joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45491d
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4cea03
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebp
mov ebp, dword [esp + 0x50]
push esi
mov esi, ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x36
jae 0x45494a
mov eax, dword [ebp + 4]
push eax
call fcn.004518e0
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret 4
push edi
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xe
lea edx, [esp + 0x1c]
push edx
push esi
call edi
cmp dword [esp + 0xc], 0xe
jne 0x454aaa
cmp word [esp + 0x10], 0x4d42
jne 0x454aaa
push 0
lea eax, [esp + 0x10]
push eax
push 0x28
lea ecx, [esp + 0x2c]
push ecx
push esi
call edi
cmp dword [esp + 0xc], 0x28
jne 0x454a94
cmp dword [esp + 0x20], 0x28
jne 0x454a94
push 0x4c
call fcn.004be8d8
add esp, 4
mov dword [esp + 0x58], eax
xor esi, esi
cmp eax, esi
mov dword [esp + 0x50], esi
je 0x4549d4
push esi
push eax
mov ecx, str.image
call fcn.00490790
mov esi, eax
lea ecx, [esp + 0x58]
call fcn.00404090
mov dword [esp + 0x50], 1
mov edx, dword [esp + 0x24]
push edx
lea eax, [esp + 0x5c]
push 0x4db72c
push eax
call fcn.004058b0
mov ecx, dword [esp + 0x64]
add esp, 0xc
push ecx
push esi
mov ecx, str.width
call fcn.00405560
mov edx, dword [esp + 0x28]
push edx
lea eax, [esp + 0x5c]
push 0x4db72c
push eax
call fcn.004058b0
mov ecx, dword [esp + 0x64]
add esp, 0xc
push ecx
push esi
mov ecx, str.height
call fcn.00405560
movzx eax, word [esp + 0x2e]
cmp eax, 4
je 0x454a55
cmp eax, 8
je 0x454a4e
cmp eax, 0x18
jne 0x454a65
push str.16.7M
jmp 0x454a5a
push 0x4e4c84
jmp 0x454a5a
push 0x4e4c78
mov ecx, str.colors
push esi
call fcn.00405560
mov ecx, dword [str.http:__www.shareaza.com_schemas_image.xsd]
push esi
mov edx, ebp
call fcn.004523e0
lea ecx, [esp + 0x58]
mov esi, eax
call fcn.00403b90
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret 4
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret 4
mov edx, dword [ebp + 4]
push edx
call fcn.004518e0
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x48
ret 4
Function at 0x455e70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x14]
push eax
mov ebx, 4
push ebx
lea ecx, [esp + 0x20]
push ecx
push esi
mov dword [ebp], 0
call edi
cmp dword [esp + 0x10], ebx
jne 0x456007
cmp dword [esp + 0x14], 0x5367674f
jne 0x456007
push 0
lea edx, [esp + 0x14]
push edx
push 1
lea eax, [esp + 0x2c]
push eax
push esi
call edi
cmp dword [esp + 0x10], 1
jne 0x456007
mov al, byte [esp + 0x20]
test al, al
jne 0x456007
push 0
lea ecx, [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0x2c]
push edx
push esi
call edi
cmp dword [esp + 0x10], 1
jne 0x456007
mov al, byte [esp + 0x24]
cmp al, 0xff
jae 0x455f0a
cmp byte [esp + 0x20], al
jne 0x456007
push 0
lea eax, [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x24]
push ecx
push esi
call edi
cmp dword [esp + 0x10], ebx
jne 0x456007
push 1
push 0
push 8
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 0x14]
push edx
push ebx
lea eax, [esp + 0x20]
push eax
push esi
call edi
cmp dword [esp + 0x10], ebx
jne 0x456007
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x28]
jne 0x456007
push 0
lea edx, [esp + 0x14]
push edx
push ebx
lea eax, [esp + 0x20]
push eax
push esi
call edi
cmp dword [esp + 0x10], ebx
jne 0x456007
push 0
lea ecx, [esp + 0x14]
push ecx
mov ebx, 1
push ebx
lea edx, [esp + 0x2c]
push edx
push esi
call edi
cmp dword [esp + 0x10], ebx
jne 0x456007
mov al, byte [esp + 0x20]
test al, al
je 0x455fcb
push 0
lea eax, [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x1b]
push ecx
push esi
call edi
cmp dword [esp + 0x10], ebx
mov al, byte [esp + 0x20]
jne 0x455fc7
movzx edx, byte [esp + 0xf]
mov ecx, dword [ebp]
add ecx, edx
dec al
mov dword [ebp], ecx
mov byte [esp + 0x20], al
jne 0x455f96
jmp 0x455fcb
test al, al
jne 0x456007
mov ecx, dword [esp + 0x2c]
cmp ecx, 0xffffffff
mov eax, dword [ebp]
jae 0x456012
cmp eax, ecx
jb 0x456007
push eax
call fcn.004be903
mov ecx, dword [ebp]
add esp, 4
push 0
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push ecx
push ebx
push esi
call edi
mov edx, dword [esp + 0x10]
cmp edx, dword [ebp]
je 0x456024
push ebx
call fcn.004be908
add esp, 4
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10
push ebx
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x18]
mov dword [ebp], ecx
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret 0x10
Function at 0x4576d0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4cea68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x1c], edi
call fcn.004be803
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov edx, dword [esp + 0x34]
push edi
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x38], edi
push edx
mov word [esp + 0x28], di
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4577c8
mov edi, edi
cmp dword [esp + 0x18], 1
jne 0x4577c8
mov eax, edi
inc edi
cmp eax, 0x1000
mov dword [esp + 0x1c], edi
jae 0x4577c8
mov ax, word [esp + 0x14]
cmp ax, 0xd
je 0x4577c8
cmp ax, 0xa
je 0x4577a7
mov eax, dword [esi - 4]
mov ebx, dword [esi - 0xc]
mov ebp, dword [esp + 0x14]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
lea edi, [ebx + 1]
sub eax, edi
or eax, ecx
jge 0x457785
push edi
lea ecx, [esp + 0x14]
call fcn.00403c80
mov esi, dword [esp + 0x10]
test edi, edi
mov word [esi + ebx*2], bp
jl 0x457825
cmp edi, dword [esi - 8]
jg 0x457825
mov dword [esi - 0xc], edi
mov word [esi + edi*2], 0
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 1
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x457730
lea ebx, [esp + 0x10]
call fcn.004035a0
call fcn.00403520
mov esi, dword [esp + 0x10]
add esi, 0xfffffff0
push esi
call fcn.00403fa0
mov edi, dword [esp + 0x34]
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45780e
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
push 0x80070057
call fcn.00403b70
int3
Function at 0x457830
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4cdda0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [esp + 0x1c], ebx
call fcn.004be803
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
push ebx
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebx
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push ecx
push esi
mov word [esp + 0x28], bx
xor edi, edi
call ebp
test eax, eax
je 0x457939
jmp 0x4578a0
mov edi, dword [esp + 0x1c]
jmp 0x4578a0
cmp dword [esp + 0x18], 1
jne 0x457939
mov edx, edi
inc edi
cmp edx, 0x1000
mov dword [esp + 0x1c], edi
jae 0x457939
push 1
push ebx
push 0xfffffffffffffffe
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x457939
mov ax, word [esp + 0x14]
cmp ax, 0xd
je 0x457939
cmp ax, 0xa
je 0x457921
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
lea edi, [esp + 0x24]
call fcn.00458620
add esp, 4
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.00403e70
mov byte [esp + 0x2c], bl
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x457921
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push ebx
lea eax, [esp + 0x1c]
push eax
push 1
lea ecx, [esp + 0x20]
push ecx
push esi
call ebp
test eax, eax
jne 0x457892
lea ebx, [esp + 0x10]
call fcn.004035a0
call fcn.00403520
mov esi, dword [esp + 0x10]
add esi, 0xfffffff0
push esi
call fcn.00403fa0
mov edi, dword [esp + 0x38]
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov dword [esp + 0x2c], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x45797f
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x45d2e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4cf038
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
mov eax, dword [eax + 0xc]
push esi
sub eax, 0x10
push edi
push eax
call fcn.00403fa0
add eax, 0x10
add esp, 4
mov dword [esp + 0x1c], eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x10], 0
call fcn.00403410
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push esi
add ecx, 0x30
call fcn.004bded0
lea eax, [esi - 0x10]
mov dword [esp + 0x10], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45d355
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 8
Function at 0x45e310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d2748
push eax
mov dword fs:[0], esp
sub esp, 0x10
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x50]
test ecx, ecx
jne 0x45e34f
mov ecx, dword [eax + 0x38]
test ecx, ecx
jne 0x45e34f
mov ecx, dword [eax + 0x70]
test ecx, ecx
jne 0x45e34f
mov ecx, dword [eax + 0x84]
test ecx, ecx
je 0x45e387
push 0
push 0x5746dc
lea ecx, [esp + 0x10]
call fcn.004a2dfe
push 0x32
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
call fcn.004a2d8f
test eax, eax
jne 0x45e39b
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004a2da4
xor eax, eax
pop edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
push ebx
push ebp
mov dword [edi + 0x30], 0
mov ebp, dword [0x51174c]
test ebp, ebp
push esi
mov dword [esp + 0x10], 0
je 0x45e4a8
jmp 0x45e3c0
test ebp, ebp
mov eax, ebp
je 0x45e4f7
mov ebx, dword [eax + 8]
mov eax, dword [ebx]
mov ebp, dword [ebp]
mov ecx, ebx
call dword [eax + 0x60]
test eax, eax
je 0x45e49c
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x50]
test ecx, ecx
je 0x45e401
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x45e401
lea esi, [eax + 0x58]
mov ecx, 6
lea edi, [ebx + 0x40]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x45e46a
mov ecx, dword [eax + 0x38]
test ecx, ecx
je 0x45e420
mov ecx, dword [ebx + 0x20]
test ecx, ecx
je 0x45e420
lea esi, [eax + 0x3c]
mov ecx, 5
lea edi, [ebx + 0x24]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x45e46a
mov ecx, dword [eax + 0x70]
test ecx, ecx
je 0x45e43f
mov ecx, dword [ebx + 0x74]
test ecx, ecx
je 0x45e43f
lea esi, [eax + 0x74]
mov ecx, 4
lea edi, [ebx + 0x78]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x45e46a
mov ecx, dword [eax + 0x84]
test ecx, ecx
je 0x45e49c
mov ecx, dword [ebx + 0x8c]
test ecx, ecx
je 0x45e49c
lea esi, [eax + 0x88]
mov ecx, 5
lea edi, [ebx + 0x90]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x45e49c
mov eax, dword [ebx + 0x8c]
test eax, eax
jne 0x45e47f
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x54]
test eax, eax
je 0x45e49c
mov esi, dword [esp + 0x30]
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x45e490
push esi
call fcn.0045e9c0
push esi
mov ecx, ebx
call fcn.0045e500
inc dword [esp + 0x10]
test ebp, ebp
mov edi, dword [esp + 0x30]
jne 0x45e3c0
mov ebx, dword [edi + 0x30]
test ebx, ebx
je 0x45e4cd
push 0
call fcn.00415fa0
push 0
call fcn.00415fa0
push 0x10
lea eax, [edi + 0x18]
push eax
call fcn.00405b60
call fcn.0045f3d0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.004a2da4
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
call fcn.004bcac3
int3
Function at 0x45ef40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4cea68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
call fcn.004be803
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x30]
mov dword [esp + 0x28], ebp
mov eax, dword [esi + 0x40]
neg eax
sbb eax, eax
cmp eax, ebp
mov dword [esp + 0x18], eax
je 0x45f088
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esi + 0x34]
call fcn.004be0d6
push str.__xml_version_1.0____r_n
call fcn.004ac8fd
add esp, 4
push eax
push str.__xml_version_1.0____r_n
lea ecx, [esp + 0x18]
call fcn.00409df0
mov ecx, dword [esp + 0x14]
push 1
lea eax, [esp + 0x14]
push eax
call fcn.00490c80
mov ecx, dword [esp + 0x14]
mov edi, dword [ecx + 0x18]
cmp edi, ebp
je 0x45f074
cmp edi, ebp
mov eax, edi
je 0x45f0e6
mov ebx, dword [eax + 8]
mov edi, dword [edi]
push str.index
push ebx
call fcn.00401270
mov esi, eax
cmp esi, ebp
je 0x45f042
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x45f038
mov ecx, dword [esi + 4]
cmp ecx, 1
jne 0x45f02c
lea ebp, [eax + 0x14]
push 0
push esi
mov ecx, ebp
call fcn.004bcf1a
test eax, eax
je 0x45f038
push eax
mov ecx, ebp
call fcn.004bceda
jmp 0x45f038
cmp ecx, 2
jne 0x45f038
push esi
push eax
call fcn.0045d2e0
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
xor ebp, ebp
mov esi, dword [ebx + 8]
cmp esi, ebp
je 0x45f061
push ebp
add esi, 0x14
push ebx
mov ecx, esi
call fcn.004bcf1a
cmp eax, ebp
je 0x45f061
push eax
mov ecx, esi
call fcn.004bceda
cmp edi, ebp
mov dword [ebx + 8], ebp
jne 0x45efe2
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x30]
cmp ecx, ebp
je 0x45f07e
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esp + 0x18], ebp
jne 0x45ef90
lea ecx, [esi + 0x34]
call fcn.004bdfb9
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
push eax
call fcn.00403fa0
mov esi, dword [esp + 0x38]
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45f0cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
call fcn.004bcac3
int3
Function at 0x45f8e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4cda06
push eax
mov dword fs:[0], esp
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
push edi
push 0xa
lea ecx, [esi + 0x48]
mov dword [esi], 0x4e5fb8
call fcn.004be150
xor edi, edi
cmp ebp, edi
mov dword [esp + 0x18], edi
mov ebx, 1
je 0x45f924
mov eax, ebp
jmp 0x45f948
push 0xf0
call fcn.004be8d8
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, edi
mov byte [esp + 0x18], bl
je 0x45f946
push ebx
push eax
call fcn.0046cf00
jmp 0x45f948
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 8], eax
pop edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x461050
Capabilities:
Check for time delay via gettickcount
Send data
Send data on socket

Disassembly:
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x504]
xor ebp, ebp
cmp eax, ebp
jne 0x461067
pop esi
pop ebp
jmp fcn.004137a0
mov ecx, dword [esi + 0x514]
xor eax, eax
cmp ecx, ebp
sete al
push edi
mov edi, eax
cmp edi, ebp
je 0x46108b
push 0x38
call fcn.004be8d8
add esp, 4
mov dword [esi + 0x514], eax
cmp edi, ebp
push ebx
mov ebx, dword [esi + 0x514]
je 0x4610ee
push 0x38
push ebp
push 8
xor eax, eax
mov ecx, 0xe
mov edi, ebx
rep stosd dword es:[edi], eax
push 8
push 6
mov eax, 0x4db050
mov ecx, 0xf
mov edx, ebx
call fcn.004951d0
test eax, eax
je 0x4610ee
push ebx
call fcn.004be908
mov ecx, dword [esi + 0x504]
add esp, 4
cmp ecx, ebp
je 0x4610d8
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esi + 0x504], ebp
mov dword [esi + 0x514], ebp
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
mov eax, dword [esi + 0x2c]
cmp dword [eax + 0xc], ebp
je 0x461105
mov ecx, esi
call fcn.004137a0
mov ecx, dword [esi + 0x2c]
cmp dword [ecx + 0xc], ebp
jne 0x4610e4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x51c]
mov ebp, eax
mov edx, ebp
sub edx, ecx
cmp edx, 0xc8
jb 0x461130
mov dword [esi + 0x518], 1
lea esp, [esp]
mov eax, dword [esi + 0x504]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x461147
mov ecx, dword [esi + 0x2c]
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x46114e
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x4610e4
mov edi, dword [esi + 0x2c]
mov eax, dword [edi + 0xc]
mov edx, dword [edi + 0x10]
sub edx, eax
cmp edx, 0x400
jae 0x46117e
add eax, 0x7ff
and eax, 0xfffffc00
push eax
mov dword [edi + 0x10], eax
mov eax, dword [edi + 8]
push eax
call fcn.004ac40b
add esp, 8
mov dword [edi + 8], eax
mov ecx, dword [esi + 0x504]
mov edx, dword [ecx + 8]
mov dword [ebx], edx
mov eax, dword [esi + 0x504]
mov ecx, dword [eax + 0xc]
mov dword [ebx + 4], ecx
mov eax, dword [esi + 0x2c]
mov edx, dword [eax + 0xc]
add edx, dword [eax + 8]
mov dword [ebx + 0xc], edx
mov eax, dword [esi + 0x2c]
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
sub ecx, edx
mov dword [ebx + 0x10], ecx
mov edx, dword [esi + 0x518]
neg edx
sbb edx, edx
and edx, 2
push edx
push ebx
call fcn.00495520
mov ecx, dword [esi + 0x504]
mov edx, dword [ebx + 4]
mov eax, dword [ecx + 0xc]
mov edi, dword [esi + 0x50c]
sub eax, edx
add edi, eax
mov dword [esi + 0x50c], edi
mov edx, dword [ebx + 4]
mov eax, dword [ecx + 0xc]
sub eax, edx
mov edx, dword [ecx + 0xc]
cmp eax, edx
ja 0x461208
test eax, eax
je 0x461208
sub edx, eax
mov dword [ecx + 0xc], edx
mov ecx, dword [ecx + 8]
push edx
lea edx, [ecx + eax]
push edx
push ecx
call fcn.004ac5c0
add esp, 0xc
mov ecx, dword [esi + 0x2c]
mov eax, dword [ecx + 0x10]
mov edi, dword [ecx + 0xc]
mov edx, dword [ebx + 0x10]
sub eax, edi
sub eax, edx
je 0x461233
mov edx, edi
add edx, eax
mov dword [ecx + 0xc], edx
mov ecx, esi
mov dword [esi + 0x51c], ebp
call fcn.004137a0
jmp 0x461130
mov eax, dword [esi + 0x518]
test eax, eax
je 0x461247
mov dword [esi + 0x518], 0
mov ecx, esi
call fcn.004137a0
jmp 0x461130
Function at 0x463a50
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
mov eax, dword [0x504530]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x40]
mov dword [esp + 0x28], eax
call ebx
mov edx, dword [edi + 0x20]
mov ecx, dword [0x534254]
sub eax, edx
cmp eax, ecx
jb 0x463af1
push ebp
call fcn.00466880
call ebx
push 0x513e08
lea ebx, [esp + 0x20]
mov ebp, eax
call fcn.00464e50
mov eax, dword [esi + 0x10]
neg eax
sbb eax, eax
mov dword [esp + 0x10], eax
je 0x463af0
lea edi, [esi + 4]
mov ebx, 1
jmp 0x463ab0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, edi
call fcn.004be0d6
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x488], ebx
jne 0x463ae8
mov eax, dword [esi + 0x4c0]
test eax, eax
je 0x463ae8
lea eax, [esp + 0x1c]
push eax
mov eax, ebp
call fcn.00441e20
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x463ab0
pop ebp
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
call fcn.004ae38e
add esp, 0x20
ret
Function at 0x468920
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor ebx, ebx
xor esi, esi
test ebp, ebp
push edi
lea edi, [ecx + eax*2]
jle 0x468959
movzx edx, word [edi]
push edx
call fcn.004adfb4
and eax, 0xff
lea ecx, [esi*8]
shl eax, cl
add esp, 4
inc esi
and esi, 3
xor ebx, eax
add edi, 2
dec ebp
jne 0x468933
push 0x4f1bbcdc
push 0
push 0
push ebx
call fcn.004af3f0
mov esi, dword [esp + 0x18]
pop edi
mov ecx, 0x40
sub ecx, esi
pop esi
pop ebp
pop ebx
jmp fcn.004bc980
Function at 0x46cf00
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4cd90b
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov dword [esi], 0x4e78b0
call fcn.004be803
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0x20]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x14], edi
je 0x46cf4f
lea ebx, [esi + 8]
push 0x513e08
call fcn.00464e50
mov ecx, dword [esp + 0xc]
or eax, 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov eax, 1
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc0], eax
mov eax, dword [0x534200]
mov dword [esi + 0xc8], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xc4], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 8