joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453f90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x487fc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00453b40
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00453bc0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00453bc0
lea ecx, [esi + 0xc]
call fcn.00477262
lea ecx, [esi + 0x10]
call fcn.00477262
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004563f0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004563f0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004563f0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004772d7
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004772d7
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x454c38
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4881e8
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x454c48
call fcn.00455160
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x454d2b
cmp byte [edi], 0
je 0x454d2b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x454c6d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00453960
test eax, eax
jne 0x454c8d
push 0x5788f4
lea ecx, [esi + 0x38]
call fcn.00477460
jmp 0x454d2b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.004539b0
test eax, eax
jne 0x454cbc
mov ecx, esi
call fcn.00453ab0
push edi
add esi, 0x38
push 0x5788d0
push esi
call fcn.00474aaf
add esp, 0xc
jmp 0x454d2b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.004559e0
test eax, eax
je 0x454d24
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.00454e00
test eax, eax
jne 0x454d40
push edi
lea eax, [esi + 0x38]
push 0x5788ac
push eax
call fcn.00474aaf
add esp, 0xc
mov ecx, esi
call fcn.00455160
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x454de8
mov ecx, dword [0x5795c8]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.00474aaf
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00453a60
test eax, eax
jne 0x454daa
push 0x578890
lea ecx, [esi + 0x38]
call fcn.00477460
jmp 0x454dba
push 0xfa
mov ecx, esi
call fcn.004559e0
test eax, eax
jne 0x454dd7
mov ecx, esi
call fcn.00455160
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004772d7
jmp 0x454d2b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004772d7
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x457210
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4572b3
test eax, eax
jbe 0x4572b3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4572b3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45725e
xor esi, esi
jmp 0x457264
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x45728f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0045b500
add esi, eax
push esi
mov ebx, esi
call fcn.0045b500
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x457270
pop ebp
test edi, edi
pop edi
jne 0x4572b3
test ebx, ebx
je 0x4572b3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00466740
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4573f5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45750d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45750d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00478d24
mov esi, eax
test esi, esi
je 0x45750d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x45750d
mov ecx, esi
call fcn.00457360
cmp edi, eax
jge 0x45750d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x457493
mov dword [esp + 0x34], 1
jmp 0x4574ee
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x45750d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004568c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x4796c7
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4796ff
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047777e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00477756
jmp 0x47970b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47adbe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47ae00
call fcn.00480d64
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47ae00
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47adf7
xor eax, eax
jmp 0x47ae08
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047ae0e
pop edi
pop esi
pop ebx
ret 4

Function at 0x481294
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4812c2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4812e0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004811fa
jmp 0x4812e0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4812e0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004811fa
test edi, edi
mov eax, edi
jne 0x4812ca
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x25c
push ebx
push ebp
push esi
mov esi, dword [0x4db790]
push edi
push 0x4eb380
mov ebx, ecx
push 0x4eb35c
call esi
test eax, eax
jne 0x40178e
push 0x4eb348
push 0x4eb35c
call esi
test eax, eax
mov edi, eax
jne 0x401884
lea eax, [esp + 0x64]
push 0x208
push eax
mov ecx, ebx
call fcn.00401110
test eax, eax
je 0x4018ad
lea ecx, [esp + 0x64]
push 0x4eb43c
push ecx
call dword [0x4db594]
lea edx, [esp + 0x64]
push edx
call dword [0x4db598]
test eax, eax
je 0x4018ad
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x10], eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
mov dword [esp + 0x18], eax
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x3c], eax
push eax
lea eax, [esp + 0x88]
mov dword [esp + 0x44], 0x44
push eax
mov word [esp + 0x78], 5
call dword [0x4db2b4]
test eax, eax
je 0x4018ad
mov ecx, dword [esp + 0x14]
mov edi, dword [0x4db2b0]
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call edi
mov ebp, dword [0x4db2b8]
xor ebx, ebx
push 0x4eb380
push 0x4eb35c
call esi
test eax, eax
jne 0x40185f
push 0x4eb348
push 0x4eb35c
call esi
test eax, eax
mov edi, eax
jne 0x401884
push 0xc8
call ebp
inc ebx
cmp ebx, 0xa
jl 0x401843
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x25c
ret 4
push 9
push edi
call dword [0x4db63c]
push edi
call dword [0x4db638]
mov eax, dword [esp + 0x270]
push 0x168
push eax
push 0x52c
push edi
call dword [0x4db630]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x25c
ret 4
Function at 0x407e50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d5fae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004b55c0
xor edi, edi
lea ecx, [esi + 0x232c]
mov dword [esp + 0x18], edi
call fcn.004aaaf0
mov ebx, 1
lea ecx, [esi + 0x2344]
mov byte [esp + 0x18], bl
call fcn.004aaaf0
lea ecx, [esi + 0x2368]
mov byte [esp + 0x18], 2
call fcn.00499f30
lea ecx, [esi + 0x37e0]
mov byte [esp + 0x18], 3
call fcn.004cc7c0
lea ecx, [esi + 0x3ea0]
mov byte [esp + 0x18], 4
call fcn.004aaaf0
lea ecx, [esi + 0x3eb8]
mov byte [esp + 0x18], 5
call fcn.004aaaf0
lea ecx, [esi + 0x3e80]
xor eax, eax
mov dword [esi], 0x4dbbec
mov dword [esi + 0x28], 0x4dbbe4
mov dword [esi + 0x30], 0x4dbbe0
mov dword [esi + 0x3ee4], edi
mov dword [esi + 0x3ee8], edi
mov dword [esi + 0x3eec], edi
mov dword [esi + 0x3ef0], edi
mov dword [esi + 0x26c], edi
mov dword [esi + 0x3ee0], edi
mov dword [esi + 0x3ed4], ebx
mov dword [esi + 0x3ed8], edi
mov dword [ecx], eax
xor edx, edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea eax, [esi + 0x3e90]
mov ecx, 0x412
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [esi + 0x235c], edi
mov dword [esi + 0x2360], edi
xor eax, eax
lea edi, [esi + 0x2794]
mov dword [esi + 0x3e78], 4
mov dword [esi + 0x2364], ebx
mov dword [esi + 0x37dc], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
mov dword [esi + 0x3ef8], eax
mov dword [esi + 0x3ef4], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x407e67
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d5fae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004b55c0
xor edi, edi
lea ecx, [esi + 0x232c]
mov dword [esp + 0x18], edi
call fcn.004aaaf0
mov ebx, 1
lea ecx, [esi + 0x2344]
mov byte [esp + 0x18], bl
call fcn.004aaaf0
lea ecx, [esi + 0x2368]
mov byte [esp + 0x18], 2
call fcn.00499f30
lea ecx, [esi + 0x37e0]
mov byte [esp + 0x18], 3
call fcn.004cc7c0
lea ecx, [esi + 0x3ea0]
mov byte [esp + 0x18], 4
call fcn.004aaaf0
lea ecx, [esi + 0x3eb8]
mov byte [esp + 0x18], 5
call fcn.004aaaf0
lea ecx, [esi + 0x3e80]
xor eax, eax
mov dword [esi], 0x4dbbec
mov dword [esi + 0x28], 0x4dbbe4
mov dword [esi + 0x30], 0x4dbbe0
mov dword [esi + 0x3ee4], edi
mov dword [esi + 0x3ee8], edi
mov dword [esi + 0x3eec], edi
mov dword [esi + 0x3ef0], edi
mov dword [esi + 0x26c], edi
mov dword [esi + 0x3ee0], edi
mov dword [esi + 0x3ed4], ebx
mov dword [esi + 0x3ed8], edi
mov dword [ecx], eax
xor edx, edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea eax, [esi + 0x3e90]
mov ecx, 0x412
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [esi + 0x235c], edi
mov dword [esi + 0x2360], edi
xor eax, eax
lea edi, [esi + 0x2794]
mov dword [esi + 0x3e78], 4
mov dword [esi + 0x2364], ebx
mov dword [esi + 0x37dc], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
or eax, 0xffffffff
mov dword [esi + 0x3ef8], eax
mov dword [esi + 0x3ef4], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x416950
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
test esi, esi
jle 0x416980
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4ec43c]
xor eax, edx
inc ecx
dec esi
jne 0x416961
pop ebx
not eax
pop esi
ret
Function at 0x437f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
lea eax, [esp + 0xc]
push esi
lea ecx, [esp + 0x14]
push eax
xor esi, esi
push ecx
push 1
lea edx, [esp + 0x30]
push esi
push edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], 0xbcde0395
mov word [esp + 0x3c], 0xe52f
mov word [esp + 0x3e], 0x467c
mov byte [esp + 0x40], 0x8e
mov byte [esp + 0x41], 0x3d
mov byte [esp + 0x42], 0xc4
mov byte [esp + 0x43], 0x57
mov byte [esp + 0x44], 0x92
mov byte [esp + 0x45], 0x91
mov byte [esp + 0x46], 0x69
mov byte [esp + 0x47], 0x2e
mov dword [esp + 0x28], 0xa95664d2
mov word [esp + 0x2c], 0x9614
mov word [esp + 0x2e], 0x4f35
mov byte [esp + 0x30], 0xa7
mov byte [esp + 0x31], 0x46
mov byte [esp + 0x32], 0xde
mov byte [esp + 0x33], 0x8d
mov byte [esp + 0x34], 0xb6
mov byte [esp + 0x35], 0x36
mov byte [esp + 0x36], 0x17
mov byte [esp + 0x37], 0xe6
mov dword [esp + 0x48], 0xbfa971f1
mov word [esp + 0x4c], 0x4d5e
mov word [esp + 0x4e], 0x40bb
mov byte [esp + 0x50], 0x93
mov byte [esp + 0x51], 0x5e
mov byte [esp + 0x52], 0x96
mov byte [esp + 0x53], 0x70
mov byte [esp + 0x54], 0x39
mov byte [esp + 0x55], 0xbf
mov byte [esp + 0x56], 0xbe
mov byte [esp + 0x57], 0xe4
call dword [0x4dba64]
test eax, eax
jl 0x4380dd
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4380dd
lea edx, [esp + 0xc]
mov dword [esp + 0xc], esi
mov ecx, dword [eax]
push edx
push 1
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x4380d3
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x4380d3
lea edx, [esp + 8]
mov dword [esp + 8], esi
mov ecx, dword [eax]
push edx
push esi
lea edx, [esp + 0x3c]
push 1
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x4380c9
mov eax, dword [esp + 8]
cmp eax, esi
je 0x4380c9
lea edx, [esp + 4]
mov dword [esp + 4], esi
mov ecx, dword [eax]
push edx
push esi
push 0x56a9a8
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x4380bf
mov eax, dword [esp + 4]
cmp eax, esi
je 0x4380bf
mov edx, dword [esp + 0x48]
mov ecx, dword [eax]
push esi
push edx
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [esp + 4]
neg esi
mov ecx, dword [eax]
push eax
sbb esi, esi
inc esi
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, esi
pop esi
add esp, 0x40
ret
Function at 0x45bf80
Capabilities:
Hash data with md5

Disassembly:
push esi
xor eax, eax
lea esi, [ecx + 0x5c]
push 0x40
push eax
push esi
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
call fcn.0045cb00
mov byte [esi], 0x80
pop esi
ret
Function at 0x499620
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [edx]
push edi
mov edi, dword [esp + 0x14]
mov ecx, esi
xor ecx, eax
and ecx, 0xff
shr esi, 8
mov ecx, dword [edi + ecx*4]
xor ecx, esi
mov esi, dword [edx + 4]
mov dword [edx], ecx
and ecx, 0xff
add ecx, esi
mov esi, dword [edx + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov ebx, esi
mov dword [edx + 4], ecx
and ebx, 0xff
shr ecx, 0x18
xor ecx, ebx
shr esi, 8
mov ecx, dword [edi + ecx*4]
pop edi
xor ecx, esi
pop esi
mov dword [edx + 8], ecx
pop ebx
ret
Function at 0x4a1570
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x4a1592
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x4a1584
pop ebx
pop esi
ret
Function at 0x4ab890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d9858
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov ecx, dword [esp + 0x30]
lea eax, [esp]
push eax
push 0
push ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
call dword [0x4dba78]
test eax, eax
je 0x4ab8df
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esp]
test eax, eax
je 0x4aba17
push ebx
push 0x10
call fcn.004d5d5c
mov ebx, eax
test ebx, ebx
je 0x4aba0c
mov eax, dword [esp + 4]
push ebp
push esi
lea ebp, [ebx + 4]
push edi
push ebp
push eax
mov dword [ebx], 0x4dd3b4
mov dword [ebp], 0
call fcn.004d5d56
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.004ab7c0
mov esi, dword [esp + 0x40]
mov ecx, dword [0x4eb4c0]
add esp, 8
mov dword [esp + 0x40], ecx
test esi, esi
je 0x4ab98b
mov edx, esi
shr edx, 0x10
jne 0x4ab95b
and esi, 0xffff
lea ecx, [esp + 0x40]
push esi
call fcn.00407b70
jmp 0x4ab98b
push esi
call dword [0x4db2d0]
mov edi, eax
test edi, edi
je 0x4ab98b
push edi
lea ecx, [esp + 0x44]
call fcn.00407580
test eax, eax
je 0x4ab98b
lea ecx, [edi + edi]
mov edi, dword [esp + 0x40]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x40]
xor edi, edi
push ecx
mov dword [esp + 0x34], edi
call dword [0x4db538]
mov esi, eax
cmp esi, edi
je 0x4ab9ca
mov eax, dword [ebp]
lea edx, [esp + 0x18]
push edi
push edx
push esi
push eax
call fcn.004d5daa
cmp eax, edi
je 0x4ab9bb
mov dword [ebx + 8], eax
mov edi, eax
push esi
call dword [0x4db53c]
test edi, edi
jne 0x4ab9ca
mov dword [esp + 0x14], edi
mov edx, dword [ebx]
push 1
mov ecx, ebx
call dword [edx]
mov eax, dword [esp + 0x40]
mov edx, dword [str.GdiplusStartup]
pop edi
pop esi
lea ecx, [eax - 0xc]
mov dword [esp + 0x28], 0xffffffff
cmp ecx, edx
pop ebp
je 0x4aba0c
add eax, 0xfffffff4
push eax
call dword [0x4db2cc]
test eax, eax
jg 0x4aba0c
mov edx, dword [esp + 0x34]
add edx, 0xfffffff4
push edx
call fcn.004d2ea5
add esp, 4
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop ebx
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
mov ecx, dword [esp + 0x18]
sete al
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x4b32e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4d9970
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004d1900
lea ebp, [esi + 0x28]
xor edi, edi
mov ecx, ebp
mov dword [esp + 0x18], edi
call fcn.004c4470
mov dword [esi + 0x2c], 0x4dc564
mov dword [esi + 0x30], 0x64
mov eax, dword [0x4eb4c0]
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x4c]
mov byte [esp + 0x18], 3
call fcn.004bc0f0
lea ecx, [esi + 0x258]
mov byte [esp + 0x18], 4
call fcn.004aaaf0
lea ecx, [esi + 0x270]
mov byte [esp + 0x18], 5
call fcn.004aaaf0
lea ecx, [esi + 0x2b8]
mov byte [esp + 0x18], 6
call fcn.004a6f60
lea ecx, [esi + 0x98]
mov dword [ebp], 0x4dd558
mov ebp, dword [0x4db3fc]
push 0x4fe3e4
push ecx
mov dword [esi], 0x4dd540
mov dword [esi + 0x2c], 0x4dd538
mov dword [esi + 0x44], edi
mov dword [esi + 0x2b0], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
call ebp
lea edx, [esi + 0x1d8]
push 0x4fe3d4
push edx
call ebp
lea eax, [esi + 0xd8]
push 0x4fe3c4
push eax
call ebp
lea ecx, [esi + 0x118]
push str.ge_j
push ecx
call ebp
lea edx, [esi + 0x158]
push 0x4fe398
push edx
call ebp
add esp, 0x28
mov dword [esi + 0x2ac], 3
mov word [esi + 0x218], di
mov dword [esi + 0x29c], edi
mov dword [esi + 0x290], edi
mov dword [esi + 0x28c], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x298], edi
mov dword [esi + 0x294], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], 0xf2f2f2
mov dword [esi + 0x94], 0xa8a8a8
mov dword [esi + 0x2a0], 0xffffff
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x2b4], edi
mov dword [esi + 0x288], edi
mov dword [esi + 0x2a4], 5
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x2a8], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x48], edi
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4b55c0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4d9a7a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004d1900
xor edi, edi
mov dword [esi + 0x28], 0x4dc564
mov dword [esp + 0x18], edi
mov dword [esi + 0x2c], 0x64
lea ebp, [esi + 0x30]
mov byte [esp + 0x18], 1
mov ecx, ebp
call fcn.004c4470
lea ecx, [esi + 0x230]
mov byte [esp + 0x18], 2
call fcn.004aaaf0
lea ecx, [esi + 0x248]
mov byte [esp + 0x18], 3
call fcn.004aaaf0
lea ecx, [esi + 0x2310]
mov byte [esp + 0x18], 4
call fcn.004a6f60
mov dword [esi], 0x4dd568
mov dword [esi + 0x28], 0x4dd560
mov dword [ebp], 0x4dd55c
mov ebp, dword [0x4db3fc]
mov dword [esi + 0x68], edi
mov word [esi + 0x27c], di
mov word [esi + 0x12c8], di
mov dword [esi + 0x12c4], 1
mov dword [esi + 0x6c], edi
lea eax, [esi + 0x140]
mov dword [esi + 0x70], edi
push 0x4fe3e4
mov dword [esi + 0x74], edi
push eax
mov dword [esi + 0x210], edi
call ebp
lea ecx, [esi + 0x180]
push 0x4fe3d4
push ecx
call ebp
lea edx, [esi + 0x80]
push 0x4fe3c4
push edx
call ebp
lea eax, [esi + 0xc0]
push str.ge_j
push eax
call ebp
lea ecx, [esi + 0x100]
push 0x4fe398
push ecx
call ebp
mov eax, 0x10
add esp, 0x28
mov dword [esi + 0x22c], 3
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x268], edi
mov dword [esi + 0x26c], edi
mov dword [esi + 0x270], edi
mov dword [esi + 0x208], edi
mov dword [esi + 0x20c], edi
mov dword [esi + 0x200], eax
mov dword [esi + 0x218], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x274], edi
mov dword [esi + 0x278], edi
mov dword [esi + 0x21c], edi
mov dword [esi + 0x220], 0xf2f2f2
mov dword [esi + 0x7c], edi
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x78], edi
mov dword [esi + 0x228], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x214], edi
mov dword [esi + 0x260], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x224], 5
mov dword [esi + 0x264], 0x20
mov dword [esi + 0x60], 1
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4bafc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d9d03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004d1900
lea edi, [esi + 0x28]
mov dword [esp + 0x14], 0
mov ecx, edi
call fcn.004c4470
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call fcn.004aaaf0
mov ecx, dword [esp + 0xc]
mov eax, 0xd3d3d3
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
or eax, 0xffffffff
mov dword [edi], 0x4dd620
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi], 0x4dd614
mov dword [esi + 0x2c], 0x14
mov word [esi + 0x58], 0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret