joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101e5ee
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push edi
push 0x62
call esi
mov ebx, eax
cmp ebx, 0xc0000023
je 0x101e61e
cmp ebx, edi
jl 0x101e692
mov ebx, 0xc0000001
jmp 0x101e692
mov eax, dword fs:[0x18]
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
jne 0x101e641
mov ebx, 0xc000009a
jmp 0x101e679
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push 0x62
call esi
mov ebx, eax
test ebx, ebx
jl 0x101e679
movzx eax, word [edi]
mov ecx, dword [ebp + 0x10]
add eax, 2
mov dword [ecx], eax
cmp eax, dword [ebp + 0xc]
jbe 0x101e66a
mov ebx, 0xc0000023
jmp 0x101e679
push eax
push dword [edi + 4]
push dword [ebp + 8]
call fcn.01012650
add esp, 0xc
test edi, edi
je 0x101e692
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x101e9e8
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x1001d74
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.010186a2
mov esi, eax
cmp esi, edi
jl 0x101eaf3
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x24000001
push dword [ebp - 8]
call fcn.0101b302
mov esi, eax
cmp esi, 0xc0000225
jne 0x101ea39
mov dword [ebp + 8], edi
jmp 0x101ea41
cmp esi, edi
jl 0x101eaf3
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
shr eax, 4
push ebx
mov dword [ebp - 0xc], edi
cmp eax, edi
jbe 0x101ea76
mov ecx, dword [ebp + 0xc]
add ecx, 8
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp - 0x10]
push 4
pop ecx
mov edi, edx
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
je 0x101ea9d
add edx, 0x10
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jb 0x101ea5b
xor edi, edi
mov eax, dword fs:[0x18]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 0x30]
add ecx, 0x10
push ecx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
cmp ebx, edi
jne 0x101eaa3
mov esi, 0xc0000017
jmp 0x101eada
xor esi, esi
xor edi, edi
jmp 0x101eaf2
mov esi, dword [ebp + 0xc]
add esi, 8
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [ebp + 8]
lea eax, [ebx + 0x10]
push dword [ebp - 4]
push eax
call fcn.01012650
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, 0x10
push eax
push ebx
push 0x24000001
push dword [ebp - 8]
call fcn.0101b2be
mov esi, eax
xor edi, edi
cmp ebx, edi
je 0x101eaf2
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop ebx
cmp dword [ebp - 4], edi
je 0x101eb0e
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 8], edi
je 0x101eb1b
push dword [ebp - 8]
call fcn.01017f42
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x101fc62
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi]
and al, 0x7f
cmp al, 0x7f
jne 0x101fc85
mov dword [ebp + 8], 0xc000003a
jmp 0x101fdd4
movzx eax, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl eax, 8
or eax, ecx
add eax, esi
jmp 0x101fcaf
cmp cl, 4
jne 0x101fca0
cmp byte [eax + 1], cl
je 0x101fcbb
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
add eax, ecx
mov cl, byte [eax]
mov dl, cl
and dl, 0x7f
cmp dl, 0x7f
jne 0x101fc96
push ebx
sub eax, esi
push edi
add eax, 4
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ebx, [edi + 0xc]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0x101fcee
mov dword [ebp + 8], 0xc000009a
jmp 0x101fdb9
add edi, 0xfffffffc
push edi
push dword [ebp + 8]
lea eax, [esi + 0xc]
push eax
mov dword [esi], 1
mov dword [esi + 4], ebx
mov dword [esi + 8], 4
call fcn.01012650
lea eax, [edi + esi + 0xc]
add esp, 0xc
mov byte [eax], 0x7f
mov byte [eax + 1], 0xff
mov byte [eax + 2], 4
mov byte [eax + 3], 0
lea eax, [ebp - 4]
push eax
push 3
push esi
call fcn.0101f12a
mov dword [ebp + 8], eax
test eax, eax
jl 0x101fd9c
mov eax, dword [ebp - 4]
mov edi, dword [eax + 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
sub edi, 0xc
lea ecx, [edi + 0x14]
push ecx
push 0
push dword [eax + 0x18]
mov dword [ebp - 8], ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
jne 0x101fd6a
mov dword [ebp + 8], 0xc000009a
jmp 0x101fd9c
push dword [ebp - 8]
push 0
push ebx
call fcn.01012644
mov eax, dword [ebp - 4]
add eax, 0xc
push edi
push eax
lea eax, [ebx + 0x14]
push eax
mov dword [ebx], 2
call fcn.01012650
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
add esp, 0x18
mov dword [eax], ecx
cmp dword [ebp - 4], 0
je 0x101fdb9
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop ebx
test esi, esi
je 0x101fdd4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp + 8]
pop esi
leave
ret 0xc
Function at 0x1021d62
Capabilities:
Get process heap flags
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x18]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0x1c]
push edi
push dword [ebp + 0xc]
mov dword [eax], ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
cmp dword [ebp + 0x10], ebx
je 0x1021db0
lea eax, [ebp - 4]
push eax
push 0x20019
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.01021cea
mov edi, eax
cmp edi, ebx
jl 0x1021e75
jmp 0x1021db6
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov edi, eax
cmp edi, 0xc0000023
je 0x1021dea
cmp edi, ebx
jl 0x1021e74
mov edi, 0xc0000001
jmp 0x1021e74
mov eax, dword fs:[0x18]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
mov ebx, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
call ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x1021e55
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 0xc]
push eax
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov edi, eax
test edi, edi
jl 0x1021e74
mov esi, dword [ebp - 8]
mov eax, dword [esi + 4]
cmp eax, dword [ebp + 0x14]
je 0x1021e34
mov edi, 0xc0000024
jmp 0x1021e74
sub dword [ebp + 0xc], 0xc
mov eax, dword fs:[0x18]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
xor edi, edi
push edi
push dword [eax + 0x18]
call ebx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp eax, edi
jne 0x1021e5c
mov edi, 0xc000009a
jmp 0x1021e74
push dword [ebp + 0xc]
add esi, 0xc
push esi
push eax
call fcn.01012650
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add esp, 0xc
mov dword [ecx], eax
pop esi
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
je 0x1021e84
push eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 8], 0
je 0x1021ea1
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop ebx
leave
ret 0x18
Function at 0x1022879
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1025050]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x102570c], edi
jne 0x1022995
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call fcn.01012644
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x10228e0
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x102570c], edi
pop esi
je 0x1022968
dec eax
jne 0x1022995
cmp dword [ebp - 0x11c], 5
jne 0x1022955
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x1022949
dec eax
je 0x1022936
dec eax
je 0x102291c
mov dword [0x102570c], 0x14
jmp 0x1022995
cmp word [ebp - 0xc], 1
jb 0x102292d
mov dword [0x102570c], 0x10
or dword [0x102570c], 4
jmp 0x1022995
cmp word [ebp - 0xc], 2
jb 0x102292d
mov dword [0x102570c], 8
jmp 0x102292d
mov dword [0x102570c], 4
jmp 0x1022995
cmp dword [ebp - 0x11c], 4
ja 0x10229a7
mov dword [0x102570c], 2
cmp dword [ebp - 0x11c], 4
jne 0x1022995
cmp dword [ebp - 0x118], edi
je 0x102298b
cmp dword [ebp - 0x118], 0xa
je 0x102298b
cmp dword [ebp - 0x118], 0x5a
jne 0x1022995
mov dword [0x102570c], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x102570c]
xor ecx, ebp
pop edi
call fcn.010125ff
leave
ret
mov dword [0x102570c], 0x20
jmp 0x1022995

Function at 0x10229b8
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1025050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1022a0c
push 3
lea eax, [ebp - 0x44]
push 0x1002378
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.010125ff
leave
ret

Function at 0x1022a21
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1025050]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x1025710]
jne 0x1022abc
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x10022a8
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1022abb
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x1002360
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x1022abb
push 3
push dword [esi*8 + 0x10020f8]
lea eax, [ebp - 0xc]
push eax
call fcn.01012614
add esp, 0xc
test eax, eax
je 0x1022aad
inc esi
cmp esi, 0x1c
jb 0x1022a8c
jmp 0x1022abb
mov ax, word [esi*8 + 0x10020fc]
mov word [0x1025710], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x1025710]
xor ecx, ebp
call fcn.010125ff
leave
ret
Function at 0x4034b6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0040416e
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00403616
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x403600
test ebx, ebx
jl 0x4035a4
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcb991a
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4035c5
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4035b7
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00404f86
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00404f86
add esp, 8
mov ebx, 0x80070057
jmp 0x4035a4
Function at 0x40b60a
Capabilities:
Encode data using xor

Disassembly:
or al, 0x76
movsd dword es:[edi], dword [esi]
test eax, 0x90573160
mov bh, 0xfd
sub byte [edi + 0x30], 0x59
xor byte [ecx + 3], bl
invalid
inc edx
hlt
xor byte [ecx + 3], bl
rol dword [edx - 0xc], 0xd2
or esi, dword cs:[ebp + 0x5c]
pop esp
cmc
stosb byte es:[edi], al
xor bh, al
sub ebx, esi
inc esi
loope 0x40b5fe
invalid
jb 0x40b654
mov ah, 0xdb
fidiv word [ebx]
jno 0x40b64b
in eax, dx
int3
push ds
neg dword [eax - 0x65]
xlatb
pushal
lahf
invalid
sal dword [eax], cl
lcall 0x257d, 0xca35b0b1
or byte [edx + 0x6fa166c0], cl
inc eax
dec ebx
les esi, [ecx]
dec ebp
sti
xor dword [ebp - 5], ecx
sub eax, 0x46cbc5da
and al, 0x58
sal dword [edx], cl
insb byte es:[edi], dx
inc edx
xchg ecx, eax
je 0x40b614
loop 0x40b618
adc bl, byte [edi + 0x59]
cmpsb byte [esi], byte es:[edi]
or bl, byte [ebx + ebx*2 + 0x409b9fca]
xor bl, byte [eax + 0x236f411e]
sbb dword [ebx], ebx
cmp dword [edx + eax*4 + 0x58], esp
add cl, byte [esi - 0x7486d70e]
jbe 0x40b6a2
sti
retf
push esi
js 0x40b666
test edx, ecx
adc al, 0xd6
sbb edx, dword [esi - 0x55b65bf1]
sbb edi, dword [eax - 0x151a1aa]
shld dword [ecx - 0x56], ecx, 0x1b
mov eax, 0xfeae5e56
popal
mov cl, 0x7f
loop 0x40b715
cmp bh, cl
clc
dec ebp
inc edi
dec ebp
ja 0x40b6bd
cmp dword [esi], 0x16765def
mov dh, 0x79
aam 3
xor dword [esi - 0x51], ebx
mov edi, 0xb9806562
jb 0x40b704
mov al, 0xce
aam 0xa9
xchg edi, eax
sub eax, 0xb011aca1
and al, 0xae
out 0xf6, eax
les ebp, [esi - 0xa]
mov eax, 0xbeb2fea7
mov dh, al
jle 0x40b744
aas
xor ebp, dword [ecx + edi*4 + 0x16]
imul edx, dword [eax - 0x4d], 0xf3d58e6a
clc
inc ecx
jmp [ebx + 0x24]
aam 0x54
leave
jl 0x40b6ab
sahf
outsw dx, word [esi]
sti
fiadd word [ebp + 0x1c]
xlatb
adc byte [edi - 0x70a2350], dh
cmc
clc
cmp byte ds:[esi], bl
mov ecx, 0xfd8609fe
retf 0xbb33
cmpsd dword [esi], dword es:[edi]
jne 0x40b709
xor eax, 0x2ecf46c3
jbe 0x40b7aa
mov al, byte [0x3671dbe1]
salc
pop esi
xchg byte [esi + 0x67], dh
cmp dword [edi + 0x6eb2760f], 0xffffffbf
hlt
mov dword [ebx - 0x1c], eax
fiadd word [edx + 0x5e]
imul sp, word [edi + 0x267b7533], 0xff5a
scasd eax, dword es:[edi]
xchg edx, eax
jle 0x40b7c7
cmp dword [esi - 0x753598fb], edx
mov ebx, 0xfd357d77
std
mov dword [0xe7edabde], eax
dec esi
adc ah, bh
daa
imul esi, dword [eax + 0x78], 0x5e77ce47
mov al, byte [0x740cbd1f]
cmp eax, 0x9f162d1f
push es
mov ch, 0x5f
imul ebx, dword [eax], 0x3bb730
into
cld
mov ch, 0xd0
mov ch, 0xeb
enter 0xffffffffffffb53b, 0x2e
dec eax
push ss
ret
Function at 0x41a276
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.0041af2e
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.0041a3d6
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41a3c0
test ebx, ebx
jl 0x41a364
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcd06da
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41a385
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x41a377
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.0041bd46
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.0041bd46
add esp, 8
mov ebx, 0x80070057
jmp 0x41a364
Function at 0x431106
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.00431dbe
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00431266
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x431250
test ebx, ebx
jl 0x4311f4
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xce756a
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x431215
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x431207
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00432bd6
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00432bd6
add esp, 8
mov ebx, 0x80070057
jmp 0x4311f4
Function at 0x447b46
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004487fe
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.00447ca6
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x447c90
test ebx, ebx
jl 0x447c34
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xcfdfaa
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x447c55
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x447c47
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.00449616
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.00449616
add esp, 8
mov ebx, 0x80070057
jmp 0x447c34

Function at 0x45b752
Capabilities:
Encode data using xor

Disassembly:
dec ebx
and esi, ebx
retf 0xd6a4
outsb dx, byte [esi]
jae 0x45b6d9
xchg esp, eax
fsub st(1)
mov al, ch
daa
in eax, 0x76
xor dh, bl
xchg ebp, eax
pushal
and ebx, dword [edx]
xchg byte [ecx], dl
cwde
push eax
mul byte [esi + edi*4 + 1]
jb 0x45b737
jle 0x45b746
jbe 0x45b71d
sub esp, ebx
xor byte [edi], bl
mov al, byte [0x5f5c93fe]
pushal
invalid
pop ds
push esi
salc
movsd dword es:[edi], dword [esi]
test edx, edx
mov ebp, esp
xchg edi, eax
xor al, 0x3f
jb 0x45b738
mov esi, 0x54bc5dd1
and byte [ebp - 0x79897c49], bl
fcmove st(0), st(7)
nop
pop ebp
mov esp, 0xb79d2054
xor dword [esi - 0x7a], 0xffffffda
iretd
lodsb al, byte [esi]
salc
push ss
pop esi
fiadd dword [edx + 0x3d37b50]
xor ch, dl
jp 0x45b6ff
shl eax, cl
stosb byte es:[edi], al
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
invalid