joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401bb0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402930
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402930
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401c10
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x45044c]
test esi, esi
jle 0x401d30
mov eax, dword [0x450450]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401c44
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401cc7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401c30
mov dword [esp], ebx
call fcn.00402610
mov edi, eax
test eax, eax
je 0x401d57
mov eax, dword [0x450450]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402750
mov edx, dword [0x450450]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401d37
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401cc0
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x401cd0
add dword [0x45044c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x450450]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401cc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401bb0
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x401c4e
mov eax, dword [0x450450]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401bb0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401bb0
lea esi, cs:[esi]
nop
Function at 0x402280
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x450468
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x450460]
sub esp, 4
test ebx, ebx
je 0x4022d5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x4022ce
test eax, eax
jne 0x4022ce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4022b0
mov dword [esp], 0x450468
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402610
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402635
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402640
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402635
push esi
push ebx
mov ebx, dword [esp + 0xc]
movzx eax, word [ecx + 0x400014]
movzx esi, word [ecx + 0x400006]
sub ebx, 0x400000
lea eax, [edx + eax + 0x18]
test si, si
je 0x402688
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40267e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40268a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x402670
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40c3e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0xc
cmp eax, 8
mov dword [ebp - 0x10], ecx
mov ebx, 2
jg 0x40c468
lea ecx, [ebx*4]
cmp ecx, esi
je 0x40c4cb
xor eax, eax
cmp eax, ebx
jge 0x40c460
mov edx, edi
nop
nop
nop
nop
nop
nop
nop
movaps xmm0, xmmword [edx]
add eax, 8
movaps xmm1, xmmword [edx + 0x10]
movaps xmm3, xmmword [edx + ebx*4]
movaps xmm2, xmmword [edx + ebx*4 + 0x10]
movaps xmm5, xmm0
movaps xmm4, xmm1
addps xmm5, xmm3
subps xmm0, xmm3
addps xmm4, xmm2
movaps xmmword [edx], xmm5
subps xmm1, xmm2
movaps xmmword [edx + 0x10], xmm4
movaps xmmword [edx + ebx*4], xmm0
movaps xmmword [edx + ebx*4 + 0x10], xmm1
add edx, 0x20
cmp eax, ebx
jl 0x40c424
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0040b894
cmp esi, 0x20
mov ebx, 8
jle 0x40c402
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, edi
mov dword [esp], edx
mov edx, ebx
shl ebx, 2
call fcn.0040bb34
lea eax, [ebx*4]
cmp eax, esi
jge 0x40c402
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, edi
mov dword [esp], edx
mov edx, ebx
shl ebx, 2
call fcn.0040bb34
lea eax, [ebx*4]
cmp eax, esi
jl 0x40c484
jmp 0x40c402
xor ecx, ecx
cmp ecx, ebx
jge 0x40c460
mov eax, edi
lea edx, [ebx + ebx*2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movaps xmm0, xmmword [eax + ebx*8]
add ecx, 4
movaps xmm6, xmmword [edi + edx*4]
movaps xmm2, xmmword [eax]
movaps xmm7, xmmword [eax + ebx*4]
movaps xmm4, xmm0
subps xmm0, xmm6
shufps xmm0, xmm0, 0xb1
movaps xmm3, xmm2
addps xmm3, xmm7
xorps xmm0, xmmword [0x7d5360]
subps xmm2, xmm7
addps xmm4, xmm6
movaps xmm5, xmm3
movaps xmm1, xmm2
addps xmm5, xmm4
movaps xmmword [eax], xmm5
subps xmm3, xmm4
addps xmm1, xmm0
movaps xmmword [eax + ebx*8], xmm3
subps xmm2, xmm0
movaps xmmword [eax + ebx*4], xmm1
add eax, 0x10
movaps xmmword [edi + edx*4], xmm2
add edx, 4
cmp ecx, ebx
jl 0x40c4e4
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40d5f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040ced4
Function at 0x47e984
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
and edx, 0xffffffff
mov ecx, 1
mov dword [eax + 8], edx
lea edx, [eax + 8]
mov ebx, dword [edx]
mov esi, ebx
shr esi, 0x1e
xor esi, ebx
imul ebx, esi, 0x6c078965
add ebx, ecx
mov dword [edx + 4], ebx
and dword [edx + 4], 0xffffffff
inc ecx
add edx, 4
cmp ecx, 0x270
jl 0x47e994
mov dword [eax], 1
lea edx, [eax + 8]
mov dword [eax + 4], edx
pop esi
pop ebx
ret

Function at 0x47eb88
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
push edi
lea ecx, [eax + 8]
mov edx, ecx
mov dword [eax], 0x270
mov dword [eax + 4], ecx
mov ecx, 0xe4
jmp 0x47ebd2
mov ebx, dword [edx + 4]
mov esi, dword [edx]
mov edi, ebx
and esi, 0x80000000
and edi, 0x7fffffff
or esi, edi
shr esi, 1
test bl, 1
je 0x47ebc3
mov ebx, 0x9908b0df
jmp 0x47ebc5
xor ebx, ebx
xor esi, ebx
xor esi, dword [edx + 0x634]
mov dword [edx], esi
add edx, 4
dec ecx
jne 0x47eba0
mov ecx, 0x18d
jmp 0x47ec0e
mov ebx, dword [edx + 4]
mov esi, dword [edx]
mov edi, ebx
and esi, 0x80000000
and edi, 0x7fffffff
or esi, edi
shr esi, 1
test bl, 1
je 0x47ebff
mov ebx, 0x9908b0df
jmp 0x47ec01
xor ebx, ebx
xor esi, ebx
xor esi, dword [edx - 0x38c]
mov dword [edx], esi
add edx, 4
dec ecx
jne 0x47ebdc
mov ecx, dword [eax + 8]
mov ebx, dword [edx]
mov esi, ecx
and ebx, 0x80000000
and esi, 0x7fffffff
or ebx, esi
shr ebx, 1
test cl, 1
je 0x47ec34
mov eax, 0x9908b0df
jmp 0x47ec36
xor eax, eax
xor ebx, eax
xor ebx, dword [edx - 0x38c]
mov dword [edx], ebx
pop edi
pop esi
pop ebx
ret

Function at 0x47ec44
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, eax
dec dword [ebx]
jne 0x47ec52
mov eax, ebx
call fcn.0047eb88
mov edx, dword [ebx + 4]
add dword [ebx + 4], 4
mov eax, dword [edx]
mov edx, eax
shr edx, 0xb
xor eax, edx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
xor eax, ecx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov ecx, eax
shr ecx, 0x12
xor eax, ecx
pop ebx
ret

Function at 0x47ec88
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
dec dword [ebx]
jne 0x47ec99
mov eax, ebx
call fcn.0047eb88
mov edx, dword [ebx + 4]
add dword [ebx + 4], 4
mov eax, dword [edx]
mov edx, eax
shr edx, 0xb
xor eax, edx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
xor eax, ecx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov ecx, eax
shr ecx, 0x12
xor eax, ecx
mov dword [esp], eax
dec dword [ebx]
jne 0x47ecd8
mov eax, ebx
call fcn.0047eb88
mov eax, dword [ebx + 4]
add dword [ebx + 4], 4
mov eax, dword [eax]
mov edx, eax
shr edx, 0xb
xor eax, edx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
xor eax, ecx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov ecx, eax
shr ecx, 0x12
xor eax, ecx
mov dword [esp + 4], eax
and dword [esp], 0xffffffff
and dword [esp + 4], 0xfffff
mov eax, dword [esp]
mov edx, dword [esp + 4]
or edx, 0x3ff00000
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0043ad94
fld qword [esp]
fsub dword [0x47ed40]
pop ecx
pop edx
pop ebx
ret
Function at 0x49bda4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x49bdaa
ret

Function at 0x500344
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, eax
lea ecx, [eax + 4]
xor eax, eax
cmp ecx, edx
jbe 0x500368
movsx ebx, byte [edx]
add eax, ebx
mov ebx, eax
shl ebx, 0xa
add eax, ebx
mov ebx, eax
shr ebx, 6
xor eax, ebx
inc edx
cmp ecx, edx
ja 0x500350
mov edx, eax
shl edx, 3
add eax, edx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
shl edx, 0xf
add eax, edx
test eax, eax
jne 0x500384
or eax, 0xffffffff
pop ebx
ret

Function at 0x544da4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
lea ecx, [ebp - 0x28]
lea edx, [ebp - 4]
push ebx
push esi
mov dword [ebp - 4], eax
mov dword [ecx + 8], 0x6d0254
mov dword [ecx + 0xc], esp
mov eax, 0x56498f
mov dword [ecx + 4], eax
xor eax, eax
mov word [ecx + 0x10], 0
mov dword [ecx + 0x1c], eax
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
mov word [ecx + 0x10], 8
mov eax, 0x6ace7c
mov ebx, dword [edx]
mov dword [ebx], eax
mov eax, 0x6ace94
mov ebx, dword [edx]
mov dword [ebx], eax
inc dword [ecx + 0x1c]
mov eax, dword [edx]
add eax, 4
mov ebx, 0x6d1520
mov dword [eax], ebx
mov eax, 0x6d14a4
mov ebx, dword [edx]
mov dword [ebx], eax
mov eax, 0x6d14e0
mov ebx, dword [edx]
mov dword [ebx + 4], eax
mov eax, dword [edx]
add eax, 8
xor ebx, ebx
mov dword [eax + 4], ebx
xor ebx, ebx
mov dword [eax + 8], ebx
lea ebx, [eax + 0x10]
xor esi, esi
mov dword [ebx + 8], esi
mov dword [ebp - 0x2c], 0x80
mov dword [ebp - 0x30], 1
mov ebx, dword [ebp - 0x30]
cmp ebx, dword [ebp - 0x2c]
jbe 0x544e4d
lea ebx, [ebp - 0x30]
jmp 0x544e50
lea ebx, [ebp - 0x2c]
mov ebx, dword [ebx]
mov dword [eax], ebx
xor ebx, ebx
inc dword [ecx + 0x1c]
mov eax, dword [edx]
add eax, 0x30
mov dword [eax + 8], ebx
xor ebx, ebx
inc dword [ecx + 0x1c]
mov eax, dword [edx]
add eax, 0x5c
mov dword [eax], ebx
xor ebx, ebx
mov dword [eax + 4], ebx
xor ebx, ebx
mov dword [eax + 0xc], ebx
xor ebx, ebx
mov dword [eax + 0x10], ebx
xor ebx, ebx
mov byte [eax + 0x18], 0
mov dword [eax + 0x14], ebx
xor ebx, ebx
inc dword [ecx + 0x1c]
inc dword [ecx + 0x1c]
mov eax, dword [edx]
mov byte [eax + 0x28], 0
mov eax, dword [edx]
mov dword [eax + 0x50], ebx
xor ebx, ebx
mov eax, dword [edx]
mov dword [eax + 0x58], ebx
xor ebx, ebx
mov eax, dword [edx]
add eax, 0x40
mov dword [eax + 0xc], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov eax, dword [edx]
xor ebx, ebx
mov byte [eax + 0x54], 0
mov eax, dword [edx]
mov dword [eax + 0x3c], ebx
mov eax, dword [ecx]
mov dword fs:[0], eax
mov eax, dword [edx]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x576d80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
lea ecx, [ebp - 0x28]
lea edx, [ebp - 4]
push ebx
mov dword [ebp - 4], eax
mov eax, 0x56498f
mov dword [ecx + 8], 0x6dd274
mov dword [ecx + 0xc], esp
mov dword [ecx + 4], eax
mov word [ecx + 0x10], 0
xor eax, eax
mov dword [ecx + 0x1c], eax
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
mov word [ecx + 0x10], 8
mov ebx, dword [edx]
mov eax, 0x6ace7c
mov dword [ebx], eax
mov eax, 0x6ace94
mov ebx, dword [edx]
mov dword [ebx], eax
mov eax, 0x6dd7cc
inc dword [ecx + 0x1c]
mov ebx, dword [edx]
mov dword [ebx], eax
xor ebx, ebx
mov eax, dword [edx]
add eax, 4
mov dword [eax], ebx
xor ebx, ebx
mov dword [eax + 4], ebx
xor ebx, ebx
mov dword [eax + 0xc], ebx
xor ebx, ebx
mov dword [eax + 0x10], ebx
xor ebx, ebx
mov byte [eax + 0x18], 0
mov dword [eax + 0x14], ebx
xor ebx, ebx
inc dword [ecx + 0x1c]
inc dword [ecx + 0x1c]
mov eax, dword [edx]
mov dword [eax + 0x24], ebx
xor ebx, ebx
mov eax, dword [edx]
mov dword [eax + 0x20], ebx
xor ebx, ebx
mov eax, dword [edx]
mov dword [eax + 0x30], ebx
xor ebx, ebx
mov eax, dword [edx]
mov byte [eax + 0x34], 0
mov eax, dword [edx]
mov dword [eax + 0x38], ebx
xor ebx, ebx
mov eax, dword [edx]
mov dword [eax + 0x3c], ebx
xor ebx, ebx
mov eax, dword [edx]
mov dword [eax + 0x2c], ebx
mov eax, dword [edx]
mov dword [eax + 0x28], ebx
mov ecx, dword [ecx]
mov dword fs:[0], ecx
mov eax, dword [edx]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x584b28
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor edx, edx
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0x6dfdd8
mov dword [ebp - 0x1c], esp
mov eax, 0x56498f
mov dword [ebp - 0x24], eax
lea ebx, [ebp - 4]
mov word [ebp - 0x18], 0
mov dword [ebp - 0xc], edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x28], ecx
lea eax, [ebp - 0x28]
mov dword fs:[0], eax
mov word [ebp - 0x18], 8
mov eax, dword [ebx]
call fcn.0057f97c
add dword [ebp - 0xc], 2
mov ecx, dword [ebx]
mov edx, 0x6e04dc
mov dword [ecx], edx
xor edx, edx
mov eax, dword [ebx]
mov dword [eax + 0x1c], edx
xor eax, eax
mov ecx, dword [ebx]
mov dword [ecx + 0x20], eax
xor ecx, ecx
mov edx, dword [ebx]
mov dword [edx + 0x24], ecx
mov eax, dword [ebx]
mov dword [eax + 0x28], 0x140
mov edx, dword [ebx]
mov dword [edx + 0x2c], 0xf0
mov ecx, dword [ebx]
xor edx, edx
mov byte [ecx + 0x30], 0
mov eax, dword [ebx]
mov dword [eax + 0x34], edx
xor eax, eax
mov ecx, dword [ebx]
mov dword [ecx + 0x3c], eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0x5861a8
mov edx, dword [ebx]
mov dword [ebp - 0x2c], edx
push dword [ecx + 4]
push dword [ecx]
call fcn.004a7320
mov edx, dword [ebx]
mov dword [edx + 0x38], eax
mov ecx, dword [ebx]
xor eax, eax
mov dword [ecx + 0x40], eax
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x44], ecx
mov eax, dword [ebx]
mov byte [eax + 0x48], 0
mov edx, dword [ebx]
mov byte [edx + 0x49], 0
mov ecx, dword [ebx]
mov byte [ecx + 0x5c], 0
mov eax, dword [ebx]
mov dword [eax + 0x60], 0xffffffff
mov edx, dword [ebx]
mov dword [edx + 0x64], 0xffffffff
mov ecx, dword [ebx]
mov byte [ecx + 0x68], 0
mov eax, dword [ebx]
mov dword [eax + 0x6c], 0xffffffff
mov edx, dword [ebx]
xor ecx, ecx
mov dword [edx + 0x50], ecx
mov eax, dword [ebx]
mov dword [eax + 0x4c], ecx
mov edx, dword [ebx]
xor eax, eax
mov dword [edx + 0x58], eax
mov edx, dword [ebx]
mov dword [edx + 0x54], eax
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5dbe18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x6ea4e4
mov edi, eax
xor ecx, ecx
mov eax, edi
cmp edx, ecx
jle 0x5dbe4f
mov bl, byte [eax]
xor byte [0x7b0a80], bl
mov bl, byte [0x7b0a80]
mov ebp, dword [esi]
xor byte [ebp + 0x7af880], bl
inc dword [esi]
and dword [esi], 0xfff
inc ecx
inc eax
cmp edx, ecx
jg 0x5dbe2b
xor eax, eax
mov al, byte [edi]
and eax, 1
add dword [esi], eax
and dword [esi], 0xfff
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5dc820
Capabilities:
Hash data with md5

Disassembly:
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax], edx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret
Function at 0x5e04cc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], edx
mov dl, byte [eax + 8]
cmp dl, 3
je 0x5e064c
xor esi, esi
xor edi, edi
mov ebx, dword [eax]
test dl, 2
mov dword [esp + 4], ebx
je 0x5e051d
movzx ebp, byte [ecx]
xor edx, edx
mov dl, byte [eax + 9]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
inc esi
movzx ebp, byte [ecx + 1]
mov ebx, edx
sub ebx, ebp
mov dword [esp + esi*4 + 0xc], ebx
xor ebx, ebx
inc esi
mov bl, byte [ecx + 2]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
jmp 0x5e052e
xor edx, edx
xor ebx, ebx
mov bl, byte [ecx + 3]
mov dl, byte [eax + 9]
sub edx, ebx
mov dword [esp + esi*4 + 0xc], edx
inc esi
test byte [eax + 8], 4
je 0x5e0544
xor edx, edx
mov dl, byte [eax + 9]
movzx ecx, byte [ecx + 4]
sub edx, ecx
mov dword [esp + esi*4 + 0xc], edx
inc esi
xor edx, edx
lea ecx, [esp + 0xc]
cmp esi, edx
jle 0x5e0565
cmp dword [ecx], 0
jg 0x5e0559
xor ebx, ebx
mov dword [ecx], ebx
jmp 0x5e055d
mov di, 1
inc edx
add ecx, 4
cmp esi, edx
jg 0x5e054e
test di, di
je 0x5e064c
mov dl, byte [eax + 9]
sub dl, 2
je 0x5e058a
sub dl, 2
je 0x5e05aa
sub dl, 4
je 0x5e05e0
sub dl, 8
je 0x5e0604
jmp 0x5e064c
mov ecx, dword [eax + 4]
mov eax, dword [esp]
xor edx, edx
cmp ecx, edx
jbe 0x5e064c
shr byte [eax], 1
and byte [eax], 0x55
inc eax
inc edx
cmp ecx, edx
ja 0x5e059a
jmp 0x5e064c
mov edx, dword [esp]
mov esi, dword [eax + 4]
mov ecx, dword [esp + 0xc]
mov eax, 0xf0
sar eax, cl
and al, 0xf0
mov ecx, dword [esp + 0xc]
mov ebx, 0xf
sar ebx, cl
or al, bl
xor ebx, ebx
cmp esi, ebx
jbe 0x5e064c
mov ecx, dword [esp + 0xc]
inc ebx
shr byte [edx], cl
and byte [edx], al
inc edx
cmp esi, ebx
ja 0x5e05d0
jmp 0x5e064c
mov edi, dword [esp]
mov ebp, dword [esp + 4]
imul ebp, esi
xor ebx, ebx
cmp ebp, ebx
jbe 0x5e064c
mov eax, ebx
xor edx, edx
div esi
mov ecx, dword [esp + edx*4 + 0xc]
shr byte [edi], cl
inc edi
inc ebx
cmp ebp, ebx
ja 0x5e05f0
jmp 0x5e064c
mov ebx, dword [esp]
mov eax, esi
imul dword [esp + 4]
mov dword [esp + 8], eax
xor ebp, ebp
cmp ebp, dword [esp + 8]
jae 0x5e064c
movzx edi, byte [ebx]
shl edi, 8
xor eax, eax
mov al, byte [ebx + 1]
xor edx, edx
add di, ax
mov eax, ebp
div esi
inc ebp
mov ecx, dword [esp + edx*4 + 0xc]
shr di, cl
movzx eax, di
sar eax, 8
mov edx, edi
mov byte [ebx], al
inc ebx
and dl, 0xff
mov byte [ebx], dl
inc ebx
cmp ebp, dword [esp + 8]
jb 0x5e0619
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5f0eec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov dword [ebp - 4], eax
mov ebx, 0x56498f
mov dword [ebp - 0x20], 0x6ebecc
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x18], 0
xor ebx, ebx
lea eax, [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword fs:[0]
mov dword [ebp - 0x28], ebx
lea ebx, [ebp - 0x28]
mov dword fs:[0], ebx
mov word [ebp - 0x18], 8
mov esi, dword [eax]
mov ebx, 0x6d6c5c
mov dword [esi], ebx
mov ebx, 0x6ec054
inc dword [ebp - 0xc]
mov esi, dword [eax]
mov dword [esi], ebx
mov ebx, dword [eax]
mov dword [ebx + 8], ecx
mov ecx, dword [eax]
mov ebx, dword [ebp + 0x14]
mov dword [ecx + 0xc], ebx
xor ebx, ebx
mov ecx, dword [eax]
mov dword [ecx + 0x40], ebx
xor ebx, ebx
mov ecx, dword [eax]
mov dword [ecx + 0x1c], ebx
mov ecx, dword [eax]
mov ebx, dword [eax]
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 4]
mov dword [ebx + 0x20], ecx
mov ecx, dword [eax]
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov ebx, dword [eax]
mov ecx, dword [eax]
mov ebx, dword [ebx + 0x20]
mov esi, dword [ebx + 0x10]
mov dword [ecx + 0x30], esi
mov esi, dword [ebx + 0x14]
mov dword [ecx + 0x34], esi
mov ecx, dword [eax]
mov byte [ecx + 0x44], 0
mov ecx, dword [eax]
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov ecx, dword [eax]
mov dword [ecx + 0x24], 0xffffffff
mov ebx, dword [eax]
mov ecx, edx
mov dword [ebx + 4], ecx
inc dword [ecx + 4]
mov edx, dword [eax]
mov ecx, dword [ebp + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [edx + 0x14], ecx
mov ecx, dword [ebp + 0xc]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, dword [eax]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x625298
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0x6fb774
mov dword [ebp - 0x1c], esp
mov eax, 0x56498f
mov dword [ebp - 0x24], eax
mov ebx, ecx
mov word [ebp - 0x18], 0
xor ecx, ecx
lea esi, [ebp - 4]
mov dword [ebp - 0xc], ecx
mov eax, dword fs:[0]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x28]
mov dword fs:[0], ecx
mov word [ebp - 0x18], 8
mov ecx, dword [esi]
mov eax, 0x6fc724
mov dword [ecx], eax
mov eax, 0x6fc708
inc dword [ebp - 0xc]
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi]
mov dword [eax + 4], edx
mov edx, dword [esi]
mov ecx, dword [ebp + 8]
mov dword [edx + 0x30], ecx
mov ecx, dword [ebp + 0xc]
mov dword [edx + 0x34], ecx
mov ecx, 0xa
mov eax, dword [esi]
push esi
mov esi, ebx
lea edi, [eax + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0xc]
pop esi
imul dword [ebx + 4]
mov edx, dword [esi]
mov dword [edx + 0x40], eax
mov ecx, dword [esi]
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov eax, dword [esi]
push dword [eax + 0x34]
push dword [eax + 0x30]
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
call fcn.00438664
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x646ac4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x646aef
mov eax, ebx
call fcn.0064c0dc
cmp byte [ebx + 0x3c], 0
je 0x646ae8
mov dword [ebx + 0x14], 0xcf
mov al, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x646b5a
mov edx, dword [ebx + 0x180]
cmp byte [edx + 0x10], 0
je 0x646b52
cmp dword [ebx + 8], 0
je 0x646b11
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x180]
call dword [edx]
test eax, eax
jne 0x646b23
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x646b52
cmp dword [ebx + 8], 0
je 0x646b04
cmp eax, 3
je 0x646b36
dec eax
jne 0x646b04
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x646b04
mov edx, dword [ebx + 0x10c]
add dword [eax + 8], edx
jmp 0x646b04
mov ecx, dword [ebx + 0x6c]
mov dword [ebx + 0x74], ecx
jmp 0x646b78
cmp dword [ebx + 0x14], 0xcc
je 0x646b78
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00646b84
pop ebx
ret