joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fed0
Capabilities:
Print debug messages

Disassembly:
push 0x43c
mov eax, 0x52fde7
call fcn.0049fba2
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x444]
mov ebx, dword [ebp + 0xc]
call fcn.0042ee4c
xor edi, edi
lea ecx, [ebp - 0x438]
mov dword [ebp - 4], edi
call fcn.0042ee4c
push ebx
push esi
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 1
push 0x546080
push eax
call fcn.0042f4b2
add esp, 0x10
lea ecx, [ebp - 0x438]
call fcn.00431001
push eax
mov esi, SysReAllocStringLen
lea ecx, [ebp - 0x42c]
push esi
call fcn.0042a3d3
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 2
call fcn.0042ce42
test eax, eax
jne 0x43ff79
lea ecx, [ebp - 0x42c]
call fcn.0044409e
push eax
push ebx
lea eax, [ebp - 0x444]
push str.RemoveRegKey_failed_subkey__s__DeleteAllow__d
push eax
call fcn.0042f4b2
add esp, 0x10
lea ecx, [ebp - 0x444]
call fcn.00431001
push eax
jmp 0x43ffa7
lea ecx, [ebp - 0x448]
call fcn.00439339
push edi
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 3
call fcn.00431001
push eax
push esi
call fcn.0042bf76
add esp, 0xc
test eax, eax
jne 0x43ffaf
push str.CRegistry::RecurDeleteKey_RegDeleteKey_Failed_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x43ffb2
xor edi, edi
inc edi
lea ecx, [ebp - 0x42c]
call fcn.0042a562
lea ecx, [ebp - 0x438]
call fcn.0042ee5d
lea ecx, [ebp - 0x444]
call fcn.0042ee5d
mov eax, edi
call fcn.0049fb4c
ret

Function at 0x43ffdb
Capabilities:
Print debug messages

Disassembly:
push 0x440
mov eax, 0x52fe42
call fcn.0049fba2
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x448]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x430], eax
call fcn.0042ee4c
xor edi, edi
lea ecx, [ebp - 0x43c]
mov dword [ebp - 4], edi
call fcn.0042ee4c
push ebx
push esi
lea eax, [ebp - 0x43c]
mov byte [ebp - 4], 1
push 0x546080
push eax
call fcn.0042f4b2
add esp, 0x10
lea ecx, [ebp - 0x43c]
call fcn.00431001
push eax
mov esi, SysReAllocStringLen
lea ecx, [ebp - 0x42c]
push esi
call fcn.0042a3d3
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 2
call fcn.0042ce60
test eax, eax
jne 0x44008d
lea ecx, [ebp - 0x42c]
call fcn.0044409e
push eax
push ebx
lea eax, [ebp - 0x448]
push str.RemoveRegValue_failed_subkey__s__DeleteAllow__d
push eax
call fcn.0042f4b2
add esp, 0x10
lea ecx, [ebp - 0x448]
call fcn.00431001
push eax
jmp 0x4400c1
lea ecx, [ebp - 0x44c]
call fcn.00439339
push edi
push dword [ebp - 0x430]
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 3
call fcn.00431001
push eax
push esi
call fcn.0042abc1
add esp, 0x10
test eax, eax
jne 0x4400c9
push str.RemoveRegValue::DeleteValue_Failed_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4400cc
xor edi, edi
inc edi
lea ecx, [ebp - 0x42c]
call fcn.0042a562
lea ecx, [ebp - 0x43c]
call fcn.0042ee5d
lea ecx, [ebp - 0x448]
call fcn.0042ee5d
mov eax, edi
call fcn.0049fb4c
ret
Function at 0x440f49
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x59cd24]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push edi
push eax
mov dword [ebp - 0x620], eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test esi, esi
jne 0x441046
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.0044447b
lea eax, [ebp - 0x628]
push eax
call fcn.00444472
push 0x208
mov esi, eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c4160
push dword [esi]
mov eax, dword [esi + 0x14]
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push dword [esi + 0x10]
push eax
lea eax, [ebp - 0x20c]
push str.._d._d._d._d._d._d.bak
push eax
call fcn.004392ce
push 0x410
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.004c4160
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x61c]
add esp, 0x40
push edi
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x61c]
push 1
push eax
push edi
call ebx
push dword [ebp + 0x10]
push edi
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
lea eax, [ebp - 0x61c]
test esi, esi
je 0x44103f
push 4
push 0
jmp 0x441042
push 1
push edi
push eax
call ebx
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0049fb26
leave
ret

Function at 0x44387e
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x5a1000]
test eax, eax
je 0x4438b8
push 0x7530
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4438a5
push 0xffffffffffffffff
push dword [0x5a1000]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x5a1000]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x5a1000], 0
mov eax, dword [0x5a0ffc]
test eax, eax
je 0x4438f2
push 0x7530
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4438df
push 0xffffffffffffffff
push dword [0x5a0ffc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [0x5a0ffc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [0x5a0ffc], 0
ret

Function at 0x4449bf
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push edi
push 7
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x444a04
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x444a0c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0xea60
jb 0x4449d8
pop edi
leave
ret
Function at 0x44a647
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x59cd24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
mov dword [ebp - 0x210], esi
push edi
push eax
call fcn.004c4160
add esp, 0xc
mov dword [ebp - 0x210], edi
lea eax, [ebp - 0x210]
push eax
push 0x1a
push edi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 0x210], edi
jne 0x44a6a0
push 0x542930
jmp 0x44a6cc
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 0x210]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], edi
push eax
mov ecx, esi
call fcn.0041be16
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0049fb26
leave
ret

Function at 0x44c2bb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x53172f
call fcn.0049fc10
mov esi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x428]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
call fcn.0041289b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x430]
push esi
call fcn.00449075
lea ecx, [ebp - 0x418]
call fcn.00448f13
push 0x400
push edi
mov byte [ebp - 4], 1
call fcn.0044b14a
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
pop ecx
pop ecx
push 0x60
push 0
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x44c351
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x44c351
call fcn.00449a69
mov esi, eax
jmp 0x44c43d
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x44c374
call fcn.00449a69
jmp 0x44c430
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
je 0x44c36a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x44c3a9
mov esi, 0x8007000e
jmp 0x44c432
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00449816
jmp 0x44c3d3
lea ecx, [ebp - 0x418]
mov dword [ebp - 4], 1
call fcn.00449227
test eax, eax
je 0x44c39f
push esi
push eax
push esi
push ebx
push 0
call fcn.0040f68f
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
je 0x44c36a
lea ecx, [ebp - 0x418]
call fcn.00449227
push dword [ebp + 0x14]
xor ecx, ecx
mov word [eax + esi*2], cx
lea ecx, [ebp - 0x418]
call fcn.00449227
push eax
lea ecx, [ebp - 0x430]
call fcn.0044c174
mov esi, eax
test edi, edi
je 0x44c43d
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x418]
call fcn.0044912a
lea ecx, [ebp - 0x428]
call fcn.00412fe2
mov eax, esi
call fcn.0049fb5d
ret 0x10
Function at 0x44d04b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 1
mov esi, ecx
call fcn.0044db01
test eax, eax
je 0x44d099
mov ecx, dword [esi]
push edi
push 0
push 0
mov eax, dword [ecx]
call dword [eax + 0x28]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov ecx, esi
call fcn.0044adac
test eax, eax
jne 0x44d095
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, dword [ebp + 8]
jb 0x44d075
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 4

Function at 0x44d82a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
xor ebx, ebx
xor eax, eax
push ebx
push ebx
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x44d8ee
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, ebx
mov dword [ebp - 4], eax
imul ebx, dword [ebp + 8], 0x3e8
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, ebx
ja 0x44d8e6
push 0x1cff
push ebx
push 0
lea eax, [ebp - 8]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor ecx, ecx
sub eax, ecx
je 0x44d8e6
sub eax, 1
jne 0x44d8e6
push 1
push ecx
push ecx
push ecx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x44d867
xor esi, esi
inc esi
cmp dword [ebp - 0x28], 0x12
lea eax, [ebp - 0x2c]
push eax
cmove edi, esi
mov ebx, edi
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x44d8a9
mov esi, dword [ebp - 0xc]
test ebx, ebx
jne 0x44d8e6
mov ebx, dword [ebp - 0x10]
jmp 0x44d867
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44e920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x59cd24]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0xc
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], esi
jge 0x44e961
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049fb26
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5a1194]
inc eax
mov dword [0x5a1194], eax
cmp eax, 1
jne 0x44e986
push 0
call fcn.004f5385
xor eax, 0xbb40e64e
push eax
call fcn.004f64cc
add esp, 8
push esi
push edi
push ebx
call fcn.0044eaf0
add esp, 0xc
mov dword [ebp - 0x18], 0
call fcn.004f64ab
sar eax, 7
movzx edx, al
push esi
push edi
mov dword [ebp - 0x20], edx
call fcn.0044ea90
push edx
push esi
push edi
mov ebx, eax
call fcn.0044eb60
mov ecx, dword [ebp - 0x18]
add esp, 0x14
mov eax, dword [ebp - 0x20]
xor al, bl
mov byte [ebp + ecx - 0x10], al
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0xa
jl 0x44e998
push esi
push edi
push dword [ebp - 0x1c]
call fcn.0044eaf0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 0x18], edx
sub eax, edx
mov dword [ebp - 0x20], 0xa
mov dword [ebp - 0x1c], eax
push esi
push edi
call fcn.0044ea90
mov ebx, eax
mov eax, dword [ebp - 0x1c]
mov al, byte [eax + edx]
movzx ecx, al
push ecx
push esi
push edi
mov byte [ebp - 0x11], al
call fcn.0044eb60
mov edx, dword [ebp - 0x18]
add esp, 0x14
mov al, byte [ebp - 0x11]
xor al, bl
mov byte [edx], al
inc edx
sub dword [ebp - 0x20], 1
mov dword [ebp - 0x18], edx
jne 0x44e9f1
push esi
push edi
call fcn.0044ea90
mov esi, dword [ebp + 0x1c]
mov ebx, esi
shr ebx, 0x10
movzx ecx, bl
push ecx
push dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
push edi
call fcn.0044eb60
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
xor bl, byte [ebp - 0x1c]
push edx
push edi
mov byte [eax + 0xa], bl
call fcn.0044ea90
shr esi, 0x18
mov ebx, eax
push esi
push edx
push edi
call fcn.0044eb60
mov ecx, dword [ebp - 0x24]
add esp, 0x28
mov eax, esi
xor al, bl
mov byte [ecx + 0xb], al
mov eax, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049fb26
mov esp, ebp
pop ebp
ret

Function at 0x44eb60
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebx]
mov eax, ecx
xor eax, dword [ebp + 0x10]
mov edx, dword [ebx + 8]
movzx eax, al
shr ecx, 8
mov eax, dword [esi + eax*4]
xor eax, ecx
mov dword [ebx], eax
movzx eax, al
add eax, dword [ebx + 4]
imul ecx, eax, 0x8088405
mov eax, dword [ebp + 0x10]
inc ecx
mov dword [ebx + 4], ecx
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [esi + ecx*4]
pop esi
mov dword [ebx + 8], edx
pop ebx
pop ebp
ret
Function at 0x44ebb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
test esi, esi
jne 0x44ebcd
lea eax, [edi - 0x66]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x2c], 1
jne 0x44ebde
push esi
call fcn.0044edb0
add esp, 4
mov edi, eax
mov eax, dword [ebp + 0xc]
push ebx
test eax, eax
jne 0x44ebf8
mov eax, dword [esi + 0x40b4]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x44ebf8
mov dword [ebp - 8], eax
jmp 0x44ec0c
mov ebx, eax
lea ecx, [ebx + 1]
nop dword [eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x44ec00
sub ebx, ecx
mov dword [ebp - 8], ebx
push dword [esi + 0x20]
mov eax, dword [esi + 0xc]
push dword [esi + 0x1c]
call eax
add esp, 8
mov ebx, eax
mov dword [ebp + 8], ebx
test edi, edi
jne 0x44ec6b
mov ebx, dword [esi + 0x24]
test ebx, ebx
je 0x44ec68
xor eax, eax
nop dword [eax]
test edi, edi
jne 0x44ec5c
mov eax, dword [ebx + 8]
test eax, eax
je 0x44ec59
push eax
lea eax, [ebx + 0x10]
push eax
push dword [esi + 0x20]
mov eax, dword [esi + 8]
push dword [esi + 0x1c]
call eax
add esp, 0x10
cmp eax, dword [ebx + 8]
mov eax, 0xffffffff
cmovne edi, eax
mov eax, dword [ebp - 4]
add eax, dword [ebx + 8]
mov ebx, dword [ebx]
mov dword [ebp - 4], eax
test ebx, ebx
jne 0x44ec30
mov ebx, dword [ebp + 8]
push dword [esi + 0x24]
call fcn.0044eac0
add esp, 4
test edi, edi
jne 0x44ed71
push 4
push 0x6054b50
push dword [esi + 0x20]
push esi
call fcn.0044fe70
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x44ed71
push 2
push eax
push dword [esi + 0x20]
push esi
call fcn.0044fe70
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x44ed71
push 2
push eax
push dword [esi + 0x20]
push esi
call fcn.0044fe70
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x44ed71
push 2
push dword [esi + 0x40b0]
push dword [esi + 0x20]
push esi
call fcn.0044fe70
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x44ed71
push 2
push dword [esi + 0x40b0]
push dword [esi + 0x20]
push esi
call fcn.0044fe70
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x44ed71
push 4
push dword [ebp - 4]
push dword [esi + 0x20]
push esi
call fcn.0044fe70
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x44ed71
sub ebx, dword [esi + 0x40ac]
push 4
push ebx
push dword [esi + 0x20]
push esi
call fcn.0044fe70
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x44ed71
mov ebx, dword [ebp - 8]
push 2
push ebx
push dword [esi + 0x20]
push esi
call fcn.0044fe70
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x44ed71
test ebx, ebx
je 0x44ed71
mov eax, dword [esi + 8]
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x20]
push dword [esi + 0x1c]
call eax
add esp, 0x10
cmp eax, ebx
mov ebx, 0xffffffff
cmovne edi, ebx
jmp 0x44ed74
or ebx, 0xffffffff
push dword [esi + 0x20]
mov eax, dword [esi + 0x14]
push dword [esi + 0x1c]
call eax
add esp, 8
test eax, eax
je 0x44ed8b
test edi, edi
cmove edi, ebx
mov eax, dword [esi + 0x40b4]
pop ebx
test eax, eax
je 0x44ed9f
push eax
call fcn.004cdece
add esp, 4
push esi
call fcn.004cdece
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44edd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x44efcc
cmp dword [esi + 0x2c], eax
je 0x44efcc
cmp dword [esi + 0x80], 8
push ebx
push edi
mov dword [esi + 0x34], eax
jne 0x44ee3f
cmp dword [esi + 0x84], eax
jne 0x44ee3f
lea ebx, [esi + 0x30]
cmp dword [esi + 0x40], 0
jne 0x44ee25
push esi
call fcn.0044efe0
lea eax, [esi + 0x88]
mov dword [esi + 0x40], 0x4000
add esp, 4
mov dword [esi + 0x3c], eax
mov edi, dword [esi + 0x44]
push 4
push ebx
call fcn.0045082c
mov ecx, dword [esi + 0x44]
add esp, 8
sub ecx, edi
add dword [esi + 0x6c], ecx
test eax, eax
je 0x44ee06
xor ecx, ecx
cmp eax, 1
cmovne ecx, eax
or ebx, 0xffffffff
cmp dword [esi + 0x6c], 0
mov edi, ecx
jbe 0x44ee64
test ecx, ecx
jne 0x44ee64
push esi
call fcn.0044efe0
add esp, 4
cmp eax, ebx
cmove edi, ebx
cmp dword [esi + 0x80], 8
jne 0x44ee8b
cmp dword [esi + 0x84], 0
jne 0x44ee9f
lea eax, [esi + 0x30]
push eax
call fcn.00450bcf
add esp, 4
mov dword [esi + 0x68], 0
mov edi, eax
cmp dword [esi + 0x84], 0
jne 0x44ee9f
mov ecx, dword [esi + 0x408c]
mov eax, dword [esi + 0x38]
jmp 0x44eea5
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ebx, dword [esi + 0x40a4]
add ebx, dword [esi + 0x44]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x74]
push 4
push ecx
add eax, 0x10
mov dword [ebp - 4], ecx
push eax
call fcn.0044fed0
mov eax, dword [esi + 0x74]
push 4
add eax, 0x14
push ebx
push eax
call fcn.0044fed0
add esp, 0x18
cmp dword [esi + 0x5c], 1
jne 0x44eeee
mov eax, dword [esi + 0x74]
push 2
add eax, 0x24
push 1
push eax
call fcn.0044fed0
add esp, 0xc
mov eax, dword [esi + 0x74]
push 4
push dword [ebp + 8]
add eax, 0x18
push eax
call fcn.0044fed0
add esp, 0xc
test edi, edi
jne 0x44ef1a
push dword [esi + 0x78]
lea eax, [esi + 0x24]
push dword [esi + 0x74]
push eax
call fcn.0044e840
add esp, 0xc
mov edi, eax
push dword [esi + 0x74]
call fcn.004cdece
add esp, 4
test edi, edi
jne 0x44efb6
push dword [esi + 0x20]
mov eax, dword [esi + 0xc]
push dword [esi + 0x1c]
call eax
mov ecx, dword [esi + 0x70]
push edi
add ecx, 0xe
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x10]
push ecx
push dword [esi + 0x20]
push dword [esi + 0x1c]
call eax
add esp, 0x18
test eax, eax
je 0x44ef5a
or edi, 0xffffffff
jmp 0x44ef99
push 4
push dword [ebp - 4]
push dword [esi + 0x20]
push esi
call fcn.0044fe70
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x44ef99
push 4
push ebx
push dword [esi + 0x20]
push esi
call fcn.0044fe70
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x44ef99
push 4
push dword [ebp + 8]
push dword [esi + 0x20]
push esi
call fcn.0044fe70
add esp, 0x10
mov edi, eax
mov eax, dword [esi + 0x10]
push 0
push dword [ebp - 8]
push dword [esi + 0x20]
push dword [esi + 0x1c]
call eax
add esp, 0x10
test eax, eax
mov eax, 0xffffffff
cmovne edi, eax
inc dword [esi + 0x40b0]
mov eax, edi
pop edi
pop ebx
mov dword [esi + 0x2c], 0
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0xffffff9a
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44efe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x4090], ebx
je 0x44f049
cmp dword [esi + 0x6c], ebx
jbe 0x44f049
mov ecx, 0xffffff78
lea eax, [esi + 0x4094]
sub ecx, esi
push edi
lea edi, [esi + 0x88]
mov dword [ebp + 8], ecx
nop
mov edx, dword [esi + 0x40a0]
push edx
push eax
call fcn.0044ea90
movzx ecx, byte [edi]
mov ebx, eax
push ecx
push edx
lea eax, [esi + 0x4094]
push eax
call fcn.0044eb60
xor byte [edi], bl
add esp, 0x14
mov eax, dword [ebp + 8]
inc edi
add eax, edi
cmp eax, dword [esi + 0x6c]
lea eax, [esi + 0x4094]
jb 0x44f010
xor ebx, ebx
pop edi
push dword [esi + 0x6c]
mov ecx, dword [esi + 8]
lea eax, [esi + 0x88]
push eax
push dword [esi + 0x20]
push dword [esi + 0x1c]
call ecx
add esp, 0x10
or ecx, 0xffffffff
cmp eax, dword [esi + 0x6c]
mov dword [esi + 0x6c], 0
cmovne ebx, ecx
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x451063
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x24]
mov ecx, dword [edi + 0x6c]
mov esi, dword [edi + 0x34]
mov edx, dword [edi + 0x64]
sub esi, edx
sub esi, ecx
mov dword [ebp - 8], esi
jne 0x451092
test edx, edx
jne 0x45109f
test ecx, ecx
jne 0x45109f
mov esi, ebx
jmp 0x451121
cmp esi, 0xffffffff
jne 0x45109f
push 0xfffffffffffffffe
pop esi
jmp 0x451121
mov eax, dword [edi + 0x24]
add eax, 0xfffffefa
add eax, ebx
cmp edx, eax
jb 0x451121
mov ecx, dword [edi + 0x30]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.004c3660
mov ecx, dword [edi + 0x44]
add esp, 0xc
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], ebx
sub dword [edi + 0x64], ebx
sub dword [edi + 0x54], ebx
mov dword [ebp - 4], ecx
lea edi, [eax + ecx*2]
lea edi, [edi - 2]
xor ecx, ecx
movzx eax, word [edi]
mov edx, eax
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
sub dword [ebp - 4], 1
mov word [edi], cx
jne 0x4510d3
mov edi, dword [ebp + 8]
mov ecx, ebx
mov esi, ecx
mov eax, dword [edi + 0x38]
lea edi, [eax + ecx*2]
lea edi, [edi - 2]
xor ecx, ecx
movzx eax, word [edi]
mov edx, eax
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [edi], cx
sub esi, 1
jne 0x4510fd
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
add esi, ebx
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x45117e
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
push esi
push eax
push ecx
call fcn.004513d6
add dword [edi + 0x6c], eax
add esp, 0xc
mov ecx, dword [edi + 0x6c]
cmp ecx, 3
jb 0x45116a
mov edx, dword [edi + 0x64]
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x50]
movzx esi, byte [edx + eax]
mov dword [edi + 0x40], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
mov ecx, dword [edi + 0x6c]
xor esi, eax
and esi, dword [edi + 0x4c]
mov dword [edi + 0x40], esi
cmp ecx, 0x106
jae 0x45117e
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x451074
pop edi
pop esi
pop ebx
leave
ret