joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x49d131
push esi
call fcn.004a0145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0048f080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x49d131
push 0
push ebp
call fcn.0048f3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0048f260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x49d08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0048f2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x49d121
push 0x4b5918
push edi
call fcn.0049e3f0
push eax
push ebx
push esi
call fcn.0049cf60
push 0x4b58f8
push edi
call fcn.0049e3f0
push eax
push ebx
push esi
call fcn.0049cf60
push 0x4b58d8
push edi
call fcn.0049e3f0
push eax
push ebx
push esi
call fcn.0049cf60
push 0x4b58c0
push edi
call fcn.0049e3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0049cf60
push 0x4b58a0
push edi
call fcn.0049e3f0
push eax
push ebx
push esi
call fcn.0049cf60
push 0x4b5888
push edi
call fcn.0049e3f0
push eax
push ebx
push esi
call fcn.0049cf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x49e1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0049e140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0049e140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0049e140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0049e140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x49ebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x49ec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x4b087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x49ec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x49ec52
xor eax, eax
pop esi
leave
ret 4

Function at 0x40ed7e
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x40eae0
pop ebx
mov ecx, ecx
call fcn.0040edaa
sub ecx, 0xcf30b270
xor dword [esi], ebx
and eax, ecx
and eax, eax
inc esi
sub eax, ecx
cmp esi, edx
jne fcn.0040ed7e
or ecx, ecx
ret
Function at 0x4032d4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x49b008], 0x8088405
inc edx
mov dword [ebx + 0x49b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4240f4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4240fa
ret

Function at 0x4622b8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4622e6
mov eax, ebx
call fcn.00462d6c
cmp dword [ebx + 0x40], 0
je 0x4622df
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x462357
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x462349
cmp dword [ebx + 8], 0
je 0x462308
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x46231a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x462349
cmp dword [ebx + 8], 0
je 0x4622fb
cmp eax, 3
je 0x46232d
dec eax
jne 0x4622fb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4622fb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4622fb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x462375
cmp dword [ebx + 0x14], 0xcc
je 0x462375
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00462380
pop ebx
ret

Function at 0x47357c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404e70
mov eax, dword [ebp - 8]
call fcn.00404e70
xor eax, eax
push ebp
push 0x47365d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x47363b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x431cf4]
call fcn.00431df4
mov dword [ebp - 0xc], eax
test bl, bl
je 0x4735d9
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00431e94
jmp 0x4735e6
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.00431e94
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xc], 0
xor ecx, ecx
mov edx, 0x473674
mov eax, dword [ebp - 0xc]
call fcn.00431ef8
cmp byte [ebp + 8], 0
je 0x473612
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0043226c
jmp 0x47361d
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004321d4
mov eax, dword [ebp - 0xc]
call fcn.00431e64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x473642
mov eax, dword [ebp - 0xc]
call fcn.00403bec
ret
Function at 0x494a18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
mov eax, ebp
mov edx, dword [esp]
call fcn.00404a14
mov esi, ebx
mov eax, dword [ebp]
call fcn.00404c80
test ax, ax
jbe 0x494a83
mov word [esp + 4], ax
mov bx, 1
mov eax, ebp
call fcn.00404ed8
movzx edi, bx
mov edx, dword [ebp]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec word [esp + 4]
jne 0x494a48
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4abb60
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4abc6c
test eax, eax
je 0x4abc6c
push esi
push edi
mov ecx, 0x10
mov esi, 0x4c5fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x4abc53
lea edi, [eax + 4]
jmp 0x4abbb7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x4abbcc
mov dword [ebp - 4], 2
jmp 0x4abbed
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x4abbe3
mov dword [ebp - 4], 1
jmp 0x4abbed
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x4abc63
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x4abc26
mov byte [ecx], 0x3d
jmp 0x4abc32
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x4abc3d
mov byte [ecx], 0x3d
jmp 0x4abc43
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x4abbb4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4afb50
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
jne 0x4afb6f
mov ebx, dword [ebp + 8]
push eax
call fcn.004af060
test al, al
je 0x4afba9
mov ebx, dword [ebp + 0xc]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4afb77
sub eax, edx
mov esi, eax
push esi
mov dword [ebp + 0xc], esi
call fcn.004b7234
lea ecx, [ebp + 0xc]
push ecx
mov edi, eax
push edi
push esi
push ebx
call fcn.004abc80
add esp, 0x14
test al, al
jne 0x4afbb4
push edi
call fcn.004b7924
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
xor ebx, ebx
push edx
push edi
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x2c], 0x67452301
mov dword [ebp - 0x28], 0xefcdab89
mov dword [ebp - 0x24], 0x98badcfe
mov dword [ebp - 0x20], 0x10325476
mov dword [ebp - 0x1c], 0xc3d2e1f0
mov byte [ebp - 0x7c], bl
call fcn.004abd90
mov dword [ebp + 0xc], 0x40
cmp byte [ebp - 0x7c], bl
jne 0x4afc07
call fcn.004ac310
mov byte [ebp - 0x7c], 1
xor eax, eax
lea esp, [esp]
mov ecx, dword [ebp + eax*4 - 0x2c]
bswap ecx
mov dword [ebp + eax*4 - 0x18], ecx
inc eax
cmp eax, 5
jb 0x4afc10
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x18]
push 0x14
push ecx
call fcn.004abb60
mov edx, dword [ebp + 0xc]
push edi
mov byte [ebp + edx - 0xbc], bl
call fcn.004b7924
mov bl, byte [ebp + 0x10]
add esp, 0x14
mov eax, 0x4c634c
test bl, bl
jne 0x4afc5a
mov eax, 0x4c6364
mov edi, dword [ebp + 8]
push 0
push eax
call fcn.004af570
push 1
lea eax, [ebp - 0xbc]
push eax
call fcn.004af570
test bl, bl
je 0x4afc7c
call fcn.004af650
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x72443300
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x104
mov eax, dword [0x72473a74]
xor eax, esp
mov dword [esp + 0x100], eax
push ebp
movzx ebp, byte [esp + 0x110]
push esi
mov esi, dword [esp + 0x110]
push edi
mov edi, dword [esp + 0x11c]
xor eax, eax
xor ecx, ecx
cmp ecx, ebp
jl 0x72443337
xor ecx, ecx
mov dl, byte [ecx + esi]
xor dl, 0x87
mov byte [esp + eax + 0xc], dl
inc eax
inc ecx
cmp eax, 0x100
jl 0x72443331
mov eax, dword [esp + 0x120]
xor esi, esi
test eax, eax
jle 0x724433a2
lea eax, [eax + eax*2 + 3]
push ebx
lea esp, [esp]
mov cl, byte [edi + esi]
mov dl, cl
and dl, 0x30
mov bl, cl
shr bl, 4
or dl, bl
mov bl, cl
and bl, 0xc
shl cl, 4
or bl, cl
add bl, bl
shr dl, 2
movzx ebp, al
add bl, bl
or dl, bl
xor dl, byte [esp + ebp + 0x10]
inc esi
mov byte [edi + esi - 1], dl
sub eax, 3
cmp esi, dword [esp + 0x124]
jl 0x72443360
mov eax, dword [esp + 0x124]
pop ebx
cdq
and edx, 3
add eax, edx
sar eax, 2
xor ecx, ecx
test eax, eax
jle 0x724433c1
mov edx, dword [edi + ecx*4]
ror edx, 0x10
xor edx, ecx
mov dword [edi + ecx*4], edx
inc ecx
cmp ecx, eax
jl 0x724433b1
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.724566bc
add esp, 0x104
ret

Function at 0x72449e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
dec edx
test edx, edx
jl 0x72449eb8
inc edx
xor ebx, ebx
movzx esi, byte [eax + ebx]
mov edi, ecx
and edi, 0xff
xor esi, edi
lea esi, [esi*4]
add esi, dword [0x724aebec]
mov esi, dword [esi]
shr ecx, 8
xor esi, ecx
mov ecx, esi
inc ebx
dec edx
jne 0x72449e90
mov eax, ecx
not eax
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7244b940
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push 0x10
call fcn.72456b97
add esp, 4
mov edi, eax
xor esi, esi
call fcn.7244e830
mov dword [esi + edi], eax
mov cl, byte [esi + edi + 1]
mov dl, byte [esi + edi + 2]
movzx eax, al
xor al, 0x21
add al, 0x11
xor al, 0x30
mov byte [esi + edi], al
movzx eax, byte [esi + edi + 3]
xor cl, 0x21
xor dl, 0x21
xor al, 0x21
add cl, 0x11
add dl, 0x11
add al, 0x11
xor cl, 0x30
xor dl, 0x30
xor al, 0x30
mov byte [esi + edi + 1], cl
mov byte [esi + edi + 2], dl
mov byte [esi + edi + 3], al
inc esi
cmp esi, 4
jl 0x7244b950
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov edx, dword [edi + 4]
xor ecx, 0x12345678
sub eax, 0x12345678
mov dword [0x724aec48], ecx
mov ecx, dword [edi + 0xc]
mov dword [0x724aec50], eax
mov eax, edi
sub edx, 0x789abcdf
xor ecx, 0x87654321
pop edi
mov dword [0x724aec4c], edx
mov dword [0x724aec54], ecx
pop esi
ret
Function at 0x7244cd40
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x72473a74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x8c], esi
cmp dword [0x724aecc8], edi
jne 0x7244cd7c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.724566bc
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push eax
push edi
push esi
call fcn.72456a40
push 0x80
lea ecx, [ebp - 0x84]
push edi
add esi, 2
push ecx
mov dword [ebp - 0x88], esi
call fcn.72456a40
mov edx, dword [0x724aecc4]
mov eax, dword [0x7246784c]
mov ecx, dword [0x724aecc8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x84], edx
mov edx, dword [ecx]
lea eax, [ebp - 0x84]
add esp, 0x18
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x90], eax
pushal
mov eax, dword [ebp - 0x88]
push eax
push 0x2710
push 0x14
mov eax, dword [ebp - 0x90]
push eax
mov eax, dword [0x724aecd4]
call eax
popal
call fcn.72574295
popfd
imul eax, eax, 0x343fd
mov ecx, dword [ebp - 0x8c]
sub eax, 0x1613d
shr eax, 0x10
and eax, 7
mov byte [ecx + 1], al
mov byte [ecx], 0x23
mov byte [ecx + 0x1d], 1
mov byte [ecx + 0x1e], 0x21
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x1f
pop ebx
call fcn.724566bc
mov esp, ebp
pop ebp
ret
Function at 0x72451f50
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [eax]
movzx ecx, word [ebx + 0x14]
push ebp
xor edx, edx
xor ebp, ebp
lea eax, [ecx + ebx + 0x18]
cmp dx, word [ebx + 6]
jae 0x72452007
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x72451fa7
mov eax, dword [edi - 0x14]
mov ecx, dword [edi - 0x1c]
push 0x4000
push eax
push ecx
push edx
call fcn.724b8350
jmp 0x72451fef
lea edx, [edx + ecx*2]
lea ecx, [esi + edx*2]
mov esi, dword [ecx*4 + 0x72473a10]
test eax, 0x4000000
je 0x72451fc1
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x72451fdc
test al, 0x40
je 0x72451fd3
mov ecx, dword [ebx + 0x20]
jmp 0x72451fda
test al, al
jns 0x72451fef
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x72451fef
mov ecx, dword [edi - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
push edi
call fcn.7250baec
mov edx, dword [esp + 0x18]
mov ebx, dword [edx]
movzx eax, word [ebx + 6]
inc ebp
add edi, 0x28
cmp ebp, eax
jl 0x72451f74
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x72452760
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov eax, 0x5a4d
cmp word [ebp], ax
je 0x72452774
xor eax, eax
pop ebp
ret
push edi
mov edi, dword [ebp + 0x3c]
add edi, ebp
cmp dword [edi], 0x4550
je 0x72452787
pop edi
xor eax, eax
pop ebp
ret
mov ecx, dword [edi + 0x50]
mov edx, dword [edi + 0x34]
push ebx
push esi
call fcn.725a4410
add eax, 0x68046a
and byte [eax], al
add byte [ecx + 0x52], dl
call esi
mov ebx, eax
test ebx, ebx
jne 0x724527be
mov eax, dword [edi + 0x50]
push 4
push 0x2000
push eax
push ebx
call esi
mov ebx, eax
test ebx, ebx
je 0x7245286c
push 0x18
push 0
push edi
call fcn.725432db
push eax
call dword [0x724600f4]
mov esi, eax
xor eax, eax
push 4
mov dword [esi + 4], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x50]
push 0x1000
push ecx
push ebx
call fcn.72590dd3
jnp 0x76af7c4d
push 0x1000
push edx
push ebx
call fcn.7259c597
inc esp
mov ecx, dword [edi + 0x54]
add ecx, dword [ebp + 0x3c]
mov dword [esp + 0x14], eax
push ecx
push ebp
push eax
call fcn.724566d0
mov edx, dword [ebp + 0x3c]
mov eax, dword [esp + 0x20]
push esi
add eax, edx
push edi
mov dword [esi], eax
push ebp
mov dword [eax + 0x34], ebx
call fcn.72451ea0
mov eax, ebx
add esp, 0x18
sub eax, dword [edi + 0x34]
je 0x72452840
push eax
mov eax, esi
call fcn.72452010
add esp, 4
push esi
call fcn.72452090
add esp, 4
test eax, eax
je 0x72452863
push esi
call fcn.72451f50
mov ecx, dword [esi]
mov eax, dword [ecx + 0x28]
add esp, 4
test eax, eax
je 0x7245287d
add ebx, eax
jne 0x72452873
push esi
call fcn.72452440
add esp, 4
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
ret
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], 1
mov eax, esi
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x72456490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x724564b5
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x724564cd
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x724564fc
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x7245653e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x72456612
sub edx, 0x10000
js 0x72456612
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x72456524
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x72456524
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x72456595
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x72456592
add edx, 8
jne 0x72456579
jmp 0x72456603
add edx, 4
test eax, 0xffff
jne 0x724565a2
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x72456603
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x724565d6
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x72456524
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x72456612
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x72456524
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x72456623
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x724d4caa
Capabilities:
Encode data using xor

Disassembly:
add al, 0x81
div byte [ecx]
popfd
mov dword [ebx - 0x87e0a0b], ecx
cli
invalid
pushfd
lea edx, [edx + 1]
mov byte [esp], dl
call fcn.725c016d
call 0x24bb7993
adc eax, 0x6e9e4112
inc ebx
aaa
xor ebp, edx
mov bl, 0x42
nop
sbb al, 0x4a
popfd
daa
jae 0x724d4cc6
push eax
cli
pop edx
and al, 0xd
punpcklbw mm7, dword [edx - 0x3a]
mov al, 0x85
scasd eax, dword es:[edi]
out dx, eax
xor dword [ebp + esi*8 - 0x70], esp
loopne 0x724d4c8a
xlatb
xchg dword [edi], ebx
pop edx
ficomp word [ebx + 0x30d253b9]
pop ecx
or dword [eax + 0x476493cd], 0x2d
mov eax, 0xf826d6c8
or ebx, esi
sahf
outsd dx, dword [esi]
adc bh, byte [ebp - 0x1321a5e1]
test esi, 0x71bcbafb
adc al, 0xff
stosd dword es:[edi], eax
invalid

Function at 0x7252b2d7
Capabilities:
Encode data using xor

Disassembly:
lea esi, [eax + 0x7058fb4]
jge 0x7252e5ea
mov esi, 0x72443167
pushfd
mov esi, dword [esi + 0x9af7b]
mov byte [esp], 0x6f
pushfd
lea esi, [esi + 0x291ea1ed]
pushal
mov byte [esp + 0x1c], 0x38
xchg dword [esp + 0x28], esi
mov word [esp + 0x1c], sp
push 0x3a3d8972
push dword [esp + 4]
push dword [esp + 0x30]
ret 0x34
bswap si
nop
pushfd
mov esi, dword [esp + 4]
push edi
xchg dword [esp + 0xc], esi
pushfd
lea esp, [esp + 0x10]
jge 0x72590db1
push esi
jmp 0x724e93f2
bswap esi
lea esi, [edi + 0x439b0e4]
mov esi, 0x72443167
push esp
pushal
mov dword [esp + 0x18], 0xd8122c16
mov esi, dword [esi + 0x9af7b]
pushal
call fcn.725d818b
pushal
mov dword [esp], 0xffff9afb
xchg dword [esp + 0x1c], esi
push esp
mov dword [esp + 4], edx
call fcn.7254078a
mov al, 0x79
fild dword [edx + 0x6b83d62d]
jl 0x725f38dd
push edx
mov dword [ebp + 0x4cc637d9], 0x2635643
test dword [esp + eax*2], esi
xchg dword [ebx + 0x2d27a113], ebx
jne 0x725f3853
sub eax, 0xe46b6c52
mov bl, 2
cwde
aad 0xa5
cmp ebp, ebx
scasd eax, dword es:[edi]
out 0xed, al
retf
mov cl, 0xf3
or ch, byte [ebp + ebp*2 - 0x6890b859]
mov al, 0xa2
jl 0x725f3906
push esp
and al, 0x24
setae dh
bswap edx
pushal
lea edx, [ebp - 0x5522c156]
mov edx, dword [esp + 0x48]
mov byte [esp], 0x10
call fcn.725d9755
bswap di
nop
call int.725ec7fe
ljmp 0x5b3b

Function at 0x725863bc
Capabilities:
Encode data using xor

Disassembly:
pushfd
lea esi, [esi - 0x44fae131]
call fcn.724d9f2d
pushfd
jmp 0x72568590
xor edi, 0xb4b9ee14
bt dx, 6
pushfd
xor ebx, 0x68af29ad
mov byte [esp], ah
xor esi, 0x294cc603
clc
xor ecx, 0xc8a2a7e7
bt si, 0xb
call fcn.725b0bea
out 0x53, eax
fimul word [edi + esi - 0x54da000e]
test ax, 0x8618
jl 0x725685a5
fchs
std
loopne 0x725685cb
sub byte [ecx], 0x59
mov ch, bl
pop edi
mov esi, 0x29e713e2
sub al, 0xe8
test dword [esi + edi*4 + 0x422cd0d3], esi
dec edi
xchg ebp, eax
cmp edx, dword [esi - 0x74]
inc edx
leave
push 0x6f
mov dword [0x40542475], eax
pop ds
rol dword [ecx], cl
test al, 0xc9
xor byte [edx + 0x1e8fed38], dh
xchg ebp, eax
xchg esp, eax
mov dh, 0xc7
mov bh, 0x39
inc esp
and eax, 0x18a9eeb2
test dword [edi + 0x9e7eb59], edx
push cs
fadd qword [eax - 0x66ef0e12]
jmp 0xc37e6414
jmp 0x72530da7