joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429cb0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4d5350
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x54d158]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
lea ecx, [esp + 0x24]
call fcn.004a2c0c
mov eax, dword [esp + 0x58]
xor ebx, ebx
mov dword [esp + 0x50], ebx
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x24], esp
mov ebp, esp
push eax
mov dword [esp + 0x20], ebx
mov byte [esp + 0x1c], 0xef
mov byte [esp + 0x1d], 0xbb
mov dword [esp + 0x24], ebx
lea esi, [esp + 0x24]
lea edi, [esp + 0x20]
call fcn.0040ff10
add eax, 0x10
add esp, 4
mov dword [ebp], eax
call fcn.0042a070
add esp, 4
push ebx
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x40]
lea edi, [ebx + 2]
call fcn.0042aa50
mov esi, dword [esp + 0x5c]
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x54], 1
mov eax, dword [esi]
push 0x1001
push eax
lea ecx, [esp + 0x30]
call fcn.004a3008
cmp eax, ebx
jne 0x429d97
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x3c], 5
jne 0x429e40
sub edi, 1
cmp edi, ebx
jle 0x429e40
push 0x3e8
call ebp
mov eax, dword [esi]
lea edx, [esp + 0x34]
push edx
push 0x1001
push eax
lea ecx, [esp + 0x30]
call fcn.004a3008
cmp eax, ebx
je 0x429d60
mov ebp, dword [esp + 0x1c]
lea edi, [ebp + 3]
push edi
call fcn.004a08e1
mov esi, eax
mov ax, word [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
mov dword [esi], ebx
mov word [esi], ax
lea ecx, [esi + 3]
mov al, 0xbf
push ebp
push ecx
mov byte [esi + 2], al
call fcn.004b07f0
add esp, 0x10
push edi
push esi
lea ecx, [esp + 0x2c]
call fcn.004a295a
push esi
call fcn.004a08dc
add esp, 4
lea ecx, [esp + 0x24]
call fcn.004a2baa
push ebp
call fcn.004a08dc
mov byte [esp + 0x54], bl
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
add esp, 4
mov dword [esp + 0x34], vtable.CFileException.0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x429e19
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x50], 0xffffffff
call fcn.004a2ce0
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004a08dc
mov byte [esp + 0x54], bl
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
mov dword [esp + 0x38], vtable.CFileException.0
add esp, 4
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x429e79
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x50], 0xffffffff
call fcn.004a2ce0
mov eax, 1
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x429eb0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4d5320
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x54d158]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, ecx
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 4]
add eax, 0x44
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov ebp, esp
mov dword [esp + 0x28], esp
push eax
lea esi, [esp + 0x24]
lea edi, [esp + 0x1c]
mov dword [esp + 0x30], ebp
call fcn.0040ff10
add eax, 0x10
add esp, 4
mov dword [ebp], eax
mov dword [esp + 0x38], 1
or ebp, 0xffffffff
mov dword [esp + 0x38], ebp
call fcn.0042a070
mov eax, dword [ebx + 4]
add eax, 0x48
mov eax, dword [eax]
sub eax, 0x10
mov ebx, esp
mov dword [esp + 0x2c], esp
push eax
lea esi, [esp + 0x28]
lea edi, [esp + 0x20]
mov dword [esp + 0x2c], ebx
call fcn.0040ff10
add eax, 0x10
add esp, 4
mov dword [ebx], eax
mov dword [esp + 0x38], 3
mov dword [esp + 0x38], ebp
call fcn.0042a070
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x18]
add esp, 4
test ebx, ebx
je 0x42a040
jmp 0x429f80
mov edx, dword [ebx + 8]
mov esi, 0x51c5e8
cmp edx, esi
je 0x429fb0
test edx, edx
je 0x42a02f
mov cl, byte [esi]
movzx eax, byte [edx]
movzx edi, cl
sub eax, edi
add edx, 1
test eax, eax
jne 0x42a02f
add esi, 1
test cl, cl
jne 0x429f94
cmp dword [ebx + 4], 1
jne 0x42a02f
push 0x51c5b0
call fcn.0043c1b0
add esp, 4
test eax, eax
jne 0x429fcb
xor edi, edi
jmp 0x429fd4
mov ecx, eax
call fcn.0043c110
mov edi, eax
push str.xadl
call fcn.0043c1b0
add esp, 4
test eax, eax
je 0x429fec
mov ecx, eax
call fcn.0043c110
cmp edi, ebp
mov esi, ebp
je 0x42a01c
test edi, edi
je 0x42a02f
test ebp, ebp
je 0x42a02f
lea ebx, [ebx]
mov dl, byte [esi]
movzx ecx, byte [edi]
movzx ebp, dl
sub ecx, ebp
add edi, 1
test ecx, ecx
jne 0x42a02b
add esi, 1
test dl, dl
jne 0x42a000
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.00452850
test eax, eax
jne 0x42a02f
jmp 0x42a040
mov ebp, dword [esp + 0x14]
mov eax, dword [ebx + 0x18]
test eax, eax
mov dword [esp + 0x3c], eax
mov ebx, eax
jne 0x429f80
push ebp
call fcn.004a08dc
mov eax, dword [esp + 0x1c]
push eax
call fcn.004a08dc
add esp, 8
mov eax, ebx
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x42b060
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 8]
test eax, eax
push ebp
mov ebp, dword [esp + 0x10]
jne 0x42b074
pop ebp
ret 0xc
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push ebx
push eax
call edi
mov ecx, dword [esp + 0x14]
add ecx, 0xffffffff
cmp ecx, 6
ja case.0x42b099.5
jmp dword [ecx*4 + 0x42b148]
mov edx, dword [esp + 0x10]
mov dword [edx], 7
jmp 0x42b0e6
mov ecx, dword [esp + 0x10]
mov dword [ecx], 2
jmp 0x42b0e6
mov edx, dword [esp + 0x10]
mov dword [edx], 1
jmp 0x42b0e6
mov ecx, dword [esp + 0x10]
mov dword [ecx], 4
jmp 0x42b0e6
mov edx, dword [esp + 0x10]
mov dword [edx], 5
jmp 0x42b0e6
mov ecx, dword [esp + 0x10]
mov dword [ecx], 3
cmp eax, 0xea
je 0x42b0f1
test eax, eax
jne case.0x42b099.5
test ebp, ebp
je 0x42b13c
mov edx, dword [esi]
add edx, 2
push edx
call fcn.004a08e1
mov dword [ebp], eax
mov ecx, dword [esi]
add ecx, 2
push ecx
push 0
push eax
call fcn.004b0770
mov edx, dword [ebp]
mov ecx, dword [esp + 0x1c]
add esp, 0x10
push esi
push edx
mov edx, dword [ecx + 8]
lea eax, [esp + 0x1c]
push eax
push 0
push ebx
push edx
call edi
test eax, eax
je 0x42b13c
mov dword [esi], 0
pop edi
xor eax, eax
pop ebp
ret 0xc
pop edi
mov eax, 1
pop ebp
ret 0xc

Function at 0x42b170
Capabilities:
Set registry value

Disassembly:
mov eax, dword [eax + 8]
test eax, eax
je case.0x42b17f.5
add ecx, 0xffffffff
cmp ecx, 6
ja case.0x42b17f.5
jmp dword [ecx*4 + 0x42b1d8]
mov ecx, 7
jmp 0x42b1ae
mov ecx, 2
jmp 0x42b1ae
mov ecx, 1
jmp 0x42b1ae
mov ecx, 4
jmp 0x42b1ae
mov ecx, 5
jmp 0x42b1ae
mov ecx, 3
mov edx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
push edx
push ecx
mov ecx, dword [esp + 0x10]
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
add eax, 1
ret 0xc
xor eax, eax
ret 0xc

Function at 0x42b240
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x3f0
mov eax, dword [0x54d158]
xor eax, esp
mov dword [esp + 0x3ec], eax
push 0x3e6
lea eax, [esp + 0xa]
push 0
push eax
mov dword [esp + 0xc], 0x1f4
mov word [esp + 0x10], 0
call fcn.004b0770
mov eax, dword [esp + 0x400]
add esp, 0xc
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 8]
lea edx, [esp + 0x18]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x42b2cb
test edi, edi
je 0x42b2cb
lea edx, [esp + 4]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, 1
mov ecx, dword [esp + 0x3ec]
xor ecx, esp
call fcn.004ac89d
add esp, 0x3f0
ret 4
mov ecx, dword [esp + 0x3ec]
xor ecx, esp
xor eax, eax
call fcn.004ac89d
add esp, 0x3f0
ret 4
Function at 0x42dbd0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x54d158]
xor eax, esp
mov dword [esp + 0x800], eax
cmp edi, 0x25
push esi
mov esi, ecx
jne 0x42dc0f
add esi, 0x10
push esi
mov ecx, ebx
call fcn.0040fdf0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ac89d
add esp, 0x804
ret
cmp edi, 0x1c
jne 0x42dc36
add esi, edi
push esi
mov ecx, ebx
call fcn.0040fdf0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ac89d
add esp, 0x804
ret
cmp edi, 0x24
jne 0x42dc5e
add esi, 4
push esi
mov ecx, ebx
call fcn.0040fdf0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ac89d
add esp, 0x804
ret
cmp edi, 0x26
jne 0x42dc86
add esi, 0x14
push esi
mov ecx, ebx
call fcn.0040fdf0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ac89d
add esp, 0x804
ret
cmp edi, 0x1a
jne 0x42dcae
add esi, 0x18
push esi
mov ecx, ebx
call fcn.0040fdf0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ac89d
add esp, 0x804
ret
test edi, edi
jne 0x42dcd5
add esi, 0x24
push esi
mov ecx, ebx
call fcn.0040fdf0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ac89d
add esp, 0x804
ret
cmp edi, 0xb
jne 0x42dcfd
add esi, 0x28
push esi
mov ecx, ebx
call fcn.0040fdf0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ac89d
add esp, 0x804
ret
cmp edi, 2
jne 0x42dd25
add esi, 0x2c
push esi
mov ecx, ebx
call fcn.0040fdf0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ac89d
add esp, 0x804
ret
cmp edi, 5
jne 0x42dd4d
add esi, 0x30
push esi
mov ecx, ebx
call fcn.0040fdf0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ac89d
add esp, 0x804
ret
push ebp
mov word [esp + 8], 0
call fcn.0042f480
test eax, eax
mov ebp, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
je 0x42dd8c
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
push 0
push ecx
push edi
push 0
call ebp
test eax, eax
jne 0x42dd8c
lea edx, [esp + 8]
push edx
mov ecx, ebx
call fcn.00410090
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jne 0x42ddd5
mov edx, dword [esi + 0x38]
lea ecx, [esp + 8]
push ecx
push 0
push edx
push edi
push 0
mov word [esp + 0x1c], 0
call ebp
test eax, eax
je 0x42ddc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
or eax, 0x80080000
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004ac89d
add esp, 0x804
ret
lea eax, [esp + 8]
push eax
mov ecx, ebx
call fcn.00410090
mov ecx, dword [esp + 0x808]
pop ebp
pop esi
xor ecx, esp
xor eax, eax
call fcn.004ac89d
add esp, 0x804
ret
Function at 0x42ddf0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4d4498
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x54d158]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x20]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42de2f
test al, 0x10
jne 0x42df17
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42df17
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42df17
cmp eax, 3
je 0x42de72
or eax, 0x80070000
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
mov eax, dword [esi]
push 0x5c
push eax
call fcn.004adb61
add esp, 8
test eax, eax
je 0x42de8c
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
jne 0x42dea6
mov eax, 0x80004005
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
push eax
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call fcn.004315e0
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebx
mov dword [esp + 0x1c], 0
call fcn.0042ddf0
mov edi, eax
test edi, edi
jl 0x42def7
push esi
mov ecx, ebx
call fcn.0042ddf0
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.00410230
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
lea ecx, [esp + 0x20]
call fcn.00410230
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x42f0f0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x118
mov eax, dword [0x54d158]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x14], 2
jne 0x42f126
push str.Shell32.dll
jmp 0x42f12b
push str.SHFolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42f175
push 0x52098c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42f175
push edi
push 0
push 0
push 0x26
push 0
call eax
test eax, eax
jge 0x42f186
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004ac89d
add esp, 0x118
ret
push 0
push 0x26
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jbe 0x42f156
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
mov eax, 1
call fcn.004ac89d
add esp, 0x118
ret

Function at 0x42f480
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x54d158]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [0x54f94c]
cmp eax, 0xffffffff
jne 0x42f4e5
lea eax, [esp]
push eax
mov dword [0x54f94c], 0
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jb 0x42f4e0
mov eax, 1
mov dword [0x54f94c], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004ac89d
add esp, 0x118
ret
mov eax, dword [0x54f94c]
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004ac89d
add esp, 0x118
ret

Function at 0x42f600
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x54d158]
xor eax, esp
mov dword [esp + 0x114], eax
mov eax, dword [0x54f958]
cmp eax, 0xffffffff
jne 0x42f677
lea eax, [esp]
push eax
mov dword [0x54f958], 0
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x10], 2
jne 0x42f672
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x42f670
cmp dword [esp + 8], 0
jne 0x42f672
mov eax, 1
mov dword [0x54f958], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004ac89d
add esp, 0x118
ret
jb 0x42f651
mov eax, dword [0x54f958]
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004ac89d
add esp, 0x118
ret
Function at 0x436a30
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
push eax
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
call fcn.00436ad0
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
cmp eax, 0xffffffff
je 0x436aaa
mov ecx, dword [esp + 0xc]
push ecx
call esi
test al, 1
je 0x436a71
mov edx, dword [esp + 0xc]
and eax, 0xfffffffe
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x436aaa
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436aa1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
pop esi
ret 8
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436aca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop esi
ret 8
Function at 0x44b320
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x24]
mov ecx, dword [eax + 0x10]
cmp byte [ecx], 0x25
push edi
jne 0x44b429
mov ecx, esi
call fcn.00456ae0
mov eax, esi
call fcn.00442fb0
mov ebx, eax
test ebx, ebx
jne 0x44b359
mov ecx, str.xmlParsePEReference:_no_name_n
lea eax, [ebx + 0x44]
call fcn.0043f980
pop edi
pop esi
pop ebx
ret
mov edx, dword [esi + 0x24]
mov eax, dword [edx + 0x10]
cmp byte [eax], 0x3b
je 0x44b3cb
cmp dword [esi + 0xd4], 0
je 0x44b37a
cmp dword [esi + 0xac], 0xffffffff
je 0x44b429
push 0
push str.EntityRef:_expecting___n
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 3
push 0x17
push 1
push 0
push esi
push 0
push 0
push 0
mov dword [esi + 0x54], 0x17
call fcn.004516c0
add esp, 0x44
cmp dword [esi + 0x120], 0
mov dword [esi + 0xc], 0
jne 0x44b429
mov dword [esi + 0xd4], 1
pop edi
pop esi
pop ebx
ret
mov ecx, esi
call fcn.00456ae0
mov eax, dword [esi]
add dword [esi + 0x1b8], 1
test eax, eax
je 0x44b3f6
mov eax, dword [eax + 0x60]
test eax, eax
je 0x44b3f6
mov ecx, dword [esi + 4]
push ebx
push ecx
call eax
mov edi, eax
add esp, 8
test edi, edi
jne 0x44b449
cmp dword [esi + 0x1c], 1
je 0x44b42d
cmp dword [esi + 0x58], 0
jne 0x44b408
cmp dword [esi + 0x5c], 0
je 0x44b42d
push 0x1b
mov ecx, ebx
mov edi, str.PEReference:____s__not_found_n
mov eax, esi
call fcn.0043f9e0
add esp, 4
mov dword [esi + 0x64], 0
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
ret
mov eax, ebx
mov edx, str.PEReference:____s__not_found_n
mov ecx, 0x1a
call fcn.0043fb80
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
ret
mov eax, dword [edi + 0x30]
cmp eax, 4
je 0x44b474
cmp eax, 5
je 0x44b474
push 0x1b
mov ecx, ebx
mov edi, str.Internal:____s__is_not_a_parameter_entity_n
mov eax, esi
call fcn.0043f9e0
add esp, 4
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
ret
mov edx, dword [esi + 0x24]
cmp dword [edx + 0x28], 0x441420
mov eax, esi
je 0x44b4a5
push edi
call fcn.00441430
add esp, 4
push eax
mov eax, esi
call fcn.00440de0
add esp, 4
test eax, eax
jl 0x44b429
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
ret
call fcn.00457920
push eax
mov eax, esi
call fcn.00440de0
add esp, 4
test eax, eax
jl 0x44b429
cmp dword [edi + 0x30], 5
jne 0x44b422
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3c
jne 0x44b422
cmp byte [eax + 1], 0x3f
jne 0x44b422
cmp byte [eax + 2], 0x78
jne 0x44b422
cmp byte [eax + 3], 0x6d
jne 0x44b422
cmp byte [eax + 4], 0x6c
jne 0x44b422
mov al, byte [eax + 5]
cmp al, 0x20
je 0x44b515
cmp al, 9
jb 0x44b50d
cmp al, 0xa
jbe 0x44b515
cmp al, 0xd
jne 0x44b422
mov eax, esi
call fcn.0044a150
cmp dword [esi + 0x54], 0x20
jne 0x44b422
pop edi
mov dword [esi + 0xac], 0xffffffff
pop esi
pop ebx
ret
Function at 0x455450
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
mov edi, dword [0x5546e8]
test edi, edi
mov esi, eax
jne 0x455486
push 4
call fcn.004acec0
mov edi, eax
add esp, 4
test edi, edi
je 0x45547c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi], eax
test edi, edi
mov dword [0x5546e8], edi
je 0x455497
mov eax, dword [edi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [0x5546e8]
mov ecx, dword [0x5546fc]
mov edx, dword [0x554714]
mov dword [esi + 0x190], ecx
mov eax, 1
mov dword [esi + 0x184], eax
mov dword [esi + 0x194], eax
mov dword [esi + 0x1b0], eax
mov dword [esi + 0x198], eax
mov eax, dword [0x554704]
mov dword [esi + 0x19c], edx
mov edx, dword [0x55470c]
mov ecx, fcn.004acec0
mov dword [esi + 0x168], ecx
mov dword [esi + 0x1c0], ecx
mov ecx, dword [0x5546f4]
mov dword [esi + 0x1a0], eax
mov eax, dword [0x554754]
mov dword [esi + 0x1a4], ecx
mov ecx, dword [0x55471c]
mov dword [esi + 0x1a8], edx
mov edx, dword [0x54f7e4]
mov dword [esi + 0x1ac], eax
mov eax, dword [0x554744]
mov dword [esi + 0x18c], ecx
mov ecx, dword [0x55474c]
mov dword [esi + 0x174], edx
mov edx, dword [0x554724]
mov dword [esi + 0x178], eax
mov eax, dword [0x55472c]
mov dword [esi + 0x17c], ecx
mov ecx, dword [0x554734]
mov dword [esi + 0x1b8], edx
mov edx, dword [0x55473c]
push 0x34
mov dword [esi + 0x180], 0
mov dword [esi + 0x188], 0x1000
mov dword [esi + 4], method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_12
mov dword [esi + 8], 0x463ec0
mov dword [esi + 0xc], 0x463ee0
mov dword [esi + 0x10], 0x463f00
mov dword [esi + 0x164], fcn.004ad032
mov dword [esi + 0x170], fcn.004ad7f7
mov dword [esi + 0x16c], fcn.00452780
mov dword [esi + 0x1b4], 0x52ab3c
mov dword [esi], str.20702
mov dword [esi + 0x1bc], eax
mov dword [esi + 0x1f8], ecx
mov dword [esi + 0x1fc], edx
push 0
add esi, 0x1c4
push esi
call fcn.004b0770
add esp, 0xc
test edi, edi
je 0x4555e7
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
ret

Function at 0x458450
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, eax
xor eax, eax
test edx, edx
push edi
mov edi, ecx
je 0x45848d
mov cl, byte [edx]
movzx esi, cl
mov eax, esi
shl eax, 4
sub eax, esi
add eax, eax
test cl, cl
je 0x45848d
push ebp
mov esi, eax
mov ebp, eax
shl esi, 5
shr ebp, 3
movsx ecx, cl
add esi, ebp
add edx, 1
add esi, ecx
mov cl, byte [edx]
xor eax, esi
test cl, cl
jne 0x458470
pop ebp
test edi, edi
je 0x4584b3
mov cl, byte [edi]
test cl, cl
je 0x4584b3
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
add edi, 1
add edx, ecx
mov cl, byte [edi]
xor eax, edx
test cl, cl
jne 0x458497
test ebx, ebx
je 0x4584dc
mov cl, byte [ebx]
test cl, cl
je 0x4584dc
lea ecx, [ecx]
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
add ebx, 1
add edx, ecx
mov cl, byte [ebx]
xor eax, edx
test cl, cl
jne 0x4584c0
mov ecx, dword [esp + 0x10]
xor edx, edx
div dword [ecx + 4]
pop edi
pop esi
pop ebx
mov eax, edx
ret
Function at 0x4584f0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov esi, ecx
je 0x4585e0
mov cl, byte [edx]
movzx edi, cl
mov eax, edi
shl eax, 4
sub eax, edi
add eax, eax
test cl, cl
je 0x458536
mov edi, eax
mov ebp, eax
shl edi, 5
shr ebp, 3
movsx ecx, cl
add edi, ebp
add edx, 1
add edi, ecx
mov cl, byte [edx]
xor eax, edi
test cl, cl
jne 0x458516
mov ebp, dword [esp + 0x18]
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test esi, esi
je 0x45856c
mov cl, byte [esi]
test cl, cl
je 0x45856c
mov edx, eax
mov edi, eax
shl edx, 5
shr edi, 3
movsx ecx, cl
add edx, edi
add esi, 1
add edx, ecx
mov cl, byte [esi]
xor eax, edx
test cl, cl
jne 0x458550
test ebx, ebx
je 0x4585a2
mov cl, byte [ebx]
test cl, cl
je 0x458592
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
add ebx, 1
add edx, ecx
mov cl, byte [ebx]
xor eax, edx
test cl, cl
jne 0x458576
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test ebp, ebp
je 0x4585d0
mov cl, byte [ebp]
test cl, cl
je 0x4585d0
lea ecx, [ecx]
mov edx, eax
mov esi, eax
shl edx, 5
shr esi, 3
movsx ecx, cl
add edx, esi
add ebp, 1
add edx, ecx
mov cl, byte [ebp]
xor eax, edx
test cl, cl
jne 0x4585b0
lea ecx, [ecx]
mov ecx, dword [esp + 0x14]
xor edx, edx
div dword [ecx + 4]
pop edi
pop esi
pop ebp
pop ebx
mov eax, edx
ret
movzx ecx, byte [esi]
mov eax, ecx
shl eax, 4
sub eax, ecx
add eax, eax
jmp 0x458546