joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fc8e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push 7
mov dword [ebp - 0x18], 0x7d217d51
mov dword [ebp - 0x14], 0x7d1c7d51
mov dword [ebp - 0x10], 0x7d167d7b
mov dword [ebp - 0xc], 0x7d627d62
pop ecx
mov ax, word [ebp + ecx*2 - 0x1a]
xor word [ebp + ecx*2 - 0x18], ax
dec ecx
test ecx, ecx
jg 0x45fcb3
mov eax, 0x7d10
mov dword [ebp - 0x28], 0x6faa6fcb
xor word [ebp - 0x18], ax
mov ecx, 0x6f99
push 7
mov dword [ebp - 0x24], 0x6f986fd9
mov dword [ebp - 0x20], 0x6f996fed
mov dword [ebp - 0x1c], 0x6ff66ff6
pop edx
mov ax, word [ebp + edx*2 - 0x2a]
xor word [ebp + edx*2 - 0x28], ax
dec edx
test edx, edx
jg 0x45fcef
xor word [ebp - 0x28], cx
xor edx, edx
push edi
push 7
pop ecx
xor eax, eax
mov dword [ebp - 8], edx
lea edi, [ebp - 0x44]
mov dword [ebp - 4], edx
rep stosd dword es:[edi], eax
push 0x1c
pop ecx
lea eax, [ebp - 0x44]
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x45fd1b
lea eax, [ebp - 8]
push eax
push 0xf003f
push edx
push edx
call fcn.0046848e
add esp, 0x10
test eax, eax
je 0x45fd41
xor al, al
jmp 0x45fde1
push ebx
push esi
lea eax, [ebp - 4]
mov ebx, 0x80000020
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call fcn.0046852b
mov esi, dword [ebp + 0x10]
add esp, 0x10
mov edi, 0x659001c
push dword [ebp + 0xc]
test eax, eax
jne 0x45fd7c
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.0046a330
add esp, 0xc
jmp 0x45fd9f
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.0046a330
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.0046852b
add esp, 0x1c
test eax, eax
jne 0x45fdbe
test byte [esi + 0xc], 1
je 0x45fdb4
push edi
call fcn.00460d44
pop ecx
lea ecx, [ebp - 4]
push ecx
call eax
jmp 0x45fdbe
lea eax, [ebp - 4]
push eax
call fcn.004683b4
pop ecx
test byte [esi + 0xc], 1
pop esi
pop ebx
je 0x45fdd5
push edi
call fcn.00460d44
pop ecx
lea ecx, [ebp - 8]
push ecx
call eax
jmp 0x45fddf
lea eax, [ebp - 8]
push eax
call fcn.004683b4
pop ecx
mov al, 1
pop edi
leave
ret
Function at 0x460d44
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov edi, eax
mov dword [ebp - 0x10], eax
mov esi, dword [edi + 0x10]
mov edi, dword [edi]
test esi, esi
je 0x460dba
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
test ebx, ebx
je 0x460dba
mov eax, dword [ebx + esi + 0xc]
add eax, esi
push eax
call fcn.0044cecf
pop ecx
mov ecx, dword [ebx + esi + 0x20]
mov dword [ebp - 8], eax
add ecx, esi
xor eax, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
cmp dword [ebx + esi + 0x18], eax
jbe 0x460dba
mov eax, dword [ecx + eax*4]
add eax, esi
push eax
call fcn.0044cecf
add eax, dword [ebp - 8]
pop ecx
cmp dword [ebp + 8], eax
je 0x460dc6
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebx + esi + 0x18]
jb 0x460d96
cmp edi, dword [ebp - 0x10]
jne 0x460d5e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x460dc1
Function at 0x460de2
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push edi
push 0x63
mov edi, ebx
movaps xmm0, xmmword [0x47c810]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0x7c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push 0x6f
mov word [ebp - 0x50], ax
pop eax
push 0x6d
mov word [ebp - 0x4e], ax
pop eax
push 0x62
pop edx
push 0x61
mov word [ebp - 0x4c], ax
pop eax
push 0x73
mov word [ebp - 0x48], ax
pop eax
push 0x65
mov word [ebp - 0x46], ax
pop eax
push 0x2e
mov word [ebp - 0x44], ax
pop eax
push 0x64
mov word [ebp - 0x42], ax
pop eax
push 0x6c
mov word [ebp - 0x40], ax
pop eax
mov word [ebp - 0x3e], ax
mov word [ebp - 0x3c], ax
xor eax, eax
push 0x10
mov word [ebp - 0x4a], dx
mov word [ebp - 0x3a], ax
pop ecx
mov al, byte [ebp + ecx - 0x25]
xor byte [ebp + ecx - 0x24], al
dec ecx
test ecx, ecx
jg 0x460e57
xor byte [ebp - 0x24], 0x5d
push 0x11
pop ecx
push 0xe
mov byte [ebp - 0xd], dl
mov word [ebp - 0x10], 0x5936
mov byte [ebp - 0xe], 0xc
mov dword [ebp - 0xc], 0x780c650b
mov byte [ebp - 8], cl
mov dword [ebp - 7], 0xf751c70
mov word [ebp - 3], 0x6a6a
pop edx
mov al, byte [ebp + edx - 0x11]
xor byte [ebp + edx - 0x10], al
dec edx
test edx, edx
jg 0x460e92
movaps xmm0, xmmword [0x47c800]
xor byte [ebp - 0x10], 0x75
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 0x28], 0x5353
mov al, byte [ebp + ecx - 0x39]
xor byte [ebp + ecx - 0x38], al
dec ecx
test ecx, ecx
jg 0x460eb4
xor byte [ebp - 0x38], 0x2a
push 0x39e51281
call fcn.00460d44
pop ecx
lea ecx, [ebp - 0x50]
push ecx
call eax
push 0x91e0937
mov edi, eax
call fcn.00460d44
mov dword [ebx], eax
pop ecx
test edi, edi
je 0x460f0e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x24]
push eax
push edi
call esi
mov dword [ebx + 4], eax
lea eax, [ebp - 0x10]
push eax
push edi
call esi
mov dword [ebx + 8], eax
lea eax, [ebp - 0x38]
push eax
push edi
call esi
pop esi
jmp 0x460f35
push 0xff0a825
call fcn.00460d44
push 0xf922f540
mov dword [ebx + 4], eax
call fcn.00460d44
push 0xa5c11aff
mov dword [ebx + 8], eax
call fcn.00460d44
add esp, 0xc
mov dword [ebx + 0xc], eax
mov eax, ebx
pop edi
pop ebx
leave
ret
Function at 0x460f3e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
xor eax, eax
push edi
push 0x1dc76ec6
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call fcn.00460d44
mov dword [ebp - 0x14], eax
mov dword [esp], 0x47d93bee
call fcn.00460d44
pop ecx
push 9
pop ecx
mov esi, 0x486ac8
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
push 0x11
mov ebx, eax
pop ecx
movsw word es:[edi], word [esi]
mov ax, word [ebp + ecx*2 - 0x46]
xor word [ebp + ecx*2 - 0x44], ax
dec ecx
test ecx, ecx
jg 0x460f80
mov eax, 0x38b0
xor edi, edi
xor word [ebp - 0x44], ax
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call ebx
push 2
pop esi
test eax, eax
jne 0x4610ca
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
shr edx, 1
mov dword [ebp - 0x1c], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, word [ebp - 0xc]
jne 0x460fc3
sub ecx, edi
lea eax, [edx + 1]
sar ecx, 1
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x18], eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00466be9
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
xor eax, eax
mov dword [ebp - 0x10], edi
push eax
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x4610bb
xor ebx, ebx
mov edx, edi
inc ebx
mov ecx, dword [ebp + 0xc]
mov eax, edx
mov di, word [eax]
cmp di, word [ecx]
mov edi, dword [ebp - 0x10]
jne 0x461048
cmp word [eax], 0
je 0x461044
mov di, word [eax + 2]
cmp di, word [ecx + 2]
mov word [ebp - 2], di
mov edi, dword [ebp - 0x10]
jne 0x461048
add eax, 4
add ecx, 4
cmp word [ebp - 2], 0
jne 0x461015
xor eax, eax
jmp 0x46104c
sbb eax, eax
or eax, ebx
test eax, eax
je 0x4610bf
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, esi
cmp ax, word [ebp - 0xc]
jne 0x461058
sub ecx, dword [ebp - 4]
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, esi
cmp ax, word [ebp - 0xc]
jne 0x461076
sub ecx, dword [ebp - 4]
sar ecx, 1
jne 0x461010
mov eax, dword [ebp - 0x1c]
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x18]
dec eax
push esi
lea eax, [edi + eax*2]
push eax
call fcn.004519c1
lea eax, [esi + esi]
xor ecx, ecx
push eax
push edi
mov word [eax + edi - 2], cx
xor eax, eax
push 7
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call dword [ebp - 0x14]
test eax, eax
je 0x4610bf
xor eax, eax
mov ebx, eax
push edi
call fcn.00466f54
pop ecx
mov eax, ebx
jmp 0x46112d
cmp eax, esi
jne 0x46112b
push 0x64
lea eax, [ebp - 0xa8]
push edi
push eax
call fcn.0046a8b0
add esp, 0xc
lea eax, [ebp - 0xa8]
push dword [ebp + 0xc]
push 0x32
push eax
call fcn.004519c1
lea ecx, [ebp - 0xa8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, di
jne 0x4610fa
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 4]
push eax
lea eax, [ebp - 0xa8]
push eax
push 7
push edi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call dword [ebp - 0x14]
test eax, eax
jne 0x46112b
inc eax
jmp 0x46112d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x461132
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push esi
push edi
push 0xf
pop edx
mov ecx, edx
lea edi, [ebp - 0xa4]
mov esi, 0x4869e0
rep movsd dword es:[edi], dword [esi]
push 0x1c
pop ecx
mov ax, word [ebp + ecx*2 - 0xa6]
xor word [ebp + ecx*2 - 0xa4], ax
dec ecx
test ecx, ecx
jg 0x461152
push 7
pop ecx
mov esi, 0x486cf0
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x41e2
xor word [ebp - 0xa4], ax
push 0xd
movsw word es:[edi], word [esi]
pop ecx
mov ax, word [ebp + ecx*2 - 0x22]
xor word [ebp + ecx*2 - 0x20], ax
dec ecx
test ecx, ecx
jg 0x461185
push 8
pop ecx
mov esi, str.Gg_gfg
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x1e6e
xor word [ebp - 0x20], ax
movsw word es:[edi], word [esi]
mov ax, word [ebp + edx*2 - 0x46]
xor word [ebp + edx*2 - 0x44], ax
dec edx
test edx, edx
jg 0x4611ac
push 9
pop ecx
mov esi, 0x48678c
lea edi, [ebp - 0x68]
mov eax, 0x6714
xor word [ebp - 0x44], ax
rep movsd dword es:[edi], dword [esi]
push 0x10
pop ecx
mov ax, word [ebp + ecx*2 - 0x6a]
xor word [ebp + ecx*2 - 0x68], ax
dec ecx
test ecx, ecx
jg 0x4611d4
mov esi, dword [ebp + 8]
mov eax, 0x5e34
xor word [ebp - 0x68], ax
lea eax, [ebp - 0xa4]
push eax
push esi
call fcn.00460f3e
pop ecx
pop ecx
test eax, eax
je 0x461237
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.00460f3e
pop ecx
pop ecx
test eax, eax
je 0x461237
lea eax, [ebp - 0x68]
push eax
push esi
call fcn.00460f3e
pop ecx
pop ecx
test eax, eax
je 0x461237
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.00460f3e
pop ecx
pop ecx
test eax, eax
je 0x461237
xor eax, eax
inc eax
jmp 0x461239
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x461356
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
push edi
xor edi, edi
mov eax, dword [edx + 4]
mov ebx, dword [edx]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], edi
jle 0x4613ad
push esi
inc bl
movzx ebx, bl
mov ecx, dword [edx + ebx*4 + 8]
mov al, cl
add al, byte [ebp - 4]
mov edx, dword [ebp + 8]
movzx eax, al
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 8]
mov dword [edx + ebx*4 + 8], eax
mov dword [edx + esi*4 + 8], ecx
add cl, al
movzx eax, cl
mov ecx, dword [ebp + 0xc]
mov al, byte [edx + eax*4 + 8]
xor byte [edi + ecx], al
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x46136f
mov eax, esi
pop esi
pop edi
mov dword [edx], ebx
mov dword [edx + 4], eax
pop ebx
leave
ret
Function at 0x46178d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
push 0xdcc68363
mov dword [ebp - 4], eax
call fcn.00460d44
push 0xf44abbdd
mov dword [ebp - 8], eax
call fcn.00460d44
push 0xeb9bb51d
mov dword [ebp - 0x18], eax
call fcn.00460d44
push 0x9df954f8
mov dword [ebp - 0x20], eax
call fcn.00460d44
mov esi, eax
push 0x85f935fa
mov dword [ebp - 0x10], esi
call fcn.00460d44
push 0x8bd388ab
mov dword [ebp - 0x1c], eax
call fcn.00460d44
push 0x47a6a5c3
mov dword [ebp - 0xc], eax
call fcn.00460d44
push 0x9cf899ae
mov dword [ebp - 0x14], eax
call fcn.00460d44
mov ebx, dword [ebp + 8]
add esp, 0x20
test ebx, ebx
jne 0x4618c9
push 0x104
lea ecx, [ebp - 0x244]
push ecx
call eax
push 7
pop ecx
mov esi, 0x486b28
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
push 0xc
pop ecx
mov ax, word [ebp + ecx*2 - 0x3e]
xor word [ebp + ecx*2 - 0x3c], ax
dec ecx
test ecx, ecx
jg 0x461835
and dword [0x5c91a4], 0
mov eax, 0x30ba
xor word [ebp - 0x3c], ax
lea eax, [ebp + 8]
push 4
push 0x3000
push eax
push 0
push 0x5c91a4
push 0xffffffffffffffff
mov dword [ebp + 8], 0x400
call dword [ebp - 0xc]
test eax, eax
js 0x461920
lea eax, [ebp - 0x244]
mov esi, 0x104
push eax
push esi
push dword [0x5c91a4]
call fcn.004519c1
lea eax, [ebp - 0x3c]
push eax
push esi
push dword [0x5c91a4]
call fcn.0042699f
call dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov esi, dword [0x5c91a4]
push esi
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx + 0x3c]
mov dword [0x5c91a8], eax
mov eax, dword [ecx + 0x44]
mov dword [0x5c91ac], eax
call dword [ebp - 0x14]
mov edi, eax
jmp 0x4618d7
call esi
mov edi, dword [0x5c91ac]
mov esi, dword [0x5c91a8]
push esi
mov esi, dword [ebp - 4]
mov eax, dword [esi + 0x10]
add eax, 0x38
push eax
call dword [ebp - 8]
mov eax, dword [esi + 0x10]
push edi
add eax, 0x40
push eax
call dword [ebp - 8]
test ebx, ebx
je 0x461912
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0x8000
push eax
push 0x5c91a4
push 0xffffffffffffffff
call dword [ebp - 0x18]
and dword [0x5c91a4], 0
call dword [ebp - 0x1c]
push ebx
push 0x4625db
push 0
call dword [ebp - 0x20]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4623c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
xor eax, eax
push esi
mov dword [ebp - 4], eax
cmp dword [ebp + 8], eax
je 0x4624a7
mov ecx, dword [ebp + 8]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4623e0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x40
ja 0x4624a7
push 0xfb9fd244
call fcn.00460d44
pop ecx
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x270]
mov edx, 0x208
xor eax, eax
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x462413
push edi
push 0xe
pop ecx
mov esi, str.f__n_o_
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
push 0x1b
pop ecx
movsw word es:[edi], word [esi]
pop edi
mov ax, word [ebp + ecx*2 - 0x46]
xor word [ebp + ecx*2 - 0x44], ax
dec ecx
test ecx, ecx
jg 0x46242f
mov eax, 0x2423
mov esi, 0x104
xor word [ebp - 0x44], ax
lea eax, [ebp - 0x44]
push eax
push esi
lea eax, [ebp - 0x270]
push eax
call fcn.004519c1
push dword [ebp + 8]
lea eax, [ebp - 0x270]
push esi
push eax
call fcn.0042699f
push 0x24
pop esi
mov ecx, esi
lea eax, [ebp - 0x68]
xor edx, edx
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x462477
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], esi
push eax
lea eax, [ebp - 0x270]
push eax
call dword [ebp - 8]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
jmp 0x4624ac
mov eax, 0x80004005
pop esi
leave
ret
Function at 0x462808
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
push ebx
push esi
push edi
push 0xfabce86c
call fcn.00460d44
mov esi, eax
mov dword [esp], 0x5265ee6b
call fcn.00460d44
push 0x8650fc80
mov dword [ebp - 0x30], eax
call fcn.00460d44
push 0x42162bda
mov dword [ebp - 0x18], eax
call fcn.00460d44
push 0x147b819e
mov dword [ebp - 0x34], eax
call fcn.00460d44
push 0xf1637f1e
mov dword [ebp - 0x38], eax
call fcn.00460d44
push 0xf472eb24
mov dword [ebp - 0x3c], eax
call fcn.00460d44
xor ebx, ebx
mov dword [ebp - 0x40], eax
push 0x208
lea eax, [ebp - 0x2cc]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x2c], 0x104
call fcn.0046a8b0
add esp, 0x24
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0xc4]
mov word [ebp - 0x10], 0x500
mov dword [ebp - 8], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x2cc]
push eax
call esi
push 0x53
pop eax
push 0x79
mov word [ebp - 0x28], ax
pop eax
push 0x73
mov word [ebp - 0x26], ax
pop eax
push 0x74
mov word [ebp - 0x24], ax
pop eax
mov word [ebp - 0x22], ax
push 0x65
pop eax
mov word [ebp - 0x20], ax
push 0x6d
pop eax
mov word [ebp - 0x1e], ax
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2cc]
push eax
call fcn.00463c0d
pop ecx
pop ecx
test eax, eax
je 0x462a14
push 8
pop ecx
mov esi, 0x486e80
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
push 0xe
pop ecx
mov ax, word [ebp + ecx*2 - 0x62]
xor word [ebp + ecx*2 - 0x60], ax
dec ecx
test ecx, ecx
jg 0x46290a
mov eax, 0x1032
xor word [ebp - 0x60], ax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x2cc]
push eax
call fcn.00463c0d
pop ecx
pop ecx
test eax, eax
je 0x462a14
lea eax, [ebp - 0xc]
push eax
push 8
push 0xffffffffffffffff
call dword [ebp - 0x30]
test eax, eax
jne 0x462959
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x18]
mov dword [eax + 4], ebx
jmp 0x4629ef
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push 2
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x46297a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x46294b
push dword [ebp - 4]
call fcn.00466be9
pop ecx
mov esi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 2
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x4629a0
mov eax, dword [ebp + 8]
mov dword [eax + 4], ebx
jmp 0x4629ef
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x14]
push eax
call dword [ebp - 0x34]
test eax, eax
je 0x462998
cmp dword [esi], ebx
jbe 0x4629ef
lea edi, [esi + 8]
push dword [edi - 4]
push dword [ebp - 8]
call dword [ebp - 0x38]
test eax, eax
je 0x4629de
mov eax, dword [ebp + 8]
mov byte [eax + 1], 1
test byte [edi], 4
jne 0x4629e8
inc ebx
add edi, 8
cmp ebx, dword [esi]
jb 0x4629c5
jmp 0x4629ef
mov dword [eax + 4], 1
cmp dword [ebp - 8], 0
je 0x4629fb
push dword [ebp - 8]
call dword [ebp - 0x3c]
test esi, esi
je 0x462a06
push esi
call fcn.00466f54
pop ecx
cmp dword [ebp - 0xc], 0
je 0x462a1e
push dword [ebp - 0xc]
call dword [ebp - 0x40]
jmp 0x462a1e
mov eax, dword [ebp + 8]
mov dword [eax + 4], 2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4662b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
mov eax, dword [eax]
push edi
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 6]
lea ecx, [eax + eax*4]
shl ecx, 3
lea eax, [ecx + 0x28]
cmp eax, dword [edi + 0x54]
ja 0x466479
movzx eax, word [edi + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea ebx, [edi + 0x18]
push 0
push 0
push esi
add eax, ecx
add ebx, eax
push ebx
push esi
push dword [ebp + 0x10]
mov dword [ebp - 8], ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [ebx + esi], 0
xor edx, edx
mov ebx, dword [ebp + 0x18]
mov eax, ebx
mov ecx, dword [edi + 0x38]
div ecx
test edx, edx
jne 0x466316
mov ecx, ebx
jmp 0x46631a
sub ecx, edx
add ecx, ebx
mov esi, dword [ebp - 8]
xor edx, edx
mov eax, ebx
mov dword [esi + 8], ecx
mov ecx, dword [edi + 0x3c]
div ecx
test edx, edx
jne 0x466331
mov ecx, ebx
jmp 0x466335
sub ecx, edx
add ecx, ebx
mov dword [esi + 0x10], ecx
xor edx, edx
movzx eax, word [edi + 6]
lea ecx, [eax + eax*4]
movzx eax, word [edi + 0x14]
add eax, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx + 4]
add eax, dword [ecx]
mov dword [esi + 0x14], eax
mov eax, dword [ecx - 4]
add eax, dword [ecx]
mov esi, dword [edi + 0x38]
mov dword [ebp - 4], eax
div esi
mov ecx, dword [ebp - 4]
test edx, edx
je 0x46636a
sub esi, edx
add ecx, esi
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x24], 0x40000040
mov eax, ebx
inc word [edi + 6]
mov ecx, dword [edi + 0x38]
div ecx
test edx, edx
jne 0x46638c
mov ecx, ebx
jmp 0x466390
sub ecx, edx
add ecx, ebx
add dword [edi + 0x50], ecx
xor edx, edx
mov edi, dword [edi + 0x3c]
mov eax, ebx
div edi
test edx, edx
jne 0x4663a4
mov edi, ebx
jmp 0x4663a8
sub edi, edx
add edi, ebx
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, edi
push eax
call fcn.00466be9
mov esi, dword [esi]
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], eax
lea edx, [esi + edi]
mov ecx, dword [ecx]
mov dword [ebp - 4], ecx
test esi, esi
je 0x466428
test eax, eax
jne 0x4663dd
call fcn.0046dded
mov dword [eax], 0x16
jmp 0x466423
test ecx, ecx
je 0x4663f2
cmp edx, esi
jb 0x4663f2
push esi
push ecx
push eax
call fcn.0046a330
add esp, 0xc
jmp 0x466428
push edx
push 0
push eax
call fcn.0046a8b0
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x466411
call fcn.0046dded
mov dword [eax], 0x16
jmp 0x466423
lea eax, [esi + edi]
cmp eax, esi
jae 0x466428
call fcn.0046dded
mov dword [eax], 0x22
call fcn.0046e15b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0046e5ba
add esp, 4
xor esi, esi
test edi, edi
je 0x466457
mov ebx, dword [ebp - 8]
call fcn.0046e5cc
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
add ecx, esi
inc esi
mov byte [ecx + ebx], al
cmp esi, edi
jb 0x466440
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp - 8]
push edi
mov edi, dword [ebp + 0xc]
push 0xcc
mov eax, dword [edi]
add eax, esi
push eax
call fcn.0046a8b0
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [eax], esi
add dword [edi], ebx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x466970
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov ebx, eax
mov dword [ebp - 0x1c], eax
nop word [eax + eax]
lea eax, [ebx]
mov ebx, dword [ebx]
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax + 0x10]
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x466a45
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
test eax, eax
je 0x466a45
mov esi, dword [eax + ebx + 0xc]
add eax, ebx
add esi, ebx
mov dword [ebp - 4], eax
xor edi, edi
mov dl, byte [esi]
test dl, dl
je 0x4669e4
movsx ecx, dl
lea esi, [esi + 1]
ror edi, 0xf
cmp dl, 0x61
mov dl, byte [esi]
lea eax, [ecx - 0x20]
cmovl eax, ecx
add edi, eax
test dl, dl
jne 0x4669c7
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], eax
mov edx, dword [edx + 0x18]
mov dword [ebp - 0x10], edx
test edx, edx
je 0x466a45
nop
mov esi, dword [eax + ecx*4]
xor eax, eax
add esi, ebx
mov bl, byte [esi]
test bl, bl
je 0x466a30
nop dword [eax]
movsx edx, bl
lea esi, [esi + 1]
ror eax, 0xf
cmp bl, 0x61
mov bl, byte [esi]
lea ecx, [edx - 0x20]
cmovl ecx, edx
add eax, ecx
test bl, bl
jne 0x466a10
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
add eax, edi
cmp dword [ebp + 8], eax
je 0x466a5a
mov ebx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
cmp ecx, edx
jb 0x466a00
mov ebx, dword [ebp - 0x18]
cmp ebx, dword [ebp - 0x1c]
jne 0x466990
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov esp, ebp
pop ebp
ret