joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40104c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417054]
jne 0x401056
repz ret
jmp fcn.00401ac6

Function at 0x4079ad
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004046bf
and dword [ebp - 0x14], 0
cmp dword [0x4483a8], 0
mov dword [ebp - 0x18], eax
jne 0x407a60
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407b08
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407b08
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4483a8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4483ac], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4483b0], eax
call edi
push eax
call esi
mov dword [0x4483b8], eax
test eax, eax
je 0x407a60
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4483b4], eax
mov eax, dword [0x4483b4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x407ab9
cmp dword [0x4483b8], ecx
je 0x407ab9
push eax
call esi
push dword [0x4483b8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407ab9
test ebx, ebx
je 0x407ab9
call edi
test eax, eax
je 0x407ab0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x407ab0
test byte [ebp - 8], 1
jne 0x407ab9
or dword [ebp + 0x10], 0x200000
jmp 0x407aec
mov eax, dword [0x4483ac]
cmp eax, dword [ebp - 0x18]
je 0x407aec
push eax
call esi
test eax, eax
je 0x407aec
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x407aec
mov eax, dword [0x4483b0]
cmp eax, dword [ebp - 0x18]
je 0x407aec
push eax
call esi
test eax, eax
je 0x407aec
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4483a8]
call esi
test eax, eax
je 0x407b08
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407b0a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040104c
leave
ret
Function at 0x402880
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or eax, 0xffffffff
mov word [ebp - 0xc], ax
push ebx
xor ecx, ecx
mov eax, 0x65
Function at 0x4096a0
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd4
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx + 4]
push esi
push edi
Function at 0x40e830
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, eax
mov ebx, 5
cmp dword [edi + 8], ebx
je 0x427c86
test byte [esp + edx*4], bh
add dword [eax], eax
call fcn.0040e950
test esi, esi
je 0x40e884
cmp dword [edi + 8], ebx
jne 0x427c90
mov eax, dword [edi]
mov dword [eax + 0x210], 0
test esi, esi
jle 0x40e884
lea ebx, [ebp + 8]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
add ebx, 4
mov edx, edi
call fcn.0040cfc0
dec dword [ebp - 4]
jne 0x40e872
mov eax, dword [edi]
mov ecx, dword [eax + 0x210]
mov dword [eax + 0x20c], ecx
mov edx, dword [edi]
mov dword [edx + 8], 1
mov eax, dword [edi]
cmp dword [eax + 0x20c], 0
jle 0x40e8e1
xor edx, edx
mov ecx, 0xc
lea ecx, [ecx]
mov esi, dword [ecx + eax + 0x100]
mov dword [ecx + eax], esi
mov eax, dword [edi]
mov esi, dword [ecx + eax]
imul esi, dword [eax + 8]
mov dword [eax + 8], esi
mov eax, dword [edi]
cmp dword [eax + 8], 0x1000000
jg 0x427c9c
inc edx
add ecx, 4
cmp edx, dword [eax + 0x20c]
jl 0x40e8b0
mov eax, dword [edi]
mov eax, dword [eax + 8]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004115d7
mov ecx, dword [edi]
push 4
mov dword [ecx], eax
call fcn.004115d7
add esp, 8
test eax, eax
je 0x40e93d
mov dword [eax], 1
mov edx, dword [edi]
mov dword [edx + 4], eax
mov eax, dword [edi]
cmp dword [eax + 8], 0
jle 0x40e934
xor ecx, ecx
mov eax, dword [eax]
mov dword [eax + ecx*4], 0
mov eax, dword [edi]
inc ecx
cmp ecx, dword [eax + 8]
jl 0x40e923
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x40e914
mov dword [edi + 8], ecx
call fcn.00414ff7
sub dword [esp + eax - 0x77], 0x47
add al, 0x89
inc edi
add al, 0xa1
inc eax
jmp 0x40f828
invalid
Function at 0x40f5c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10020
call fcn.00422240
xor eax, eax
nop
mov cl, byte [eax + 0x4921a0]
mov dl, byte [eax + 0x492198]
mov byte [ebp + eax - 0x20], cl
mov byte [ebp + eax - 0x18], dl
inc eax
cmp eax, 8
jl 0x40f5d0
lea eax, [ebp - 8]
push 0x488140
push eax
call fcn.00413650
push 4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.00410e60
add esp, 0x14
push ebx
push esi
mov dword [ebp - 0xc], 0
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [ebp - 0x10020]
push 1
push edx
call fcn.00414d04
add esp, 0x10
cmp eax, 0x18
jl 0x40f691
mov edi, eax
lea esi, [edi - 0x14]
test esi, esi
jle 0x40f660
xor edx, edx
xor ecx, ecx
mov bl, byte [ebp + ecx - 0x20]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x10020]
je 0x40f67e
cmp ecx, 0x14
je 0x425d1e
ret
inc edx
cmp edx, esi
jl 0x40f640
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
lea edx, [ecx + edi - 0x14]
push esp
cmp esp, ebp
mov ecx, dword [eax]
push 1
push 0xffffffffffffffec
push ecx
mov dword [ebp - 0xc], edx
call fcn.004150d1
add esp, 0xc
jmp 0x40f614
mov bl, byte [ebp + ecx - 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001f]
je 0x40f69f
inc ecx
jmp 0x40f652
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov bl, byte [ebp + ecx - 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001e]
je 0x40f6b4
add ecx, 2
jmp 0x40f652
mov bl, byte [ebp + ecx - 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001d]
jne 0x425d16
mov bl, byte [ebp + ecx - 0x1c]
lea eax, [ecx + edx]
cmp bl, byte [ebp + eax - 0x1001c]
je 0x425d05
add ecx, 4
jmp 0x40f652
int3
inc esp
inc esi
add al, 0x8b
or al, 0xb8
push ecx
call fcn.004111f1
sub dword [esp + eax + 0x47], 0x3b
jle 0x425d1a
jb 0x425cff
pop edi
jmp 0x4109ff
in eax, 0xac
invalid
add ecx, 5
cmp ecx, 0x14
jl 0x40f657
stc
adc al, 0xf
invalid
jmp 0x40f667

Function at 0x40f820
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.00412f40
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret
Function at 0x4321b9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 1
jne 0x4321e0
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
push 8
push eax
lea ecx, [ebp - 8]
push ecx
call 0xd410e75
cmp byte [eax], 0x30
jmp 0x4321f4
mov edx, dword [esi + 0x1c]
push edx
push 8
lea eax, [ebp - 8]
push 1
push eax
call fcn.00414d19
sub dword [eax + edx + 0xf], 0xffffffb6
dec ebp
cld
movzx ecx, byte [ebp - 4]
movzx edx, byte [ebp - 3]
movzx eax, byte [ebp - 2]
add dword [esi + 0xc], 8
shl ecx, 8
or ecx, edx
movzx edx, byte [ebp - 1]
shl ecx, 8
or ecx, eax
inc esp
inc ebp
or al, 0xc1
loope 0x432220
or ecx, edx
mov dword [eax], ecx
lea ecx, [ebp - 8]
push 0x18130
push ecx
mov byte [ebp - 4], 0
call fcn.00414d45
sub dword [eax + ecx - 0x43], 0xffffffd8
xor byte [ecx - 0x39aeffff], al
inc ebp
cld
add al, ch
pop ss
sub edi, esi
inc dword [ebx - 0x2742f794]
sbb eax, eax
neg eax
pop esi
jne 0x43221f
pop ebp
ret 0x5408

Function at 0x43223e
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x432291
inc esp
inc ebp
or byte [edi], cl
mov bh, 0x48
add dl, byte [esi + 0xf]
mov bh, 0x30
push edi
xor edi, edi
test ebx, ebx
jle 0x432288
lea ecx, [ecx + 0x54]
inc esp
inc ebp
or al, 0xf
mov dh, 4
pop es
add eax, esi
xor edx, edx
mov esi, 0xfdf0fff1
div esi
inc edi
mov esi, edx
lea eax, [ecx + esi]
xor edx, edx
mov ecx, 0xfdf0fff1
div ecx
mov ecx, edx
cmp edi, ebx
jl 0x43225e
inc esp
inc ebp
or cl, al
loope 0x43229b
shl ecx, 0x10
add ecx, esi
pop edi
mov dword [eax], ecx
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x432296
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
inc esp
inc ebp
or byte [ebx + 0x4a7540], ah
mov edx, 0x68258301
mov eax, 0x4a7540
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4a7efc
jl 0x4322ac
mov dword [0x1ec0205c], 0xff18688b
mov dword [0x4a7f10], 0x54e88301
pop edi
pop ebp
ret
Function at 0x434fe5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
inc sp
dec ebp
or al, 0x83
inc ebp
or byte [ebx + 0x335650ec], al
mul byte [esi - 0x7d]
stc
pop ds
cmp cx, 0x1f
jne 0x435014
mov eax, dword [eax + 8]
xor ecx, ecx
test eax, eax
je 0x435006
mov ecx, dword [eax]
push ecx
call dword [0x482428]
pop esi
jne 0x434ff5
pop ebp
ret 0x5408
push edi
cmp cx, 0x1e
jne 0x43507b
adc al, byte [eax + 8]
cmp byte es:[ebx + 0xe], dl
sub al, 0x89
push esp
push cs
call dword [edi + 0x6a]
add byte [esi], cl
sub al, 0xff
adc eax, 0x482184
xor ecx, ecx
mov ebx, eax
mov edx, 0x29002
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004115ec
sub dword [esp + eax + 0x53], 0xffffff8b
invalid
cmp cx, 8
jne 0x4350a0
adc al, byte [eax + 8]
xor byte es:[esi - 1], dl
adc eax, 0x482428
push esi
mov edi, eax
call dword [0x482400]
mov eax, edi
pop edi
pop esi
jne 0x435081
pop ebp
ret 8
cmp cx, 0x48
jne 0x4350cc
adc al, byte [eax + 8]
push 0x28
lea ecx, [ebp - 0x50]
push ecx
mov al, 0x51
push eax
call dword [0xff102800]
jne 0x4350c4
or al, 0x74
adc cl, byte [ebp - 0xad4fab]
adc eax, 0x482428
je 0x4350cc
lea edx, [ebp - 0x50]
push edx
call dword [0x482428]
pop edi
pop esi
jne 0x4350ad
pop ebp
ret 8
pop edi
mov eax, esi
pop esi
jne 0x4350b7
pop ebp
ret 8

Function at 0x442e21
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4a7f10], 0
push esi
push edi
mov esi, 0x4a7540
jne 0x442e41
push 0
call fcn.004148c8
push eax
call fcn.00432296
sub dword [esp + eax - 0x39], 5
pop esp
and byte [ecx], cl
jo 0x442e4b
mov dword [0x49205c], 0x270
add byte [eax], al
mov dword [0x4a753c], esi
mov edx, 0xe3
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi + 0x634]
add esi, 4
xor edi, eax
dec edx
mov dword [esi - 4], edi
jne 0x442e56
mov edx, 0x18c
lea esp, [esp]
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi - 0x38c]
add esi, 4
xor edi, eax
dec edx
mov dword [esi - 4], edi
jne 0x442e91
mov ecx, dword [0x4a7540]
mov dl, cl
and dl, 1
movzx eax, dl
mov edx, dword [esi]
neg eax
sbb eax, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, dword [esi]
and eax, 0x9908b0df
shr edx, 1
xor edx, dword [esi - 0x38c]
pop edi
xor edx, eax
mov dword [esi], edx
pop esi
ret
Function at 0x44b004
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0x2a0024]
push eax
call fcn.00442c6f
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp + 0x2a0024]
push edx
call 0x6f2bc9
xor esi, esi
test edi, edi
je 0x44b04c
lea eax, [ebp + 0x2a0024]
push eax
call 0x6f2c3e
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x44b038
pop edi
pop esi
pop ebx
jne 0x44b036
pop ebp
ret 0xc

Function at 0x44b319
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
dec dword [0x49205c]
jne 0x44b32a
call fcn.00442e21
mov ecx, dword [0x4a753c]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4a753c], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [ebp - 4], edx
fild dword [ebp - 4]
jns 0x44b371
fadd qword [0x48cd18]
fmul qword [0x48cd20]
jne 0x44b35e
pop ebp
ret
Function at 0x469953
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xeb5900b8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
mov edx, dword [esi + 8]
push edi
mov edi, ecx
mov ecx, dword [esi + 4]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xc]
inc dword [eax]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 8], edi
mov dword [ebp + 0x18], 0
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
call fcn.0040bc85
test ebx, ebx
je 0x469a65
mov eax, dword [edi]
push ebx
push 4
push 0x110a
push eax
call dword [0x482654]
mov dword [ebp + 8], eax
test eax, eax
je 0xff5e9a42
push esi
call fcn.0043657a
test al, al
jne 0x4699cf
mov edi, 0x484f84
mov eax, esi
call fcn.0040d215
mov edi, dword [ebp - 8]
cmp byte [ebp + 0x14], 0
je 0x469a05
mov edx, dword [ebp + 0x18]
push 0xa
lea ecx, [ebp - 0xb4]
push ecx
push edx
call fcn.00413071
add esp, 0xc
push 0x23
mov eax, esi
call fcn.00403035
lea edi, [ebp - 0xb4]
mov eax, esi
call fcn.0040d215
mov edi, dword [ebp - 8]
jmp 0x469a1b
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call fcn.00461c5f
lea ecx, [ebp - 0x18]
push ecx
mov eax, esi
call fcn.0040bd65
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push edx
push esi
push eax
push ecx
mov ecx, edi
call fcn.00469953
test al, al
jne 0xff5e9ae2
lea edx, [ebp - 0x28]
push edx
call fcn.0040e0b5
cmp ebx, dword [ebp + 0xc]
je 0x469a80
mov eax, dword [edi]
push ebx
push 1
push 0x110a
push eax
call dword [0x482654]
inc dword [ebp + 0x18]
mov ebx, eax
test ebx, ebx
jne 0x46999a
xor eax, 0x8dffffff
dec ebp
call 0xf9ce9354
dec dword [ebp - 0xf1727b3]
xchg ecx, edi
push dword [edx]
rcr byte [edi + 0x5e], 0x5b
lea ecx, [ebp - 0x18]
call fcn.00402265
lea ecx, [ebp - 0x28]
call fcn.00402265
xor al, al
pop edi
pop esi
pop ebx
jne 0x469a61
pop ebp
ret 0xff14
push esi
call fcn.0043657a
test al, al
jne 0x469a99
mov edi, 0x484f84
mov eax, esi
call fcn.0040d215
mov edi, dword [ebp - 8]
cmp byte [ebp + 0x14], 0
je 0x469acc
mov edx, dword [ebp + 0x18]
push 0xa
lea ecx, [ebp - 0xb4]
push ecx
push edx
call fcn.00413071
add esp, 0xc
push 0x23
mov eax, esi
call fcn.00403035
lea edi, [ebp - 0xb4]
mov eax, esi
call fcn.0040d215
jmp 0x469ae2
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call fcn.00461c5f
lea ecx, [ebp - 0x18]
push ecx
mov eax, esi
call fcn.0040bd65
and dword [edx], 0xfffffffa
dec dword [ebp + 0x7be8e84d]
xchg ecx, edi
dec dword [ebp + 0x73e8d84d]
xchg ecx, edi
call [edi + 0x5e]
lea ecx, [ebp - 0x18]
call fcn.00402265
lea ecx, [ebp - 0x28]
call fcn.00402265
pop edi
pop esi
mov al, 1
pop ebx
jne 0x469ade
pop ebp
ret 0x14
Function at 0x46ec63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x24], 0
je 0x46ed98
push edi
call fcn.0043657a
test al, al
jne 0x48ed98
push 0
mov byte [ebp + 0x17], al
push ebx
or eax, 0xffffffff
mov dword [ebp + 8], 0x100
call fcn.0040c615
cmp dword [ebp + 0x10], 0
jne 0x46eca9
mov byte [ebp + 0x17], 1
lea ecx, [ebp - 0x40]
call fcn.0040bc85
lea ecx, [ebp - 0x30]
call fcn.0040bc85
lea esi, [ebp - 0x20]
call fcn.0040d385
xor esi, esi
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
lea ecx, [ecx]
pop edi
pop esi
xor eax, eax
pop ebx
jne 0x46ed84
pop ebp
ret 0x10
jae 0x48ee0e
dec ecx
Function at 0x47093d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4a8690]
push ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [eax + ebx*4]
push edi
mov edi, dword [ecx]
push 0
push edi
call fcn.00430018
mov eax, dword [edi + 0x18]
test eax, eax
je 0x470965
push eax
call dword [0x482510]
push esi
mov esi, 3
cmp dword [0x4a86b4], esi
jl 0x470a7f
lea ebx, [ebx]
mov edx, dword [0x4a86a4]
mov eax, dword [edx + esi*4]
cmp dword [eax], 0
je 0x470a72
mov eax, dword [eax]
mov ecx, dword [eax + 4]
cmp ecx, dword [edi + 4]
jne 0x470b72
movzx ecx, byte [eax + 0x88]
add ecx, 0xfffffff6
cmp ecx, 0x13
ja 0x470a07
movzx edx, byte [ecx + 0x18470b58]
jmp dword [edx*4 + 0x18470b44]
mov eax, dword [0x4a86a4]
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x60]
test eax, eax
je 0x470a1f
push eax
call dword [0x4820c8]
mov eax, dword [0x4a86a4]
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x64]
test eax, eax
je 0x470a37
push eax
call dword [0x482704]
mov eax, dword [0x4a86a4]
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
test eax, eax
je 0x470a4f
push eax
call dword [0x4820c8]
mov eax, dword [0x4a86a4]
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x4c]
test eax, eax
je 0x470a67
push eax
call dword [0x482608]
push esi
push 0x4a8630
call fcn.00451990
inc esi
cmp esi, dword [0x4a86b4]
jle 0x47097d
mov eax, dword [edi + 0x20]
pop esi
test eax, eax
je 0x470a8e
push eax
call dword [0x482704]
mov edi, dword [edi + 0x24]
test edi, edi
je 0x470a9c
push edi
call dword [0x482704]
mov eax, dword [0x4a8690]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
test eax, eax
je 0x470ab0
push eax
call fcn.00470020
mov edx, dword [0x4a8690]
mov eax, dword [edx + ebx*4]
mov dword [eax], 0
mov eax, dword [0x4a8650]
dec eax
cmp ebx, dword [0x4a869c]
pop edi
mov dword [0x4a8650], eax
pop ebx
jne 0x470ade
mov dword [0x4a869c], 0xffffffff
cmp al, 1
jne 0x470b09
mov ecx, dword [0x4a8694]
xor eax, eax
test ecx, ecx
jle 0x470b02
mov edx, dword [0x4a8690]
mov edx, dword [edx + eax*4]
cmp dword [edx], 0
jne 0x470b02
inc eax
cmp eax, ecx
jl 0x470aef
mov dword [0x4a869c], eax
jmp 0x470b2b
test eax, eax
jne 0x470b25
mov eax, dword [0x4a8654]
push eax
push 0
call dword [0x4826d4]
mov dword [0x4a8654], 0
mov ecx, dword [0x4a8694]
test ecx, ecx
je 0x470b52
mov edx, dword [0x4a8690]
mov eax, dword [edx + ecx*4 - 4]
cmp dword [eax], 0
jne 0x470b52
push 0x4a868c
call fcn.0042ffb4
mov ecx, dword [0x4a8694]
test ecx, ecx
jne 0x470b2f
pop ebp
ret 4
add al, 0
add al, 4
add dword [esp + eax], eax
add al, 4
add al, 4
add al, 2
add al, 3
Function at 0x47dcd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov eax, dword [edx + eax*4]
movsx ecx, word [eax + 0xa]
lea esi, [ebp - 0x24]
mov dword [ebp + 0x10], ecx
call fcn.0040d385
mov eax, dword [edi]
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 4]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
push eax
call fcn.0045f65a
xor eax, eax
lea ecx, [ebp + 0xc]
push ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push esi
mov eax, edi
push ebx
lea edi, [ebp - 0x14]
mov dword [ebp - 0x14], 0x488088
call fcn.00408da5
test eax, eax
jne 0x47dd68
mov ecx, dword [ebp + 0x14]
lea edx, [ebp - 4]
push edx
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x24]
push edi
push eax
push ecx
lea edx, [ebx + 0x1015c]
push edx
call fcn.00454302
cmp eax, 6
jne 0x47dd86
mov eax, dword [ebp + 0x10]
push eax
push 0x185
push ebx
call fcn.0045e74c
dec dword [ebp + 0x5e8ec4d]
das
stc
dec dword [ebp - 0x1217238b]
xor eax, 0x1b8fff8
sbb bh, bh
add byte [edi + 0x5e], bl
lea ecx, [ebp - 0x14]
call fcn.00410c75
lea esi, [ebp - 0x24]
call fcn.00401365
mov eax, 0xff1801
pop edi
pop esi
pop ebx
jne 0x47dd67
pop ebp
ret 0x10
cmp eax, 5
je 0x47dd68
cmp eax, 7
jne 0x47dd98
mov ecx, dword [ebp + 0x10]
push ecx
push 0x70
jmp 0x47dd62
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
mov eax, dword [eax + 4]
push 0
push edx
add eax, ebx
call fcn.00403ca5
mov edx, dword [ebx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 4]
push 0
push ecx
add eax, ebx
call fcn.00403ce5
lea ecx, [ebp - 0x14]
call fcn.00410c75
lea esi, [ebp - 0x24]
call fcn.00401365
pop edi
pop esi
sub dword [edi - 8], ebx
dec dword [ebp - 0x4e1713b3]
stc
dec dword [ebp - 0x6617238b]
xor eax, 0x5e5ffff8
xor eax, eax
pop ebx
jne 0x47ddb8
pop ebp
ret 0x10
Function at 0x408d50
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x444c30]
jne 0x408d5a
repz ret
jmp fcn.0040b86c

Function at 0x40b037
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004051e7
and dword [ebp - 4], 0
cmp dword [0x445fc4], 0
mov ebx, eax
jne 0x40b0e8
push 0x402ab4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b199
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402aa8
push edi
call esi
test eax, eax
je 0x40b199
push eax
call fcn.00405175
mov dword [esp], 0x402a98
push edi
mov dword [0x445fc4], eax
call esi
push eax
call fcn.00405175
mov dword [esp], 0x402a84
push edi
mov dword [0x445fc8], eax
call esi
push eax
call fcn.00405175
mov dword [esp], 0x402a68
push edi
mov dword [0x445fcc], eax
call esi
push eax
call fcn.00405175
pop ecx
mov dword [0x445fd4], eax
test eax, eax
je 0x40b0e8
push 0x402a50
push edi
call esi
push eax
call fcn.00405175
pop ecx
mov dword [0x445fd0], eax
mov eax, dword [0x445fd0]
cmp eax, ebx
je 0x40b140
cmp dword [0x445fd4], ebx
je 0x40b140
push eax
call fcn.004051f0
push dword [0x445fd4]
mov esi, eax
call fcn.004051f0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b140
test edi, edi
je 0x40b140
call esi
test eax, eax
je 0x40b137
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b137
test byte [ebp - 0xc], 1
jne 0x40b140
or dword [ebp + 0x10], 0x200000
jmp 0x40b179
mov eax, dword [0x445fc8]
cmp eax, ebx
je 0x40b179
push eax
call fcn.004051f0
pop ecx
test eax, eax
je 0x40b179
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b179
mov eax, dword [0x445fcc]
cmp eax, ebx
je 0x40b179
push eax
call fcn.004051f0
pop ecx
test eax, eax
je 0x40b179
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x445fc4]
call fcn.004051f0
pop ecx
test eax, eax
je 0x40b199
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b19b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret