joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b6de
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004427fb
xor ebx, ebx
cmp dword [0x46f820], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x44b7b4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x44b894
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x45cc78
push edi
call esi
cmp eax, ebx
je 0x44b894
push eax
call fcn.0044278d
mov dword [esp], 0x45cc68
push edi
mov dword [0x46f820], eax
call esi
push eax
call fcn.0044278d
mov dword [esp], 0x45cc54
push edi
mov dword [0x46f824], eax
call esi
push eax
call fcn.0044278d
mov dword [0x46f828], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043deb5
test eax, eax
pop ecx
pop ecx
je 0x44b782
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043baf2
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x44b7b4
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0044278d
cmp eax, ebx
pop ecx
mov dword [0x46f830], eax
je 0x44b7b4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044278d
pop ecx
mov dword [0x46f82c], eax
mov eax, dword [0x46f82c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x44b839
cmp dword [0x46f830], ecx
je 0x44b839
push eax
call fcn.00442804
push dword [0x46f830]
mov esi, eax
call fcn.00442804
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x44b839
cmp edi, ebx
je 0x44b839
call esi
cmp eax, ebx
je 0x44b806
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44b806
test byte [ebp - 0x18], 1
jne 0x44b839
lea eax, [ebp - 0x10]
push eax
call fcn.0043deec
test eax, eax
pop ecx
je 0x44b821
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043baf2
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x44b830
or dword [ebp + 0x10], 0x200000
jmp 0x44b874
or dword [ebp + 0x10], 0x40000
jmp 0x44b874
mov eax, dword [0x46f824]
cmp eax, dword [ebp - 8]
je 0x44b874
push eax
call fcn.00442804
cmp eax, ebx
pop ecx
je 0x44b874
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44b874
mov eax, dword [0x46f828]
cmp eax, dword [ebp - 8]
je 0x44b874
push eax
call fcn.00442804
cmp eax, ebx
pop ecx
je 0x44b874
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46f820]
call fcn.00442804
cmp eax, ebx
pop ecx
je 0x44b894
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44b896
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x451048
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x46b8c4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00450fdd
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0043d3d0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x451097
cmp dword [ebp - 0x1c], 5
jb 0x4510af
jmp 0x4510ab
cmp dword [ebp - 0x10], 1
jne 0x4510af
cmp dword [ebp - 0x1c], 4
ja 0x4510ab
jne 0x4510af
cmp dword [ebp - 0x18], 0
jbe 0x4510af
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x45dea8
call fcn.00450eb1
test eax, eax
jge 0x4510d0
mov byte [0x46f9a4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043b64b
add ebp, 0x78
leave
ret
Function at 0x621939
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp + 2]
jmp 0x621997
rdtsc
rol edx, 0x13
mov dh, byte [esp]
mov edx, ebp
sub esp, 6
lea esp, [esp + 4]
not cl
mov eax, dword [esp]
rcl dx, cl
jp 0x621980
jnp 0x62195c

Function at 0x6220da
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 0xd]
lea esp, [esp + 2]
jmp 0x62190c
mov al, ah
clc
jle 0x621835
mov ah, byte [esp + 0xd]
call 0x62187d
mov ebx, 0xe8243c87
imul eax, dword [eax], reloc.WINMM.dll_waveOutUnprepareHeader
xor ebp, eax
inc edx
add byte [eax], al
add byte [esi + 0x10e18610], dl
aad 8
xchg dword [esp], edi
call 0x6218cc
lea edx, [ebx + esi]
call 0x6218ad
xchg esi, eax
adc byte [esi + 0x8d510e1], al
lea ebx, reloc.WINMM.dll_waveOutUnprepareHeader
out dx, eax
mul cl
and byte [ebx + 0x66], ah
mov eax, esi
mov eax, dword [esp]
rcl ax, cl
xchg dx, ax
mov ax, word [esp]
jmp 0x62185b
mov byte [esp + 4], bh
rdtsc
rcr ah, 1
push word [esp + 7]
jmp 0x62184c
push edx
rdtsc
xchg edx, eax
jmp 0x62189e
shr dh, 7
jg 0x621955
mov dh, 0x2a
jmp 0x621957
lea esp, [esp + 0x10]
dec cl
lea eax, [edx + esi]
xchg dx, ax
lea eax, reloc.WINMM.dll_waveOutUnprepareHeader
jmp 0x6218f0
mov dh, 0x2a
call fcn.00621939
rdtsc
rol edx, 0x13
mov dh, byte [esp]
jmp 0x62196a
mov edx, ebp
sub esp, 6
jmp 0x62198d
push dword [esp]
jmp 0x6219a7
xchg dword [esp + 3], edx
mov dx, word [esp + 4]
xchg dh, al
setp dh
mov dx, bp
pop ax
jmp 0x621af1
jmp 0x6218ea
jno 0x621efd
jo 0x621efd
mov dword [esp + 0x1c], edi
popal
lea eax, [eax + ecx]
mov edx, dword [eax]
pop eax
jmp 0x621e86
lea ecx, reloc.WINMM.dll_waveOutUnprepareHeader
pushal
mov dword [esp + 3], eax
call fcn.00621ea8
cmp bh, byte [ebp + 0x75c7342d]
or al, 0x50
pushal
mov ebx, 0xa232c998
xchg ch, dl
jmp 0x621e75
lea esp, [esp + 4]
rol cl, 0
sub esp, 0xc
jg 0x6219d0
push edx
rdtsc
xchg edx, eax
mov byte [esp + 4], bh
rdtsc
jmp 0x6218a4
bt edx, esp
jmp 0x621e69

Function at 0x62b117
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 9]
push edx
pop word [esp]
lea esp, [esp + 3]
jmp 0x615d23
push word [esp + 5]
jmp 0x62b0fd
Function at 0x892c1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
bswap esi
mov bl, bh
mov ecx, 0xa1849a74
add esp, 0x14
mov word [esp + 1], dx
jmp 0x892c97
rcr dh, 7
push dword [esp + 0x12]
clc
rdtsc
add esp, 0x10
sub esp, 4
jmp 0x892be7
mov dword [esp + 0x19], ecx
push word [esp + 0x13]
sub dx, 0xfdc8
jmp 0x892c02
pop dx
mov byte [esp + 0x2b], ah
setns ah
mov cl, ch
lea ebx, [eax + ebx]
jmp 0x892dc5
not bh
cpuid
cpuid
xchg ecx, eax
mov dl, dh
stc
jmp 0x892c4e
neg bh
bsr si, cx
pushal
ror edi, 0x17
neg ecx
btr edi, esp
jmp 0x892c65
mov dword [esp], esi
push dword [esp + 4]
pushal
inc bl
mov byte [esp + 0x17], ch
add esp, 0x12
jmp 0x892c7f
mov bx, 0xbb6d
cld
cld
cpuid
xchg ecx, eax
push word [esp + 0x11]
jmp 0x892cf0
lea esp, [esp + 5]
inc cl
mov word [esp + 0x1f], di
pop ax
mov dword [esp + 9], eax
jmp 0x892caa
setae bh
lea esi, [esi - 0xe5]
lea esp, [esp + 5]
xchg si, bx
pop dword [esp + 0x22]
xchg ecx, esi
jmp 0x892cc0
cpuid
mov dword [esp + 0x15], eax
stc
xchg word [esp + 5], ax
xchg byte [esp + 2], dl
jmp 0x892d77
pop word [esp + 6]
mov dh, byte [esp + 0x30]
rdtsc
pop eax
push word [esp + 0x11]
mov ah, byte [esp + 4]
jmp 0x892cd8
shl si, cl
rdtsc
mov al, ah
ror ch, 5
call int.00892d5d
clc
push 0xcf6899fe
add eax, 0x83cf865f
in al, dx
or byte [edi + 0x660b2444], cl
xchg dword [esp + 0xc], ebx
pop edi
xchg bh, cl
sub esp, 8
pop dword [esp + 0xb]
xchg word [esp + 0xc], bx
jmp 0x892d1f
popal
not ebx
xchg cx, bp
sub esp, 0x14
clc
mov bx, word [esp + 2]
jmp 0x892d35
setge ah
shr bh, 3
rdtsc
not eax
pop bx
ror edi, 3
jmp 0x892d4c
pop dword [esp + 9]
xchg dh, al
inc ebp
push dword [esp + 0x17]
push esp
pop esi
jmp 0x892d08

Function at 0x892f2e
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr esi, edx
add esp, 2
pop dword [esp + 0xa]
xchg word [esp + 0xb], di
add al, dh
pop dword [esp + 7]
jmp 0x892f80
lea esp, [esp + 0x2f]
lea edx, [esp + edi]
bswap eax
sub esp, 0x16
lea edx, [ecx + 0x23]
xchg dx, bx
jmp 0x892ed6
mov si, di
mov cl, 0x32
mov eax, 0x4590843a
mov word [esp + 0x10], sp
mov di, word [esp + 0x14]
pop ebp
jmp 0x892ef2
setbe dh
setp ch
xchg bx, dx
jmp 0x892f0c
xchg word [esp + 0x20], di
popal
not dx
xchg dh, al
push word [esp + 1]
xchg byte [esp + 0x18], cl
jmp 0x892f90
setle ah
rdtsc
xchg dword [esp + 0x17], edi
mov ecx, 0x1478df2c
sub bp, 0x7db0
push dword [esp + 0x22]
jmp 0x892f39
lea eax, [esp + ebx]
push dword [esp + 0x12]
rdtsc
xchg si, ax
clc
pushal
jmp 0x892f54
pop dword [esp + 0x11]
rcr dh, 7
xchg byte [esp + 4], dl
bswap ebp
pop dword [esp + 0xf]
mov dword [esp + 0x11], esi
jmp 0x892fda
lea esp, [esp + 0xd]
pop dword [esp]
pop edi
mov dh, byte [esp + 1]
xchg ah, bl
sub esp, 0x1c
jmp 0x892fbe

Function at 0x893398
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 5
bsr bx, cx
xchg word [esp + 1], di
neg ebp
mov byte [esp + 2], ah
mov ebx, 0xda05e8ca
lea ebx, [esi + 0x4d]
jmp 0x89336c
Function at 0x896d55
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x896da4
xchg ch, dl
mov ch, byte [esp + 0x15]
xor bx, 0x65ec
rdtsc
lea ebx, [ebp*4]
mov dl, 0x34
jmp 0x896d8e
push word [esp + 3]
add esp, 6
lea esp, [esp + 1]
pushal
bswap ebx
pushal
jmp 0x896d57

Function at 0x896f7f
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
inc si
jmp 0x896fd0
mov word [esp + 6], bx
setae dh
setl dh
mov dword [esp + 9], ebp
mov ecx, 0xc22a3a5c
jmp 0x896fb9

Function at 0x8972ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
clc
lea ecx, [ecx*4]
xchg word [esp + 0x15], di
neg dh
stc
jmp 0x896ff5
pop word [esp + 5]
xchg byte [esp + 6], dl
pushal
mov dl, 0x5c
pop word [esp + 1]
xchg dword [esp + 0x18], esi
jmp 0x89700d
inc ax
push edx
cmc
sub esp, 8
bswap eax
lea esi, reloc.WINMM.dll_waveOutUnprepareHeader
jmp 0x89702b
add esp, 0xd
inc cl
mov ax, word [esp]
mov bp, dx
xchg di, dx
inc si
jmp 0x89725b
rdtsc
push word [esp + 8]
jmp 0x897276

Function at 0x897475
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
neg ebx
mov ebx, dword [esp + 8]
btr edi, esp
add esp, 9
lea esp, [esp + 1]
jmp 0x897490
jmp 0x89745c
lea esp, [esp]
mov byte [esp + 3], ah
xchg dword [esp], ebx
mov bh, byte [esp + 1]
pop bx
pushal
jmp 0x8974a0
lea esp, [esp]
push esp
rdtsc
bsf ax, ax
not ch
mov al, 0xce
jmp 0x897477
pop dword [esp + 0x17]
btc edx, ebx
pop ebp
push word [esp + 3]
xchg dword [esp], esi
inc ecx
jmp 0x89757f
lea ebp, [eax + 0xd9]
xchg edx, ecx
setl dh
xchg byte [esp], bl
xchg edx, edi
xchg ah, bl
jmp 0x8974e3
bsr ax, bp
mov dx, word [esp + 0x13]
lea esp, [esp + 0x12]
xchg edi, ecx
mov eax, dword [esp]
cld
jmp 0x8974fb
rdtsc
mov bp, di
mov ch, byte [esp + 0xd]
mov dword [esp + 2], ebp
pop word [esp + 1]
push word [esp + 9]
jmp 0x897513
lea ebp, reloc.WINMM.dll_waveOutUnprepareHeader
xchg byte [esp + 0x1a], bl
inc eax
pop di
pop dx
pop dword [esp]
jmp 0x89752d

Function at 0x897b33
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, eax
add esp, 5
shr bh, 3
cpuid
lea esi, [eax + 9]
jmp 0x897b70
shl dx, cl
lea ecx, [eax + edx]
mov eax, 0xc15207cc
jmp 0x897b1c
mov ax, 0xf69d
neg dx
xchg bh, cl
bswap ecx
sub esp, 0
rdtsc
jmp 0x897b59

Function at 0x89819b
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.0089705d
pop word [esp + 3]
push word [esp + 1]
push word [esp + 7]
jmp 0x898257
push eax
jmp 0x897058
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x8981fe
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x89821d
mov byte [esp + 1], ah
push word [esp + 1]
pop word [esp + 7]
lea esp, [esp + 2]
mov dword [esp + 0x70], edi
lea esp, [esp + 0x70]
jmp 0x898239
Function at 0x40adf0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40afbe
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40ae1b
mov eax, 0x7000000
jmp 0x40ae23
test eax, eax
je 0x40af99
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.004592c0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x54a5e0]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40afb1
cmp ecx, 0x21
jae 0x40afa5
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00454fd0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.004550a0
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x4e1e48]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x4e1ec0]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40af74
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x4e1f00]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.004593a0
mov eax, ecx
mov ecx, 0x21
call fcn.00459440
nop
call fcn.00457f00
jmp fcn.0040adf0
Function at 0x412ca0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x412eb4
sub esp, 0x18
mov eax, dword [0x582148]
test eax, eax
jne 0x412e9d
nop
lea eax, [0x582130]
mov dword [esp], eax
call fcn.00408c20
mov eax, dword [0x582134]
test eax, eax
je 0x412ce9
cmp dword [eax + 8], 0xcc
jne 0x412d5f
mov edx, dword [0x582128]
test edx, edx
jne 0x412d41
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x583ad8]
mov dword [esp + 8], eax
call fcn.0040afd0
mov eax, dword [esp + 0xc]
mov dword [0x582128], eax
mov ecx, dword [0x5820e4]
mov dword [eax], ecx
mov eax, dword [0x582128]
mov dword [0x5820e4], eax
movzx eax, byte [0x582540]
test al, al
jne 0x412d41
xor eax, eax
jmp 0x412e49
mov edx, dword [0x582128]
mov ebx, dword [edx + 4]
mov dword [0x582128], ebx
mov ebx, dword [0x582134]
mov dword [edx + 4], ebx
mov dword [0x582134], edx
mov edx, dword [0x582134]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x412e31
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00401d60
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x5822c0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x412dbd
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x412dca
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00459310
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x5822c0]
test edx, edx
jne 0x412df6
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x412e17
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00459310
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00459310
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00459310
mov byte [0x5820a7], 1
nop
lea eax, [0x582130]
mov dword [esp], eax
call fcn.00408e20
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.004593a0
lea esi, [0x582540]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x412d41
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x412e93
lea edx, [0x5462ec]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x412e3b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00459390
mov ecx, 5
call fcn.00459390
lea eax, [0x4bd772]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004320d0
nop
call fcn.00457f00
jmp fcn.00412ca0
Function at 0x424530
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4246a0
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00422590
mov eax, dword [esp + 4]
test eax, eax
je 0x424689
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.004205b0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.00408c20
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x4245c7
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42462d
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x4245dc
cmp byte [ebp + 6], dl
je 0x4245e7
cmp esi, ebx
ja 0x42462d
jne 0x4245c5
cmp byte [ebp + 6], dl
jbe 0x4245c5
jmp 0x42462d
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00408e20
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x424624
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x424624
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00424430
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00408e20
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x424680
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x424680
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x4bed8f]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.004320d0
nop
call fcn.00457f00
jmp fcn.00424530
Function at 0x424b10
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x424c2c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x424ba5
cmp cl, 2
je 0x424b4d
cmp cl, 3
jne 0x424c15
mov byte [eax + 8], 1
jmp 0x424c11
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042a060
nop
lea eax, [0x56671c]
mov dword [esp], eax
call fcn.00408c20
nop
mov eax, dword [0x5666e8]
sub eax, dword [0x5666cc]
mov dword [0x5666e8], eax
mov eax, dword [0x5666d8]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5666d8], ecx
nop
lea eax, [0x56671c]
mov dword [esp], eax
call fcn.00408e20
jmp 0x424c11
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00412ca0
nop
lea eax, [0x56671c]
mov dword [esp], eax
call fcn.00408c20
nop
mov eax, dword [0x5666c0]
sub eax, dword [0x5666a4]
mov dword [0x5666c0], eax
mov eax, dword [0x5666b0]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5666b0], ecx
nop
nop
lea eax, [0x56671c]
mov dword [esp], eax
call fcn.00408e20
add esp, 0x14
ret
lea eax, [0x4ba79f]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004320d0
nop
call fcn.00457f00
jmp fcn.00424b10
Function at 0x44a7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44a923
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x44a91b
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x44a7fc
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x44a7fc
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x44a80f
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x44a8f0
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x44a8e2
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x44a8db
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x44a866
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x44a8af
mov eax, 1
cmp eax, ecx
ja 0x44a89d
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00459400
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x44a8d6
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x44a8a2
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x44a86b
call fcn.004593a0
xor eax, eax
call fcn.00459390
call fcn.00459400
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x44a916
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x44a8e7
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x44a814
call fcn.004593a0
xor eax, eax
call fcn.00459390
nop
call fcn.00457f00
jmp fcn.0044a7a0
Function at 0x451cc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x451d5f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004594d7
lea ecx, [0x451d70]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00457df0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00457f00
jmp fcn.00451cc0