joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ac5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x423fd0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402b59
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402b16
cmp dword [ebp + 0x10], ebx
jne 0x402b4d
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402ac5
test eax, eax
jne 0x402b28
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405dda
cmp eax, ebx
je 0x402b60
push ebx
push dword [0x423fd0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402b59
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x423fd0], ebx
jne 0x402b56
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402b56
jmp 0x402b59
Function at 0x40309c
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x4170d4]
mov edi, eax
sub esi, dword [0x40b004]
add edi, 0x1f4
add esi, dword [esp + 0x1c]
cmp esi, ebp
jle 0x403272
push dword [0x41f0e4]
call fcn.004032af
push ebp
push ebp
push dword [0x40b004]
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41f0e0], esi
mov dword [0x4170d0], ebp
mov eax, dword [0x4170d8]
mov ebx, 0x4000
sub eax, dword [0x41f0e4]
cmp eax, ebx
jg 0x40310f
mov ebx, eax
mov esi, 0x413090
push ebx
push esi
call fcn.0040327d
test eax, eax
je 0x40323d
add dword [0x41f0e4], ebx
mov dword [0x40b020], esi
mov dword [0x40b024], ebx
cmp dword [0x423f28], ebp
je 0x4031a0
cmp dword [0x423fc0], ebp
jne 0x4031a0
cmp dword [esp + 0x10], ebp
je 0x40316d
mov eax, dword [0x41f0e0]
push ebp
sub eax, dword [0x4170d4]
sub eax, dword [esp + 0x20]
add eax, dword [0x40b004]
mov dword [0x4170d0], eax
call fcn.00405e13
jmp 0x4031a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jbe 0x4031a0
mov eax, dword [0x423f24]
neg eax
sbb eax, eax
not eax
and eax, str.unpacking_data:__d__
push eax
push 0x402bca
push ebp
push 0x6f
push dword [0x423f20]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
mov ecx, 0x40b008
mov dword [0x40b028], 0x40b090
mov dword [0x40b02c], 0x8000
call fcn.00405ed4
test eax, eax
jl 0x403246
mov esi, dword [0x40b028]
mov eax, 0x40b090
sub esi, eax
je 0x403207
lea ecx, [esp + 0x14]
push ebp
push ecx
push esi
push eax
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403242
cmp esi, dword [esp + 0x14]
jne 0x403242
add dword [0x40b004], esi
cmp dword [0x40b024], ebp
jne 0x403135
jmp 0x403213
cmp dword [0x40b024], ebp
jne 0x403246
cmp ebx, ebp
je 0x403246
mov eax, dword [0x4170d4]
mov ecx, eax
sub ecx, dword [0x40b004]
add ecx, dword [esp + 0x1c]
test ecx, ecx
jg 0x4030f9
push ebp
push ebp
push eax
push dword [0x409024]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40324b
or eax, 0xffffffff
jmp 0x403274
push 0xfffffffffffffffe
jmp 0x403248
push 0xfffffffffffffffd
pop eax
jmp 0x403274
mov esi, dword [esp + 0x10]
cmp esi, ebp
je 0x403272
mov eax, dword [0x41f0e0]
push ebp
push ebp
push 0x113
push esi
mov dword [0x4170d0], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
Function at 0x405361
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x422538], 0x44
push eax
xor eax, eax
push 0x422538
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40539c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405426
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.004056c8
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x40545c
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423fa8], eax
jmp 0x4055e1
mov dword [ebp + 8], ecx
push edi
and dword [ebp + 8], 1
je 0x405477
test eax, eax
je 0x40558c
test cl, 2
je 0x40558c
mov esi, 0x421538
push ebx
push esi
call fcn.00405af4
cmp dword [ebp + 8], 0
je 0x405496
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x40549c
push ebx
call fcn.0040562e
push 0x409010
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405582
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405612
cmp byte [eax], 0
je 0x4054ed
cmp byte [ebp - 0x18], 0
je 0x4054ed
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405503
mov al, byte [esi + 1]
test al, al
je 0x405561
cmp al, 0x2e
jne 0x405503
cmp byte [esi + 2], 0
je 0x405561
push esi
push edi
call fcn.00405af4
test byte [ebp - 0x148], 0x10
je 0x405528
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405561
push dword [ebp + 0xc]
push ebx
call fcn.00405426
jmp 0x405561
push ebx
call fcn.004057ac
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405559
test byte [ebp + 0xc], 4
je 0x405551
push ebx
push 0xfffffffffffffff1
call fcn.00404e9f
push 0
push ebx
call fcn.00405842
jmp 0x405561
inc dword [0x423fa8]
jmp 0x405561
push ebx
push 0xfffffffffffffff2
call fcn.00404e9f
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4054cb
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40558c
and byte [edi - 1], 0
xor esi, esi
pop edi
cmp dword [ebp + 8], esi
je 0x4055e1
cmp dword [ebp - 8], esi
jne 0x4055a1
inc dword [0x423fa8]
jmp 0x4055e1
push ebx
call fcn.00405d9c
test eax, eax
je 0x4055e1
push ebx
call fcn.004055e7
push ebx
call fcn.004057ac
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4055d9
test byte [ebp + 0xc], 4
je 0x405599
push ebx
push 0xfffffffffffffff1
call fcn.00404e9f
push esi
push ebx
call fcn.00405842
jmp 0x4055e1
push ebx
push 0xffffffffffffffe5
call fcn.00404e9f
pop esi
pop ebx
leave
ret 8
Function at 0x4056c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421938
push esi
call fcn.00405af4
push esi
call fcn.0040567b
mov edi, eax
test edi, edi
jne 0x4056e9
xor eax, eax
jmp 0x40573b
push edi
call fcn.00405d03
test byte [0x423f30], 0x80
je 0x405702
mov al, byte [edi]
test al, al
je 0x4056e5
cmp al, 0x5c
je 0x4056e5
sub edi, esi
jmp 0x40571a
call fcn.00405d9c
test eax, eax
je 0x405714
test byte [eax], 0x10
je 0x4056e5
push esi
call fcn.0040562e
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405706
call fcn.004055e7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4057ac
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4057c8
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x4057cb
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4057fa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40583e
test edi, edi
jne 0x405805
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405838
Function at 0x405842
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405dda
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405866
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x40599f
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x4226c0], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x4226c0
je 0x4058aa
push 1
push 0
push esi
call fcn.004057cb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4059a5
cmp eax, edi
jg 0x4059a5
mov esi, 0x422138
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4059a5
cmp eax, edi
jg 0x4059a5
push esi
push ebp
push str._s_s_r_n
push 0x421d38
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x423f28]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405b16
push 4
push 0xc0000000
push esi
call fcn.004057cb
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x40599f
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405998
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405998
cmp edi, dword [esp + 0x18]
jne 0x405998
push str._Rename__r_n
push esi
call fcn.00405740
test eax, eax
jne 0x4059ac
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405af4
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x421d38
push eax
call fcn.0040578c
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x423fb0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x4093a0
push eax
call fcn.00405740
test eax, eax
je 0x405963
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x4059d3
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x4059c8
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405965
Function at 0x4059db
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405a4c
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405a3b
cmp dword [ebp + 0x14], 1
je 0x405a3d
cmp dword [ebp + 0x14], 2
je 0x405a3d
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405b16
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jge 0x405b37
mov ecx, dword [0x4236fc]
lea eax, [edi*4 + 4]
sub ecx, eax
mov edi, dword [ecx]
mov eax, dword [0x423f58]
mov ecx, dword [ebp + 8]
add edi, eax
mov eax, 0x422ec0
sub ecx, eax
mov ebx, eax
cmp ecx, 0x800
jae 0x405cdd
mov ebx, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405cdd
mov edx, ebx
sub edx, eax
cmp edx, 0x400
jge 0x405cea
inc edi
cmp cl, 0xfc
jbe 0x405cd0
movsx eax, byte [edi + 1]
movsx ecx, byte [edi]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
or ecx, edx
or eax, edx
inc edi
mov dword [ebp - 0x10], ecx
inc edi
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 8], eax
jne 0x405c7b
cmp dword [0x423fa4], 0
push 2
pop esi
je 0x405bc2
push 4
pop esi
mov eax, dword [ebp - 0x14]
test al, al
jns 0x405bf9
mov ecx, eax
and eax, 0x3f
add eax, dword [0x423f58]
and ecx, 0x40
push ecx
push ebx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004059db
cmp byte [ebx], 0
jne 0x405c62
push dword [ebp - 0xc]
push ebx
call fcn.00405b16
jmp 0x405c5d
cmp eax, 0x25
jne 0x405c0c
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405c5d
cmp eax, 0x24
jne 0x405c59
push 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor esi, esi
jmp 0x405c59
lea eax, [ebp - 4]
dec esi
push eax
push dword [ebp + esi*4 - 0x14]
push dword [0x423f24]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405c56
push ebx
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp + 0xc], 0
jne 0x405c5d
and byte [ebx], 0
test esi, esi
jne 0x405c21
cmp byte [ebx], 0
je 0x405c73
cmp dword [ebp - 0xc], 0x1a
jne 0x405c73
push str.MicrosoftInternet_ExplorerQuick_Launch
push ebx
call sub.KERNEL32.dll_lstrcatA
push ebx
call fcn.00405d03
jmp 0x405cc1
cmp byte [ebp + 0xf], 0xfd
jne 0x405caf
cmp esi, 0x1d
jne 0x405c94
push dword [0x423f24]
push ebx
call fcn.00405a52
jmp 0x405ca5
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push ebx
call fcn.00405af4
add esi, 0xffffffeb
cmp esi, 7
jae 0x405cc1
jmp 0x405c73
cmp byte [ebp + 0xf], 0xff
jne 0x405cc1
or eax, 0xffffffff
sub eax, esi
push eax
push ebx
call fcn.00405b16
push ebx
call sub.KERNEL32.dll_lstrlenA
add ebx, eax
mov eax, 0x422ec0
jmp 0x405cdd
jne 0x405cda
mov cl, byte [edi]
mov byte [ebx], cl
inc ebx
inc edi
jmp 0x405cdd
mov byte [ebx], cl
inc ebx
mov cl, byte [edi]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405b62
and byte [ebx], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405cff
push eax
push dword [ebp + 8]
call fcn.00405af4
leave
ret 8
Function at 0x405e46
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422ac4], 0
push esi
jne 0x405e7d
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405e57
mov dword [ecx*4 + 0x422ac0], eax
inc ecx
cmp ecx, 0x100
jl 0x405e52
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405eae
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422ac0]
xor eax, esi
inc ecx
dec edx
jne 0x405e90
pop edi
not eax
pop esi
ret 0xc
Function at 0x458e14
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4ebd90
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x458e36
shr eax, 1
xor eax, 0xedb88320
jmp 0x458e38
shr eax, 1
dec edx
jne 0x458e24
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x458e1d
mov byte [0x4ec190], 1
pop esi
pop ebx
ret

Function at 0x458e54
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4ec190], 0
jne 0x458e6b
call fcn.00458e14
mov eax, edi
dec eax
test eax, eax
jl 0x458e94
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4ebd90]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x458e75
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x45b4c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x45b4f5
dec al
je 0x45b531
dec al
je 0x45b575
dec al
je 0x45b5e0
jmp 0x45b66a
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x45b66a
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x45b505
jmp 0x45b66a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x45b66a
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x45b541
jmp 0x45b66a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x45b66a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x45b5a3
xor ebp, ebp
jmp 0x45b5b4
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x45b5bd
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x45b585
jmp 0x45b66a
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x45b66a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x45b638
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00458e9c
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x45b5f4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46ad14
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x46ad1c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4d5dee
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4d5e04
mov eax, esi
call fcn.00468ba0
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call 0x399370
lea ecx, [ebp - 0x10]
mov edx, 0x4d5e18
mov eax, esi
call fcn.00468ba0
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call 0x399370
lea ecx, [ebp - 0x14]
mov edx, 0x4d5e30
mov eax, esi
call fcn.00468ba0
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call 0x399370
lea ecx, [ebp - 0x18]
mov edx, 0x4d5e4c
mov eax, esi
call fcn.00468ba0
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call 0x399370
lea ecx, [ebp - 0x1c]
mov edx, 0x4d5e68
mov eax, esi
call fcn.00468ba0
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call 0x399370
lea ecx, [ebp - 0x24]
mov edx, 0x4d5e80
mov eax, esi
call fcn.00468ba0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call 0x39d850
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call 0x39dc30
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4d5e98
mov eax, esi
call fcn.00468ba0
mov eax, dword [ebp - 0x28]
call fcn.004625ec
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4d5ea8
mov eax, esi
call fcn.00468ba0
mov eax, dword [ebp - 0x2c]
call fcn.004625ec
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4d5ec0
mov eax, esi
call fcn.00468ba0
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call 0x39dc30
inc eax
je 0x46aeb1
lea ecx, [ebp - 0x34]
mov edx, 0x4d5ec0
mov eax, esi
call fcn.00468ba0
mov eax, dword [ebp - 0x34]
call 0x39dbf4
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call 0x39f488
fstp qword [ebp - 0x3c]
wait
call 0x39f7ec
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x46aecc
lea ecx, [ebp - 0x40]
mov edx, 0x4d5ec0
mov eax, esi
call fcn.00468ba0
mov eax, dword [ebp - 0x40]
call fcn.004625ec
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4d5ed0
mov eax, esi
call fcn.00468ba0
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call 0x399370
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5df5
lea eax, [ebp - 0x44]
mov edx, 2
call 0x399340
lea eax, [ebp - 0x34]
mov edx, 0xb
call 0x399340
ret
Function at 0x471de0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4dcd1a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00471dd0
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00461258
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00460e58
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dcd21
lea eax, [ebp - 4]
call 0x39931c
ret

Function at 0x49ffbc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c328
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x60d670]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp + 8]
lea ecx, [esi + 0x30]
push eax
mov dword [ebp - 4], 0
call fcn.004986cc
mov edx, dword [esi + 0x34]
push 0
lea ecx, [esi + 8]
push ecx
push edx
call dword [0x5a7938]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a002a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4ac3ec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x592258
mov eax, dword fs:[0]
push eax
mov eax, dword [0x60d670]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
add ecx, 0x30
push eax
mov dword [ebp - 4], 0
call fcn.004986cc
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ac447
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4