joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b673
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x41b695
cmp dword [edi + 0x3c], 0
jne 0x41b695
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.004220db
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0041b6c2
pop edi
pop esi
pop ebx
ret 8

Function at 0x41ba02
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4233fc
call fcn.0040fb60
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.004220db
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x41ba41
call fcn.004220db
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41ba4f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41ba5d
or eax, 0xffffffff
jmp 0x41bb45
mov ecx, esi
call fcn.0041b978
mov dword [ebp - 0x14], eax
call fcn.0041c81a
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x41ba94
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41ba94
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0041c7ce
push dword [ebp - 0x14]
call fcn.0041c300
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0041b710
cmp eax, edi
je 0x41bb07
test byte [esi + 0x24], 0x10
je 0x41bad5
push 4
mov ecx, esi
pop ebx
call fcn.0041e947
test ah, 1
je 0x41bacd
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.0041e33b
cmp dword [esi + 0x1c], edi
je 0x41bb07
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0041e9ac
jmp 0x41bb07
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x41bb1b
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x41bb34
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x41bb34
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0041b9b2
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x41e1e9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41e22b
call fcn.004220db
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41e22b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41e222
xor eax, eax
jmp 0x41e233
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041e239
pop edi
pop esi
pop ebx
ret 4

Function at 0x422638
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x422666
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x422684
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042259e
jmp 0x422684
mov eax, dword [esi + 0x14]
test eax, eax
je 0x422684
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0042259e
test edi, edi
mov eax, edi
jne 0x42266e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x423b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ecx, dword ds:[eax + 0x3c]
mov edx, eax
push dword ds:[ecx + edx + 0x78]
push edx
pop edx
pop eax
add eax, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x423bbe
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
cmp edx, dword [ecx + 0x18]
jae 0x423c71
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
add ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov cl, byte [eax]
mov byte [ebp - 0x19], cl
mov edx, dword [ebp - 0x14]
cmp cl, byte [edx]
jne 0x423c2b
cmp byte [ebp - 0x19], 0
je 0x423c22
mov eax, dword [ebp - 0x18]
mov cl, byte [eax + 1]
mov byte [ebp - 0x1a], cl
mov edx, dword [ebp - 0x14]
cmp cl, byte [edx + 1]
jne 0x423c2b
add dword [ebp - 0x18], 2
add dword [ebp - 0x14], 2
cmp byte [ebp - 0x1a], 0
jne 0x423bee
mov dword [ebp - 0x20], 0
jmp 0x423c33
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
jne 0x423c6c
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dx, word [eax + ecx*2]
mov word [ebp - 0x10], dx
mov eax, dword [ebp - 4]
mov ecx, dword ds:[eax + 0x1c]
add ecx, dword [ebp + 8]
movzx edx, word [ebp - 0x10]
mov eax, dword ds:[ecx + edx*4]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
jmp 0x423bb5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x40f008]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x9c
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.00404e20
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x9c], 6
sete al
xor ecx, ebp
call fcn.00401c57
leave
ret
Function at 0x401c57
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f008]
jne 0x401c61
repz ret
jmp fcn.004024ec

Function at 0x405f6b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403148
and dword [ebp - 4], 0
cmp dword [0x410950], 0
mov ebx, eax
jne 0x40601c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4060cd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4060cd
push eax
call fcn.004030d6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x410950], eax
call esi
push eax
call fcn.004030d6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x410954], eax
call esi
push eax
call fcn.004030d6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x410958], eax
call esi
push eax
call fcn.004030d6
pop ecx
mov dword [0x410960], eax
test eax, eax
je 0x40601c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004030d6
pop ecx
mov dword [0x41095c], eax
mov eax, dword [0x41095c]
cmp eax, ebx
je 0x406074
cmp dword [0x410960], ebx
je 0x406074
push eax
call fcn.00403151
push dword [0x410960]
mov esi, eax
call fcn.00403151
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406074
test edi, edi
je 0x406074
call esi
test eax, eax
je 0x40606b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40606b
test byte [ebp - 0xc], 1
jne 0x406074
or dword [ebp + 0x10], 0x200000
jmp 0x4060ad
mov eax, dword [0x410954]
cmp eax, ebx
je 0x4060ad
push eax
call fcn.00403151
pop ecx
test eax, eax
je 0x4060ad
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4060ad
mov eax, dword [0x410958]
cmp eax, ebx
je 0x4060ad
push eax
call fcn.00403151
pop ecx
test eax, eax
je 0x4060ad
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x410950]
call fcn.00403151
pop ecx
test eax, eax
je 0x4060cd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4060cf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x593147]
shl eax, 2
mov dword [0x59314b], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00415dd4
pop edx
call fcn.00415170
call fcn.00415dd8
push 0
call fcn.00418918
pop ecx
push 0x5930f0
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x59314f], eax
push 0
jmp fcn.00421cb0
Function at 0x415ac8
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x418b80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x418b9c
call fcn.00419e40
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x418bb7
test bl, 1
je 0x418bb7
mov dword [0x5da668], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x418d64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x418d83
mov eax, dword [0x5d92dc]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x418d90
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x418dbd
je 0x418dcf
sub ecx, 0x100
je 0x418ddd
sub ecx, 0x100
je 0x418de4
sub ecx, 0x100
je 0x418dd6
jmp 0x418deb
sub ecx, 0x600
je 0x418de4
sub ecx, 0x100
je 0x418dcf
jmp 0x418deb
mov edi, 1
jmp 0x418df0
mov edi, 2
jmp 0x418df0
mov edi, 4
jmp 0x418df0
mov edi, 5
jmp 0x418df0
mov edi, 3
test byte [ebp + 0xd], 1
je 0x418e17
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5d8d54]
test al, 0x80
je 0x418e10
mov ebx, 0x80
jmp 0x418e29
mov ebx, 1
jmp 0x418e29
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x418e29
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x418e3b
je 0x418e44
dec eax
je 0x418e4d
jmp 0x418e56
mov dword [ebp - 4], closesocket
jmp 0x418e65
mov dword [ebp - 4], 0x40000000
jmp 0x418e65
mov dword [ebp - 4], 0xc0000000
jmp 0x418e65
push 1
call fcn.00419ddc
pop ecx
mov ebx, eax
jmp 0x418f55
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x418e81
sub eax, 0x10
je 0x418e88
sub eax, 0x10
je 0x418e91
sub eax, 0x10
je 0x418e9a
jmp 0x418e9a
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x418ea1
mov dword [ebp - 8], 1
jmp 0x418ea1
mov dword [ebp - 8], 2
jmp 0x418ea1
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x418f0e
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x418f03
test byte [ebp + 0xd], 1
je 0x418efe
mov ebx, 0x50
jmp 0x418f03
mov ebx, 2
push ebx
call fcn.00419ddc
pop ecx
mov ebx, eax
jmp 0x418f55
mov edi, esi
push edi
call fcn.00418cd4
pop ecx
test eax, eax
je 0x418f22
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x418f2e
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00419b20
add esp, 8
mov ebx, eax
inc eax
jne 0x418f55
push 4
call fcn.00419ddc
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41cec8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.00417cfc
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00417d8c
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.00417d8c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x5d9f31
lea ecx, [ebp - 0x200]
push ecx
call fcn.00417cfc
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.00417d8c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.0041e0ac
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x41cfd9
push esi
call fcn.00417d8c
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.00417d8c
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.00415080
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x41cfb0
xor eax, eax
jmp 0x41d060
push esi
call fcn.00417d8c
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.00417d8c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.00417c58
add esp, 0xc
jmp 0x41d019
mov edi, dword [ebx + 0x24]
push edi
call fcn.00417d8c
pop ecx
push eax
push esi
call fcn.00417d8c
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.00417d8c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004150a0
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x41d019
xor eax, eax
jmp 0x41d060
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.00417cfc
add esp, 8
push 0x5d9f33
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00417cfc
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.00417cfc
add esp, 8
push 0x5d9f35
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00417cfc
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4209e4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x420a46
call fcn.00420994
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00417d8c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00417d8c
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x420aac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x5da670], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x420b86
cmp dword [0x5da66c], 0
jne 0x420b86
cmp dword [0x5da864], 0
je 0x420b40
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00420894
add esp, 8
mov ebx, eax
test eax, eax
jne 0x420b26
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00420894
add esp, 8
mov ebx, eax
test eax, eax
jne 0x420b26
lea ebx, [ebp - 0x84]
jmp 0x420b27
inc ebx
call fcn.00420a68
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x420bc1
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x5da674
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00417d8c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x5da677
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x420bc1
cmp dword [0x5da66c], 0
je 0x420ba0
cmp dword [0x5da66c], 0xffffffff
je 0x420bc1
push esi
call dword [0x5da66c]
pop ecx
mov eax, dword [0x5da670]
test eax, eax
je 0x420bc1
cmp dword [0x5da670], 0xffffffff
je 0x420bc1
cmp byte [eax], 0
je 0x420bc1
push esi
push eax
call fcn.004209e4
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43af1c
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0xca
jne 0x43af4f
push ebx
call fcn.0043ba1b
cmp dword [ebx + 0x40], 0
pop ecx
je 0x43af48
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
pop ebp
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x43afc1
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x43afb3
cmp dword [ebx + 8], 0
je 0x43af71
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
pop ecx
push ebx
mov eax, dword [ebx + 0x1b4]
call dword [eax]
pop ecx
test eax, eax
jne 0x43af84
xor eax, eax
pop ebx
pop ebp
ret
cmp eax, 2
je 0x43afb3
cmp dword [ebx + 8], 0
je 0x43af64
cmp eax, 3
je 0x43af97
dec eax
jne 0x43af64
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x43af64
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x43af64
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x43afdf
cmp dword [ebx + 0x14], 0xcc
je 0x43afdf
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
push ebx
mov ecx, dword [ebx]
call dword [ecx]
pop ecx
push ebx
call fcn.0043afe9
pop ecx
pop ebx
pop ebp
ret

Function at 0x43afe9
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0xcc
je 0x43b084
push ebx
mov eax, dword [ebx + 0x1a4]
call dword [eax]
pop ecx
xor edx, edx
mov dword [ebx + 0x8c], edx
mov dword [ebx + 0x14], 0xcc
jmp 0x43b084
mov eax, dword [ebx + 8]
test eax, eax
je 0x43b032
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x74]
mov dword [eax + 8], edx
push ebx
mov ecx, dword [ebx + 8]
call dword [ecx]
pop ecx
mov esi, dword [ebx + 0x8c]
lea eax, [ebx + 0x8c]
push 0
push eax
push 0
push ebx
mov edx, dword [ebx + 0x1a8]
call dword [edx + 4]
add esp, 0x10
cmp esi, dword [ebx + 0x8c]
jne 0x43b05c
xor eax, eax
jmp 0x43b0aa
mov edx, dword [ebx + 0x8c]
cmp edx, dword [ebx + 0x74]
jb 0x43b01b
push ebx
mov ecx, dword [ebx + 0x1a4]
call dword [ecx + 4]
pop ecx
push ebx
mov eax, dword [ebx + 0x1a4]
call dword [eax]
pop ecx
xor edx, edx
mov dword [ebx + 0x8c], edx
mov ecx, dword [ebx + 0x1a4]
cmp dword [ecx + 8], 0
jne 0x43b05c
cmp dword [ebx + 0x44], 0
je 0x43b09d
mov eax, 0xce
jmp 0x43b0a2
mov eax, 0xcd
mov dword [ebx + 0x14], eax
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x446194
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x5eb70c
test edx, edx
jne 0x4461b3
xor eax, eax
jmp 0x4462d1
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4461d0
push esi
push edx
push eax
call fcn.004462d8
add esp, 0xc
jmp 0x4462d1
push esi
push edx
push eax
call fcn.004465dc
add esp, 0xc
jmp 0x4462d1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44e1a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov cl, byte [edx + 8]
cmp cl, 3
je 0x44e341
mov ecx, dword [edx]
xor ebx, ebx
mov dword [ebp - 4], ecx
xor esi, esi
test byte [edx + 8], 2
je 0x44e1fb
movzx edi, byte [eax]
xor ecx, ecx
mov cl, byte [edx + 9]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
movzx edi, byte [eax + 1]
xor ecx, ecx
mov cl, byte [edx + 9]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
xor ecx, ecx
movzx edi, byte [eax + 2]
inc ebx
mov cl, byte [edx + 9]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
jmp 0x44e20b
xor ecx, ecx
mov cl, byte [edx + 9]
movzx edi, byte [eax + 3]
sub ecx, edi
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
test byte [edx + 8], 4
je 0x44e221
xor ecx, ecx
mov cl, byte [edx + 9]
movzx eax, byte [eax + 4]
sub ecx, eax
mov dword [ebp + ebx*4 - 0x20], ecx
inc ebx
xor ecx, ecx
lea eax, [ebp - 0x20]
cmp ebx, ecx
jle 0x44e242
mov edi, dword [eax]
test edi, edi
jg 0x44e236
xor edi, edi
mov dword [eax], edi
jmp 0x44e23a
mov si, 1
inc ecx
add eax, 4
cmp ebx, ecx
jg 0x44e22a
test si, si
je 0x44e341
mov al, byte [edx + 9]
sub al, 2
je 0x44e267
sub al, 2
je 0x44e287
sub al, 4
je 0x44e2c2
sub al, 8
je 0x44e2ed
jmp 0x44e341
mov ecx, dword [edx + 4]
mov eax, dword [ebp + 0xc]
xor edx, edx
cmp ecx, edx
jbe 0x44e341
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x44e277
jmp 0x44e341
mov esi, dword [ebp - 0x20]
mov ebx, 0xf0
mov ecx, esi
mov edx, dword [edx + 4]
sar ebx, cl
mov ecx, esi
mov esi, 0xf
sar esi, cl
mov ecx, esi
and bl, 0xf0
or bl, cl
xor esi, esi
cmp edx, esi
mov eax, dword [ebp + 0xc]
jbe 0x44e341
mov ecx, dword [ebp - 0x20]
inc esi
shr byte [eax], cl
and byte [eax], bl
inc eax
cmp edx, esi
ja 0x44e2b3
jmp 0x44e341
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
imul ebx
mov dword [ebp - 8], eax
xor esi, esi
mov eax, dword [ebp - 8]
cmp esi, eax
jae 0x44e341
mov eax, esi
xor edx, edx
div ebx
inc esi
mov ecx, dword [ebp + edx*4 - 0x20]
shr byte [edi], cl
inc edi
mov eax, dword [ebp - 8]
cmp esi, eax
jb 0x44e2d6
jmp 0x44e341
mov edi, dword [ebp + 0xc]
mov eax, ebx
imul dword [ebp - 4]
mov dword [ebp - 0x10], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jae 0x44e341
movzx esi, byte [edi]
shl esi, 8
xor eax, eax
mov al, byte [edi + 1]
xor edx, edx
add si, ax
mov eax, dword [ebp - 0xc]
div ebx
mov ecx, dword [ebp + edx*4 - 0x20]
shr si, cl
movzx eax, si
sar eax, 8
mov edx, esi
mov byte [edi], al
inc edi
and dl, 0xff
mov byte [edi], dl
inc edi
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jb 0x44e307
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret