joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4210d0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ceb43
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0x4dd7c8
mov dword [edi + 8], 0x4dd764
mov dword [edi + 0xc], 0x4dce9c
mov dword [edi + 0x10], 0
mov dword [edi], 0x4dd7f8
mov dword [edi + 4], 0x4dd81c
mov dword [edi + 8], 0x4dd838
mov dword [edi + 0xc], 0x4dd84c
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov word [edi + 0x20], 0
mov byte [edi + 0x1a], 1
mov byte [edi + 0x1c], 1
mov byte [edi + 0x1e], 1
mov dword [edi + 0x28], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
lea ecx, [edi + 0x3c]
mov byte [ebp - 4], 4
call fcn.00402df0
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 5
call fcn.00402df0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x64], 0
lea esi, [edi + 0x68]
mov byte [ebp - 4], 8
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00402df0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 0xa
call fcn.00402df0
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 0xb
call fcn.00402df0
mov byte [esi + 0x31], 0
mov byte [esi + 0x38], 0
mov dword [esi + 0x3c], 0xffffffff
lea ecx, [edi + 0xa8]
mov byte [ebp - 4], 0xc
call fcn.00402df0
mov word [edi + 0xc2], 0x101
mov byte [edi + 0xc4], 1
mov dword [edi + 0x100], 0
mov dword [edi + 0x108], 0
mov dword [edi + 0x110], 0
mov dword [edi + 0x114], 0
mov dword [edi + 0x118], 0
mov byte [edi + 0x126], 0
mov dword [edi + 0x128], 0
mov dword [edi + 0x144], 0
mov dword [edi + 0x148], 0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x150], 0
mov dword [edi + 0x154], 0
mov dword [edi + 0x158], 0
mov dword [edi + 0x190], 0
mov dword [edi + 0x194], 0
mov dword [edi + 0x198], 0
mov dword [edi + 0x19c], 0
mov dword [edi + 0x1a0], 0
mov dword [edi + 0x1a4], 0
lea ecx, [edi + 0x1a8]
mov byte [ebp - 4], 0x14
call fcn.00402df0
mov dword [edi + 0x1b4], 0
mov dword [edi + 0x1b8], 0
mov dword [edi + 0x1bc], 0
push 0x38
mov byte [ebp - 4], 0x16
call fcn.00404600
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0x17
test eax, eax
je 0x42131b
mov ecx, eax
call fcn.00414510
mov esi, eax
jmp 0x42131d
xor esi, esi
mov byte [ebp - 4], 0x16
mov dword [edi + 0x160], esi
test esi, esi
je 0x421331
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [edi + 0x128]
test ecx, ecx
je 0x421341
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi + 0x128], esi
call fcn.00423690
mov byte [edi + 0x15c], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x428d30
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf611
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0xc]
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
lea eax, [esi + 0xc]
push eax
call fcn.00402d30
lea eax, [esi + 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x18]
call fcn.00428b30
mov eax, dword [esi + 0x24]
lea ecx, [edi + 0x30]
mov dword [edi + 0x24], eax
movzx eax, byte [esi + 0x28]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x29]
mov byte [edi + 0x29], al
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
lea eax, [esi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00428c20
lea eax, [esi + 0x3c]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x3c]
call fcn.00404e80
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, edi
movdqu xmm0, xmmword [esi + 0x50]
movdqu xmmword [edi + 0x50], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42b5f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfb61
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x10]
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x10]
push eax
call fcn.00402d30
lea eax, [esi + 0x1c]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x1c]
call fcn.00402d30
mov eax, dword [esi + 0x28]
lea ecx, [edi + 0x30]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
lea eax, [esi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00402d30
lea eax, [esi + 0x3c]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x3c]
call fcn.00402d30
movzx eax, byte [esi + 0x48]
mov byte [edi + 0x48], al
movzx eax, byte [esi + 0x49]
mov byte [edi + 0x49], al
movzx eax, byte [esi + 0x4a]
mov byte [edi + 0x4a], al
movzx eax, byte [esi + 0x4b]
mov byte [edi + 0x4b], al
movzx eax, byte [esi + 0x4c]
mov byte [edi + 0x4c], al
movzx eax, byte [esi + 0x4d]
mov byte [edi + 0x4d], al
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
movzx eax, byte [esi + 0x6c]
mov byte [edi + 0x6c], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x435190
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0370
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0x4de5e0
mov dword [esi + 8], 0x4dd7c8
mov dword [esi + 0xc], 0x4dcff4
mov dword [esi + 0x10], 0x4de5c8
mov dword [esi + 0x14], 0x4de5b4
mov dword [esi + 0x18], 0x4dd764
mov dword [esi + 0x1c], 0x4dce9c
mov dword [esi + 0x20], 0x4de5a8
mov dword [esi + 0x24], 0
mov dword [esi], 0x4de5f8
mov dword [esi + 4], 0x4de628
mov dword [esi + 8], 0x4de640
mov dword [esi + 0xc], 0x4de65c
mov dword [esi + 0x10], 0x4de67c
mov dword [esi + 0x14], 0x4de694
mov dword [esi + 0x18], 0x4de6a8
mov dword [esi + 0x1c], 0x4de6bc
mov dword [esi + 0x20], 0x4de6d0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0xffffffff
mov dword [ebp - 4], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 3
call fcn.00402df0
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 4
call fcn.00402df0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov byte [ebp - 4], 6
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov word [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
call fcn.00423690
mov byte [esi + 0x28], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x438790
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d099b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi], 0x4dee80
mov dword [esi + 4], 0x4dee9c
mov byte [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
lea ecx, [esi + 0x20]
mov dword [ebp - 4], 0
call fcn.00402df0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
push 0x510de0
mov word [esi + 0x3c], 0
call dword [0x4dc1d8]
push 0xbe
push dword [0x5106a4]
call dword [0x4dc558]
mov dword [esi + 0x38], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43d400
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d10df
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0x4df3bc
lea ecx, [esi + 0x20]
mov dword [esi + 8], 0x4df3d4
mov dword [esi + 0xc], 0x4df394
mov dword [esi + 0x10], 0x4df3e8
mov dword [esi + 0x14], 0x4dce9c
mov dword [esi + 0x18], 0x4dd764
mov dword [esi + 0x1c], 0
mov dword [esi], 0x4df408
mov dword [esi + 4], 0x4df44c
mov dword [esi + 8], 0x4df464
mov dword [esi + 0xc], 0x4df478
mov dword [esi + 0x10], 0x4df4a0
mov dword [esi + 0x14], 0x4df4c0
mov dword [esi + 0x18], 0x4df4d4
call fcn.00402df0
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 0
call fcn.00402df0
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.00402df0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x6c], 0
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 4
mov word [esi + 0x70], 1
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x94], 0
mov word [esi + 0x9c], 0
call fcn.00402df0
lea ecx, [esi + 0xac]
mov byte [ebp - 4], 5
call fcn.00402df0
lea ecx, [esi + 0xb8]
mov byte [ebp - 4], 6
call fcn.00402df0
lea ecx, [esi + 0xc4]
mov byte [ebp - 4], 7
call fcn.00402df0
lea ecx, [esi + 0xd0]
mov byte [ebp - 4], 8
call fcn.00402df0
mov word [esi + 0xdc], 0
mov eax, esi
mov byte [esi + 0xde], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4411f0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1528
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov eax, esp
mov dword [eax], 0x4df924
mov dword [eax + 4], esi
mov dword [eax + 0x10], eax
mov ecx, dword [esi + 0x30]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ecx]
call dword [eax + 0x24]
sub esp, 0x18
mov eax, esp
mov dword [eax], 0x4df944
mov dword [eax + 4], esi
mov dword [eax + 0x10], eax
mov ecx, dword [esi + 0x34]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ecx]
call dword [eax + 0x24]
sub esp, 0x18
mov eax, esp
mov dword [eax], 0x4df964
mov dword [eax + 4], esi
mov dword [eax + 0x10], eax
mov ecx, dword [esi + 0x38]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x447460
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1a69
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], 0x4e01bc
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
mov dword [esi + 8], 0
call fcn.00402df0
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402df0
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00402df0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00402df0
mov dword [esi + 0x3c], 0
mov eax, esi
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44b9f0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d20f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], 0x4e02d0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov byte [esi + 0x45], 0
call fcn.00402df0
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.00402df0
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 4
mov byte [esi + 0x60], 0
call fcn.00402df0
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 5
call fcn.00402df0
mov byte [esi + 0x7c], 1
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 7
call fcn.00402df0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44bb10
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d213e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], 0x4e029c
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
mov dword [esi + 8], 0
call fcn.00402df0
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402df0
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00402df0
mov dword [esi + 0x30], 0
mov eax, esi
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4523a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2a96
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], 0x4e0a8c
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x18], 0xffffffff
mov word [esi + 0x1c], 0
mov dword [esi + 0x20], 0xffffffff
call fcn.00402df0
mov dword [esi + 0x30], 0
mov eax, esi
mov word [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x40], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x454a00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2f1e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00402d30
lea eax, [esi + 0xc]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0xc]
call fcn.00402d30
mov eax, dword [esi + 0x18]
lea ecx, [edi + 0x30]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
lea eax, [esi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00402d30
lea eax, [esi + 0x3c]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x3c]
call fcn.00402d30
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
movzx eax, byte [esi + 0x4c]
mov byte [edi + 0x4c], al
movzx eax, byte [esi + 0x4d]
mov byte [edi + 0x4d], al
movzx eax, byte [esi + 0x4e]
mov byte [edi + 0x4e], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4616f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d41de
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], 0x4e1754
lea esi, [edi + 0x20]
mov dword [edi + 4], 0x4e1780
mov dword [edi + 8], 0x4e17a0
mov dword [edi + 0xc], 0x4de5b4
mov dword [edi + 0x10], 0x4dd764
mov dword [edi + 0x14], 0x4ddcfc
mov dword [edi + 0x18], 0x4dce9c
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
call fcn.00402df0
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402df0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
mov word [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00402df0
mov dword [edi + 0x60], 0
mov eax, edi
mov dword [edi], 0x4e17cc
mov dword [edi + 4], 0x4e17f8
mov dword [edi + 8], 0x4e1818
mov dword [edi + 0xc], 0x4e1830
mov dword [edi + 0x10], 0x4e1844
mov dword [edi + 0x14], 0x4e1858
mov dword [edi + 0x18], 0x4e1870
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x474c30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6373
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi], 0x4e1cf8
lea ecx, [esi + 0x10]
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
mov dword [esi + 0xc], 0
call fcn.00402df0
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 1
call fcn.00402df0
mov dword [esi + 0x28], 0
mov eax, esi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x476ac0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d68a4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x38]
mov word [edi], 0
mov byte [edi + 2], 1
mov dword [edi + 8], 0xffffffff
mov dword [edi + 0xc], 0xffffffff
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xffffffff
mov dword [edi + 0x1c], 0xffffffff
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0xffffffff
mov dword [edi + 0x2c], 0xffffffff
mov dword [edi + 0x30], 0xffffffff
mov dword [edi + 0x34], 0xffffffff
call fcn.00402df0
lea ecx, [edi + 0x44]
mov dword [ebp - 4], 0
call fcn.00402df0
lea ecx, [edi + 0x50]
mov byte [ebp - 4], 1
call fcn.00402df0
mov byte [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
lea esi, [edi + 0x6c]
mov byte [ebp - 4], 3
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
call fcn.00402df0
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 4
call fcn.00402df0
add esi, 0x18
mov byte [ebp - 4], 5
mov ecx, esi
mov dword [ebp - 0x18], esi
call fcn.00402df0
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 6
call fcn.00402df0
lea eax, [edi + 0x9c]
push eax
call fcn.00401d90
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47d350
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d70a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x509dd8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x3c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0047d450
push eax
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
call fcn.00402f30
push dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.00404630
add esp, 4
lea eax, [esi + 0x40]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0047d480
push eax
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 1
call fcn.00402f30
push dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.00404630
add esp, 4
lea eax, [esi + 0x44]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0047d4b0
push eax
lea ecx, [esi + 0x24]
mov dword [ebp - 4], 2
call fcn.00402f30
push dword [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00404630
add esp, 4
lea ecx, [esi + 0x30]
push dword [0x508500]
call fcn.00402fa0
push 0x11
call fcn.0047e3a0
mov dword [esi + 0x48], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47dc50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [edx + 4], 0
xor bl, bl
push edi
cmp dword [ecx + 4], esi
jbe 0x47dd6d
mov edi, dword [ecx]
movzx ecx, word [edi + esi*2]
inc esi
cmp ecx, 0x20
je case.0x47dcbf.98
cmp ecx, 0x2d
je 0x47dd6d
test bl, bl
je case.0x47dcbf.99
lea eax, [ecx - 0x41]
xor bl, bl
cmp ax, 0x19
ja 0x47dca7
lea eax, [ecx + 0x20]
movzx eax, ax
jmp 0x47dca9
mov eax, ecx
movzx eax, ax
add eax, 0xffffff9e
cmp eax, 0x12
ja case.0x47dcbf.99
movzx eax, byte [eax + 0x47dde8]
jmp dword [eax*4 + 0x47ddd0]
mov edi, 0xa
jmp 0x47dce0
mov edi, 0x14
jmp 0x47dce0
mov edi, 0x1e
jmp 0x47dce0
mov edi, 0x28
mov ecx, dword [edx + 4]
mov eax, dword [edx]
xor edx, edx
lea eax, [eax + ecx*8]
mov ecx, dword [eax - 8]
add eax, 0xfffffff8
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, 0x40
sub eax, edi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
cmp dword [ebp - 8], ecx
ja 0x47ddc5
mov eax, dword [ebp - 4]
jb 0x47dd2c
cmp eax, edx
jae 0x47ddc5
mov edx, dword [ebp - 8]
mov ecx, edi
call fcn.004ad6e0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edx
mov ecx, dword [eax + 4]
cmp esi, ecx
jae 0x47dd5e
mov eax, dword [eax]
lea eax, [eax + esi*2]
lea ecx, [ecx]
cmp word [eax], 0x20
je 0x47dd5e
inc esi
add eax, 2
cmp esi, ecx
jb 0x47dd50
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp esi, dword [ecx + 4]
jb 0x47dc73
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
dec esi
lea eax, [ebp - 0xc]
push eax
lea edi, [edi + esi*2]
push edi
call fcn.004049b0
mov ebx, eax
mov eax, edx
mov dword [ebp - 0x10], eax
cmp edi, dword [ebp - 0xc]
je 0x47ddc5
mov ecx, ebx
or ecx, eax
je 0x47ddc5
mov ecx, dword [ebp + 0xc]
call fcn.004124d0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ecx + eax*8], ebx
mov bl, 1
mov dword [ecx + eax*8 + 4], edx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
sub eax, edi
sar eax, 1
inc dword [edx + 4]
add esi, eax
jmp case.0x47dcbf.98
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8