joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4261e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x509c83
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0xffffffff
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0x14], edx
mov dword [eax], 0x525164
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov edx, fcn.004cd520
mov dword [eax + 0x30], fcn.004cd5fd
mov dword [eax + 0x34], fcn.004cf7ca
mov dword [eax + 0x38], edx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], fcn.004cd5fd
mov dword [eax + 0x50], fcn.004cf7ca
mov dword [eax + 0x54], edx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], 0x2bf20
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x428500
Capabilities:
Check http status code

Disassembly:
push 0xffffffffffffffff
push 0x50e560
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
mov edi, ecx
xor ebx, ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x1c], 0x52c5b8
mov dword [esp + 0x20], ebx
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x3c], 1
call fcn.00442830
test al, al
je 0x42857e
mov ecx, dword [edi + 0x224]
mov dword [esp + 0x20], edi
cmp ecx, ebx
je 0x4285b9
mov esi, dword [ecx + 0x24]
cmp esi, ebx
jne 0x42859d
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], bl
call fcn.004424e0
jmp 0x4285c2
lea ecx, [esp + 0x14]
call fcn.004386d0
push 0x5251f0
push 0x523340
mov edx, eax
call fcn.00439ae0
add esp, 8
jmp 0x4285c2
xor eax, eax
cmp esi, ebx
jle 0x4285b9
lea edx, [ecx + 0x34]
cmp eax, 0xc8
jge 0x4285b9
cmp dword [edx], ebp
je 0x4285e3
inc eax
add edx, 0x10
cmp eax, esi
jl 0x4285a6
mov byte [esp + 0x38], bl
call fcn.00442970
lea ecx, [esp + 0x14]
call fcn.00438670
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x18
mov edx, 1
shl eax, 4
cmp dword [esp + 0x50], edx
jne 0x428608
add eax, ecx
mov ecx, dword [esp + 0x4c]
mov dword [eax + 0x3c], ecx
mov byte [eax + 0x38], dl
cmp dword [esp + 0x54], edx
jne 0x428640
mov byte [eax + 0x41], dl
jmp 0x428640
mov byte [eax + ecx + 0x38], bl
mov eax, dword [ecx + 0x18]
mov edx, dword [ecx + 0x1c]
mov ecx, dword [ecx + 0x20]
mov dword [esp + 0x28], edx
cmp eax, ebx
je 0x428640
cmp ecx, 0xfffffffe
je 0x428640
push eax
call dword [0x513454]
test eax, eax
je 0x428640
mov eax, dword [esp + 0x48]
cmp dword [eax + 4], ebx
je 0x428640
mov edi, dword [esp + 0x40]
push ebp
call fcn.00428670
push 0x13
call fcn.0043ebe0
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], bl
call fcn.004424e0
lea ecx, [esp + 0x14]
call fcn.00438670
mov al, 1
jmp 0x4285cd
Function at 0x428700
Capabilities:
Check http status code

Disassembly:
push 0xffffffffffffffff
push 0x50c6a0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
mov edi, ecx
xor ebx, ebx
cmp ebp, ebx
je 0x4287ab
mov byte [esp + 0x1c], bl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x20], 0x52c5b8
mov dword [esp + 0x24], ebx
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x38], 1
call fcn.00442830
test al, al
je 0x428785
mov esi, dword [edi + 0x224]
mov dword [esp + 0x24], edi
cmp esi, ebx
jne 0x4287af
mov byte [esp + 0x34], bl
call fcn.00442970
lea ecx, [esp + 0x18]
call fcn.00438670
xor al, al
jmp 0x428822
lea ecx, [esp + 0x18]
call fcn.004386d0
push 0x5251f0
push 0x523340
mov edx, eax
call fcn.00439ae0
add esp, 8
lea ecx, [esp + 0x18]
call fcn.00438670
xor al, al
jmp 0x428822
mov edx, dword [esi + 0x24]
cmp edx, ebx
jne 0x4287d0
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], bl
call fcn.004424e0
lea ecx, [esp + 0x18]
call fcn.00438670
xor al, al
jmp 0x428822
xor eax, eax
cmp edx, ebx
jle 0x42880e
lea ecx, [esi + 0x38]
lea esp, [esp]
cmp eax, 0xc8
jge 0x42880e
cmp dword [ecx - 4], ebp
jne 0x4287f0
cmp byte [ecx], bl
je 0x4287fa
inc eax
add ecx, 0x10
cmp eax, edx
jl 0x4287e0
jmp 0x42880e
add eax, 4
shl eax, 4
push 0x13
mov byte [eax + esi], 1
call fcn.0043ebe0
add esp, 4
mov byte [esp + 0x34], bl
call fcn.00442970
lea ecx, [esp + 0x18]
call fcn.00438670
mov al, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x42d980
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x50b7e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x164]
mov esi, dword [esp + 0x160]
mov ebx, edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
xor ebp, ebp
mov dword [esp + 0x34], ebp
cmp dword [esp + 0x40], ebp
je 0x42db6f
cmp byte [esp + 0x158], 0
lea eax, [esp + 0x48]
jne 0x42d9e1
mov eax, dword [esp + 0x44]
add eax, 4
push eax
call dword [0x5130fc]
cmp eax, 0xffffffff
je 0x42db6f
shr eax, 4
not al
and al, 1
je 0x42db6f
lea edx, [esp + 0x20]
push edx
mov edi, ebx
lea ecx, [esp + 0x40]
mov dword [esp + 0x24], ebp
call fcn.00436c20
test al, al
je 0x42db36
mov edi, dword [esp + 0x20]
cmp edi, ebp
je 0x42db36
cmp byte [esp + 0x158], 0
mov dword [esp + 0x18], ebp
lea eax, [esp + 0x48]
jne 0x42da3f
mov eax, dword [esp + 0x44]
add eax, 4
push 0x522fc8
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004cfacd
add esp, 0xc
test eax, eax
jne 0x42daa7
mov ecx, dword [esp + 0x16c]
lea ebp, [edi + ecx]
push ebp
mov ecx, esi
call fcn.00403450
mov esi, eax
test esi, esi
je 0x42daa7
push ebp
push 0
push esi
call fcn.004d4670
mov edx, dword [esp + 0x24]
add esp, 0xc
push edx
push edi
push 1
push esi
call fcn.004d16d1
add esp, 0x10
cmp edi, eax
je 0x42dac1
mov eax, dword [esp + 0x18]
push eax
call fcn.004d091b
add esp, 4
mov dword [esp + 0x18], 0
push 0x529d70
mov ecx, ebx
call fcn.00402860
lea ecx, [esp + 0x3c]
call fcn.00439450
jmp 0x42dbb1
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004d091b
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
add esp, 4
cmp byte [esp + 0x168], 0
mov dword [edx], esi
mov dword [esp + 0x18], 0
mov dword [eax], ebp
lea ecx, [esp + 0x3c]
je 0x42db1b
push 0
push 0
push ebx
call fcn.00436e60
lea ecx, [esp + 0x3c]
mov bl, al
call fcn.00439450
mov al, bl
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
call fcn.00439450
mov al, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov ecx, ebx
call fcn.004386d0
push 0x529d70
push 0x523340
mov edx, eax
call fcn.00439ae0
add esp, 8
cmp byte [esp + 0x158], 0
mov dword [esp + 0x3c], 0x52af58
jne 0x42dbb1
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x48]
cmp eax, ecx
jmp 0x42dba6
mov ecx, ebx
call fcn.004386d0
push 0x529d70
push 0x523340
mov edx, eax
call fcn.00439ae0
add esp, 8
cmp byte [esp + 0x158], 0
mov dword [esp + 0x3c], 0x52af58
jne 0x42dbb1
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x48]
cmp eax, edx
je 0x42dbb1
push eax
call fcn.004cd520
add esp, 4
xor al, al
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x42e6f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x509cf8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], 0x529da8
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004cd5fd
mov dword [eax + 0x24], fcn.004cf7ca
mov dword [eax + 0x28], fcn.004cd520
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], 0x529ea0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x430460
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x509cf8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], 0x52a0b0
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004cd5fd
mov dword [eax + 0x24], fcn.004cf7ca
mov dword [eax + 0x28], fcn.004cd520
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], 0x52a224
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x430a10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x509cf8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], 0x52a0c4
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004cd5fd
mov dword [eax + 0x24], fcn.004cf7ca
mov dword [eax + 0x28], fcn.004cd520
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], 0x52a254
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8
Function at 0x430ea0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5098e9
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push fcn.00451500
push 0x430e60
push 0xc8
push 0x10
lea eax, [esi + 0x34]
push eax
call fcn.004d1b86
push fcn.00451500
push 0x430e80
push 0x7d0
push 0xc
lea ecx, [esi + 0xcb8]
xor edi, edi
push ecx
mov dword [esp + 0x28], edi
call fcn.004d1b86
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0xcb4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x6a78], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x432d70
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x50d41d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
fld dword [0x530d3c]
sub esp, 0xc
fstp dword [esp + 8]
lea esi, [edi + 0x804]
fld dword [0x530d38]
lea eax, [esp + 0x18]
fstp dword [esp + 4]
mov dword [esp + 0x18], fcn.004cd5fd
fld dword [0x530d34]
mov dword [esp + 0x1c], fcn.004cf7ca
fstp dword [esp]
mov dword [esp + 0x20], fcn.004cd520
call fcn.00407cc0
mov dword [esp + 0x20], 0
fld dword [0x530d3c]
sub esp, 0xc
fstp dword [esp + 8]
lea esi, [edi + 0x840]
fld dword [0x530d38]
lea eax, [esp + 0x18]
fstp dword [esp + 4]
mov dword [esp + 0x18], fcn.004cd5fd
fld dword [0x530d34]
mov dword [esp + 0x1c], fcn.004cf7ca
fstp dword [esp]
mov dword [esp + 0x20], fcn.004cd520
call fcn.00407cc0
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
push ecx
mov dword [edi + 0x890], eax
mov eax, dword [esp + 0x30]
push edx
push eax
mov eax, dword [esp + 0x48]
mov ecx, edi
mov dword [edi + 0x88c], 0
call fcn.00432d00
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0x18
Function at 0x43f930
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50b353
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
fld dword [0x530d34]
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0x11
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
fstp dword [esi + 0xc]
fld dword [0x530d38]
mov ecx, esi
fstp dword [esi + 0x10]
fld dword [0x530d3c]
fstp dword [esi + 0x14]
call fcn.00441090
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x440580
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50e270
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push edi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor ebx, ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], fcn.004cd5fd
mov dword [esp + 0x28], fcn.004cf7ca
mov dword [esp + 0x2c], fcn.004cd520
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 0x1fff8
mov dword [esp + 0x20], 0x513858
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edi, [esp + 0x1c]
mov byte [esp + 0x48], 1
call fcn.00443740
test al, al
jne 0x440658
mov byte [esp + 0x40], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x440628
push eax
call fcn.004cd520
add esp, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0x5136ec
call fcn.004033d0
lea ecx, [esp + 0xc]
call fcn.00438670
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x38
ret 8
mov eax, dword [esp + 0x48]
lea edx, [esp + 0x14]
push edx
push eax
call fcn.00440ae0
mov byte [esp + 0x40], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x440688
push eax
call fcn.004cd520
add esp, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0x5136ec
call fcn.004033d0
lea ecx, [esp + 0xc]
call fcn.00438670
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x38
ret 8
Function at 0x442e80
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 4]
push ebx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00442f30
mov byte [esp + 0xb], al
mov eax, dword [esp + 0x70]
add esp, 4
lea ebx, [esp + 8]
call fcn.00447880
mov al, byte [esp + 7]
pop ebx
add esp, 0x64
ret

Function at 0x442ee0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret

Function at 0x445fc0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x50a968
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5415a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0x11
mov esi, ecx
xor ebx, ebx
xor eax, eax
push 0x52c924
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], ax
call fcn.00446920
mov eax, esi
mov dword [esp + 0x38], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x446020
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [esp + 0x18]
call fcn.00446810
push 6
push 0x52c948
call fcn.00446810
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
push ebx
mov eax, esi
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00446710
push 0x80000001
push edi
call fcn.004461a0
add esp, 0x24
cmp dword [esp + 0x28], 8
mov bl, al
jb 0x44608e
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004cf9e5
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004cd511
add esp, 0x30
ret
Function at 0x4460b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x50a968
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5415a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov word [esp + 0x14], ax
mov eax, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x446100
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.00446920
push 6
push 0x52c948
lea esi, [esp + 0x18]
mov dword [esp + 0x40], ebx
call fcn.00446810
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
push 0xffffffffffffffff
push ebx
mov eax, esi
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push eax
mov word [ecx + 4], dx
call fcn.00446710
push 0x80000000
push edi
call fcn.004461a0
add esp, 0x24
cmp dword [esp + 0x28], 8
mov bl, al
jb 0x446176
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004cf9e5
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004cd511
add esp, 0x30
ret
Function at 0x446410
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50b2d6
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x5415a0]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
push esi
push edi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0x450]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push 0x3e
xor ebx, ebx
mov word [esp + 0x30], cx
push 0x52c988
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
call fcn.00446920
mov eax, 0x52affc
mov dword [esp + 0x458], ebx
lea edx, [eax + 2]
jmp 0x446490
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x446490
sub eax, edx
sar eax, 1
push eax
push 0x52affc
lea esi, [esp + 0x30]
call fcn.00446810
push 0xb
push 0x52c8fc
call fcn.00446810
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x458], 1
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x4464d9
lea eax, [esp + 0x2c]
lea edx, [esp + 0x14]
push edx
push 1
push ebx
push eax
push 0x80000001
mov dword [esp + 0x28], ebx
call dword [0x513018]
cmp eax, ebx
jne 0x4465b7
mov eax, dword [esp + 0x14]
push 0x3fe
lea edx, [esp + 0x4a]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov word [esp + 0x50], cx
call fcn.004d4670
add esp, 0xc
push 0x52c914
lea eax, [esp + 0x1c]
push eax
lea edi, [esp + 0x2c]
lea esi, [esp + 0x4c]
mov dword [esp + 0x2c], 0x200
call fcn.00445db0
test eax, eax
jne 0x4465a8
xor ecx, ecx
cmp cx, word [esp + 0x44]
jne 0x446565
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x44655a
push eax
call dword [0x513014]
lea ecx, [esp + 0x28]
call fcn.0043bcd0
jmp 0x4465cb
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x44]
call fcn.00445fc0
test al, al
jne 0x446585
lea ecx, [esp + 0x44]
call fcn.004460b0
mov byte [esp + 0x13], al
jmp 0x44658a
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x446599
push eax
call dword [0x513014]
lea ecx, [esp + 0x28]
call fcn.0043bcd0
mov al, byte [esp + 0x13]
jmp 0x4465cd
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4465b7
push eax
call dword [0x513014]
cmp dword [esp + 0x40], 8
jb 0x4465cb
mov edx, dword [esp + 0x2c]
push edx
call fcn.004cf9e5
add esp, 4
xor al, al
mov ecx, dword [esp + 0x450]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.004cd511
mov esp, ebp
pop ebp
ret
Function at 0x448560
Capabilities:
Encode data using xor

Disassembly:
mov eax, ebx
call fcn.00448030
test eax, eax
jl 0x448798
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x4485cd
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x448590
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x448794
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x527a88]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x527a88]
and esi, 0xff
mov esi, dword [esi*4 + 0x528688]
and edi, 0xff
xor esi, dword [edi*4 + 0x528e88]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x527a88]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x529288]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x527a88]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x528a88]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x527a88]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x527a88]
and esi, 0xff
mov esi, dword [esi*4 + 0x528688]
and edi, 0xff
xor esi, dword [edi*4 + 0x528e88]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x527a88]
and edi, 0xff
xor esi, dword [edi*4 + 0x528a88]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x527a88]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x529288]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x527a88]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x527a88]
and esi, 0xff
mov esi, dword [esi*4 + 0x528688]
and edi, 0xff
xor esi, dword [edi*4 + 0x528e88]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x527a88]
and edi, 0xff
xor esi, dword [edi*4 + 0x528a88]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x527a88]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x529288]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x527a88]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x527a88]
and esi, 0xff
mov esi, dword [esi*4 + 0x528688]
and edi, 0xff
xor esi, dword [edi*4 + 0x528e88]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x527a88]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x527a88]
and edi, 0xff
xor esi, dword [edi*4 + 0x528a88]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x529288]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x4485e1
pop edi
xor eax, eax
pop esi
ret