joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053a20
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x100afa73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.100a28e6
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x100b2110]
push eax
mov ecx, edi
call fcn.100a7f9f
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.100a94bb
test eax, eax
je 0x10053b3c
mov ecx, dword [esp + 0x3c]
call fcn.100a7fcc
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x100b2620]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x10053b00
push edi
mov ecx, esi
call fcn.100a560d
mov ecx, esi
call fcn.10053d00
cmp dword [esp + 0x38], 1
jne 0x10053b35
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.100a5748
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x10055d40
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x10055d73
push esi
call fcn.10064100
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x10055d6c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x10055df9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10055de2
mov eax, dword [esi + 8]
test eax, eax
je 0x10055d97
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x10055dde
cmp eax, 2
je 0x10055de2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10055d8a
cmp eax, 3
je 0x10055dbd
cmp eax, 1
jne 0x10055d8a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x10055d8a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x10055d8a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.10055e20
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x10055e08
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.10055e20
add esp, 4
pop esi
ret
Function at 0x10076900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b03f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.100764b0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.10076530
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.10076530
lea ecx, [esi + 0xc]
call fcn.100a1299
lea ecx, [esi + 0x10]
call fcn.100a1299
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.10077ac0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.10077ac0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.10077ac0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.100a130e
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.100a130e
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1007af30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x10d0ca04]
xor edx, edx
cmp eax, edx
jne 0x1007af56
xor eax, eax
mov byte [eax + 0x10d0c904], al
inc eax
cmp eax, 0x100
jl 0x1007af3e
mov dword [0x10d0ca04], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x10d0c904
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x1007afe7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x1007afba
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x1007af88
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x1007aff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x1007b043
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x1007b02a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100819c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100b07ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.100822e0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x10cac484
call fcn.100a104f
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x10081a53
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100a104f
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x10081a4c
push 0
mov ecx, eax
call fcn.10078b60
mov dword [esi + 0xc], eax
jmp 0x10081a55
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x10081a55
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x10ecd3a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1106e3f8
jmp 0x1106e468
xor eax, 0x60f7419b
add edx, eax
pop eax
sub edx, 4
xchg dword [esp], edx
pop esp
mov dword [esp], ebp
jmp 0x1106e531
push edx
mov edx, esp
push ecx
mov dword [esp], 0x740afc3b
mov dword [esp], eax
mov eax, 0x60f7419f
jmp 0x1106e451
jmp 0x110fd8e1
jmp 0x1109f787
push 0x2908ea8d
mov dword [esp], ebp
mov dword [esp], eax
push ebx
mov ebx, 0x467a1fbf
mov dword [esp + 4], ebx
pop ebx
mov dword [esp], edx
jmp 0x1109f7a5
jmp 0x1115edf9
push esi
mov esi, esp
add esi, 4
sub esi, 4
xchg dword [esp], esi
pop esp
mov dword [esp], edi
mov dword [esp], edx
mov dword [esp], ebx
jmp 0x110acd93
jmp 0x110d0be6
jmp 0x110d0c85
push ebp
push ecx
mov ecx, 0x50fa8a82
mov dword [esp + 4], ecx
mov ecx, dword [esp]
add esp, 4
mov dword [esp], eax
mov dword [esp], ecx
jmp 0x110d0d05
jmp 0x1109f6b1
jmp 0x110fd9d1
push esp
push dword [esp]
pop ebp
sub esp, 4
mov dword [esp], edi
mov edi, esp
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
jmp 0x110fd9f3
jmp 0x1110727a
push ebp
push esp
pop ebp
push ebx
mov ebx, 0x5e2b8a34
or ebx, 0x3ddfc3b8
jbe 0x11107294
jmp 0x111072e9
push ebx
mov eax, dword [esp]
push edi
mov edi, esp
add edi, 4
push ecx
mov ecx, 0x7fbf18bb
dec ecx
not ecx
add ecx, 0x73af526d
not ecx
shr ecx, 5
xor ecx, 0x607e36
add edi, ecx
pop ecx
xchg dword [esp], edi
mov esp, dword [esp]
push 0x45c9d1ae
mov dword [esp], edi
mov edi, esp
add edi, 4
sub edi, 4
xchg dword [esp], edi
mov esp, dword [esp]
mov dword [esp], ebx
pop ebx
jmp 0x11107300
xor ebx, 0x6feb12bc
sub ebx, 0x3de9cb5b
jnp 0x11107300
jmp 0x11107300
dec ebx
je 0x111072e9
jmp 0x1110730c
push eax
mov eax, 0x1be1062f
or eax, 0x6dfe176a
jmp 0x111073bb
sub ebp, 0x14
xchg dword [esp], ebp
pop esp
jmp 0x111073d1
add eax, 0x8000e890
add ebx, eax
pop eax
add ebx, 0x2dd4f261
add ebp, ebx
pop ebx
jmp 0x111073af
jmp 0x110acc5d
jmp 0x1115ee5d
rdtsc
jmp 0x1115ef0f
jmp 0x11165ed4
jmp fcn.11165fe0
Function at 0x407cc0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4c9238
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4f8458]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.00402780
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x407d14
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x14]
call fcn.00407d70
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
mov ecx, esi
mov word [esi + 4], di
call fcn.00402780
cmp dword [esp + 0x24], 8
jb 0x407d5a
mov eax, dword [esp + 0x10]
push eax
call fcn.00493b60
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x416710
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
push edi
mov edi, eax
mov esi, edx
jne 0x41671f
pop edi
xor eax, eax
pop esi
ret
cmp edi, 8
not esi
jb 0x416807
push ebp
mov ebp, edi
shr ebp, 3
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4d5778]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4d5778]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + 0x4d5778]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4d5778]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4d5778]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4d5778]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4d5778]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4d5778]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x416730
pop ebp
test edi, edi
je 0x41682c
jmp 0x416810
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x4d5778]
add ecx, 1
sub edi, 1
jne 0x416810
mov eax, esi
pop edi
not eax
pop esi
ret

Function at 0x416840
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [edx]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4d5778]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x4d5778]
mov dword [edx + 8], ecx
ret

Function at 0x416890
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
xor al, bl
movzx ebx, al
xor ebx, edx
shr edx, 8
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4d5778]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
add edx, 1
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x4d5778]
pop ebx
mov dword [esi + 8], ecx
ret
Function at 0x417b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x417b18
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x417b0d
cmp dword [edi + 0x7c], ebx
je 0x417b27
call fcn.00417ef0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00417920
add esp, 0xc
test eax, eax
je 0x417b4d
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push ebp
push 0x84
call fcn.00495125
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x417b8f
push 0x4000
call fcn.00495125
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add esp, 4
cmp eax, ebx
mov dword [ebp], eax
mov dword [ebp + 0x44], ecx
mov dword [ebp + 0x48], edx
mov dword [ebp + 0x4c], ebx
jne 0x417b9b
push ebp
call fcn.00495048
add esp, 4
pop ebp
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [ebp + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [ebp + 0x54], ecx
mov dword [ebp + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [ebp + 0x64], edx
mov ecx, dword [edi]
mov dword [ebp + 0x60], ecx
mov edx, dword [edi + 0xc]
push esi
mov dword [ebp + 0x68], edx
cmp eax, ebx
mov dword [ebp + 0x18], ebx
jne 0x417be4
lea esi, [ebp + 4]
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
call fcn.00416b10
test eax, eax
jne 0x417be4
mov dword [ebp + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [ebp + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [ebp + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [ebp + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x417c0e
mov cl, byte [edi + 0x39]
mov byte [ebp + 0x80], cl
jmp 0x417c17
mov dl, byte [edi + 0x3f]
mov byte [ebp + 0x80], dl
mov al, byte [ebp + 0x6c]
mov esi, dword [esp + 0x20]
neg al
lea edx, [ebp + 0x70]
mov dword [edx], 0x12345678
mov dword [ebp + 0x74], 0x23456789
mov dword [ebp + 0x78], 0x34567890
sbb eax, eax
and eax, 0xc
cmp esi, ebx
mov dword [ebp + 0x7c], eax
je 0x417c53
mov cl, byte [esi]
cmp cl, bl
je 0x417c53
call fcn.00416840
add esi, 1
jne 0x417c43
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [ebp + 0x3c], eax
mov dword [ebp + 8], ebx
pop esi
mov dword [edi + 0x7c], ebp
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x428e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c9e59
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f8458]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0x30], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esp + 0x28], ecx
xor ebx, ebx
cmp dword [ebp + 0x68], ecx
mov dword [esp + 0x30], 1
jle 0x428ebc
jmp 0x428e55
xor ecx, ecx
mov eax, dword [ebp + 0x50]
mov eax, dword [eax + ebx*4]
cmp eax, ecx
je 0x428eb4
mov edi, eax
mov eax, dword [esi + 4]
cmp eax, ecx
mov dword [esp + 0x14], edi
jne 0x428e70
xor edx, edx
jmp 0x428e78
mov edx, dword [esi + 8]
sub edx, eax
sar edx, 2
cmp eax, ecx
je 0x428e95
mov ecx, dword [esi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x428e95
mov eax, dword [esi + 8]
mov dword [eax], edi
add eax, 4
mov dword [esi + 8], eax
jmp 0x428eb4
mov edi, dword [esi + 8]
cmp eax, edi
jbe 0x428ea1
call fcn.0049458d
push edi
push esi
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
mov eax, esi
call fcn.004091f0
add ebx, 1
cmp ebx, dword [ebp + 0x68]
jl 0x428e53
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x42d7c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c9e21
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4f8458]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
call fcn.00410cf0
mov dword [esi + 0x48], eax
mov ebx, 1
mov byte [eax + 0x15], bl
mov eax, dword [esi + 0x48]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x48]
mov dword [eax], eax
mov eax, dword [esi + 0x48]
xor edi, edi
mov dword [eax + 8], eax
mov dword [esi + 0x4c], edi
mov dword [esp + 0x18], edi
call fcn.0042d100
mov dword [esi + 0x5c], eax
mov byte [eax + 0x11], bl
mov eax, dword [esi + 0x5c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x5c]
mov dword [eax], eax
mov eax, dword [esi + 0x5c]
mov dword [eax + 8], eax
mov dword [esi + 0x60], edi
mov byte [esp + 0x18], bl
call fcn.0042d100
mov dword [esi + 0x68], eax
mov byte [eax + 0x11], bl
mov eax, dword [esi + 0x68]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x68]
mov dword [eax], eax
mov eax, dword [esi + 0x68]
mov dword [eax + 8], eax
mov dword [esi + 0x6c], edi
mov byte [esp + 0x18], 2
call fcn.0042d100
fld1
mov dword [esi + 0x74], eax
mov byte [eax + 0x11], bl
mov eax, dword [esi + 0x74]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x74]
mov dword [eax], eax
mov eax, dword [esi + 0x74]
mov dword [eax + 8], eax
mov dword [esi + 0x78], edi
fstp dword [esi]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], 0x5a
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x430770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c9238
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4f8458]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea esi, [esp + 0xc]
mov edi, 0x5005f8
call fcn.00468c50
mov esi, 8
mov dword [esp + 0x30], 0
cmp dword [eax + 0x18], esi
jb 0x4307ba
mov eax, dword [eax + 4]
jmp 0x4307bd
add eax, 4
mov edx, eax
call fcn.004bb550
cmp dword [esp + 0x24], esi
jb 0x4307d7
mov eax, dword [esp + 0x10]
push eax
call fcn.00493b60
add esp, 4
mov eax, 0x500d18
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret
Function at 0x433770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c9ce0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4f8458]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea esi, [esp + 0xc]
mov edi, 0x5005f8
mov dword [esp + 0x30], 1
call fcn.00468ba0
mov esi, 8
cmp dword [eax + 0x18], esi
jb 0x4337ba
mov eax, dword [eax + 4]
jmp 0x4337bd
add eax, 4
cmp dword [esp + 0x6c], esi
mov edx, dword [esp + 0x58]
jae 0x4337cb
lea edx, [esp + 0x58]
cmp dword [esp + 0x50], esi
mov ecx, dword [esp + 0x3c]
jae 0x4337d9
lea ecx, [esp + 0x3c]
push eax
push edx
push ecx
push str.Count
call dword [0x4cf110]
cmp dword [esp + 0x24], esi
jb 0x4337fa
mov eax, dword [esp + 0x10]
push eax
call fcn.00493b60
add esp, 4
cmp dword [esp + 0x50], esi
jb 0x43380d
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00493b60
add esp, 4
xor eax, eax
cmp dword [esp + 0x6c], esi
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], eax
mov word [esp + 0x3c], ax
jb 0x433833
mov edx, dword [esp + 0x58]
push edx
call fcn.00493b60
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 0x38

Function at 0x433aa0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
push esi
push edi
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x20
xor edi, edi
call dword [0x4cf320]
push eax
call dword [0x4cf038]
test eax, eax
je 0x433b1c
lea ecx, [esp + 0x14]
push ecx
push str.SeDebugPrivilege
push edi
mov dword [esp + 0x1c], 1
call dword [0x4cf048]
mov eax, dword [esp + 0xc]
push edi
push edi
push 0x10
lea edx, [esp + 0x1c]
neg esi
push edx
sbb esi, esi
push edi
and esi, 2
push eax
mov dword [esp + 0x34], esi
call dword [0x4cf044]
call dword [0x4cf348]
mov ecx, dword [esp + 0xc]
mov esi, eax
neg esi
sbb esi, esi
push ecx
add esi, 1
call dword [0x4cf2e8]
mov eax, esi
pop edi
pop esi
add esp, 0x1c
ret
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x434a20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4c832b
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x4f8458]
xor eax, esp
mov dword [esp + 0x42c], eax
push esi
push edi
mov eax, dword [0x4f8458]
xor eax, esp
push eax
lea eax, [esp + 0x43c]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea eax, [esp + 0x2e]
push edi
push eax
mov word [esp + 0x34], di
call fcn.0049d900
add esp, 0xc
push edi
push 9
lea ecx, [esp + 0x30]
push ecx
push edi
call dword [0x4cf418]
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], edi
mov word [esp + 0x10], di
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x434aa0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x2c]
push edx
lea esi, [esp + 0x14]
call fcn.004028c0
push 9
push 0x4d7738
mov ecx, esi
mov dword [esp + 0x44c], edi
call fcn.00407d70
push 0x206
lea eax, [esp + 0x236]
push edi
push eax
mov word [esp + 0x23c], di
call fcn.0049d900
add esp, 0xc
push 0x104
lea ecx, [esp + 0x234]
push ecx
push edi
call dword [0x4cf2d8]
mov eax, dword [esp + 0x10]
mov edi, 8
cmp dword [esp + 0x24], edi
jae 0x434b18
lea eax, [esp + 0x10]
push str._funcsendto
push eax
lea edx, [esp + 0x238]
push edx
xor esi, esi
call fcn.004ba7f0
add esp, 0xc
cmp dword [esp + 0x24], edi
jb 0x434b43
mov eax, dword [esp + 0x10]
push eax
call fcn.00493b60
add esp, 4
mov ecx, dword [esp + 0x43c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.00493b65
add esp, 0x43c
ret

Function at 0x434b70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4c82eb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4f8458]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
push edi
mov eax, dword [0x4f8458]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
xor edi, edi
push 0x206
lea eax, [esp + 0x2e]
push edi
push eax
mov word [esp + 0x34], di
call fcn.0049d900
add esp, 0xc
push edi
push 9
lea ecx, [esp + 0x30]
push ecx
push edi
call dword [0x4cf418]
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], edi
mov word [esp + 0x10], di
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x434bf0
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x2c]
push edx
lea esi, [esp + 0x14]
call fcn.004028c0
push 9
push 0x4d7738
mov ecx, esi
mov dword [esp + 0x244], edi
call fcn.00407d70
mov eax, dword [esp + 0x10]
mov esi, 8
cmp dword [esp + 0x24], esi
jae 0x434c36
lea eax, [esp + 0x10]
push eax
call dword [0x4cf100]
cmp dword [esp + 0x24], esi
jb 0x434c50
mov eax, dword [esp + 0x10]
push eax
call fcn.00493b60
add esp, 4
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00493b65
add esp, 0x234
ret