joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467c24
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x467e84
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x467c87
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004678cc
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040c468
cmp al, 1
jne 0x467c87
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00467b94
test al, al
je 0x467e13
cmp dword [ebp - 8], 0
jge 0x467ca5
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004678cc
mov eax, dword [ebp - 0x210]
call fcn.0040418c
cmp ebx, eax
jge 0x467cef
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004678cc
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4950a4]
and eax, 0xff
bt dword [edx], eax
jae 0x467cef
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x467d03
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00467c00
cmp ebx, dword [ebp - 8]
je 0x467e05
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x467d2f
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403378
and eax, 0x7f
movzx eax, word [eax*2 + 0x493f34]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x467df2
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403378
and eax, 0x7f
movzx eax, word [eax*2 + 0x493f34]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00443404
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403378
and eax, 0x7f
movzx eax, word [eax*2 + 0x493f34]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00443404
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467df9
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x467e66
cmp dword [ebp - 8], 0
jge 0x467e1e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004678cc
mov eax, dword [ebp - 0x218]
call fcn.0040418c
cmp eax, dword [ebp - 8]
jg 0x467e58
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004678cc
mov eax, dword [ebp - 0x21c]
call fcn.0040418c
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00467c00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467e8b
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00403ef0
ret
Function at 0x47c154
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47c182
mov eax, ebx
call fcn.0047cc08
cmp dword [ebx + 0x40], 0
je 0x47c17b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47c1f3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x47c1e5
cmp dword [ebx + 8], 0
je 0x47c1a4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47c1b6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47c1e5
cmp dword [ebx + 8], 0
je 0x47c197
cmp eax, 3
je 0x47c1c9
dec eax
jne 0x47c197
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47c197
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47c197
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47c211
cmp dword [ebx + 0x14], 0xcc
je 0x47c211
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047c21c
pop ebx
ret

Function at 0x48d638
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48d708
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403ecc
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, esi
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.0040413c
mov eax, dword [esi]
call fcn.0040418c
mov edx, dword [esi]
cmp byte [edx + eax - 1], 0x5c
jne 0x48d6ac
push esi
mov eax, dword [esi]
call fcn.0040418c
mov ecx, eax
dec ecx
mov eax, dword [esi]
mov edx, 1
call fcn.004043ec
mov eax, dword [esi]
call fcn.0040418c
mov ebx, eax
cmp ebx, 1
jl 0x48d6c8
mov eax, dword [esi]
cmp byte [eax + ebx - 1], 0x5c
je 0x48d6c8
dec ebx
test ebx, ebx
jne 0x48d6ba
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [esi]
mov ecx, ebx
mov edx, 1
call fcn.004043ec
mov edx, dword [ebp - 0x10c]
mov eax, esi
mov ecx, 0x48d720
call fcn.004041d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d70f
lea eax, [ebp - 0x10c]
call fcn.00403ecc
ret

Function at 0x48d8e4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push esp
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0040413c
add esp, 0x10c
pop ebx
ret

Function at 0x48dc24
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040413c
mov eax, dword [ebx]
call fcn.0040418c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x48dc62
mov eax, ebx
mov edx, 0x48dc74
call fcn.00404194
add esp, 0x108
pop ebx
ret
Function at 0x491d40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x491de4
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 0xf
call fcn.0048df2c
mov ebx, eax
lea edx, [ebp - 0x12c]
mov eax, ebx
call fcn.0048df4c
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x491dca
lea edx, [ebp - 4]
lea eax, [ebp - 0x108]
call fcn.00408cc8
mov edx, 0x491df8
mov eax, dword [ebp - 4]
call fcn.00407fbc
test eax, eax
jne 0x491db7
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_TerminateProcess
lea edx, [ebp - 0x12c]
mov eax, ebx
call fcn.0048df6c
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x491d80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491deb
lea eax, [ebp - 4]
call fcn.00403ecc
ret

Function at 0x491e08
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x491f41
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x491f1c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0048dc24
push dword [ebp - 4]
push 0x491f58
push 0x491f6c
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040424c
push dword [ebp - 4]
push 0x491f58
push 0x491f78
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040424c
lea eax, [ebp - 0x10]
mov edx, 0x491f58
call fcn.00403f64
mov eax, dword [ebp - 8]
call fcn.004087a8
test al, al
je 0x491e8e
mov eax, dword [ebp - 8]
call fcn.004088c4
mov ecx, dword [ebp - 8]
mov edx, 0x491f88
mov eax, dword [ebp - 0x10]
call fcn.0048dae4
mov dl, 1
mov eax, dword [0x48dfc4]
call fcn.0040314c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x491f0b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x491f94
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0048e404
cmp al, 2
jne 0x491eed
push 1
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040438c
push eax
push 0x491f9c
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491f12
mov eax, dword [ebp - 0x14]
call fcn.0040317c
mov eax, dword [ebp - 8]
call fcn.004088c4
ret
Function at 0x491fa4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x492104
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4920d7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x49211c
call fcn.00403f64
mov eax, dword [ebp - 4]
call fcn.004792bc
test al, al
jne 0x491fef
mov eax, dword [ebp - 4]
call fcn.004792c4
push dword [ebp - 4]
push 0x492138
push 0x49214c
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040424c
push dword [ebp - 4]
push 0x492138
push 0x492158
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040424c
lea eax, [ebp - 0x10]
mov edx, 0x492138
call fcn.00403f64
mov eax, dword [ebp - 8]
call fcn.004087a8
test al, al
je 0x492044
mov eax, dword [ebp - 8]
call fcn.004088c4
mov ecx, dword [ebp - 8]
mov edx, 0x492168
mov eax, dword [ebp - 0x10]
call fcn.0048dae4
mov dl, 1
mov eax, dword [0x48dfc4]
call fcn.0040314c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4920c6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x492174
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0048e404
cmp al, 2
jne 0x4920a8
push 0
lea eax, [ebp - 0x18]
mov ecx, 0x492184
mov edx, dword [ebp - 0xc]
call fcn.004041d8
mov eax, dword [ebp - 0x18]
call fcn.0040438c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4920cd
mov eax, dword [ebp - 0x14]
call fcn.0040317c
mov eax, dword [ebp - 8]
call fcn.004088c4
ret
Function at 0x10917efe
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x10926910
call fcn.109182d4
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x10917f3e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10917f3e
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10917f56
cmp eax, 0x20b
je 0x10917f43
mov dword [ebp - 0x1c], ebx
jmp 0x10917f6a
cmp dword [ecx + 0x84], 0xe
jbe 0x10917f3e
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x10917f64
cmp dword [ecx + 0x74], 0xe
jbe 0x10917f3e
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x10954c04], 0xffffffff
or dword [0x10954c14], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x10954bf4]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x10954bf0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10954bf8], eax
call fcn.10918216
call fcn.109182bf
cmp dword [0x1092c7d0], ebx
jne 0x10917fca
push 0x109182bc
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.109182a4
push 0x1092b424
push 0x1092b320
call sub.MSVCR71.dll__initterm
push 0x1091825a
call fcn.10917e96
mov eax, dword [0x10954bec]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x10954be8]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x1091801e
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x1092b21c
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1091809c
cmp al, bl
je 0x10918048
cmp dword [ebp - 0x20], ebx
jne 0x1091809c
mov al, byte [esi]
cmp al, bl
je 0x10918058
cmp al, 0x20
ja 0x10918058
inc esi
mov dword [ebp - 0x24], esi
jmp 0x10918048
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x10918074
movzx eax, word [ebp - 0x54]
jmp 0x10918077
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.1090144c
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x10918094
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x109180f1
cmp al, 0x22
jne 0x109180ab
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x109180be
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x10918036
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.1091830f
ret
Function at 0x46fa60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x461f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
lea ecx, [esp + 0xc]
call 0x4bfc78
mov eax, dword [esp + 0x2c]
xor esi, esi
push esi
push 0x9041
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], esi
call 0x4bff10
test eax, eax
je 0x46fb6a
call 0x4bedba
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebp, [eax + 0x10]
mov dword [esp + 0x2c], ebp
mov edi, dword [esp + 0x30]
mov eax, dword [edi + 8]
test eax, eax
mov byte [esp + 0x24], 1
jle 0x46fb3d
lea esp, [esp]
test esi, esi
jl 0x46fb8f
cmp esi, eax
jge 0x46fb8f
mov eax, dword [edi + 4]
lea eax, [eax + esi*4]
push 0x4657a0
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.0046a870
add esp, 0xc
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 2
call fcn.0046df70
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x24], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46fb31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [edi + 8]
inc esi
cmp esi, eax
jl 0x46fad0
mov ebp, dword [esp + 0x2c]
mov eax, dword [ebp - 0xc]
push eax
push ebp
lea ecx, [esp + 0x14]
call 0x4bf9cb
lea eax, [ebp - 0x10]
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46fb6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call 0x4bfcb7
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
call 0x4b8ae4
int3
Function at 0x4792f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x250
xor eax, eax
mov dword [esp + 0x28], eax
push ebx
mov bl, byte [ebp + 0xc]
mov dword [esp + 0x30], eax
push edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x18
lea edx, [esp + 0x3c]
push edx
push eax
push eax
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 8]
push 0x74080
push eax
call dword [0x4642a0]
test eax, eax
je 0x4793c9
mov cl, byte [esp + 0x34]
mov al, 1
test al, cl
je 0x4793c9
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov byte [esp + 0x1c], bl
and bl, al
mov dword [esp + 0x28], ecx
mov byte [esp + 0x15], al
mov byte [esp + 0x16], al
xor eax, eax
push eax
mov dword [esp + 0x30], ecx
lea edx, [esp + 0x10]
push edx
mov edx, dword [ebp + 8]
push 0x210
mov ecx, 0x84
lea edi, [esp + 0x54]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x54]
push eax
push 0x20
lea ecx, [esp + 0x24]
push ecx
or bl, 0xfa
push 0x7c088
shl bl, 4
push edx
mov byte [esp + 0x3a], 0xec
mov byte [esp + 0x39], bl
mov dword [esp + 0x30], 0x200
call dword [0x4642a0]
test eax, eax
jne 0x4793d1
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov eax, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x74]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x78]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x7c]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov byte [esi + 0x14], 0
lea eax, [esi + 1]
mov edi, 0xa
mov cl, byte [eax - 1]
mov dl, byte [eax]
mov byte [eax - 1], dl
mov byte [eax], cl
add eax, 2
dec edi
jne 0x479401
xor eax, eax
cmp byte [eax + esi], 0x20
jge 0x47941d
mov byte [eax + esi], 0x20
inc eax
cmp eax, 0x14
jl 0x479413
pop edi
mov eax, 0x14
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47cf86
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x462ca9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov ecx, 1
xor eax, eax
push edi
mov dword [esp + 8], esi
mov dword [esi + 4], ecx
mov dword [esi + 0xc], eax
mov dword [esi], 0x466938
mov dword [esi + 8], 0x466914
mov dword [esi + 0x10], 0x4668d8
mov dword [esi + 0x14], 0x4668b4
lea edi, [esi + 0x10]
mov dword [esp + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 0xa
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
lea eax, [esi + 0x50]
push eax
mov dword [eax + 0x18], ecx
call dword [fcn.004642d4]
push edi
mov byte [esp + 0x18], 3
call fcn.0047cd50
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x47fc70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x24]
push esi
push edi
mov dword [esp + 0x14], eax
jmp 0x47fc85
mov eax, dword [esp + 0x14]
mov edx, dword [ebp + 0x6c]
mov ebx, dword [ebp + 0x34]
mov ecx, dword [ebp + 0x64]
sub ebx, edx
mov edx, dword [ebp + 0x24]
lea edx, [eax + edx - 0x106]
sub ebx, ecx
cmp ecx, edx
jb 0x47fd0f
mov edi, dword [ebp + 0x30]
mov ecx, eax
mov edx, ecx
shr ecx, 2
lea esi, [edi + eax]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x68]
mov edx, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x54]
sub esi, eax
sub edx, eax
sub ecx, eax
mov dword [ebp + 0x68], esi
mov esi, dword [ebp + 0x44]
mov dword [ebp + 0x54], ecx
mov ecx, dword [ebp + 0x3c]
mov dword [ebp + 0x64], edx
lea edx, [ecx + esi*2]
movzx ecx, word [edx - 2]
sub edx, 2
cmp ecx, eax
jb 0x47fce6
sub ecx, eax
jmp 0x47fce8
xor ecx, ecx
dec esi
mov word [edx], cx
jne 0x47fcd7
mov edx, dword [ebp + 0x38]
mov esi, eax
lea edx, [edx + eax*2]
movzx ecx, word [edx - 2]
sub edx, 2
cmp ecx, eax
jb 0x47fd05
sub ecx, eax
jmp 0x47fd07
xor ecx, ecx
dec esi
mov word [edx], cx
jne 0x47fcf6
add ebx, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x47fd78
mov ecx, dword [ebp + 0x6c]
mov edx, dword [ebp + 0x64]
mov edi, dword [ebp + 0x30]
add ecx, edx
add ecx, edi
push ecx
mov ecx, ebx
mov ebx, eax
call fcn.0047f930
mov ecx, dword [ebp + 0x6c]
add ecx, eax
mov edx, ecx
add esp, 4
cmp edx, 3
mov dword [ebp + 0x6c], ecx
jb 0x47fd62
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebp + 0x50]
mov dword [ebp + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebp + 0x4c]
mov dword [ebp + 0x40], eax
cmp edx, 0x106
jae 0x47fd78
mov edx, dword [ebp]
mov eax, dword [edx + 4]
test eax, eax
jne 0x47fc81
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x499934
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x499962
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x499969
cmp ebx, dword [eax + 4]
jae 0x499969
xor eax, eax
jmp 0x499b59
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x49997a
xor eax, eax
inc eax
jmp 0x499b58
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x499990
cmp ecx, edx
jae 0x499ad5
cmp dword [eax + 4], 0
je 0x499999
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x499981
cmp dword [ebp + 8], 0
je 0x4999bb
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x499ad5
cmp eax, esi
jae 0x499ad5
mov eax, dword [0x48d2b8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4999e0
cmp dword [esi*4 + 0x48d2c0], edi
je 0x499ad9
inc esi
cmp esi, eax
jl 0x4999ce
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x46429c]
test eax, eax
je 0x499b55
cmp dword [ebp - 8], 0x1000000
jne 0x499b55
test byte [ebp - 0xc], 0xcc
je 0x499a5e
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x499b55
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x499b55
cmp word [eax + 0x18], 0x10b
jne 0x499b55
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x499b55
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x499a5e
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x499a5e
test byte [ecx + 0x27], 0x80
jne 0x499ad5
push 1
push 0x48d300
call dword [fcn.00464314]
test eax, eax
jne 0x499972
mov ecx, dword [0x48d2b8]
test ecx, ecx
mov edx, ecx
jle 0x499a92
lea eax, [ecx*4 + 0x48d2bc]
cmp dword [eax], edi
je 0x499a92
dec edx
sub eax, 4
test edx, edx
jg 0x499a86
test edx, edx
jne 0x499ac3
push 0xf
pop ebx
cmp ecx, ebx
jg 0x499a9f
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x499ab7
lea eax, [edx*4 + 0x48d2c0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x499aa5
cmp ecx, 0x10
jge 0x499ac3
inc ecx
mov dword [0x48d2b8], ecx
push 0
push 0x48d300
call dword [fcn.00464314]
jmp 0x499972
xor eax, eax
jmp 0x499b58
test esi, esi
jle 0x499972
mov ebx, dword [fcn.00464314]
push 1
push 0x48d300
call ebx
test eax, eax
jne 0x499972
cmp dword [esi*4 + 0x48d2c0], edi
je 0x499b2f
mov eax, dword [0x48d2b8]
lea esi, [eax - 1]
test esi, esi
jl 0x499b1d
cmp dword [esi*4 + 0x48d2c0], edi
je 0x499b19
dec esi
jns 0x499b0d
test esi, esi
jge 0x499b2d
cmp eax, 0x10
jge 0x499b28
inc eax
mov dword [0x48d2b8], eax
lea esi, [eax - 1]
jmp 0x499b2f
je 0x499b47
xor ecx, ecx
test esi, esi
jl 0x499b47
lea eax, [ecx*4 + 0x48d2c0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x499b35
push 0
push 0x48d300
call ebx
jmp 0x499972
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret