joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469ce8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x469d61
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [esi]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00402c94
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 8]
mov cl, byte [ecx + ebx]
mov byte [edx + eax - 1], cl
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x469d07
mov eax, dword [esi]
mov byte [eax + 4], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x469d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor esi, esi
cmp esi, dword [ebp - 0xc]
jge 0x469dea
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00402c94
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
mov edx, dword [ebx]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x1c]
mov cl, byte [ecx]
mov byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
mov al, byte [eax + esi]
mov edx, dword [ebx]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
inc esi
cmp esi, dword [ebp - 0xc]
jl 0x469d8f
mov eax, dword [ebx]
mov byte [eax + 4], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x469df8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x469e71
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
mov eax, dword [esi]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00402c94
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 8]
mov cl, byte [ecx + ebx]
xor byte [edx + eax - 1], cl
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x469e17
mov eax, dword [esi]
mov byte [eax + 4], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a5e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x46a65d
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [esi]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00402c94
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx]
mov byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x46a603
mov eax, dword [esi]
mov byte [eax + 4], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a66c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor esi, esi
cmp esi, dword [ebp - 0xc]
jge 0x46a6e6
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00402c94
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
mov edx, dword [ebx]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x1c]
mov cl, byte [ecx]
mov byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
mov al, byte [eax + esi]
mov edx, dword [ebx]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
inc esi
cmp esi, dword [ebp - 0xc]
jl 0x46a68b
mov eax, dword [ebx]
mov byte [eax + 4], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a6f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x46a76d
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [esi]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00402c94
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx]
xor byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x46a713
mov eax, dword [esi]
mov byte [eax + 4], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46b244
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [0x497d64]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x28]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x18]
shr edx, 1
add eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x18]
shr ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x28]
call fcn.00402c94
add dword [ebp - 4], 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x30]
shl edx, 2
sub edx, 5
test edx, edx
jl 0x46b314
inc edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, eax
and ecx, 0xff
mov esi, dword [0x49805c]
movzx ecx, byte [esi + ecx]
mov ecx, dword [ebx + ecx*4 + 0x1000]
mov esi, eax
shr esi, 8
and esi, 0xff
mov edi, dword [0x49805c]
movzx esi, byte [edi + esi]
xor ecx, dword [ebx + esi*4 + 0x1400]
mov esi, eax
shr esi, 0x10
and esi, 0xff
mov edi, dword [0x49805c]
movzx esi, byte [edi + esi]
xor ecx, dword [ebx + esi*4 + 0x1800]
shr eax, 0x18
mov esi, dword [0x49805c]
movzx eax, byte [esi + eax]
xor ecx, dword [ebx + eax*4 + 0x1c00]
mov eax, dword [ebp - 4]
mov dword [eax], ecx
add dword [ebp - 4], 4
dec edx
jne 0x46b29e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x46c008
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x46c17d
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x466290]
call fcn.00405768
add esp, 4
mov eax, dword [ebp - 4]
mov byte [eax], 0xf2
mov eax, dword [ebp - 4]
mov byte [eax + 1], 0x53
mov eax, dword [ebp - 4]
mov byte [eax + 2], 0x50
mov eax, dword [ebp - 4]
mov byte [eax + 3], 0xc6
xor ecx, ecx
mov eax, dword [ebp - 4]
mov dl, byte [eax + 1]
xor eax, eax
mov al, dl
mov al, byte [eax + 0x496030]
mov ebx, dword [esi + 4]
sub al, byte [ebx + ecx]
mov ebx, dword [ebp - 4]
add byte [ebx], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 2]
mov ebx, dword [esi + 4]
movzx ebx, byte [ebx + ecx]
xor al, byte [ebx + 0x496030]
sub dl, al
mov eax, dword [ebp - 4]
mov byte [eax + 1], dl
mov eax, dword [ebp - 4]
mov dl, byte [eax + 3]
mov eax, edx
mov ebx, dword [ebp - 4]
sub dl, byte [ebx]
and eax, 0xff
mov al, byte [eax + 0x496030]
mov ebx, dword [esi + 4]
add al, byte [ebx + ecx]
mov ebx, dword [ebp - 4]
xor al, byte [ebx + 2]
mov ebx, dword [ebp - 4]
mov byte [ebx + 2], al
mov eax, dword [esi + 4]
movzx eax, byte [eax + ecx]
add dl, byte [eax + 0x496030]
mov ebx, dword [ebp - 4]
lea edi, [ebx + 3]
mov eax, edx
mov byte [edi], al
mov edx, dword [ebp - 4]
movzx edx, byte [edx]
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + 1]
shl ebx, 8
add edx, ebx
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + 2]
shl ebx, 0x10
add edx, ebx
and eax, 0xff
shl eax, 0x18
add edx, eax
mov eax, edx
mov edx, eax
shr eax, 0x1d
shl edx, 3
or eax, edx
mov edx, eax
and edx, 0xff
mov ebx, dword [ebp - 4]
mov byte [ebx], dl
shr eax, 8
mov edx, eax
and edx, 0xff
mov ebx, dword [ebp - 4]
mov byte [ebx + 1], dl
shr eax, 8
mov edx, eax
and edx, 0xff
mov ebx, dword [ebp - 4]
mov byte [ebx + 2], dl
shr eax, 8
mov edx, dword [ebp - 4]
mov byte [edx + 3], al
inc ecx
cmp ecx, 4
jne 0x46c055
lea eax, [esi + 4]
mov edx, dword [0x466290]
call fcn.00405874
lea eax, [esi + 4]
mov edx, dword [ebp - 4]
mov ecx, dword [0x466290]
call fcn.004058b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c184
lea eax, [ebp - 4]
mov edx, dword [0x466290]
call fcn.00405874
ret
Function at 0x46c1f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov ebp, 3
mov byte [esp + 1], 0
mov eax, dword [edi]
call fcn.0040558c
mov esi, eax
cmp esi, 1
jl 0x46c259
mov eax, dword [edi]
mov bl, byte [eax + esi - 1]
mov edx, 3
mov eax, ebx
call fcn.004691e4
mov ebx, eax
xor bl, 0x13
mov byte [esp], bl
xor bl, byte [esp + 1]
mov eax, esi
sub bl, al
mov edx, 4
mov eax, ebx
call fcn.00469208
mov ebx, eax
mov al, byte [esp]
mov byte [esp + 1], al
mov eax, dword [edi]
mov byte [eax + esi - 1], bl
dec esi
test esi, esi
jne 0x46c217
mov byte [esp + 1], 0
mov eax, dword [edi]
call fcn.0040558c
mov esi, eax
cmp esi, 1
jl 0x46c2be
mov eax, dword [edi]
call fcn.0040558c
sub eax, esi
mov edx, dword [edi]
mov bl, byte [edx + eax]
sub bl, 0x18
xor bl, 0xff
mov edx, esi
mov eax, ebx
call fcn.004691e4
mov ebx, eax
mov byte [esp], bl
xor bl, byte [esp + 1]
mov eax, esi
sub bl, al
mov edx, 3
mov eax, ebx
call fcn.00469208
mov ebx, eax
mov al, byte [esp]
mov byte [esp + 1], al
mov eax, dword [edi]
call fcn.0040558c
sub eax, esi
mov edx, dword [edi]
mov byte [edx + eax], bl
dec esi
test esi, esi
jne 0x46c26c
dec ebp
jne 0x46c204
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46c2cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov dword [esp], 3
xor ebp, ebp
mov eax, dword [edi]
call fcn.0040558c
mov esi, eax
cmp esi, 1
jl 0x46c33a
mov eax, dword [edi]
call fcn.0040558c
sub eax, esi
mov edx, dword [edi]
mov bl, byte [edx + eax]
mov edx, 3
mov eax, ebx
call fcn.004691e4
mov ebx, eax
mov eax, esi
add bl, al
mov eax, ebp
xor bl, al
mov ebp, ebx
and ebp, 0xff
mov eax, ebp
mov edx, esi
call fcn.00469208
mov ebx, eax
xor bl, 0xff
add bl, 0x18
mov eax, dword [edi]
call fcn.0040558c
sub eax, esi
mov edx, dword [edi]
mov byte [edx + eax], bl
dec esi
test esi, esi
jne 0x46c2ea
xor ebp, ebp
mov eax, dword [edi]
call fcn.0040558c
mov esi, eax
cmp esi, 1
jl 0x46c38a
mov eax, dword [edi]
mov bl, byte [eax + esi - 1]
mov edx, 4
mov eax, ebx
call fcn.004691e4
mov ebx, eax
mov eax, esi
add bl, al
mov eax, ebp
xor bl, al
mov ebp, ebx
and ebp, 0xff
xor bl, 0x13
mov edx, 3
mov eax, ebx
call fcn.00469208
mov ebx, eax
mov eax, dword [edi]
mov byte [eax + esi - 1], bl
dec esi
test esi, esi
jne 0x46c34a
dec dword [esp]
jne 0x46c2da
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46f4dc
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x4963fc], 0
mov eax, dword [0x498158]
cmp dword [eax], 2
jne 0x46f6b5
mov eax, dword [0x497c4c]
cmp dword [eax], 5
jl 0x46f6b5
call fcn.0046c60c
test al, al
jne 0x46f50d
call fcn.0046c618
call fcn.0046c604
mov dword [0x496404], eax
push 0x46f6b8
mov eax, dword [0x496404]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963c8], eax
cmp dword [0x4963c8], 0
jne 0x46f568
mov edx, 0x8000
mov eax, 0x46f6cc
call fcn.0040e7b8
mov dword [0x496400], eax
mov eax, dword [0x496400]
mov dword [0x496404], eax
push 0x46f6b8
mov eax, dword [0x496404]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963c8], eax
cmp dword [0x4963c8], 0
je 0x46f6b0
push 0x46f6d8
mov eax, dword [0x496404]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963cc], eax
cmp dword [0x4963cc], 0
je 0x46f6b0
push 0x46f6e4
mov eax, dword [0x496404]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963d0], eax
cmp dword [0x4963d0], 0
je 0x46f6b0
mov byte [0x4963fc], 1
push 0x46f6f4
mov eax, dword [0x496404]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963d4], eax
push 0x46f700
mov eax, dword [0x496404]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963d8], eax
push 0x46f70c
mov eax, dword [0x496404]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963dc], eax
push 0x46f71c
mov eax, dword [0x496404]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963e0], eax
push 0x46f72c
mov eax, dword [0x496404]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963e4], eax
mov edx, 0x8000
mov eax, 0x46f744
call fcn.0040e7b8
mov dword [0x496408], eax
cmp dword [0x496408], 0
je 0x46f6b5
push 0x46f754
mov eax, dword [0x496408]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963e8], eax
push 0x46f770
mov eax, dword [0x496408]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963ec], eax
push 0x46f790
mov eax, dword [0x496408]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963f0], eax
push 0x46f7ac
mov eax, dword [0x496408]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963f4], eax
push 0x46f7c4
mov eax, dword [0x496408]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4963f8], eax
ret
call fcn.0046f45c
ret
Function at 0x471e40
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x471f68
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00471d28
mov eax, dword [esi]
call fcn.0040558c
add eax, 0x28
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x466290]
call fcn.00405768
add esp, 4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00402c94
mov ebx, 0x1c
mov eax, dword [ebp - 8]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00402c94
add ebx, 0x1c
mov eax, dword [esi]
call fcn.0040558c
mov dword [ebp - 0xc], eax
mov eax, dword [0x498064]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 8]
mov ecx, ebx
call fcn.00467218
add ebx, 4
mov eax, dword [ebp - 8]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00403104
add ebx, 3
mov eax, dword [ebp - 8]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.0040558c
push eax
lea ecx, [ebp - 8]
mov eax, dword [esi]
xor edx, edx
call fcn.00467150
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.00466f68
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.00467210
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471f6f
lea eax, [ebp - 8]
mov edx, dword [0x466290]
call fcn.00405874
ret

Function at 0x479a00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x479a71
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebp - 8]
mov eax, dword [esi + 0x30]
call fcn.00408970
mov eax, dword [ebp - 8]
mov esi, dword [0x497abc]
mov esi, dword [esi]
mov edx, dword [ebx]
call esi
mov esi, eax
push ebx
mov ecx, esi
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.00404a5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479a78
lea eax, [ebp - 8]
call fcn.0040453c
ret
Function at 0x4901fc
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004072fc
ret

Function at 0x490324
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049ec
xor eax, eax
push ebp
push 0x490472
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.004901fc
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004049fc
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x490451
xor eax, eax
push ebp
push 0x49044a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x490433
xor eax, eax
push ebp
push 0x49042c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x490415
xor eax, eax
push ebp
push 0x49040e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.00490230
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490415
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490433
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490451
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.004902b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490479
lea eax, [ebp - 4]
call fcn.0040453c
ret
Function at 0x490564
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x49063e
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 9], 1
push 0x80
lea edx, [ebp - 0x89]
push edx
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x490620
inc ebx
xor esi, esi
lea ecx, [ebp - 0x90]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x90]
push eax
lea edx, [ebp - 0x94]
lea eax, [ebp - 0x89]
call fcn.00409558
mov edx, dword [ebp - 0x94]
pop eax
call fcn.00404b40
test eax, eax
je 0x49061c
lea eax, [ebp - 0x98]
lea edx, [ebp - 0x89]
mov ecx, 0x80
call fcn.004047ac
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4905c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490645
lea eax, [ebp - 0x98]
mov edx, 3
call fcn.00404560
ret

Function at 0x4928a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4929b0
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.00433354
xor edx, edx
mov eax, dword [ebx + 0x300]
call fcn.00433354
xor edx, edx
mov eax, dword [ebx + 0x31c]
call fcn.00433354
xor edx, edx
mov eax, dword [ebx + 0x324]
call fcn.00433354
xor edx, edx
mov eax, dword [ebx + 0x318]
call fcn.00433354
xor edx, edx
mov eax, dword [ebx + 0x320]
call fcn.00433354
mov dl, 1
mov eax, dword [ebx + 0x328]
call fcn.00433354
mov dl, 1
mov eax, dword [ebx + 0x32c]
call fcn.00433354
push 1
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004923cc
mov eax, dword [ebp - 4]
call fcn.004049fc
push eax
call sub.kernel32.dll_WinExec
jmp 0x49294e
mov eax, dword [0x497ed8]
mov eax, dword [eax]
call fcn.00452c8c
push 0
push 0x4929bc
call sub.user32.dll_FindWindowA
test eax, eax
jb 0x492942
push 0
push 0
push 0x10
push 0
push 0x4929bc
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebx + 0x304]
call fcn.00455d14
push 1
push 0xa
mov ecx, 0x4929d4
mov edx, 0x4929fc
mov eax, dword [ebx + 0x304]
call fcn.00455928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4929b7
lea eax, [ebp - 4]
call fcn.0040453c
ret