joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a5b68
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x4ca5d0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, edx
push 0x40
xor edi, edi
lea eax, [esp + 0x34]
push edi
push eax
call fcn.004887c0
mov edx, dword [0x4cea4c]
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x4cea4c
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c], 0x44
mov dword [esp + 0x58], 0x181
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov ecx, dword [ebp + 8]
push ebx
push ecx
mov dword [esp + 0x88], edi
push 0x4b2110
lea edi, [esp + 0x20]
call fcn.00412b30
xor edi, edi
add esp, 0xc
cmp esi, edi
je 0x4110aa
mov edx, 0xa
mov word [esp + 0x5c], dx
jmp 0x4110b1
xor eax, eax
mov word [esp + 0x5c], ax
mov ecx, dword [esp + 0x14]
push ecx
call dword [0x4aa290]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x30]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push ecx
push edi
call dword [0x4aa28c]
cmp eax, edi
mov eax, dword [ebp + 0xc]
jne 0x411103
mov edx, dword [ebp + 8]
push ebx
push edx
push esi
push eax
call dword [0x4aa2b4]
push eax
push 0x4b2120
mov ecx, 0x4d0000
call fcn.00478ee0
add esp, 0x18
mov ebx, edi
jmp 0x411118
cmp eax, edi
je 0x411113
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call dword [0x4aa2a4]
mov ebx, 1
mov eax, dword [esp + 0x1c]
mov esi, dword [0x4aa128]
cmp eax, edi
je 0x41112d
push eax
call esi
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x41113c
push eax
call esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x80], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x411167
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412f30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a5b38
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ca5d0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x4cea4c]
mov edx, dword [eax + 0xc]
xor ebx, ebx
mov ecx, 0x4cea4c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
push esi
push 0x4b1f38
mov ecx, 0x4d0000
mov dword [esp + 0x30], ebx
call fcn.00478ee0
mov edi, dword [ebp + 8]
add esp, 8
lea eax, [esp + 0x10]
push eax
mov eax, esi
call fcn.004130d0
mov esi, eax
push esi
push 0x4b1f4c
mov ecx, 0x4d0000
call fcn.00478ee0
add esp, 8
test esi, esi
je 0x41306f
push 0x3c
call fcn.004831b8
add esp, 4
test eax, eax
je 0x412fd9
push eax
call fcn.00469af0
mov edi, eax
jmp 0x412fdb
xor edi, edi
mov ebx, edi
test edi, edi
je 0x41306f
push 0x4b1f64
mov ecx, 0x4d0000
call fcn.00478ee0
mov edx, dword [ebp + 0xc]
mov eax, dword [esp + 0x14]
mov ecx, dword [edi]
mov ecx, dword [ecx]
add esp, 4
push edx
push eax
push esi
push edi
call ecx
xor edx, edx
mov esi, eax
test esi, esi
sete dl
mov ecx, 0x4d0000
push edx
push 0x4b1f70
call fcn.00478ee0
add esp, 8
test esi, esi
je 0x413067
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413050
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esp + 0x18], 1
mov esi, dword [esp + 0x14]
cmp dword [esi - 0xc], 0
je 0x413080
push esi
call dword [0x4aa254]
test ebx, ebx
je 0x41308c
mov ecx, dword [ebx]
mov edx, dword [ecx + 0xc]
push ebx
call edx
lea eax, [esi - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4130b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4164b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4a40b9
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4ca5d0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ca5d0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x50]
xor ebx, ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [0x4cea4c]
mov edx, dword [eax + 0xc]
mov edi, ecx
add ebp, 6
mov ecx, 0x4cea4c
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], ebp
call edx
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x48], ebx
mov eax, dword [0x4b18d8]
mov ecx, dword [0x4b18dc]
mov edx, dword [0x4b18e0]
mov dword [esp + 0x24], eax
mov eax, dword [0x4b18e4]
mov dword [esp + 0x28], ecx
mov ecx, dword [0x4b18e8]
mov dword [esp + 0x2c], edx
mov edx, dword [0x4b18ec]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x14], ebx
jmp 0x416560
movzx esi, word [esp + ebx*2 + 0x24]
push esi
push ebp
call fcn.004842d4
add esp, 8
test eax, eax
je 0x4165cb
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x416582
push 0x20
call fcn.0041bfb0
mov eax, dword [edi]
mov ebx, dword [eax - 0xc]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
movzx ebp, si
lea esi, [ebx + 1]
sub eax, esi
or eax, ecx
jge 0x4165a7
mov ecx, esi
mov eax, edi
call fcn.00407880
mov eax, dword [edi]
mov word [eax + ebx*2], bp
test esi, esi
jl 0x4165f8
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x4165f8
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov dword [eax - 0xc], esi
mov ecx, dword [edi]
xor edx, edx
mov word [ecx + esi*2], dx
inc ebx
mov dword [esp + 0x14], ebx
cmp ebx, 0xb
jb 0x416560
mov eax, edi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00482dc4
add esp, 0x38
ret 4
push 0x80070057
invalid
sahf
invalid
Function at 0x41c210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x4c
mov eax, dword [0x4ca5d0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebp
mov ebp, dword [esp + 0x54]
insb byte es:[edi], dx
and al, 0x54
push esi
mov eax, ebp
push edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c230
sub eax, edx
mov edi, eax
mov ecx, edi
xor eax, eax
and ecx, 0x800000ff
mov dword [esp + 0xc], edi
jns 0x41c253
dec ecx
or ecx, 0xffffff00
inc ecx
mov dl, byte [eax + 0x4cc3f8]
xor dl, cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x40
jl 0x41c253
xor esi, esi
test edi, edi
jle 0x41c2b6
jmp 0x41c270
mov al, byte [esi + ebp]
mov ecx, esi
and ecx, 0x3f
movzx edi, byte [esp + ecx + 0x14]
and edi, 0x80000007
not al
jns 0x41c28c
dec edi
or edi, 0xfffffff8
inc edi
mov ecx, edi
mov dl, 1
shl dl, cl
mov ecx, 8
sub ecx, edi
mov dword [esp + 0x10], edi
dec dl
and dl, al
shl dl, cl
mov cl, byte [esp + 0x10]
shr al, cl
inc esi
or dl, al
cmp esi, dword [esp + 0xc]
mov byte [esi + ebp - 1], dl
jl 0x41c270
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00482dc4
add esp, 0x4c
ret

Function at 0x41c220
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x4c
mov eax, dword [0x4ca5d0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebp
mov ebp, dword [esp + 0x54]
insb byte es:[edi], dx
and al, 0x54
push esi
mov eax, ebp
push edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c230
sub eax, edx
mov edi, eax
mov ecx, edi
xor eax, eax
and ecx, 0x800000ff
mov dword [esp + 0xc], edi
jns 0x41c253
dec ecx
or ecx, 0xffffff00
inc ecx
mov dl, byte [eax + 0x4cc3f8]
xor dl, cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x40
jl 0x41c253
xor esi, esi
test edi, edi
jle 0x41c2b6
jmp 0x41c270
mov al, byte [esi + ebp]
mov ecx, esi
and ecx, 0x3f
movzx edi, byte [esp + ecx + 0x14]
and edi, 0x80000007
not al
jns 0x41c28c
dec edi
or edi, 0xfffffff8
inc edi
mov ecx, edi
mov dl, 1
shl dl, cl
mov ecx, 8
sub ecx, edi
mov dword [esp + 0x10], edi
dec dl
and dl, al
shl dl, cl
mov cl, byte [esp + 0x10]
shr al, cl
inc esi
or dl, al
cmp esi, dword [esp + 0xc]
mov byte [esi + ebp - 1], dl
jl 0x41c270
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00482dc4
add esp, 0x4c
ret
Function at 0x41c2d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x44
mov eax, dword [0x4ca5d0]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c2e3
sub eax, edx
push ebp
mov ebp, eax
mov ecx, ebp
xor eax, eax
and ecx, 0x800000ff
push esi
jns 0x41c304
dec ecx
or ecx, 0xffffff00
inc ecx
mov dl, byte [eax + 0x4cc3f8]
xor dl, cl
mov byte [esp + eax + 8], dl
inc eax
cmp eax, 0x40
jl 0x41c304
xor esi, esi
test ebp, ebp
jle 0x41c366
push ebx
lea ecx, [ecx]
mov eax, esi
and eax, 0x3f
movzx ecx, byte [esp + eax + 0xc]
and ecx, 0x80000007
jns 0x41c337
dec ecx
or ecx, 0xfffffff8
inc ecx
mov dl, byte [edi + esi]
mov eax, 8
sub eax, ecx
mov ecx, eax
mov bl, 1
shl bl, cl
mov ecx, 8
sub ecx, eax
inc esi
dec bl
and bl, dl
shl bl, cl
mov cl, al
shr dl, cl
or bl, dl
cmp esi, ebp
not bl
mov byte [edi + esi - 1], bl
jl 0x41c320
pop ebx
mov ecx, dword [esp + 0x48]
pop esi
pop ebp
xor ecx, esp
call fcn.00482dc4
add esp, 0x44
ret

Function at 0x41fd50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4a6b77
mov eax, dword fs:[0]
push eax
sub esp, 0x490
mov eax, dword [0x4ca5d0]
xor eax, esp
mov dword [esp + 0x48c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ca5d0]
xor eax, esp
push eax
lea eax, [esp + 0x4a4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4b4]
mov esi, ecx
push esi
mov dword [esp + 0x24], eax
call dword [0x4aa334]
test eax, eax
je 0x41fdf4
lea ecx, [esp + 0x24]
push ecx
call fcn.004797f0
xor ebx, ebx
push ebx
lea edx, [esp + 0x28]
push edx
push esi
mov dword [esp + 0x4b8], ebx
call fcn.00478300
add esp, 0xc
test eax, eax
jne 0x41fdfb
lea ebx, [esp + 0x24]
call fcn.004201a0
mov eax, dword [esp + 0x38]
push eax
call fcn.00482db9
mov ecx, dword [esp + 0x28]
add esp, 4
push ecx
mov dword [esp + 0x3c], 0
call fcn.00482db9
add esp, 4
xor eax, eax
jmp 0x4200f1
mov edx, dword [esp + 0x38]
mov edi, dword [esp + 0x24]
mov ebp, dword [edx]
mov dword [esp + 0x40], edi
Function at 0x422f60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a3b09
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x4ca5d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], esi
mov eax, dword [0x4cea4c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4cea4c
call edx
add eax, 0x10
mov dword [edi], eax
cmp ebp, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], 1
mov edx, ebp
jge 0x422fbe
neg edx
cmp ebx, esi
mov esi, ebx
jge 0x422fc6
neg esi
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jge 0x422fd0
neg ecx
mov eax, dword [esp + 0x28]
test eax, eax
jge 0x422fda
neg eax
push edx
xor edx, edx
test ebp, ebp
setl dl
dec edx
and edx, 0xffffffd1
add edx, 0x5f
push edx
xor edx, edx
test ebx, ebx
setl dl
push esi
dec edx
and edx, 0xffffffd1
add edx, 0x5f
push edx
push ecx
xor ecx, ecx
cmp dword [esp + 0x40], ecx
setl cl
xor edx, edx
dec ecx
and ecx, 0xffffffd1
add ecx, 0x5f
cmp dword [esp + 0x3c], edx
push ecx
setl dl
push eax
dec edx
and edx, 0xffffffd1
add edx, 0x5f
push edx
push 0x4b118c
call fcn.004020b0
add esp, 0x24
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x426b80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a7968
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push edi
mov eax, dword [0x4ca5d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0x4af1b0
mov ecx, 0x4d0000
call fcn.00478ee0
mov eax, dword [0x4cfdb4]
xor ebx, ebx
add esp, 4
mov dword [0x4cfd9c], esi
cmp dword [eax - 0xc], ebx
je 0x426d4a
cmp esi, ebx
je 0x426d02
invalid
invalid
add dword [eax], eax
invalid
add eax, 0xfffffff0
call fcn.00405170
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x38], ebx
cmp dword [eax - 0xc], ebx
jg 0x426c25
add eax, 0xfffffff0
mov dword [esp + 0x38], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426c11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret
mov eax, 3
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
call fcn.00412470
lea edi, [esp + 0xc]
mov byte [esp + 0x38], 1
call fcn.004051e0
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x426c69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0xc]
call fcn.0042a9c0
push ebx
push 0x100000
push edx
push eax
call fcn.00496200
cmp eax, 0x3c
jge 0x426cf1
mov edx, 1
lea ecx, [edx + 0x63]
call fcn.0041c110
push 0x4ad1bb
lea ecx, [esp + 0x18]
call fcn.004018d0
push ebx
push 1
lea edx, [esp + 0x1c]
mov ecx, 0x4cfd78
mov byte [esp + 0x40], 2
call fcn.00426d60
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], bl
call fcn.00401e50
push 0x4af1c0
mov ecx, 0x4d0000
call fcn.00478ee0
add esp, 4
lea ecx, [esp + 0xc]
call fcn.00402a80
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.00402a80
call fcn.0046bfb0
mov edx, dword [0x4cfdb4]
mov ecx, eax
call fcn.0046b630
cmp dword [0x4cfd9c], ebx
je 0x426d28
mov ecx, 0x4cfd78
call fcn.00428ad0
jmp 0x426d45
push ebx
push ebx
push 0x4cfd78
push 0x427ab0
push ebx
push ebx
call dword [0x4aa124]
mov dword [0x4cfdb0], eax
cmp eax, ebx
je 0x426d4a
mov ebx, 1
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x30
ret
Function at 0x427790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a7106
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4ca5d0]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ca5d0]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
xor esi, esi
push 0x206
lea ecx, [esp + 0x2a]
xor eax, eax
push esi
push ecx
mov dword [esp + 0x24], esi
mov word [esp + 0x30], ax
call fcn.004887c0
mov edx, dword [0x4cea4c]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x4cea4c
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x1c], ebp
lea ecx, [esp + 0x24]
push ecx
push 0x104
mov dword [esp + 0x240], esi
call dword [0x4aa0c0]
cmp eax, esi
je 0x42792d
lea edx, [esp + 0x24]
push edx
call dword [0x4aa330]
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x427833
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x24]
mov ebx, eax
push ecx
mov eax, 0x4cfdb8
call fcn.004078f0
push 7
push 0x4af45c
push 0x4cfdb8
call fcn.00412940
fdiv qword [eax + 0x15fffffe]
mov eax, 0x50004aa2
push 0x4af46c
lea edi, [esp + 0x24]
call fcn.00412b30
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp - 0xc]
add esp, 8
push eax
push ebp
push 0x4cfdb8
call fcn.00412940
mov edx, dword [0x4cfdb8]
push edx
call fcn.00410f00
add esp, 4
test eax, eax
jne 0x4278f8
lea ebx, [esp + 0x20]
call fcn.00427630
mov edi, 0x4cfdb8
mov byte [esp + 0x238], 1
call fcn.004051e0
mov byte [esp + 0x238], 0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4278e5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x4cfdb8]
push ecx
call fcn.00410f00
add esp, 4
test eax, eax
je 0x42792d
mov edx, dword [0x4cfdb8]
push edx
push 0x4af478
mov ecx, 0x4d0000
call fcn.00478ee0
add esp, 8
call fcn.0046bfb0
mov edx, dword [0x4cfdb8]
mov ecx, eax
call fcn.0046bbf0
mov dword [esp + 0x18], 1
jmp 0x427937
mov esi, 0x4cfdb8
call fcn.00407770
add ebp, 0xfffffff0
mov dword [esp + 0x238], 0xffffffff
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42795f
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00482dc4
add esp, 0x228
ret
Function at 0x42e4b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4a3fa8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4ca5d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.0040e4a0
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42e506
sub eax, edx
sar eax, 1
push eax
push ebx
lea eax, [esp + 0x14]
call fcn.004126b0
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.0040e4a0
cmp dword [esp + 0x24], 8
jb 0x42e54e
mov edx, dword [esp + 0x10]
push edx
call fcn.00482db9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x443cb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10093353
mov eax, dword fs:[0]
push eax
mov eax, dword [0x100b52f0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov edx, 7
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], ecx
mov word [eax + 4], cx
mov dword [esp + 0xc], ecx
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], ecx
mov word [eax + 0x20], cx
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x450d10
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x24
test edx, edx
push ebx
push ebp
push esi
push edi
jne 0x450d2b
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
cmp word [edx], 0x5a4d
jne 0x450d1f
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x450d1f
mov esi, dword [eax + 0x80]
test esi, esi
jne 0x450d56
lea eax, [esi + 1]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
mov eax, dword [esi + edx + 0x10]
add esi, edx
test eax, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], esi
je 0x450e4a
mov ecx, dword [esi]
test ecx, ecx
je 0x450e52
test eax, eax
je 0x450e52
mov edi, dword [esi + 0xc]
add edi, edx
mov dword [esp + 0x18], edi
add ecx, edx
add eax, edx
xor edi, edi
cmp dword [ecx], edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
je 0x450e38
mov eax, ecx
xor esi, esi
mov eax, dword [eax]
mov ecx, eax
and ecx, 0x80000000
xor ebx, ebx
xor ebp, ebp
cmp ecx, 0x80000000
jne 0x450dc4
and eax, 0x7fffffff
mov ebx, eax
jmp 0x450dd0
test eax, eax
je 0x450e52
lea ebp, [eax + edx + 2]
mov edx, dword [esp + 0x18]
push edx
call dword [0x1009d218]
test eax, eax
je 0x450e52
test ebx, ebx
mov ecx, ebx
jne 0x450de7
mov ecx, ebp
push ecx
push eax
call dword [0x1009d08c]
test eax, eax
je 0x450e52
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x38]
add ecx, esi
lea edx, [esp + 0x20]
mov dword [ecx], eax
push edx
lea eax, [esp + 0x2c]
push eax
add ebx, 0x18
mov dword [esp + 0x28], ecx
call fcn.004518e0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x3c]
add edi, 1
lea esi, [edi*4]
cmp dword [esi + ecx], 0
lea eax, [esi + ecx]
jne 0x450da5
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x24]
add esi, 0x14
test eax, eax
mov dword [esp + 0x10], esi
jne 0x450d70
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
Function at 0x45ef10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp + 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x45ef33
mov eax, dword [ebp - 4]
jmp 0x45f00f
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x45efea
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
lea ecx, [ecx]
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100a0100]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x100a0100]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100a0100]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x100a0100]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100a0100]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x100a0100]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x100a0100]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100a0100]
dec ebp
jne 0x45ef54
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x45f006
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x100a0100]
dec ecx
jne 0x45eff4
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45faf0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
mov eax, dword [0x100b52f0]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x60]
push esi
mov esi, ecx
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x6c]
lea ecx, [esp + 8]
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
call fcn.0045f8c0
push esi
lea esi, [esp + 0xc]
call fcn.0045f9e0
mov ecx, dword [esp + 0x64]
add esp, 8
pop esi
xor ecx, esp
call fcn.00478577
add esp, 0x5c
ret

Function at 0x45fb02
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
mov eax, dword [0x100b52f0]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x60]
push esi
mov esi, ecx
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x6c]
lea ecx, [esp + 8]
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
call fcn.0045f8c0
push esi
lea esi, [esp + 0xc]
call fcn.0045f9e0
mov ecx, dword [esp + 0x64]
add esp, 8
pop esi
xor ecx, esp
call fcn.00478577
add esp, 0x5c
ret