword [esp + 0x1c], 0xffffffff
call sub.python26.dll_PyGILState_Ensure
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x4364f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x558e29
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x20]
mov dword [ebx], vtable.ScriptRequest.0
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x24]
push 0
lea esi, [ebx + 4]
or edi, 0xffffffff
mov dword [ebx], vtable.StartMonitorServerRequest.0
call fcn.004993c0
mov byte [esp + 0x18], 1
mov eax, dword [esp + 0x28]
push 0
lea esi, [ebx + 8]
call fcn.004993c0
mov byte [esp + 0x18], 2
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x30]
push 0
lea esi, [ebx + 0x10]
call fcn.004993c0
mov byte [esp + 0x18], 3
cmp dword [esp + 0x34], 0
setne cl
mov byte [ebx + 0x14], cl
mov dword [esp + 0x18], edi
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0x18
Function at 0x436bf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x563fab
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
push 0x18
call sub.mfc90u.dll_new_1
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x436c4d
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push ecx
push eax
call fcn.004364f0
jmp 0x436c4f
xor eax, eax
mov dword [esp + 0x14], 0xffffffff
push 0x411
mov ecx, 0x32
lea esi, [esp + 0x30]
call fcn.00401a60
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14

Function at 0x439620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push ebx
mov eax, edi
call fcn.00439a00
test eax, eax
jl 0x43966a
mov edx, dword [edi + 0x33c]
lea esi, [edi + 0x33c]
push eax
mov eax, dword [edx + 0x1f4]
mov ecx, esi
call eax
push edi
mov eax, ebx
call fcn.0043a270
mov edx, dword [esi]
mov eax, dword [edx + 0x27c]
mov ecx, esi
call eax
pop esi
pop ebx
mov dword [esp + 4], eax
mov ecx, edi
jmp fcn.0043a900
pop esi
pop ebx
ret 4
Function at 0x43daf0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x558b5d
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea ecx, [esi + 4]
mov dword [esi], vtable.TermCommandLine.0
call fcn.004992d0
xor ebx, ebx
mov dword [esp + 0x14], ebx
lea ecx, [esi + 8]
call fcn.004992d0
mov byte [esp + 0x14], 1
lea ecx, [esi + 0xc]
call fcn.004992d0
mov byte [esp + 0x14], 2
lea eax, [esi + 0x10]
call fcn.00407ff0
mov byte [esp + 0x14], 3
lea ecx, [esi + 0x18]
call fcn.004992d0
mov byte [esp + 0x14], 4
lea ecx, [esi + 0x38]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], 0x7d00
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
call fcn.004992d0
mov byte [esp + 0x14], 5
lea ecx, [esi + 0x3c]
call fcn.004992d0
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x441930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x555482
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
xor ebx, ebx
mov dword [esi], vtable.TermEventHandler.0
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esp + 0x14], ebx
mov edx, 1
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], dl
mov byte [esi + 0xe], dl
mov byte [esi + 0xf], dl
lea eax, [esi + 0x30]
mov ecx, 8
jmp 0x441990
mov dword [eax - 0x20], ebx
mov dword [eax], 0xffffff
add eax, 4
sub ecx, edx
jne 0x441990
mov byte [esi + 0x50], bl
mov eax, dword [0x680770]
add eax, 0xb84
call fcn.0040f1f0
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x54], eax
xor ecx, ecx
mov eax, 0x27100
mov edx, 2
mul edx
seto cl
mov byte [esi + 0x58], bl
mov byte [esi + 0x5a], bl
mov byte [esi + 0x5b], bl
mov byte [esi + 0x60], bl
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
neg ecx
or ecx, eax
push ecx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov byte [esi + 0x9c], bl
mov dword [esi + 0xa0], ebx
call sub.mfc90u.dll_new__
lea ecx, [esi + 0xa4]
add esp, 4
mov dword [esp + 0x20], ecx
mov dword [ecx], eax
mov byte [esp + 0x14], 2
mov byte [esi + 0xa8], bl
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 0xc
Function at 0x451ae0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x558990
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push edi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
call fcn.00499c60
mov eax, dword [esp + 0x30]
or ecx, 0xffffffff
or edx, ecx
mov word [eax], cx
mov word [eax + 2], dx
cmp dword [esi], 0
jge 0x451b3b
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov edx, dword [esi]
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
push edx
lea edx, [esp + 0x18]
push edx
call eax
mov dword [esp + 0x24], 0
xor edi, edi
call fcn.0049a170
mov cx, word [eax]
mov eax, esi
call fcn.00451cb0
mov ebp, eax
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00499450
test ebp, ebp
jne 0x451c18
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov eax, dword [edx]
mov edi, dword [esi]
or ebx, 0xffffffff
call eax
movsx ecx, ax
cmp edi, ecx
jge 0x451bd9
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov edx, dword [edx + 0x14]
inc edi
push edi
lea eax, [esp + 0x1c]
push eax
call edx
mov dword [esp + 0x24], 1
xor edi, edi
call fcn.0049a170
mov cx, word [eax]
mov eax, esi
call fcn.00451cb0
mov ebx, eax
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00499450
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov edx, dword [eax]
mov edi, dword [esi]
call edx
cwde
cmp edi, eax
je 0x451bf3
cmp ebx, 1
je 0x451bf3
cmp ebx, 2
jne 0x451bf7
mov dword [esp + 0x10], edi
mov ebx, dword [esp + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x451c07
mov eax, dword [esi]
cmp ebx, eax
jge 0x451c24
dec eax
mov dword [esi], eax
test eax, eax
jge 0x451b41
mov ebx, dword [esp + 0x2c]
jmp 0x451c88
cmp ebp, 1
je 0x451c01
cmp ebp, 2
je 0x451c01
jmp 0x451bfb
sub bx, ax
movzx edi, bx
test eax, eax
jne 0x451c3f
cmp ebp, 1
je 0x451c3f
cmp ebp, 2
je 0x451c3f
mov dword [esi], 0xffffffff
inc edi
mov ebx, dword [esp + 0x2c]
movsx eax, di
lea eax, [eax + eax*4]
mov ecx, ebx
call fcn.004994c0
mov bp, word [esi]
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
push 0
inc bp
push edi
movzx ebp, bp
push ebp
push eax
mov eax, dword [edx + 0x2c]
call eax
movzx eax, ax
cwde
mov ecx, ebx
call fcn.00499c10
mov cx, word [esi]
mov eax, dword [esp + 0x30]
inc cx
mov word [eax], cx
mov dx, word [esi]
add dx, di
mov word [eax + 2], dx
mov eax, ebx
call fcn.00499c50
xor ecx, ecx
test al, al
sete cl
mov al, cl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x469180
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x55d39b
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, esi
call fcn.0049c9f0
xor ebx, ebx
mov dword [esp + 0x14], ebx
lea eax, [esi + 0x10]
push eax
mov dword [esi + 0xc], vtable.VUnknown_class_FileTransfer_.0
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov byte [esp + 0x14], 1
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esi], vtable.XYModemTransfer.0
mov dword [esi + 0xc], vtable.XYModemTransfer.1.0
mov dword [esi + 0x41c], eax
mov dword [esi + 0x420], ecx
mov dword [esi + 0x424], edi
cmp edi, ebx
je 0x4691fe
mov edx, dword [edi]
mov eax, dword [edx + 4]
push edi
call eax
mov byte [esp + 0x14], 2
lea eax, [esi + 0x428]
call fcn.00407ff0
mov byte [esp + 0x14], 3
lea ecx, [esi + 0x430]
call fcn.004992d0
mov byte [esp + 0x14], 4
lea ecx, [esi + 0x43c]
push ecx
mov dword [esi + 0x438], ebx
call fcn.0049df90
mov byte [esp + 0x14], 5
cmp dword [esp + 0x28], ebx
mov edx, dword [0x604608]
mov eax, dword [0x60460c]
setne cl
inc cl
mov byte [esi + 0x14], cl
mov ecx, dword [esi + 0x41c]
mov dword [esi + 0x488], eax
mov dword [esi + 0x458], ebx
mov dword [esi + 0x45c], ebx
mov dword [esi + 0x460], ebx
mov dword [esi + 0x464], ebx
mov byte [esi + 0x468], 1
mov dword [esi + 0x46c], ebx
mov dword [esi + 0x470], ebx
mov dword [esi + 0x474], ebx
mov byte [esi + 0x478], bl
mov dword [esi + 0x47c], ebx
mov byte [esi + 0x480], bl
mov dword [esi + 0x484], edx
mov dword [esi + 0x48c], ebx
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push 1
call eax
push str.VANDYKE_DONT_CHANGE_XMODEM_SEND_PACKET_SIZE
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
test eax, eax
setne cl
mov byte [esi + 0x478], cl
mov ecx, esi
call fcn.0049ca40
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 0x10

Function at 0x46a800
Capabilities:
Encode data using xor

Disassembly:
lea edx, [ecx + eax]
xor eax, eax
cmp ecx, edx
jae 0x46a831
push esi
lea ebx, [ebx]
movzx esi, ax
shl eax, 8
shr esi, 8
xor ax, word [esi*2 + 0x66f3e0]
movzx si, byte [ecx]
xor ax, si
inc ecx
movzx eax, ax
cmp ecx, edx
jb 0x46a810
pop esi
ret
Function at 0x46afd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x55d304
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov eax, edi
call fcn.0049c9f0
xor ebx, ebx
mov dword [esp + 0x20], ebx
lea eax, [edi + 0x10]
push eax
mov dword [edi + 0xc], vtable.VUnknown_class_FileTransfer_.0
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov byte [esp + 0x20], 1
mov eax, esi
mov dword [edi], vtable.ZModemTransfer.0
mov dword [edi + 0xc], vtable.ZModemTransfer.1.0
mov dword [edi + 0x18], ebp
mov dword [edi + 0x1c], esi
call fcn.0049cb10
mov dword [edi + 0x20], eax
mov eax, ebp
call fcn.00441810
add eax, 0x201c
mov dword [edi + 0x24], eax
lea eax, [edi + 0x34]
push eax
mov dword [edi + 0x28], ebx
mov byte [edi + 0x2c], bl
mov dword [edi + 0x30], ebx
call fcn.0049df90
mov byte [esp + 0x20], 2
lea esi, [edi + 0x964]
mov eax, 0x400
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x960], ebx
call fcn.00402840
mov byte [esp + 0x20], 3
lea ecx, [edi + 0xdc4]
mov dword [edi + 0x99c], ebx
mov dword [edi + 0xda0], ebx
mov dword [edi + 0xda8], ebx
mov dword [edi + 0xdac], ebx
mov dword [edi + 0xdb0], ebx
mov dword [edi + 0xdb4], ebx
mov dword [edi + 0xdb8], ebx
mov dword [edi + 0xdbc], ebx
mov dword [edi + 0xdc0], ebx
call fcn.004992d0
mov byte [esp + 0x20], 4
mov byte [edi + 0xdc8], bl
mov byte [edi + 0xdc9], bl
call fcn.00493a10
mov ecx, edi
call fcn.0049ca40
mov eax, 0x1388
lea esi, [ebx + 0x4d]
mov ecx, edi
call fcn.0049cb40
push 0x2c
call sub.mfc90u.dll_new_1
add esp, 4
mov dword [esp + 0x2c], eax
mov byte [esp + 0x20], 5
cmp eax, ebx
je 0x46b123
mov ecx, dword [edi + 0x18]
push 0x60ae44
push ecx
push eax
call fcn.00409100
jmp 0x46b125
xor eax, eax
mov byte [esp + 0x20], 4
mov dword [edi + 0x14], eax
mov eax, dword [edi + 0x18]
call fcn.00441810
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x64]
call eax
movzx ecx, al
push ecx
mov byte [edi + 0x2c], al
call fcn.00493a10
mov eax, dword [edi + 0x18]
add esp, 4
mov byte [edi + 0xdca], 1
call fcn.00441810
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x60]
push 1
call eax
mov eax, dword [edi + 0x18]
call fcn.00441810
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x64]
call eax
movzx ecx, al
push ecx
call fcn.00493a10
add esp, 4
call fcn.00493a10
mov eax, dword [edi + 0x1c]
cmp eax, ebx
je 0x46b1a3
call fcn.00416730
test al, al
jne 0x46b1a3
mov dword [edi + 0xdbc], 2
mov dword [esp + 0x20], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x46c010
Capabilities:
Hash data with crc32

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
call fcn.00493a10
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x17]
mov ecx, ebp
or esi, 0xffffffff
mov byte [esp + 0x1c], 0
xor ebx, ebx
call fcn.0046cc10
test eax, eax
je 0x46c088
lea esp, [esp]
mov cl, byte [esp + 0x18]
test cl, cl
jne 0x46c050
cmp ebx, 0x900
jae 0x46c098
mov al, byte [esp + 0x13]
mov edx, esi
movzx edi, al
and edx, 0xff
xor edx, edi
shr esi, 8
xor esi, dword [edx*4 + 0x66f5e0]
test cl, cl
jne 0x46c0b3
mov byte [ebx + ebp + 0x60], al
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x17]
mov ecx, ebp
inc ebx
call fcn.0046cc10
test eax, eax
jne 0x46c040
call fcn.00493a10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
call fcn.00493a10
call fcn.00493a10
push ebp
call fcn.0046e8e0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x1c]
mov byte [ecx], al
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 0
mov byte [esp + 0x1e], 0
mov byte [esp + 0x1f], 0
xor edi, edi
nop
lea edx, [esp + 0x18]
push edx
lea eax, [esp + edi + 0x20]
mov ecx, ebp
call fcn.0046cc10
test eax, eax
je 0x46c088
inc edi
cmp edi, 4
jb 0x46c0d0
lea ecx, [esp + 0x1c]
call fcn.0046afa0
not esi
cmp eax, esi
je 0x46c124
push ebx
call fcn.00493a10
push eax
call fcn.00493a10
push esi
call fcn.00493a10
add esp, 0xc
call fcn.00493a10
push ebp
call fcn.0046e8e0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
call fcn.00493a10
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret 8
Function at 0x46d3a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
mov esi, eax
call fcn.00493a10
xor edi, edi
xor eax, eax
add esp, 4
cmp ebp, edi
mov dword [esi + 0x960], edi
mov word [esi + 0x990], ax
jle 0x46d411
push ebx
jmp 0x46d3d0
mov ecx, dword [esp + 0x14]
mov bl, byte [edi + ecx]
mov byte [esp + 0x18], bl
mov edx, dword [esp + 0x18]
push edx
call fcn.0046d640
movzx eax, word [esi + 0x990]
movzx ecx, ax
shl eax, 8
shr ecx, 8
xor ax, word [ecx*2 + 0x66f3e0]
movzx dx, bl
xor ax, dx
inc edi
cmp edi, ebp
mov word [esi + 0x990], ax
jl 0x46d3d0
pop ebx
call fcn.00493a10
mov cl, 0x6b
mov eax, esi
call fcn.0046d380
pop edi
pop esi
pop ebp
ret 8

Function at 0x46d4f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
mov esi, eax
call fcn.00493a10
xor edi, edi
add esp, 4
cmp ebp, edi
mov dword [esi + 0x960], edi
mov dword [esi + 0x994], 0xffffffff
jle 0x46d553
lea ecx, [ecx]
movzx eax, byte [edi + ebx]
push eax
call fcn.0046d640
mov eax, dword [esi + 0x994]
movzx edx, byte [edi + ebx]
mov ecx, eax
and ecx, 0xff
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x66f5e0]
inc edi
cmp edi, ebp
mov dword [esi + 0x994], eax
jl 0x46d520
call fcn.00493a10
push 0x6b
mov eax, esi
call fcn.0046d570
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x46d570
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [esp + 8]
push esi
mov esi, eax
call fcn.00493a10
mov cl, 0x18
call fcn.0046d620
mov cl, bl
call fcn.0046d620
mov eax, dword [esi + 0x994]
mov ecx, eax
movzx edx, bl
and ecx, 0xff
shr eax, 8
xor ecx, edx
xor eax, dword [ecx*4 + 0x66f5e0]
not eax
push eax
mov dword [esi + 0x994], eax
call fcn.00493a10
movzx eax, byte [esi + 0x994]
add esp, 4
push eax
call fcn.0046d640
mov ecx, dword [esi + 0x994]
shr ecx, 8
push ecx
call fcn.0046d640
movzx edx, byte [esi + 0x996]
push edx
call fcn.0046d640
movzx eax, byte [esi + 0x997]
push eax
call fcn.0046d640
call fcn.00493a10
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x960]
mov edx, dword [ecx]
mov edx, dword [edx + 0x8c]
push eax
add esi, 0x60
push esi
call edx
pop esi
pop ebx
ret 4
Function at 0x46eea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55d204
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov dword [esi + 4], vtable.IContainedType.0
xor eax, eax
mov dword [esi], vtable.ScriptObjectDispatchImpl_struct_IApplication_.1.0
mov dword [esi + 4], vtable.ScriptObjectDispatchImpl_struct_IApplication_.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esp + 0x1c], eax
lea edi, [esi + 0x14]
push edi
mov dword [esi], vtable.ApplicationDisp.0
mov dword [esi + 4], vtable.ApplicationDisp.1.0
call fcn.00481ae0
mov byte [esp + 0x1c], 1
lea ebx, [esi + 0x30]
push ebx
call fcn.0046f0d0
mov byte [esp + 0x1c], 2
lea ebp, [esi + 0x44]
push ebp
call fcn.0046f1b0
mov byte [esp + 0x1c], 3
lea eax, [esi + 0x58]
push eax
call fcn.0046f290
mov byte [esp + 0x1c], 4
lea eax, [esi + 0x6c]
push eax
call fcn.0046f370
mov byte [esp + 0x1c], 5
lea eax, [esi + 0x80]
push eax
call fcn.0046f450
mov byte [esp + 0x1c], 6
lea eax, [esi + 0x94]
push eax
call fcn.00473d40
mov byte [esp + 0x1c], 7
lea edx, [esi + 0xac]
call fcn.00483400
lea eax, [esi + 0xb8]
call fcn.00496b80
mov byte [esp + 0x1c], 8
test edi, edi
je 0x46ef81
lea eax, [esi + 0x18]
jmp 0x46ef83
xor eax, eax
push eax
push esi
call fcn.0046ffa0
test ebx, ebx
je 0x46ef93
lea eax, [esi + 0x34]
jmp 0x46ef95
xor eax, eax
push eax
push esi
call fcn.0046ffa0
test ebp, ebp
je 0x46efa5
lea eax, [esi + 0x48]
jmp 0x46efa7
xor eax, eax
push eax
push esi
call fcn.0046ffa0
lea eax, [esi + 0x58]
test eax, eax
je 0x46efba
lea eax, [esi + 0x5c]
jmp 0x46efbc
xor eax, eax
push eax
push esi
call fcn.0046ffa0
lea eax, [esi + 0x6c]
test eax, eax
je 0x46efcf
lea eax, [esi + 0x70]
jmp 0x46efd1
xor eax, eax
push eax
push esi
call fcn.0046ffa0
lea eax, [esi + 0x80]
test eax, eax
je 0x46efea
lea eax, [esi + 0x84]
jmp 0x46efec
xor eax, eax
push eax
push esi
call fcn.0046ffa0
lea eax, [esi + 0x94]
test eax, eax
je 0x46f005
lea eax, [esi + 0x98]
jmp 0x46f007
xor eax, eax
push eax
push esi
call fcn.0046ffa0
lea eax, [esi + 0xac]
push eax
push esi
call fcn.0046ffa0
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4