joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f730
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x465584
call fcn.0045cf28
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00402938
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00402938
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00402938
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.00402938
mov al, byte [edi + 0x30]
lea ecx, [esi + 0x34]
mov byte [esi + 0x30], al
lea eax, [edi + 0x34]
push eax
mov byte [ebp - 4], 3
call fcn.00402938
add edi, 0x40
lea ecx, [esi + 0x40]
push edi
mov byte [ebp - 4], 4
call fcn.00402938
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x412942
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x465c5d
call fcn.0045cf28
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov al, byte [esi]
lea ecx, [ebx + 8]
mov byte [ebx], al
mov al, byte [esi + 1]
mov byte [ebx + 1], al
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
lea eax, [esi + 8]
push eax
call fcn.00402938
mov al, byte [esi + 0x14]
and dword [ebp - 4], 0
mov byte [ebx + 0x14], al
lea eax, [esi + 0x18]
push eax
lea ecx, [ebx + 0x18]
call fcn.00402938
lea eax, [esi + 0x28]
lea edx, [ebx + 0x28]
push 0xc
mov esi, eax
pop ecx
mov edi, edx
rep movsd dword es:[edi], dword [esi]
add eax, 0x30
lea ecx, [edx + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00402938
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x68]
mov byte [ebp - 4], 2
lea eax, [esi + 0x68]
push eax
call fcn.00412a4c
mov eax, dword [esi + 0x7c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x7c], eax
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x41342e
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x465dc6
call fcn.0045cf28
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov al, byte [edi]
lea ecx, [esi + 0xc]
mov byte [esi], al
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
lea eax, [edi + 0xc]
push eax
call fcn.00402938
and dword [ebp - 4], 0
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
call fcn.004134a5
and dword [esi + 0x30], 0
and dword [esi + 0x34], 0
lea ecx, [esi + 0x2c]
lea eax, [edi + 0x2c]
push eax
mov byte [ebp - 4], 1
mov dword [ecx], 0x46b5f4
call fcn.004134f1
mov al, byte [edi + 0x38]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x38], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4174e2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4665ad
call fcn.0045cf28
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x46bb3c
mov dword [esi + 4], 0x46bb2c
mov dword [esi + 8], 0x46b8f4
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 8
mov dword [esi + 0x10], 0x46b498
lea ecx, [esi + 0x24]
push 0xf
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040152b
lea ecx, [esi + 0x30]
push 0xf
mov byte [ebp - 4], 1
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040152b
lea ecx, [esi + 0x40]
mov dword [esi + 0x3c], ebx
push 0xf
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040152b
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi], 0x46bafc
mov dword [esi + 4], 0x46baec
mov dword [esi + 8], 0x46badc
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4187be
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4667ef
call fcn.0045cf28
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x46b498
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x46bb7c
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.004073ca
push dword [esi + 8]
mov ecx, ebx
call fcn.004073ca
push dword [esi + 0xc]
mov ecx, edi
call fcn.004073ca
push dword [esi + 0xc]
mov ecx, edi
call fcn.004073ca
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x4187ca
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4667ef
call fcn.0045cf28
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x46b498
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x46bb7c
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.004073ca
push dword [esi + 8]
mov ecx, ebx
call fcn.004073ca
push dword [esi + 0xc]
mov ecx, edi
call fcn.004073ca
push dword [esi + 0xc]
mov ecx, edi
call fcn.004073ca
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x41d464
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x467157
call fcn.0045cf28
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi], 0x46bcb4
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x10
mov dword [esi + 0x14], 0x46bcac
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], 1
mov byte [esi + 0x2c], al
push 0xf
mov byte [ebp - 4], 1
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
call fcn.0040152b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x423dcd
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
push 4
pop ecx
movzx esi, byte [esp + 0xc]
mov edx, eax
shr dword [esp + 0xc], 8
and edx, 0xff
xor edx, esi
shr eax, 8
mov edx, dword [edx*4 + 0x482f00]
xor eax, edx
dec ecx
jne 0x423dd5
pop esi
ret 8

Function at 0x423dfc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 8
pop edi
mov eax, dword [ebp + 0xc]
mov ecx, esi
movzx edx, al
and ecx, 0xff
push 8
xor ecx, edx
mov edx, dword [ebp + 0x10]
shr esi, 8
mov ecx, dword [ecx*4 + 0x482f00]
xor esi, ecx
pop ecx
call fcn.0045e070
dec edi
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
jne 0x423e07
mov eax, esi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x428c77
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov eax, ecx
push esi
push edi
mov edi, dword [eax]
cmp dword [ebp + 0xc], 0
je 0x428cc6
mov esi, dword [eax + 4]
test esi, esi
je 0x428cc6
mov cl, byte [edx]
inc edx
mov byte [esi + eax + 8], cl
mov ecx, dword [eax + 4]
inc ecx
and ecx, 3
dec dword [ebp + 0xc]
test ecx, ecx
mov dword [eax + 4], ecx
jne 0x428c84
and dword [ebp + 8], ecx
lea esi, [eax + 8]
movzx ebx, byte [esi]
mov ecx, dword [ebp + 8]
add dword [ebp + 8], 8
shl ebx, cl
xor edi, ebx
inc esi
cmp dword [ebp + 8], 0x20
jl 0x428caf
jmp 0x428c84
mov ecx, dword [ebp + 0xc]
shr ecx, 2
mov esi, ecx
dec ecx
test esi, esi
je 0x428cf6
inc ecx
movzx esi, byte [edx]
inc edx
xor ebx, ebx
mov bh, byte [edx]
or esi, ebx
inc edx
movzx ebx, byte [edx]
shl ebx, 0x10
or esi, ebx
inc edx
movzx ebx, byte [edx]
shl ebx, 0x18
or esi, ebx
inc edx
xor edi, esi
dec ecx
jne 0x428cd4
mov esi, dword [ebp + 0xc]
mov dword [eax], edi
and esi, 3
je 0x428d17
mov ecx, dword [eax + 4]
mov bl, byte [edx]
inc edx
mov byte [ecx + eax + 8], bl
mov ecx, dword [eax + 4]
inc ecx
and ecx, 3
dec esi
mov dword [eax + 4], ecx
jne 0x428d00
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x428e94
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push esi
xor esi, esi
mov edx, dword [eax + 4]
test edx, edx
jle 0x428eba
push edi
lea ecx, [edx*8 - 8]
movzx edi, byte [eax + esi + 8]
shl edi, cl
sub ecx, 8
xor dword [eax], edi
inc esi
cmp esi, edx
jl 0x428ea8
pop edi
pop esi
ret

Function at 0x42ed92
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x468aa3
call fcn.0045cf28
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x46bd90
lea ecx, [esi + 0xc]
mov dword [esi + 4], 0x46c07c
mov dword [esi + 8], edi
push 0xf
mov dword [ebp - 0x10], esi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.0040152b
lea ecx, [esi + 0x18]
push 0xf
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.0040152b
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], 4
mov dword [esi + 0x24], 0x46c074
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], 8
mov dword [esi + 0x38], 0x46b498
mov dword [esi], 0x46c040
mov dword [esi + 4], 0x46c030
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4357b8
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x46935c
call fcn.0045cf28
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 1
mov dword [esi], 0x46bea4
lea ecx, [esi + 0x34]
mov byte [esi + 0x20], bl
mov byte [esi + 0x30], bl
push 0xf
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.00405bcf
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x40], bl
mov byte [esi + 0x41], 3
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43b116
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x469a9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x46bf68
mov dword [esi + 4], 0x46c36c
mov dword [esi + 8], 0x46b9f4
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esp + 8], esi
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x140]
mov dword [esp + 0x14], edi
call fcn.0040c0d6
lea eax, [esi + 0x6fe8]
mov dword [esi + 0x6fd8], edi
mov dword [esi + 0x6fe0], edi
push eax
mov dword [esi + 0x6fe4], edi
call fcn.004549d0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x7010], edi
mov dword [esi + 0x6fd4], edi
mov dword [esi], 0x46c35c
mov dword [esi + 4], 0x46c34c
mov dword [esi + 8], 0x46c33c
mov dword [esi + 0x7000], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x43dd80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.0043d440
push 0x41
mov ecx, esi
call fcn.0043d440
push 0x59
mov ecx, esi
call fcn.0043d440
push 0x26
mov ecx, esi
call fcn.0043d440
push 0x53
mov ecx, esi
call fcn.0043d440
push 0x59
mov ecx, esi
call fcn.0043d440
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x43de10
test cl, cl
jbe 0x43de0c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x47fbf8]
xor eax, edi
dec ecx
jne 0x43ddf6
xor edi, edi
jmp 0x43de3f
cmp bl, cl
jne 0x43de17
inc edi
jmp 0x43de22
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x47fbf8]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x43ddce
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.0043d480
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.0043d580
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x43e050
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x170]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.0043de80
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x19c], bl
je 0x43e0cd
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x178]
shl edx, 9
lea ecx, [edx + eax + 0x8cf0]
push ecx
call fcn.004549b0
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x43e10a
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x174
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x43e0df
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
mov eax, dword [esp + 0x20]
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.0043e1e0
mov eax, dword [esi + 0x8ce0]
cmp byte [eax + 0x19c], bl
je 0x43e1d2
mov edi, dword [esi + 0x8cd8]
mov ecx, dword [eax + 0x198]
inc edi
cmp edi, ecx
jne 0x43e155
xor edi, edi
cmp dword [eax + 0x1b0], ebx
je 0x43e1ae
lea ebx, [eax + 0x140]
mov ecx, ebx
call fcn.0040cd6f
mov ecx, eax
mov ebp, edx
mov edx, dword [ebx + 0x28]
mov eax, 0xf
sub eax, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
cdq
add ecx, eax
adc ebp, edx
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebp
mov eax, dword [edx + 0x1b0]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [edi + edi*8]
shl ecx, 3
mov edx, dword [eax + 0x178]
sub ecx, edi
shl ecx, 9
lea eax, [edx + ecx + 0x8cf0]
push eax
call fcn.004548f0
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x441760
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x469eb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov edx, dword [esp + 0x3c]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 8]
push edx
lea eax, [esi + 8]
push eax
mov dword [esp + 0x18], eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0x50]
lea edi, [esi + 0x18]
push eax
mov ecx, edi
call fcn.0040cd48
mov edx, dword [esp + 0x58]
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0xc]
push edx
push eax
call dword [ecx + 0xc]
mov dword [esp + 0x2c], esi
mov byte [esp + 0x30], 1
mov ecx, edi
mov dword [esp + 0x44], 0
call fcn.0040cd6f
mov ebp, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov ebx, dword [esp + 0x58]
mov dword [esp + 0x4c], 0x40000
test ebx, ebx
je 0x44181b
mov ecx, edi
call fcn.0040cd6f
mov ecx, dword [ebx]
mov ebx, dword [esp + 0x14]
add ecx, ebx
mov ebx, dword [esp + 0x58]
mov ebx, dword [ebx + 4]
adc ebx, dword [esp + 0x18]
sub ecx, eax
sbb ebx, edx
mov dword [esp + 0x38], ebx
jne 0x44181b
cmp ecx, 0x40000
jae 0x44181b
test ecx, ecx
mov dword [esp + 0x4c], ecx
je 0x4418c4
mov eax, dword [esp + 0x4c]
mov ecx, esi
push eax
call fcn.004410a0
mov ebx, eax
test ebx, ebx
jne 0x4418ac
cmp dword [esi + 0xd54], 0xffffffff
je 0x4418c4
test ebp, ebp
je 0x4417d3
mov eax, dword [esi + 0x48]
mov ebx, dword [esi + 0x50]
sub eax, ebx
cdq
mov ecx, eax
mov ebx, edx
mov edx, dword [esi + 0x40]
mov eax, 0x20
sub eax, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
cdq
sub ecx, eax
mov eax, dword [esi + 0x58]
sbb ebx, edx
mov edx, dword [esi + 0x5c]
add ecx, eax
adc ebx, edx
mov dword [esp + 0x24], ecx
mov ecx, edi
mov dword [esp + 0x28], ebx
call fcn.0040cd6f
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
sub eax, ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
sbb edx, ebx
push eax
mov dword [esp + 0x24], edx
mov edx, dword [ebp]
push ecx
push ebp
call dword [edx + 0xc]
mov ebx, eax
test ebx, ebx
jne 0x4418fc
jmp 0x4417d3
mov ecx, edi
mov dword [esp + 0x44], 0xffffffff
call fcn.0040ce28
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x44191f
jmp 0x441912
mov ecx, edi
mov byte [esp + 0x30], 0
call fcn.0040ce28
mov edi, eax
mov eax, dword [esi + 0x2c]
test eax, eax
mov dword [esp + 0x44], 0xffffffff
je 0x4418ee
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x2c], 0
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, edi
jmp 0x44192b
mov ecx, edi
mov dword [esp + 0x44], 0xffffffff
call fcn.0040ce28
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x44191f
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x2c], 0
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, ebx
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 0x14
Function at 0x446d80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [ecx]
push ebx
mov edx, eax
push ebp
shr edx, 2
push esi
mov ebx, dword [esp + 0x20]
mov edx, dword [edx*4 + 0x482310]
push edi
mov dword [esp + 0x14], edx
mov edx, 0x800
sub edx, eax
shr edx, 2
mov eax, dword [edx*4 + 0x482310]
mov edx, dword [ecx + 4]
mov esi, edx
shr esi, 2
mov esi, dword [esi*4 + 0x482310]
add esi, eax
mov dword [esp + 0x18], esi
mov esi, 0x800
sub esi, edx
shr esi, 2
mov edx, dword [esi*4 + 0x482310]
add edx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], edx
xor esi, esi
mov dword [esp + 0x10], eax
cmp esi, dword [esp + 0x28]
jae 0x446f06
mov edx, esi
xor edi, edi
or edx, 8
cmp edx, 1
je 0x446e25
mov eax, edx
shr edx, 1
and eax, 1
lea ebp, [edx + ebx*8]
mov ebp, dword [ecx + ebp*4 + 8]
sub ebp, eax
neg eax
xor ebp, eax
shr ebp, 2
and ebp, 0x1ff
mov eax, dword [ebp*4 + 0x482310]
add edi, eax
cmp edx, 1
jne 0x446dfa
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add edi, edx
inc esi
mov dword [eax], edi
add eax, 4
cmp esi, 8
mov dword [esp + 0x10], eax
jb 0x446de4
cmp esi, 0x10
jae 0x446eac
mov eax, dword [esp + 0x2c]
lea edx, [eax + esi*4]
mov dword [esp + 0x24], edx
cmp esi, dword [esp + 0x28]
jae 0x446f06
lea edx, [esi - 8]
xor edi, edi
or edx, 8
cmp edx, 1
je 0x446e93
mov eax, edx
shr edx, 1
and eax, 1
lea ebp, [edx + ebx*8]
mov ebp, dword [ecx + ebp*4 + 0x208]
sub ebp, eax
neg eax
xor ebp, eax
shr ebp, 2
and ebp, 0x1ff
mov eax, dword [ebp*4 + 0x482310]
add edi, eax
cmp edx, 1
jne 0x446e65
mov eax, dword [esp + 0x18]
add edi, eax
mov eax, dword [esp + 0x24]
inc esi
mov dword [eax], edi
add eax, 4
cmp esi, 0x10
mov dword [esp + 0x24], eax
jb 0x446e4e
cmp esi, dword [esp + 0x28]
jae 0x446f06
mov edx, dword [esp + 0x2c]
lea ebx, [edx + esi*4]
lea edx, [esi - 0x10]
xor edi, edi
or dh, 1
cmp edx, 1
je 0x446ef1
mov eax, edx
shr edx, 1
and eax, 1
mov ebp, dword [ecx + edx*4 + 0x408]
sub ebp, eax
neg eax
xor ebp, eax
shr ebp, 2
and ebp, 0x1ff
mov eax, dword [ebp*4 + 0x482310]
add edi, eax
cmp edx, 1
jne 0x446ec6
mov eax, dword [esp + 0x1c]
add ebx, 4
add edi, eax
mov eax, dword [esp + 0x28]
mov dword [ebx - 4], edi
inc esi
cmp esi, eax
jb 0x446eb9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x44ab30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], ecx
xor edi, edi
add ecx, 0x33d14
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ecx
xor esi, esi
mov edx, 1
mov ebx, 4
mov ecx, dword [esp + 0x18]
mov eax, edi
and eax, 1
mov ecx, dword [ecx + edx*4 + 0x28f78]
mov ebp, eax
sub ecx, eax
add edx, edx
neg ebp
xor ecx, ebp
or edx, eax
shr ecx, 2
and ecx, 0x1ff
shr edi, 1
mov ebp, dword [ecx*4 + 0x482310]
add esi, ebp
dec ebx
jne 0x44ab57
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
inc edi
mov dword [eax], esi
add eax, 4
cmp edi, 0x10
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
jb 0x44ab4b
mov edx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword [edx + 0x33d54], 0
pop ebx
add esp, 0xc
ret

Function at 0x44c9d6
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
or eax, 0xffffffff
cmp dword [esp + 8], ecx
jbe 0x44ca08
push esi
mov edx, dword [esp + 8]
mov esi, eax
and esi, 0xff
movzx edx, byte [ecx + edx]
xor edx, esi
shr eax, 8
mov edx, dword [edx*4 + 0x482f00]
xor eax, edx
inc ecx
cmp ecx, dword [esp + 0xc]
jb 0x44c9e2
pop esi
not eax
ret 8
Function at 0x4547e0
Capabilities:
Create thread

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.0045e11b
mov ecx, dword [esp + 0x1c]
add esp, 0x18
xor edx, edx
test eax, eax
setne dl
push edx
mov dword [ecx], eax
call fcn.00454790
ret 0xc

Function at 0x459db0
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x18], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x1c], eax
ret
Function at 0x45a8d0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 0x20], eax
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x24], eax
ret

Function at 0x45adb0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [ecx]
push esi
push edi
mov eax, edx
movzx edi, byte [esp + 0xc]
mov esi, 0xff
and eax, esi
xor eax, edi
shr edx, 8
mov eax, dword [eax*4 + 0x482f00]
xor eax, edx
mov edx, dword [ecx + 8]
mov dword [ecx], eax
and eax, esi
add eax, dword [ecx + 4]
mov edi, edx
and edi, esi
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr edx, 8
mov eax, dword [eax*4 + 0x482f00]
pop esi
xor eax, edx
mov dword [ecx + 8], eax
ret 4