joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464fbc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edi, edx
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
add eax, 0x3c
mov esi, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 8]
mov dword [edx], eax
cmp esi, eax
jbe 0x465024
mov ecx, dword [ebp - 8]
push ecx
push edi
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
add eax, 0x28
push eax
call fcn.00464680
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add dword [edx + 0x38], ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
xor eax, eax
jmp 0x46512f
cmp ebx, edi
jne 0x465032
mov eax, 0x1001
jmp 0x46512f
mov edx, esi
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x10]
add ecx, 0x28
push ecx
call fcn.00464680
mov eax, esi
mov edx, esi
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
sub dword [ebp - 8], edx
add edi, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ecx + 0x18]
xor eax, dword [edx + 0x28]
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x1c]
xor eax, dword [edx + 0x2c]
mov dword [ebx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x20]
xor eax, dword [edx + 0x30]
mov dword [ebx + 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x24]
xor eax, dword [edx + 0x34]
mov edx, ebx
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00466b10
add ebx, esi
cmp esi, dword [ebp - 8]
ja 0x4650e1
mov eax, ebx
sub eax, esi
mov edx, dword [eax]
xor edx, dword [edi]
mov dword [ebx], edx
mov ecx, dword [eax + 4]
xor ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
mov edx, dword [eax + 8]
xor edx, dword [edi + 8]
mov dword [ebx + 8], edx
mov eax, dword [eax + 0xc]
xor eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00466b10
add edi, esi
add ebx, esi
sub dword [ebp - 8], esi
cmp esi, dword [ebp - 8]
jbe 0x4650a6
mov eax, ebx
mov ecx, dword [ebp - 4]
sub eax, esi
mov edx, dword [eax]
mov dword [ecx + 0x18], edx
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 4]
mov dword [ecx + 0x1c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 8]
mov dword [ecx + 0x20], edx
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 8]
push eax
push edi
mov ecx, dword [ebp - 4]
add ecx, 0x28
push ecx
call fcn.00464680
add esp, 0xc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x38], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
sub dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x465138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
jae 0x465198
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.00464680
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x465275
cmp esi, edi
jne 0x4651a6
mov eax, 0x1001
jmp 0x465275
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 0x10]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.00464680
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
add edi, eax
add esp, 0xc
sub dword [ebp - 4], edx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00466b10
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [esi + 0xc], ecx
add esi, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jb 0x46524b
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00466b10
mov edx, dword [edi]
xor edx, dword [ebx + 0x18]
mov dword [esi], edx
mov ecx, dword [edi + 4]
xor ecx, dword [ebx + 0x1c]
mov dword [esi + 4], ecx
mov eax, dword [edi + 8]
xor eax, dword [ebx + 0x20]
mov dword [esi + 8], eax
mov edx, dword [edi + 0xc]
xor edx, dword [ebx + 0x24]
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
jae 0x465209
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.00464680
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x465280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
jae 0x4652e0
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.00464680
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x4653d5
cmp esi, edi
jne 0x4652ee
mov eax, 0x1001
jmp 0x4653d5
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 0x10]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.00464680
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
add edi, eax
add esp, 0xc
sub dword [ebp - 4], edx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00466b10
mov ecx, dword [ebx + 0x28]
xor dword [ebx + 0x18], ecx
mov eax, dword [ebx + 0x2c]
xor dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x30]
xor dword [ebx + 0x20], edx
mov ecx, dword [ebx + 0x34]
xor dword [ebx + 0x24], ecx
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
add esi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jb 0x4653ab
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00466b10
mov ecx, dword [edi]
xor dword [ebx + 0x18], ecx
mov eax, dword [edi + 4]
xor dword [ebx + 0x1c], eax
mov edx, dword [edi + 8]
xor dword [ebx + 0x20], edx
mov ecx, dword [edi + 0xc]
xor dword [ebx + 0x24], ecx
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
jae 0x46535d
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.00464680
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x465530
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ecx, dword [esp + 4]
mov esi, dword [ebx + 0x38]
mov edx, 0x10
lea eax, [ebx + 0x3c]
mov dword [ecx], edx
lea edx, [ebx + 0x18]
call fcn.00466b10
xor ecx, ecx
mov eax, dword [esp]
mov edx, eax
lea eax, [ebx + 0x28]
cmp esi, ecx
jbe 0x465573
mov bl, byte [eax]
inc ecx
xor bl, byte [eax - 0x10]
inc eax
mov byte [edx], bl
inc edx
cmp esi, ecx
ja 0x465565
mov eax, dword [esp + 4]
mov dword [eax], esi
xor eax, eax
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x46595c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
ja 0x4659bc
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.00464680
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x465a9e
cmp edi, esi
jne 0x4659ca
mov eax, 0x1001
jmp 0x465a9e
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.00464680
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
add edi, edx
add esp, 0xc
sub dword [ebp - 4], ecx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00466b10
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [esi + 0xc], ecx
add esi, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x465a74
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00466b10
mov edx, dword [edi]
xor edx, dword [ebx + 0x18]
mov dword [esi], edx
mov ecx, dword [edi + 4]
xor ecx, dword [ebx + 0x1c]
mov dword [esi + 4], ecx
mov eax, dword [edi + 8]
xor eax, dword [ebx + 0x20]
mov dword [esi + 8], eax
mov edx, dword [edi + 0xc]
xor edx, dword [ebx + 0x24]
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
ja 0x465a32
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.00464680
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x465aa8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov esi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
ja 0x465b08
mov ecx, dword [ebp - 4]
push ecx
push esi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.00464680
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x465c19
cmp esi, edi
jne 0x465b16
mov eax, 0x1001
jmp 0x465c19
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
push ecx
push esi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.00464680
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x10]
add esi, edx
add esp, 0xc
sub dword [ebp - 4], ecx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00466b10
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [edi + 0xc], ecx
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x2c]
mov dword [ebx + 0x1c], edx
mov ecx, dword [ebx + 0x30]
mov dword [ebx + 0x20], ecx
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x24], eax
add edi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jbe 0x465bef
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00466b10
mov ecx, dword [ebx + 0x18]
xor ecx, dword [esi]
mov dword [edi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [esi + 4]
mov dword [edi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [esi + 8]
mov dword [edi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [esi + 0xc]
mov dword [edi + 0xc], ecx
mov eax, dword [esi]
mov dword [ebx + 0x18], eax
mov edx, dword [esi + 4]
mov dword [ebx + 0x1c], edx
mov ecx, dword [esi + 8]
mov dword [ebx + 0x20], ecx
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add esi, eax
mov ecx, dword [ebp - 4]
add edi, eax
cmp ecx, dword [ebp - 0xc]
ja 0x465b96
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push esi
push edx
call fcn.00464680
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x465dc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
mov dword [esp], ecx
mov edi, edx
mov edx, dword [esp]
mov esi, dword [ebx + 0x38]
lea eax, [ebx + 0x3c]
mov dword [edx], esi
lea edx, [ebx + 0x18]
call fcn.00466b10
xor ecx, ecx
mov edx, edi
lea eax, [ebx + 0x28]
cmp esi, ecx
jbe 0x465df7
mov bl, byte [eax]
inc ecx
xor bl, byte [eax - 0x10]
inc eax
mov byte [edx], bl
inc edx
cmp esi, ecx
ja 0x465de9
mov eax, dword [esp]
mov dword [eax], esi
xor eax, eax
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x46e8c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00404c44
lea eax, [ebp - 0x105]
xor ecx, ecx
mov edx, 0x105
call fcn.00403644
push 0
push edi
lea eax, [ebp - 0x105]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathA
mov edx, ebx
lea eax, [ebp - 0x105]
call fcn.00409f7c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46fb3c
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x46fb4b
add esp, 0xfffffff0
call fcn.004041f0
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.0046ef54
push 0x46fcf0
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov dword [edi + 0xc0], esi
test esi, esi
jne 0x46fb84
mov ecx, 0x46fd04
mov dl, 1
mov eax, dword [0x4082a8]
call fcn.0040d560
call fcn.00404658
push 0x46fd1c
mov eax, dword [edi + 0xc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xc8], eax
push 0x46fd2c
mov eax, dword [edi + 0xc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xcc], eax
push 0x46fd40
mov eax, dword [edi + 0xc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xd0], eax
push 0x46fd48
mov eax, dword [edi + 0xc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xd4], eax
push 0x46fd58
mov eax, dword [edi + 0xc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xd8], eax
push 0x46fd64
mov eax, dword [edi + 0xc0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0xdc], eax
cmp dword [edi + 0xc8], 0
jne 0x46fc2d
mov ecx, 0x46fd7c
mov dl, 1
mov eax, dword [0x4082a8]
call fcn.0040d560
call fcn.00404658
cmp dword [edi + 0xcc], 0
jne 0x46fc4c
mov ecx, 0x46fd7c
mov dl, 1
mov eax, dword [0x4082a8]
call fcn.0040d560
call fcn.00404658
cmp dword [edi + 0xd0], 0
jne 0x46fc6b
mov ecx, 0x46fd7c
mov dl, 1
mov eax, dword [0x4082a8]
call fcn.0040d560
call fcn.00404658
cmp dword [edi + 0xd4], 0
jne 0x46fc8a
mov ecx, 0x46fd7c
mov dl, 1
mov eax, dword [0x4082a8]
call fcn.0040d560
call fcn.00404658
cmp dword [edi + 0xd8], 0
jne 0x46fca9
mov ecx, 0x46fd7c
mov dl, 1
mov eax, dword [0x4082a8]
call fcn.0040d560
call fcn.00404658
cmp dword [edi + 0xdc], 0
jne 0x46fcc8
mov ecx, 0x46fd7c
mov dl, 1
mov eax, dword [0x4082a8]
call fcn.0040d560
call fcn.00404658
call dword [edi + 0xc8]
mov dword [edi + 0xc4], eax
mov eax, edi
test bl, bl
je 0x46fce9
call fcn.00404248
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x46ffec
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x46fffb
add esp, 0xfffffff0
call fcn.004041f0
mov ebx, edx
mov edi, eax
mov dl, 1
mov eax, dword [0x46fae4]
call fcn.0046fb3c
mov dword [edi + 0x28], eax
mov eax, dword [0x485010]
call fcn.00405114
push eax
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov dword [edi + 4], esi
test esi, esi
jne 0x47003d
mov ecx, 0x470128
mov dl, 1
mov eax, dword [0x4082a8]
call fcn.0040d560
call fcn.00404658
push 0x470130
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x4c], eax
push 0x470140
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x50], eax
push 0x47015c
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x54], eax
push 0x470174
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x58], eax
push 0x47018c
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [edi + 0x5c], eax
cmp dword [edi + 0x4c], 0
jne 0x4700ae
mov ecx, 0x4701a8
mov dl, 1
mov eax, dword [0x4082a8]
call fcn.0040d560
call fcn.00404658
cmp dword [edi + 0x50], 0
jne 0x4700ca
mov ecx, 0x4701a8
mov dl, 1
mov eax, dword [0x4082a8]
call fcn.0040d560
call fcn.00404658
cmp dword [edi + 0x54], 0
jne 0x4700e6
mov ecx, 0x4701a8
mov dl, 1
mov eax, dword [0x4082a8]
call fcn.0040d560
call fcn.00404658
cmp dword [edi + 0x5c], 0
jne 0x470102
mov ecx, 0x4701a8
mov dl, 1
mov eax, dword [0x4082a8]
call fcn.0040d560
call fcn.00404658
mov eax, edi
test bl, bl
je 0x470117
call fcn.00404248
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x471108
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4169dc]
call fcn.00405678
xor eax, eax
push ebp
push 0x47124c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x485014], 0
jne 0x47115b
mov ecx, dword [0x48533c]
mov dl, 1
mov eax, dword [0x4082a8]
call fcn.0040d61c
call fcn.00404658
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403644
mov eax, ebx
call fcn.004054dc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x47125c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004068a4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004054ec
test eax, eax
jle 0x4711f3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4711ec
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404edc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404ec4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040919c
test eax, eax
jne 0x4711ec
mov ebx, 0x15
jmp 0x4711f8
mov ebx, 0x10
jmp 0x4711f8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x485014]
call fcn.00471060
mov eax, dword [ebp - 8]
call fcn.00471060
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004068bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471253
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404c68
lea eax, [ebp - 0x10]
mov edx, dword [0x4169dc]
call fcn.00405748
ret
Function at 0x40bf40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov eax, dword [ebx + 4]
mov edi, ecx
sub esp, 0x10
mov dword [esp + 0x1c], edi
mov edx, dword [esi]
mov dword [esp + 0x3c], 3
mov eax, dword [eax + edx*4]
mov edx, esp
movsx ecx, word [eax + 0xa]
mov dword [esp + 0x28], ecx
mov ecx, dword [eax]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
lea ecx, [edi + 0x13c]
mov dword [edx + 0xc], eax
inc dword [eax]
call fcn.0040adf0
mov dword [esp + 0x5c], eax
test eax, eax
je 0x4504b6
mov eax, dword [edi + 0x150]
mov ecx, dword [esi]
mov dword [esp + 0x84], eax
inc ecx
xor eax, eax
mov dword [esp + 0x7c], 1
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x54], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x60], 0x49cc38
mov dword [esp + 0x48], 0x49cc3c
mov dword [esi], ecx
mov eax, dword [eax + ecx*4]
cmp word [eax + 8], 0x47
jne 0x4504ce
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], ecx
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x14], ecx
push eax
push esi
push ebx
mov ecx, edi
call fcn.0040ac91
test eax, eax
js 0x450a2d
mov ecx, dword [esp + 0x5c]
mov eax, dword [ecx + 0x10]
cmp eax, dword [0x4d23a0]
jg 0x4504e0
test eax, eax
jle 0x4504e0
shl eax, 4
add eax, dword [0x4d23dc]
mov esi, dword [eax + 4]
mov dword [esp + 0x34], eax
mov eax, dword [esi]
cmp word [eax + 8], 0
jne 0x40c07e
cmp dword [eax], 0x2b
je 0x4504e7
mov eax, 3
mov edx, dword [esp + 0x10]
xor ebx, ebx
cmp dword [ecx + 0x14], ebx
mov edi, eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
jg 0x40c670
push dword [esp + 0x18]
mov ecx, edi
push 0x85
call fcn.0047359c
or eax, 0xffffffff
jmp 0x40c3ba
push dword [esp + 0x18]
mov ecx, edi
push 0x6f
call fcn.0047359c
jmp 0x450a2d
xor eax, eax
jmp 0x40c065
mov eax, 4
mov dword [esp + 0x2c], eax
jmp 0x40c083