joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452098
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x452160
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004048a0
or ecx, 0xffffffff
xor edx, edx
mov eax, esi
call fcn.00451fb0
mov ebx, eax
test ebx, ebx
jbe 0x452142
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404f08
mov eax, dword [ebp - 8]
call fcn.00404b7c
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00451fb0
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404f08
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404b84
mov eax, dword [ebp - 4]
lea eax, [esi + 0x2c]
mov edx, dword [ebp - 8]
call fcn.00404b84
call sub.kernel32.dll_GetTickCount
mov edi, eax
or ecx, 0xffffffff
xor edx, edx
mov eax, esi
call fcn.00451fb0
mov ebx, eax
push 1
call sub.kernel32.dll_Sleep
test ebx, ebx
ja 0x452142
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp eax, 0x3e8
jbe 0x45211b
test ebx, ebx
jne 0x4520c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452167
lea eax, [ebp - 8]
call fcn.004048a0
ret

Function at 0x452170
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov edi, eax
mov edx, ebx
mov eax, esi
call fcn.00452098
cmp dword [ebx], 0
jne 0x452193
push 1
call sub.kernel32.dll_Sleep
cmp dword [ebx], 0
jne 0x4521a4
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp eax, dword [esi + 0x20]
jb 0x45217e
pop edi
pop esi
pop ebx
ret

Function at 0x452d8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
push ebp
push 0x452e1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x452e2c]
mov dword [ebp - 7], eax
mov ax, word [0x452e30]
mov word [ebp - 3], ax
mov al, byte [0x452e32]
mov byte [ebp - 1], al
push 6
lea eax, [ebp - 7]
push eax
push 0x1004
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x2c]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404b10
mov eax, dword [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409670
push 2
lea edx, [ebp - 0x27]
push edx
push eax
call sub.gdi32.dll_TranslateCharsetInfo
mov ebx, dword [ebp - 0x27]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452e25
lea eax, [ebp - 0x2c]
call fcn.004048a0
ret

Function at 0x4531a8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push ecx
mov esi, ecx
mov ebx, edx
shl ebx, 2
add ebx, eax
mov eax, ebx
call fcn.00405ec4
test eax, eax
je 0x4531e8
push esp
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
mov dword [ebx], esi
push esp
mov eax, dword [esp + 4]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
push 4
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
pop esi
pop ebx
ret
Function at 0x4533a4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
push esp
push 0x40
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, ebx
mov eax, edi
mov ecx, esi
call fcn.00402ac0
push esp
mov eax, dword [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4539b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], edx
mov dword [esp], eax
lea ebp, [esp + 0x10]
mov eax, dword [0x541614]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4539f3
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x541614]
call fcn.0041d9ac
mov ebx, eax
mov eax, dword [esp]
cmp eax, dword [ebx]
jne 0x4539ef
mov eax, dword [ebx + 4]
jmp 0x453ab9
inc edi
dec esi
jne 0x4539d2
mov edi, dword [esp]
mov ebx, edi
xor esi, esi
mov edx, ebp
mov eax, ebx
call fcn.0045359c
test al, al
jne 0x453a0b
mov byte [ebp], 1
xor eax, eax
mov al, byte [ebp]
add esi, eax
xor eax, eax
mov al, byte [ebp]
add ebx, eax
cmp esi, 5
jb 0x4539fa
mov edx, esi
mov eax, edi
call fcn.00453790
add eax, 5
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
call fcn.004027ac
mov ebp, eax
mov eax, 0x14
call fcn.004027ac
mov ebx, eax
mov eax, dword [esp]
mov dword [ebx], eax
mov dword [ebx + 4], ebp
mov eax, dword [esp + 8]
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], esi
mov eax, esi
call fcn.004027ac
mov dword [ebx + 0xc], eax
mov edx, dword [ebx + 0xc]
mov eax, edi
mov ecx, esi
call fcn.00402ac0
mov edx, ebx
mov eax, dword [0x541614]
call fcn.0041d800
lea eax, [esp + 0xc]
push eax
push 0x40
mov eax, dword [esp + 0x10]
push eax
push ebp
call sub.kernel32.dll_VirtualProtect
mov edx, ebp
mov eax, edi
mov ecx, esi
call fcn.00402ac0
mov ecx, esi
mov edx, edi
mov eax, ebp
call fcn.0045382c
lea edx, [esi + edi]
lea eax, [esi + ebp]
call fcn.004533e4
mov edx, dword [esp + 4]
mov eax, edi
call fcn.004533e4
mov eax, ebp
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x453d18
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov ebx, eax
xor esi, esi
mov edx, 0x40
mov eax, ebx
call fcn.0042fc04
test al, al
je 0x453d5c
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x453d5c
cmp dword [eax + 0x3c], 0
je 0x453d5c
mov esi, dword [eax + 0x3c]
add esi, ebx
mov edx, 0xf8
mov eax, esi
call fcn.0042fc04
test al, al
je 0x453d5a
cmp dword [esi], 0x4550
je 0x453d5c
xor esi, esi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x45531c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404b10
add esp, 0x104
pop ebx
ret
Function at 0x456790
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00404b10
add esp, 0x104
pop ebx
ret

Function at 0x4567c4
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00404b10
add esp, 0x104
pop ebx
ret

Function at 0x456914
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x456a8c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
add esi, 4
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, 8
call fcn.00409604
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.00409604
push dword [ebp - 0x14]
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c3c
mov eax, dword [ebp - 0xc]
call fcn.00404d7c
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x456a71
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x4569c9
cmp esi, 4
jne 0x4569c9
push ebx
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x456a71
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x456a53
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov esi, dword [eax]
mov eax, dword [edi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x1c]
mov eax, 8
call fcn.00409604
push dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x20]
mov eax, 8
call fcn.00409604
push dword [ebp - 0x20]
push dword [ebp - 8]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404c3c
mov eax, dword [ebp - 0x18]
call fcn.00404d7c
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
add eax, 4
mov dword [edi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456a93
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.004048c4
ret
Function at 0x458490
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45857a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x54178c], bl
mov eax, 0x541790
mov edx, esi
call fcn.004048f4
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
xor edx, edx
mov dl, bl
mov eax, dword [0x4547b0]
call fcn.004194b0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
call fcn.00402894
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x24]
mov eax, 8
call fcn.00409604
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x458590
call fcn.0040a9c4
mov eax, dword [ebp - 4]
call fcn.00404d7c
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp dword [0x542010], 0
je 0x458557
add bl, 0xfb
sub bl, 5
jae 0x458557
push 0x242010
push 0x4585c4
mov eax, esi
call fcn.00404d7c
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458581
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004048c4
lea eax, [ebp - 4]
call fcn.004048a0
ret

Function at 0x4587d8
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x4587a0
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x458870
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov ebx, edx
mov dword [esp], eax
push 0
lea eax, [esp + 0x18]
push eax
xor ecx, ecx
mov edx, 0x7fffffff
mov eax, 0x7fffffff
call fcn.0041c2ec
lea esi, [esp + 0x14]
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, esp
push eax
push 0x4587f8
call sub.user32.dll_EnumWindows
mov edi, ebx
lea esi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x4588cf
push 0xffffffffffffffff
push ebx
or ecx, 0xffffffff
or edx, 0xffffffff
or eax, 0xffffffff
call fcn.0041c2ec
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x458954
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
test ebx, ebx
je 0x458a32
mov eax, ebx
call fcn.00404b7c
mov esi, eax
inc esi
push 0
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x458a2b
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x458a11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4589f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404d7c
mov edx, dword [ebp - 8]
mov ecx, esi
call fcn.00402ac0
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 4]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4589fa
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x458a38
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
add esp, 0xffffffac
test al, al
je 0x458a84
push esp
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [esp + 0x44]
xor ecx, ecx
mov edx, 0x10
call fcn.00403220
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
mov eax, dword [0x54177c]
call fcn.00404d7c
push eax
push 0
push 0x220
push 0
push 0
push 0
call sub.kernel32.dll_GetCommandLineA_1
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 1
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
add esp, 0x54
ret

Function at 0x458c1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov edx, dword [0x53cba0]
mov dl, byte [edx]
mov byte [ebp - 1], dl
mov ecx, eax
mov dl, 1
mov eax, dword [0x454874]
call fcn.00458a98
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x458cec
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.00458b10
test al, al
je 0x458cd6
cmp word [ebp - 4], 0x5a4d
jne 0x458cd6
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.0042084c
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00458b10
test al, al
je 0x458cd6
cmp dword [ebp - 8], 0
je 0x458cd6
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.0042084c
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00458b10
test al, al
je 0x458cd6
cmp dword [ebp - 0xc], 0x4550
jne 0x458cd6
lea edx, [ebp - 0x24]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.00458b10
test al, al
je 0x458cd6
test byte [ebp - 0x11], 0x20
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458cf3
mov eax, dword [ebp - 0x10]
call fcn.00403984
ret
Function at 0x458cfc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x458e93
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x454874]
call fcn.00458a98
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x458e76
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.00458b10
test al, al
je 0x458e60
cmp word [ebp - 4], 0x5a4d
jne 0x458e60
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.0042084c
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00458b10
test al, al
je 0x458e60
cmp dword [ebp - 8], 0
je 0x458e60
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.0042084c
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00458b10
test al, al
je 0x458e60
cmp dword [ebp - 0xc], 0x4550
jne 0x458e60
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.00458b10
test al, al
je 0x458e5c
test byte [ebp - 0x15], 0x20
je 0x458e5c
push 2
push 0
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.00455104
mov eax, dword [ebp - 0x2c]
call fcn.00404d7c
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x458e55
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x458ea4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x458e3a
push 0xa
push 0x458eb0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x458e3a
mov byte [ebp - 1], 2
jmp 0x458e3e
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458e60
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458e7d
mov eax, dword [ebp - 0x10]
call fcn.00403984
ret
Function at 0x4590cc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4590d5
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4592ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004048a0
mov eax, esi
call fcn.004048a0
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, ebx
call fcn.00404d7c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x4592d4
mov eax, dword [ebp - 4]
call fcn.004027ac
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4592cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, ebx
call fcn.00404d7c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4592b4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x459300
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4591fe
push 0x459324
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
mov edx, 4
call fcn.004095dc
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.004095dc
push dword [ebp - 0x24]
push 0x459340
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404c3c
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00404d7c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4591fe
cmp dword [ebp - 0xc], 1
jbe 0x4591fe
mov eax, dword [ebp - 0x18]
call fcn.0040a2d4
mov ecx, eax
mov eax, edi
mov edx, dword [ebp - 0x18]
call fcn.00404990
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x459354
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4592b4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
call fcn.00407b70
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov di, word [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
call fcn.00407b70
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0x18]
mov ax, word [eax + 0xc]
mov word [ebp - 0x10], ax
lea edx, [ebp - 0x28]
movzx eax, bx
call fcn.004094c8
push dword [ebp - 0x28]
push 0x459360
lea edx, [ebp - 0x2c]
movzx eax, di
call fcn.004094c8
push dword [ebp - 0x2c]
push 0x459360
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0xe]
call fcn.004094c8
push dword [ebp - 0x30]
push 0x459360
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x10]
call fcn.004094c8
push dword [ebp - 0x34]
mov eax, esi
mov edx, 7
call fcn.00404c3c
mov eax, dword [esi]
mov edx, 0x45936c
call fcn.00404cc8
jne 0x4592b4
mov eax, esi
call fcn.004048a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4592d4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.004027cc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4592f6
lea eax, [ebp - 0x34]
mov edx, 7
call fcn.004048c4
ret
Function at 0x45a168
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov byte [ebp - 0x15], 0
mov eax, dword [0x539688]
mov edx, dword [eax]
call dword [edx + 8]
push 0x45a27c
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x28], eax
push 0x45a288
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
xor eax, eax
push ebp
push 0x45a26f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x45a298
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 4], eax
push 0x45a2b0
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x14], eax
push 0x45a2c8
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x24], eax
push 0x45a2d8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 8], eax
push 0x45a2f4
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0xc], eax
push 0x45a304
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x10], eax
push 0x45a314
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x1c], eax
push 0x45a324
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x20], eax
call fcn.004598d4
test al, al
je 0x45a22f
push ebp
call fcn.0045a108
pop ecx
jmp 0x45a236
push ebp
call fcn.00459fd0
pop ecx
mov edx, 0x4598cc
mov eax, dword [0x539688]
call fcn.0041dc98
cmp byte [ebp - 0x15], 0
jne 0x45a252
push ebp
call fcn.004599c0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a276
cmp dword [ebp - 0x28], 0
je 0x45a26e
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
Function at 0x45b450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x45b5cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
lea edx, [ebp - 5]
mov ecx, 1
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f6
jb 0x45b4af
cmp byte [ebp - 5], 0x80
jb 0x45b4af
and byte [ebp - 5], 0x7f
mov byte [ebp - 6], 1
xor edx, edx
mov dl, byte [ebp - 5]
mov eax, ebx
call fcn.00402cec
xor ecx, ecx
mov cl, byte [ebp - 5]
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp word [esi + 0x19], 0x1f4
jb 0x45b5a2
cmp byte [esi + 0x3b], 0
je 0x45b512
mov eax, dword [0x541998]
mov edx, dword [esi + 0x37]
call fcn.00404cc8
je 0x45b501
mov eax, dword [esi + 0x37]
call fcn.0043e090
mov eax, 0x541998
mov edx, dword [esi + 0x37]
call fcn.004048f4
xor ecx, ecx
mov cl, byte [ebx]
lea edx, [ebx + 1]
lea eax, [ebx + 1]
call fcn.0043e130
jmp 0x45b54b
cmp byte [ebx], 0
je 0x45b54b
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00404b04
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0043e48c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x45b5e8
call fcn.00404bc8
mov edx, dword [ebp - 0xc]
mov eax, ebx
mov ecx, 0xff
call fcn.00404b58
cmp byte [ebp - 6], 0
je 0x45b5b4
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00404b04
push dword [ebp - 0x1c]
push 0x45b5f4
lea ecx, [ebp - 0x120]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0045b450
lea edx, [ebp - 0x120]
lea eax, [ebp - 0x20]
call fcn.00404b04
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404c3c
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, 0xff
call fcn.00404b58
jmp 0x45b5b4
xor edx, edx
mov dl, byte [ebx]
test edx, edx
jle 0x45b5b4
lea eax, [ebx + 1]
xor byte [eax], 0x62
inc eax
dec edx
jne 0x45b5ad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b5d6
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.004048c4
ret