joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456010
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x456176
sub esp, 0x28
mov eax, dword [esp + 0x2c]
test byte [eax], al
lea ecx, [0x13d3fc4]
mov dword [esp], ecx
call fcn.00479360
mov eax, dword [esp + 4]
test eax, eax
jne 0x456048
call fcn.00432ef0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jne 0x45615f
mov ecx, dword [0x13d4400]
test ecx, ecx
jne 0x456067
mov ecx, dword [esp + 0x2c]
jmp 0x456078
call fcn.004744e0
mov ecx, dword [esp + 0x2c]
mov dword [edi], ecx
mov edx, dword [eax + 0x2c]
mov dword [edi + 4], edx
mov dword [eax + 0x2c], ecx
mov edx, dword [ecx + 0xc]
mov ebx, dword [ecx + 8]
inc ebx
mov ebp, dword [ecx + 4]
mov esi, dword [eax + 0xc]
mov edi, dword [eax + 0x10]
cmp edx, ebx
jae 0x4560fa
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp + 0xc], 1
lea eax, [0x845960]
mov dword [esp + 0x10], eax
call fcn.0046f310
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
mov dword [ebx + 0xc], eax
mov eax, dword [0x13d4400]
test eax, eax
je 0x4560e3
call fcn.004744e0
mov dword [edi], ecx
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov dword [ebx + 4], ecx
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, ecx
mov ebx, edx
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 8], ebx
lea edx, [ebx + ebx*2]
mov dword [ebp + edx*4 - 8], esi
mov dword [ebp + edx*4 - 4], edi
mov ebx, dword [0x13d4400]
test ebx, ebx
je 0x456120
call fcn.004744e0
mov dword [edi], eax
mov ebx, dword [ebp + edx*4 - 0xc]
mov dword [edi + 4], ebx
mov dword [ebp + edx*4 - 0xc], eax
mov edx, dword [ecx + 8]
mov dword [esp], ecx
dec edx
mov dword [esp + 4], edx
call fcn.00457c30
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 8]
test ecx, ecx
jbe 0x456156
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x30]
cmp dword [ecx], edx
jne 0x456152
mov dword [esp], eax
call fcn.00457a20
add esp, 0x28
ret
xor eax, eax
mov ecx, eax
call fcn.00474550
lea eax, [0x89f443]
mov dword [esp], eax
mov dword [esp + 4], 0xf
call fcn.0046daf0
nop
call fcn.004730d0
jmp fcn.00456010
Function at 0x456420
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x456579
sub esp, 0x10
mov ebx, dword [esp + 0x14]
mov ebp, dword [ebx + 8]
test ebp, ebp
jbe 0x45656f
mov ebp, dword [ebx + 4]
mov ebp, dword [ebp]
cmp dword [ebp + 0x2c], ebx
jne 0x456559
mov esi, dword [0x13d4400]
test esi, esi
je 0x456469
mov esi, dword [ebp + 0x2c]
call fcn.004744d0
mov dword [edi], esi
mov dword [ebp + 0x2c], 0
mov ebp, dword [ebx + 8]
lea eax, [ebp - 1]
test eax, eax
jle 0x4564af
mov esi, dword [ebx + 4]
lea edi, [ebp + ebp*2]
mov ecx, dword [esi + edi*4 - 8]
mov edx, dword [esi + edi*4 - 4]
mov edi, dword [esi + edi*4 - 0xc]
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov ecx, dword [0x13d4400]
test ecx, ecx
je 0x4564ad
mov ecx, edi
call fcn.004744e0
mov dword [edi], ecx
mov edx, dword [esi]
mov dword [edi + 4], edx
mov edi, ecx
mov dword [esi], edi
mov ecx, dword [ebx + 8]
cmp ecx, eax
jbe 0x456554
mov esi, dword [ebx + 4]
lea edi, [ebp + ebp*2]
mov dword [esi + edi*4 - 8], 0
mov dword [esi + edi*4 - 4], 0
mov ecx, dword [0x13d4400]
test ecx, ecx
je 0x4564ea
mov ecx, dword [esi + edi*4 - 0xc]
mov edx, edi
call fcn.004744d0
mov dword [edi], ecx
mov edi, edx
mov dword [esi + edi*4 - 0xc], 0
mov edx, dword [ebx + 0xc]
cmp edx, eax
jb 0x45654d
mov dword [esp + 0xc], ebp
mov dword [ebx + 8], eax
test eax, eax
jle 0x456518
mov dword [esp], ebx
mov dword [esp + 4], 0
call fcn.00457dc0
mov ebx, dword [esp + 0x14]
mov dword [esp], ebx
call fcn.00457a20
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x456549
mov eax, dword [esp + 0x14]
add eax, 0x28
nop
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.00479420
add esp, 0x10
ret
mov ecx, eax
call fcn.00474590
call fcn.00474550
lea eax, [0x89cffe]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.0046daf0
xor eax, eax
mov ecx, eax
call fcn.00474550
nop
call fcn.004730d0
jmp fcn.00456420
Function at 0x458220
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45831c
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x10], eax
test byte [eax], al
nop
nop
mov dword [esp], eax
call fcn.0040a8d0
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x458263
call fcn.004580c0
mov eax, dword [esp + 0x10]
inc dword [eax + 8]
movzx ecx, byte [eax + 5]
test cl, 1
je 0x4582b7
test cl, 4
je 0x4582b7
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
test ebx, ebx
setg bl
xchg ebp, ebx
sete bl
xchg ebp, ebx
test edx, edx
seta dl
and ebp, edx
or ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x4582b7
and ecx, 0xfffffffb
mov byte [eax + 5], cl
mov ecx, dword [eax + 0x2c]
test byte [ecx], al
add ecx, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
call fcn.00479470
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 5]
nop
test cl, 1
jne 0x4582f5
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
test edx, edx
setg dl
sete bl
test ecx, ecx
seta cl
and ebx, ecx
or ebx, edx
test bl, bl
je 0x4582f5
movzx ecx, byte [eax + 6]
test cl, cl
je 0x4582ee
mov ecx, dword [eax + 8]
test ecx, ecx
seta cl
jmp 0x4582f7
mov ecx, 1
jmp 0x4582f7
xor ecx, ecx
mov byte [esp + 0xf], cl
mov dword [esp], eax
call fcn.00455d90
movzx eax, byte [esp + 0xf]
test al, al
je 0x458318
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00456930
add esp, 0x14
ret
call fcn.004730d0
jmp fcn.00458220
Function at 0x45a8c0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45a9bd
sub esp, 0x38
mov eax, dword [esp + 0x40]
cmp eax, 0xf
jne 0x45a90f
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
lea ecx, [0x89f461]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xf
call fcn.00403230
movzx eax, byte [esp + 0xc]
test al, al
jne 0x45a999
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0045a7b0
mov eax, dword [esp + 8]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x28], ebx
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x24], ebp
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
call fcn.0043a0d0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.0043a930
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0043a930
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.0043a930
call fcn.0043a130
add esp, 0x38
ret
call fcn.0043a0d0
lea eax, [0x898176]
mov dword [esp], eax
mov dword [esp + 4], 5
call fcn.0043a930
call fcn.0043a130
add esp, 0x38
ret
call fcn.004730d0
jmp fcn.0045a8c0
Function at 0x45aab0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45acc5
sub esp, 0x30
call fcn.0043a0d0
lea eax, [0x89c0f5]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0043a930
call fcn.0043a130
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x45aaf5
xor ecx, ecx
xor edx, edx
jmp 0x45ab12
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.00454910
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, eax
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.0045a8c0
mov eax, dword [esp + 0x44]
test eax, eax
setne cl
mov edx, dword [esp + 0x40]
test edx, edx
setne bl
or ecx, ebx
test cl, cl
je 0x45ab6a
call fcn.0043a0d0
lea eax, [0x89e97c]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043a930
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
call fcn.0043a620
call fcn.0043a130
call fcn.0043a0d0
call fcn.0043a2d0
call fcn.0043a130
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.004547e0
mov eax, dword [esp + 0x3c]
cmp dword [esp + 8], eax
jae 0x45ab9e
lea ecx, [eax - 1]
jmp 0x45aba0
mov ecx, eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov edx, dword [esp + 0x38]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.00470810
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
sar eax, 0x1f
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x10]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x24], ebx
call fcn.0043a0d0
lea eax, [0x9427dc]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0043a930
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0043a930
lea eax, [0x9427ac]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0043a930
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.0043a750
call fcn.0043a130
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [esp + 0x38]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.004547e0
mov eax, dword [esp + 0x3c]
cmp dword [esp + 8], eax
jae 0x45acb2
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
mov ecx, dword [esp + 0x38]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004547e0
mov eax, dword [esp + 8]
mov dword [esp + 0x1c], eax
call fcn.0043a0d0
lea eax, [0x8972aa]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.0043a930
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x1c]
sub eax, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043a7c0
call fcn.0043a130
call fcn.0043a0d0
call fcn.0043a2d0
call fcn.0043a130
add esp, 0x30
ret
call fcn.004730d0
jmp fcn.0045aab0
Function at 0x45c0c0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45c208
sub esp, 0x18
call fcn.0044aac0
cmp dword [esp], 1
jg 0x45c1ff
movzx eax, byte [esp + 0x28]
cmp al, 0x16
jne 0x45c10d
movzx eax, byte [esp + 0x2d]
cmp al, 0xa
je 0x45c10d
cmp al, 0x13
je 0x45c10d
cmp al, 0xf
je 0x45c10d
mov byte [esp + 0x30], 0
add esp, 0x18
ret
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x45c11b
xor ecx, ecx
xor eax, eax
jmp 0x45c133
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call fcn.00454910
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp ecx, 0xf
je 0x45c144
xor edx, edx
jmp 0x45c16d
mov dword [esp], eax
lea ecx, [0x89f461]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xf
call fcn.00403230
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov eax, dword [esp + 0x14]
test dl, dl
je 0x45c183
movzx edx, byte [esp + 0x2c]
test dl, dl
jne 0x45c183
mov byte [esp + 0x30], 1
add esp, 0x18
ret
mov dword [esp], eax
mov dword [esp + 4], ecx
mov byte [esp + 8], 0x2e
call fcn.004032a0
mov eax, dword [esp + 0xc]
test eax, eax
jl 0x45c1f5
mov eax, dword [esp + 0x10]
cmp eax, 8
jge 0x45c1ac
mov eax, 1
jmp 0x45c1f7
mov eax, dword [esp + 0x14]
mov dword [esp], eax
lea ecx, [0x899b60]
mov dword [esp + 4], ecx
mov dword [esp + 8], 8
call fcn.00403230
movzx eax, byte [esp + 0xc]
test al, al
jne 0x45c1da
mov eax, 1
jmp 0x45c1f7
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
call fcn.0045c220
movzx eax, byte [esp + 8]
jmp 0x45c1f7
xor eax, eax
mov byte [esp + 0x30], al
add esp, 0x18
ret
mov byte [esp + 0x30], 1
add esp, 0x18
ret
call fcn.004730d0
jmp fcn.0045c0c0

Function at 0x4608d0
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4609af
sub esp, 0x24
mov eax, dword [esp + 0x28]
test byte [eax], al
lea ecx, [eax + 0x19c]
mov dword [esp + 0x18], ecx
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00479440
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
lea ecx, [0x4609c0]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1c]
mov dword [esp], ecx
call fcn.00472fe0
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x14], eax
nop
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00479440
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jne 0x46095b
add esp, 0x24
ret
mov dword [esp + 0xc], eax
call fcn.0043a0d0
lea eax, [0x89e98a]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043a930
mov eax, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0043a620
call fcn.0043a2d0
call fcn.0043a130
lea eax, [0x8a6d76]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0046daf0
nop
call fcn.004730d0
jmp fcn.004608d0
Function at 0x461b60
Capabilities:
Get geographical location
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x461d6a
sub esp, 0x68
movzx eax, byte [esp + 0x88]
test al, al
je 0x461d1a
mov ecx, dword [esp + 0x8c]
test ecx, ecx
sete dl
mov ebx, dword [esp + 0x90]
test ebx, ebx
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebp, edx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x461c2a
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x2c], edx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x34], ebx
movzx eax, al
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x19
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 3
call fcn.0045e420
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x461cac
mov edx, dword [esp + 0x78]
mov dword [esp + 0x48], edx
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x4c], ebp
mov esi, dword [esp + 0x80]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x84]
mov dword [esp + 0x54], esi
movzx eax, al
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ebx
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x30
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], 4
call fcn.0045e420
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
movzx ebx, byte [esp + 0x89]
test bl, bl
je 0x461d01
mov ebx, dword [esp + 0x78]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x44], ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov byte [esp + 0xc], 0x22
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.0045e420
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x68
ret
call fcn.0043a0d0
lea eax, [0x89e998]
mov dword [esp], eax
mov dword [esp + 4], 0xe
call fcn.0043a930
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
call fcn.0043a620
call fcn.0043a2d0
call fcn.0043a130
lea eax, [0x8b5274]
mov dword [esp], eax
mov dword [esp + 4], 0x2f
call fcn.0046daf0
nop
call fcn.004730d0
jmp fcn.00461b60
Function at 0x468120
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x34
mov eax, dword [esp + 0x38]
test eax, eax
je 0x468220
mov eax, dword [0x13d411c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x28], eax
mov ecx, dword [eax + 0x98]
mov edx, dword [eax + 0x9c]
lea ebx, [eax + 0x1d0]
mov dword [esp + 0x30], ebx
lea ebp, [eax + 0x318]
mov dword [esp + 0x2c], ebp
add ecx, 1
mov dword [eax + 0x98], ecx
adc edx, 0
mov dword [eax + 0x9c], edx
mov ecx, dword [eax + 0xa8]
mov dword [ecx], 0
call fcn.0046de10
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00436990
mov eax, dword [esp + 0x28]
mov byte [eax + 0x8c], 1
inc dword [eax + 0xa0]
mov ecx, dword [esp + 0x38]
mov dword [esp], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 4], edx
call fcn.00474160
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
mov byte [ecx + 0x8c], 0
dec dword [ecx + 0xa0]
nop
mov edx, dword [esp + 0x2c]
mov dword [esp], edx
mov dword [esp + 4], 0
call fcn.004795b0
lea edi, [esp + 0xc]
mov esi, dword [esp + 0x30]
call fcn.00474c74
call fcn.0046dfc0
mov eax, dword [0x13d411c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
test byte [eax], al
lea edi, [eax + 0x1d0]
lea esi, [esp + 0xc]
call fcn.00474c74
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
add esp, 0x34
ret
lea eax, [0x89bf8a]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0046daf0
nop
int3
Function at 0x4709b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x470b2a
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x470b20
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x470a0a
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x470a0a
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x470a1d
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x470af7
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x470aeb
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x470ae2
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x470a70
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x470ab3
mov eax, 1
cmp eax, ecx
ja 0x470aa7
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.004745c0
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x470add
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x470aac
mov ecx, dword [esp + 0xc]
jmp 0x470a75
call fcn.00474560
xor eax, eax
mov ecx, eax
call fcn.00474550
call fcn.004745c0
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x470b1b
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x470af0
mov ecx, dword [esp + 0x18]
jmp 0x470a22
call fcn.00474560
xor eax, eax
mov ecx, eax
call fcn.00474550
nop
call fcn.004730d0
jmp fcn.004709b0
Function at 0x472380
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x13d411c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47241b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x13d411c]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00474797
lea ecx, [0x45bec0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00472fe0
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.004730d0
jmp fcn.00472380
Function at 0x474380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x13d4720]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x472b0b
je 0x472b5e
cmp ebx, 0x20
jbe 0x472b64
cmp ebx, 0x40
jbe 0x472baa
jmp 0x472c4b
test ebx, ebx
je 0x472b54
add eax, 0x10
test ax, 0xff0
je 0x472b40
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x9495a0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x9496a0]
jmp 0x472b28
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x472b28
pxor xmm1, xmmword [0x13d4730]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x13d4730]
pxor xmm2, xmmword [0x13d4740]
pxor xmm3, xmmword [0x13d4750]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x13d4730]
pxor xmm2, xmmword [0x13d4740]
pxor xmm3, xmmword [0x13d4750]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x472caa
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x13d3f28], 0
je 0x47439a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x472ad0
jmp fcn.004092e0