joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec eax
mov dword [esp + 8], ebx
dec eax
mov dword [esp + 0x10], esi
push edi
dec eax
sub esp, 0x60
dec eax
mov eax, dword [0xa13ba]
dec eax
xor eax, esp
dec eax
mov dword [esp + 0x50], eax
dec eax
mov eax, dword [ecx + 8]
dec eax
mov edi, ecx
dec ecx
mov esi, eax
dec eax
mov ebx, edx
dec eax
mov ecx, dword [eax + 0x18]
dec eax
mov eax, dword [edx + 8]
dec eax
cmp ecx, dword [eax + 0x18]
jb 0x1016ddd
ja 0x1016dd6
dec ebp
test eax, eax
jne 0x1016d38
dec eax
lea edx, [0x727e1]
inc ecx
lea ecx, [eax + 2]
call fcn.01012560
movzx eax, word [ebx + 0x10]
mov word [esp + 0x22], ax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 0x20]
mov dword [esp + 0x30], eax
dec eax
test esi, esi
jne 0x1016d71
dec eax
lea edx, [0x727a7]
lea ecx, [esi + 2]
call fcn.01012560
movzx eax, word [edi + 0x10]
dec eax
lea edx, [esp + 0x20]
mov word [esp + 0x3a], ax
dec eax
lea ecx, [esp + 0x38]
mov eax, dword [edi + 0x14]
mov dword [esp + 0x3c], eax
mov eax, dword [edi + 0x18]
mov dword [esp + 0x40], eax
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x44], eax
mov eax, dword [edi + 0x20]
mov dword [esp + 0x48], eax
call fcn.010154a0
test eax, eax
jne 0x1016de2
mov eax, dword [edi + 0x10]
mov edx, dword [ebx + 0x10]
shr eax, 0x13
shr edx, 0x13
and eax, 1
and edx, 1
cmp eax, edx
jb 0x1016ddd
ja 0x1016dd6
dec eax
lea edx, [0x72730]
mov ecx, 2
call fcn.01012560
xor eax, eax
jmp 0x1016de2
mov eax, 1
jmp 0x1016de2
mov eax, 0xffffffff
dec eax
mov ecx, dword [esp + 0x50]
dec eax
xor ecx, esp
call 0x107d7f0
dec eax
mov ebx, dword [esp + 0x70]
dec eax
mov esi, dword [esp + 0x78]
dec eax
add esp, 0x60
pop edi
ret
Function at 0x414dc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GdBKlczN
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x414de2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414de9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414dd8
mov eax, 1
add ebx, ebx
jne 0x414dfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414df0
jne 0x414e0c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414df0
xor ecx, ecx
sub eax, 3
jb 0x414e20
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414e92
mov ebp, eax
add ebx, ebx
jne 0x414e2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414e38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414e5c
inc ecx
add ebx, ebx
jne 0x414e48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414e3d
jne 0x414e59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414e3d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414e7c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414e6d
jmp 0x414dde
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414e7c
add edi, ecx
jmp 0x414dde
pop esi
mov edi, esi
mov ecx, 2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414e9a
cmp byte [edi], 5
jne 0x414e9a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414e9f
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414f17
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19bb8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19bf4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414ecc
mov ecx, edi
jns 0x414efb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19bfc]
or eax, eax
je 0x414f11
mov dword [ebx], eax
add ebx, 4
jmp 0x414ee9
call dword [esi + 0x19bf8]
mov ebp, dword [esi + 0x19c00]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414f4b
sub esp, 0xffffff80
jmp 0x401134

Function at 0x40896c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x4085d8
pop eax
or edi, edi
call fcn.00408990
add edi, 1
xor dword [ebx], eax
inc ebx
and edi, ecx
add ecx, ecx
cmp ebx, edx
jne fcn.0040896c
ret
Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x405da0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x405ff3
sub esp, 0x18
movzx eax, byte [0x8844bf]
test al, al
jne 0x405fcb
mov eax, dword [0x8846f0]
mov ecx, dword [esp + 0x24]
imul eax, ecx
mov edx, dword [esp + 0x20]
add eax, edx
mov ebx, dword [esp + 0x1c]
test ecx, ecx
je 0x405ec2
cmp ecx, 4
jb 0x405f95
je 0x405f7d
cmp ecx, 8
jbe 0x405f4c
cmp ecx, 0x10
jbe 0x405eed
mov ebp, dword [0x8846f4]
imul ebp, edx
mov esi, dword [0x8846f8]
imul esi, edx
mov edi, dword [0x8846fc]
imul edi, edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], edi
cmp ecx, 0x10
jb 0x405eb4
mov edx, ebx
mov dword [esp + 0x14], edx
lea ecx, [edx + 4]
lea edi, [edx + 8]
add edx, 0xc
mov ebx, dword [ebx]
xor eax, ebx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, dword [ecx]
xor ebp, ecx
imul ebp, ebp, 0xc70f85e1
rol ebp, 0xf
imul ebp, ebp, 0x319bca41
mov ecx, dword [edi]
xor esi, ecx
imul esi, esi, 0x319bca41
rol esi, 0xf
imul esi, esi, 0x8b421a21
mov edi, dword [edx]
mov ecx, dword [esp + 0x10]
xor edi, ecx
imul edi, edi, 0x8b421a21
rol edi, 0xf
imul edi, edi, 0xbce2d621
mov ecx, dword [esp + 0x14]
add ecx, 0x10
mov ebx, ecx
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
mov edx, dword [esp + 0x20]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], edi
cmp ecx, 0x10
jae 0x405e34
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
jne 0x405de7
mov edx, eax
mov eax, edx
shr edx, 0x11
xor eax, edx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor ecx, eax
imul ecx, ecx, 0x8b421a21
mov eax, ecx
shr ecx, 0x10
xor eax, ecx
mov dword [esp + 0x28], eax
add esp, 0x18
ret
mov edx, ebx
lea ebp, [edx + 4]
lea esi, [ecx + edx - 8]
lea ecx, [ecx + edx - 4]
mov edx, dword [ebx]
xor edx, eax
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
mov eax, dword [ebp]
xor edx, eax
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
mov eax, dword [esi]
xor edx, eax
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
mov eax, dword [ecx]
xor edx, eax
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
jmp 0x405ec4
mov ebp, ebx
lea ecx, [ecx + ebp - 4]
mov edx, dword [ebx]
xor edx, eax
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
mov eax, dword [ecx]
xor edx, eax
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
jmp 0x405ec4
mov edx, dword [ebx]
xor edx, eax
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
jmp 0x405ec4
mov ebp, ebx
mov esi, ecx
shr ecx, 1
add ecx, ebp
lea ebp, [esi + ebp - 1]
movzx edx, byte [ebx]
xor edx, eax
movzx eax, byte [ecx]
shl eax, 8
xor edx, eax
movzx eax, byte [ebp]
shl eax, 0x10
xor edx, eax
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
jmp 0x405ec4
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
call fcn.00449be0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
add esp, 0x18
ret
call fcn.004486b0
jmp fcn.00405da0
Function at 0x40cf30
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40d0c4
sub esp, 0x38
mov eax, dword [0x847120]
cmp eax, 0x7000000
jle 0x40d0af
mov eax, 0x7000000
mov dword [esp + 0x10], eax
call fcn.0044a220
mov eax, dword [esp]
and eax, 0x3ffffff
inc eax
mov dword [esp], eax
call fcn.0044a2b0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x18], xmm0
mov eax, dword [esp + 0x1c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, dword [esp + 0x18]
mov edi, 0
adc edi, 0
shr esi, 0x1b
shl ebx, 5
or esi, ebx
mov dword [esp + 0x14], esi
test edi, edi
jne 0x40d0a8
cmp ecx, 0x21
jae 0x40d0a8
shl ecx, 3
lea ebx, [0x84fca0]
movsd xmm0, qword [ebx + ecx]
movsd qword [esp + 0x30], xmm0
shl ebp, 3
movsd xmm1, qword [ebx + ebp]
movsd qword [esp + 0x28], xmm1
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0
adc eax, 0xffffffff
mov dword [esp + 4], eax
call fcn.00445120
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x20], xmm0
mov eax, dword [esp + 0x14]
and eax, 0xfffff
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00445210
movsd xmm0, qword [esp + 0x28]
movsd xmm1, qword [esp + 0x20]
addsd xmm1, xmm0
movsd xmm2, qword [esp + 0x30]
subsd xmm2, xmm0
movsd xmm0, qword [esp + 8]
mulsd xmm2, xmm0
movsd xmm0, qword [0x730228]
mulsd xmm2, xmm0
addsd xmm1, xmm2
movsd xmm0, qword [0x730308]
subsd xmm1, xmm0
xorps xmm0, xmm0
ucomisd xmm1, xmm0
jbe 0x40d0a2
xorps xmm0, xmm0
mov eax, dword [esp + 0x10]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x7303f8]
mulsd xmm2, xmm1
mulsd xmm0, xmm2
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x38
ret
movsd xmm0, xmm1
jmp 0x40d07d
call fcn.00424680
ud2
test eax, eax
je 0x40d0b8
jmp 0x40cf5f
mov dword [esp + 0x3c], 0
add esp, 0x38
ret
call fcn.004486b0
jmp fcn.0040cf30
Function at 0x411040
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x411282
sub esp, 0x20
lea eax, [0x884538]
mov dword [esp], eax
call fcn.0040b0e0
mov eax, dword [0x872354]
test eax, eax
je 0x41107f
mov eax, dword [eax + 8]
cmp eax, 0xcc
jne 0x411152
mov eax, dword [0x87234c]
test eax, eax
jne 0x411134
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x886258]
mov dword [esp + 8], eax
call fcn.0040d0d0
mov eax, dword [esp + 0xc]
mov dword [0x87234c], eax
mov ecx, dword [0x872324]
mov dword [eax], ecx
mov eax, dword [0x87234c]
mov dword [0x872324], eax
movzx eax, byte [0x884920]
test al, al
jne 0x411134
xor eax, eax
mov dword [esp + 0x10], eax
cmp eax, 0x80
jge 0x411134
mov ecx, 0x66666667
imul ecx
sar edx, 1
mov ebx, dword [esp + 0x10]
mov ebp, ebx
sar ebx, 0x1f
sub edx, ebx
lea edx, [edx + edx*4]
mov ebx, ebp
sub ebp, edx
cmp ebp, 5
jae 0x41127b
lea edx, [0x847178]
movzx ebp, byte [edx + ebp]
cmp ebx, 0x80
jae 0x41127b
lea esi, [0x884920]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
mov dword [esp + 0x10], eax
cmp eax, 0x80
jl 0x4110e1
mov eax, dword [0x87234c]
mov ecx, dword [eax + 4]
mov dword [0x87234c], ecx
mov ecx, dword [0x872354]
mov dword [eax + 4], ecx
mov dword [0x872354], eax
mov eax, dword [0x872354]
mov dword [esp + 0x1c], eax
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
cmp ecx, 0xcc
jae 0x411274
lea edx, [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.004016e0
mov eax, dword [esp + 0x18]
lea eax, [eax + eax*4]
mov dword [esp + 0x14], eax
mov ecx, dword [0x884700]
mov edx, dword [esp + 0x1c]
lea ebx, [edx + eax*4 + 0x10]
test ecx, ecx
jne 0x411257
mov ecx, dword [esp + 0x28]
mov dword [edx + eax*4 + 0x10], ecx
mov ecx, dword [esp + 0x2c]
mov dword [edx + eax*4 + 0x18], ecx
lea ecx, [edx + eax*4 + 0x1c]
mov ebx, dword [0x884700]
test ebx, ebx
jne 0x41123a
mov ecx, dword [esp + 0x30]
mov dword [edx + eax*4 + 0x1c], ecx
mov ecx, dword [0x884700]
lea ebx, [edx + eax*4 + 0x20]
test ecx, ecx
jne 0x411220
mov ecx, dword [esp + 0x34]
mov dword [edx + eax*4 + 0x20], ecx
mov ecx, dword [0x884700]
lea ebx, [edx + eax*4 + 0x14]
test ecx, ecx
jne 0x41120e
mov ecx, dword [esp + 0x24]
mov dword [edx + eax*4 + 0x14], ecx
mov byte [0x8844b6], 1
lea eax, [0x884538]
mov dword [esp], eax
call fcn.0040b2c0
add esp, 0x20
ret
mov dword [esp], ebx
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0040d5a0
jmp 0x4111f5
mov dword [esp], ebx
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.0040d5a0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
jmp 0x4111df
mov dword [esp], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 4], ecx
call fcn.0040d5a0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
jmp 0x4111c9
mov dword [esp], ebx
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
call fcn.0040d5a0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
jmp 0x4111ab
call fcn.00424680
ud2
call fcn.00424680
ud2
call fcn.004486b0
jmp fcn.00411040
Function at 0x41f0a0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41f1c7
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x41f14c
cmp cl, 2
jne 0x41f134
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0041fb50
lea eax, [0x8784d8]
mov dword [esp], eax
call fcn.0040b0e0
lea eax, [0x8784b4]
test byte [eax], al
mov ecx, dword [0x8784cc]
mov edx, dword [0x8784b4]
sub ecx, edx
mov dword [0x8784cc], ecx
test byte [eax], al
mov ecx, dword [0x8784c0]
mov edx, dword [esp + 0x18]
mov dword [edx], ecx
test byte [eax], al
mov dword [0x8784c0], edx
lea eax, [0x8784d8]
mov dword [esp], eax
call fcn.0040b2c0
add esp, 0x14
ret
lea eax, [0x708afe]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00425c90
ud2
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x1c]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.00411040
lea eax, [0x8784d8]
mov dword [esp], eax
call fcn.0040b0e0
lea eax, [0x878490]
test byte [eax], al
mov ecx, dword [0x8784a8]
mov edx, dword [0x878490]
sub ecx, edx
mov dword [0x8784a8], ecx
test byte [eax], al
mov ecx, dword [0x87849c]
mov edx, dword [esp + 0x18]
mov dword [edx], ecx
test byte [eax], al
mov dword [0x87849c], edx
lea eax, [0x8784d8]
mov dword [esp], eax
call fcn.0040b2c0
jmp 0x41f130
call fcn.004486b0
jmp fcn.0041f0a0
Function at 0x43d340
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x230]
test byte [ecx], al
mov edx, dword [esp + 0x14]
mov dword [eax + 0x230], edx
test byte [ecx], al
mov edx, dword [esp + 0x18]
mov dword [eax + 0x234], edx
lea edx, [esp + 0x1c]
mov dword [eax + 0x238], edx
mov edx, dword [0x872330]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.00402670
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x240]
mov edx, dword [eax + 0x244]
mov eax, dword [eax + 0x23c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
add esp, 0x10
ret

Function at 0x43fab0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43fbe4
sub esp, 0x2c
mov ecx, dword [esp + 0x34]
test ecx, ecx
setne dl
mov ebx, dword [esp + 0x30]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
or edx, ebp
test dl, dl
je 0x43fbdb
mov edx, dword [0x87c3bc]
mov ebp, dword [0x87c3b8]
cmp ecx, edx
xchg esi, ebx
sete bl
xchg esi, ebx
cmp ebx, ebp
xchg ebp, ebx
setb bl
xchg ebp, ebx
and esi, ebp
cmp ecx, edx
setl dl
or edx, esi
test dl, dl
je 0x43fbd2
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x30], ecx
mov edx, dword fs:[0x14]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
mov edx, dword [edx + 0x4c]
mov ebx, dword [edx + 0x90]
add ebx, 1
mov ebp, dword [edx + 0x94]
mov dword [edx + 0x90], ebx
adc ebp, 0
mov dword [edx + 0x94], ebp
mov ebx, dword [edx + 0x18]
mov ebx, dword [ebx + 0x54]
mov dword [edx + 0x98], ebx
lea edi, [esp + 0x14]
mov ebx, eax
xor eax, eax
call fcn.0044a37a
mov ecx, dword [edx + 0x68]
mov ebp, dword [edx + 0x64]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ecx
mov ecx, dword [edx + 0x94]
mov edx, dword [edx + 0x90]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x30]
shr ecx, 6
mov edx, ebx
shl ebx, 0x1a
or ecx, ebx
mov dword [esp + 0x24], ecx
shr edx, 6
mov dword [esp + 0x28], edx
mov byte [esp], 0x1d
mov dword [esp + 4], 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 3
call fcn.0043e5d0
add esp, 0x2c
ret
mov eax, ecx
mov ecx, ebx
jmp 0x43fb1c
mov eax, ecx
mov ecx, ebx
jmp 0x43fb1c
call fcn.004486b0
jmp fcn.0043fab0
Function at 0x4421c0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x442273
sub esp, 0x38
lea eax, [esp + 0x3c]
mov ecx, eax
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call fcn.00449ad0
mov eax, dword [esp + 4]
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 0x10], ecx
mov dword [esp + 8], 0
lea edi, [esp + 0x14]
mov edx, eax
xor eax, eax
call fcn.0044a377
lea eax, [0x447f70]
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x14]
mov dword [esp], eax
call fcn.00448590
mov eax, dword [esp + 8]
mov dword [esp + 0x4c], eax
add esp, 0x38
ret
call fcn.004486b0
jmp fcn.004421c0
Function at 0x444db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x444f45
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
cmp eax, ecx
jge 0x444f37
ja 0x444f30
sub ecx, eax
lea edx, [ecx - 1]
sar edx, 0x1f
xor edx, 0xffffffff
and edx, eax
test ecx, ecx
jbe 0x444f29
mov ebx, dword [esp + 4]
movzx ebp, byte [ebx + edx]
lea esi, [ebp + 0x40]
xchg esi, eax
cmp al, 0x20
xchg esi, eax
jae 0x444e3f
cmp ecx, 1
jle 0x444e25
movzx ecx, byte [ebx + edx + 1]
lea edx, [ecx - 0x80]
cmp dl, 0x3f
ja 0x444e25
and ebp, 0x1f
shl ebp, 6
and ecx, 0x3f
or ebp, ecx
cmp ebp, 0x7f
jg 0x444e33
mov dword [esp + 0x10], 0xfffd
inc eax
mov dword [esp + 0x14], eax
ret
mov dword [esp + 0x10], ebp
add eax, 2
mov dword [esp + 0x14], eax
ret
lea esi, [ebp + 0x20]
xchg esi, eax
cmp al, 0x10
xchg esi, eax
jae 0x444ea1
cmp ecx, 2
jle 0x444e25
movzx ecx, byte [ebx + edx + 1]
lea esi, [ecx - 0x80]
xchg esi, eax
cmp al, 0x3f
xchg esi, eax
ja 0x444e25
movzx edx, byte [ebx + edx + 2]
lea ebx, [edx - 0x80]
cmp bl, 0x3f
ja 0x444e25
and ebp, 0xf
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ebp, ecx
and edx, 0x3f
or ebp, edx
cmp ebp, 0x7ff
jle 0x444e25
lea ecx, [ebp - 0xd800]
cmp ecx, 0x7ff
ja 0x444e95
jmp 0x444e25
mov dword [esp + 0x10], ebp
add eax, 3
mov dword [esp + 0x14], eax
ret
lea esi, [ebp + 0x10]
xchg esi, eax
cmp al, 8
xchg esi, eax
jae 0x444e25
cmp ecx, 3
jle 0x444e25
movzx ecx, byte [ebx + edx + 1]
lea esi, [ecx - 0x80]
xchg esi, eax
cmp al, 0x3f
xchg esi, eax
ja 0x444e25
movzx esi, byte [ebx + edx + 2]
lea edi, [esi - 0x80]
xchg edi, eax
cmp al, 0x3f
xchg edi, eax
ja 0x444e25
movzx edx, byte [ebx + edx + 3]
lea ebx, [edx - 0x80]
cmp bl, 0x3f
ja 0x444e25
and ebp, 7
shl ebp, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ebp, ecx
and esi, 0x3f
shl esi, 6
or ebp, esi
and edx, 0x3f
or ebp, edx
lea ecx, [ebp - 0x10000]
cmp ecx, 0xfffff
jbe 0x444f1d
jmp 0x444e25
mov dword [esp + 0x10], ebp
add eax, 4
mov dword [esp + 0x14], eax
ret
call fcn.00424680
ud2
call fcn.004246e0
ud2
mov dword [esp + 0x10], 0xfffd
inc eax
mov dword [esp + 0x14], eax
ret
call fcn.004486b0
jmp fcn.00444db0

Function at 0x4498d0
Capabilities:
Access peb ldr_data

Disassembly:
push eax
push ebx
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
lea eax, [esp + 0xc]
mov dword [ebx + 0x20], eax
mov eax, dword [eax - 4]
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x30], 0
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x4498ff
call fcn.00427e40
pop ebx
pop eax
ret
Function at 0x449be0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x449c20
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x884800]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x449e22
je 0x449e0a
cmp ebx, 0x20
jbe 0x449dcc
cmp ebx, 0x40
jbe 0x449d3b
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x884810]
pxor xmm2, xmmword [0x884820]
pxor xmm3, xmmword [0x884830]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x449cc1
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x884810]
pxor xmm2, xmmword [0x884820]
pxor xmm3, xmmword [0x884830]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
pxor xmm1, xmmword [0x884810]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqu xmm1, xmmword [eax]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
test ebx, ebx
je 0x449e55
add eax, 0x10
test ax, 0xff0
je 0x449e41
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x732780]
jmp 0x449e0e
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x732880]
jmp 0x449e0e
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret