joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45aa80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60d816
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x698b9c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [esp + 0x38]
xor ebx, ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [esp + 0x30], ebx
mov dword [edi], vtable.webrtc::Description::Entry.0
mov dword [edi + 0x10], 3
mov dword [edi + 0x14], ebx
lea ebp, [edi + 0x1c]
push 0x10
mov dword [ebp], ebx
call fcn.005c020b
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x45ab03
push 0x24
mov dword [esi], ebx
mov dword [esi + 4], 0x24
mov dword [esi + 8], ebx
mov dword [esi + 0xc], 1
call fcn.005c052e
mov dword [esi], eax
add esp, 4
mov byte [eax], bl
jmp 0x45ab05
xor esi, esi
mov dword [ebp], esi
push 0x67e894
call fcn.005c7cf6
mov dword [edi + 0x20], eax
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x24], vtable.webrtc::Description::Attributes.0
push 0x10
mov byte [esp + 0x38], 2
call fcn.005c020b
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x45ab5d
push 0x20
mov dword [esi], ebx
mov dword [esi + 4], 0x20
mov dword [esi + 8], ebx
mov dword [esi + 0xc], 1
call fcn.005c052e
mov dword [esi], eax
add esp, 4
mov byte [eax], bl
jmp 0x45ab5f
xor esi, esi
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x30], 3
lea ecx, [esp + 0x14]
push ecx
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 0xffffffff
call fcn.0045a990
push str.application
lea ecx, [esp + 0x18]
call fcn.0045a6e0
test al, al
je 0x45abad
mov dword [edi + 0x14], 1
jmp 0x45abe1
push str.audio
lea ecx, [esp + 0x18]
call fcn.0045a6e0
test al, al
je 0x45abc8
mov dword [edi + 0x14], 3
jmp 0x45abe1
push str.video
lea ecx, [esp + 0x18]
call fcn.0045a6e0
test al, al
je 0x45abe1
mov dword [edi + 0x14], 2
lea edx, [esp + 0x14]
push edx
lea esi, [esp + 0x1c]
call fcn.0045a990
lea ecx, [esp + 0x14]
call fcn.00404fd0
push ebp
mov dword [edi + 0x18], eax
call fcn.0045a990
xor eax, eax
cmp dword [edi + 0x18], ebx
mov byte [esp + 0x30], 2
mov esi, dword [esp + 0x14]
sete al
mov dword [edi + 0x34], eax
cmp esi, ebx
je 0x45ac39
dec dword [esi + 0xc]
cmp dword [esi + 0xc], ebx
jg 0x45ac39
mov eax, dword [esi]
cmp eax, ebx
je 0x45ac30
push eax
call fcn.005c05f8
add esp, 4
push esi
call fcn.005bf7fb
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x45c6c0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x60df3e
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x698b9c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x38]
xor ebx, ebx
mov dword [esi], vtable.webrtc::Transport.0
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebx
cmp ebp, ebx
je 0x45c708
mov dword [ebp + 8], esi
mov edi, dword [esp + 0x28]
add edi, 0x38
mov dword [esp + 0x1c], ebx
push edi
mov dword [esi], vtable.webrtc::SctpTransport.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx + 0x34]
push edi
cmp eax, ebx
je 0x45c742
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x30], edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x2c]
jmp 0x45c74d
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x10000
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 0x18], eax
lea eax, [esi + 0x24]
push 0x7d0
push eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
lea edi, [esi + 0x3c]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], 0x400
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x1c], 2
push 0x69db74
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebp
mov dword [esi + 0x60], ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x45c7ae
call fcn.0045c620
push 0x1400000
push 0x64
mov ecx, edi
call fcn.0045c4c0
mov edx, dword [esp + 0x30]
push edx
push esi
call fcn.0045c8c0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18
Function at 0x45d7d0
Capabilities:
Resolve dns

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
mov eax, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call sub.WS2_32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
je 0x45d864
cmp word [ebx + 8], 2
push edi
jne 0x45d835
cmp word [ebx + 0xa], 4
jne 0x45d835
mov edi, dword [ebx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x45d835
lea ebx, [ebx]
mov edx, dword [eax]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push ebp
push eax
push ecx
call fcn.0045d760
mov dword [esi], eax
test eax, eax
je 0x45d858
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x45d810
mov edx, dword [ebx]
mov eax, dword [esp + 0x20]
push 0x400
push edx
push 0x401
push eax
call fcn.005c7ada
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
ret 0x10
call sub.WS2_32.dll_WSAGetLastError
add eax, 0xffffd507
cmp eax, 3
ja case.0x45d873.11001
jmp dword [eax*4 + 0x45d89c]
pop esi
pop ebp
mov eax, 0x2af9
pop ebx
ret 0x10
pop esi
pop ebp
mov eax, 0x2afa
pop ebx
ret 0x10
pop esi
pop ebp
mov eax, 0x2afb
pop ebx
ret 0x10
Function at 0x45e0d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x238
mov eax, dword [0x698b9c]
xor eax, esp
mov dword [esp + 0x234], eax
cmp dword [0x69dfc0], 0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], str.getaddrinfo
mov dword [esp + 0x14], 0x45db30
mov dword [esp + 0x18], str.getnameinfo
mov dword [esp + 0x1c], 0x45de20
mov dword [esp + 0x20], str.freeaddrinfo
mov dword [esp + 0x24], fcn.0045dae0
je 0x45e135
movzx eax, word [esp + 0x24c]
mov eax, dword [eax*8 + 0x69be84]
jmp 0x45e24c
push 0x104
lea ecx, [esp + 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x45e233
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.005c7c1a
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.005c7c82
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x45e1ac
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x45e1f8
push esi
call ebp
lea eax, [esp + 0x138]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.005c7c1a
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.005c7c82
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x45e233
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x45e1f8
push esi
call ebp
jmp 0x45e233
xor edi, edi
lea ebx, [ebx]
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
mov dword [esp + edi*8 + 0x14], eax
test eax, eax
je 0x45e1f3
inc edi
cmp edi, 3
jl 0x45e200
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x69be84], edx
mov dword [0x69be8c], eax
mov dword [fcn.0045dae0], ecx
movzx edx, word [esp + 0x24c]
mov eax, dword [edx*8 + 0x69be84]
mov dword [0x69dfc0], 1
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005bfcb8
add esp, 0x238
ret 4
Function at 0x461270
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xb8
mov eax, dword [0x698b9c]
xor eax, esp
mov dword [esp + 0xb0], eax
push ebx
mov ebx, dword [esp + 0xc0]
push ebp
mov ebp, dword [esp + 0xc8]
push esi
mov esi, ecx
test edi, edi
jne 0x4612ab
call fcn.005c7bd1
mov dword [eax], 9
jmp 0x4613b8
test ebx, ebx
jne 0x4612bf
call fcn.005c7bd1
mov dword [eax], 0xe
jmp 0x4613b8
push 0x80
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.005bfd50
add esp, 0xc
test esi, esi
je 0x4613ad
mov eax, dword [esi]
test al, 1
je 0x46130a
mov cx, word [esi + 4]
mov dx, word [esi + 6]
mov word [esp + 0x38], cx
mov ecx, dword [esi + 8]
mov word [esp + 0x3c], dx
mov edx, dword [esi + 0xc]
mov dword [esp + 0x40], ecx
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x44], edx
mov dword [esp + 0x54], ecx
jmp 0x461318
xor edx, edx
xor ecx, ecx
mov word [esp + 0x3c], dx
mov word [esp + 0x38], cx
test al, 2
je 0x461330
mov dx, word [esi + 0x14]
mov ecx, dword [esi + 0x18]
and dx, 0xf
or word [esp + 0x3c], dx
mov dword [esp + 0x48], ecx
test al, 4
jne 0x4613ad
mov eax, 1
xor esi, esi
lea edx, [esp + 0x10]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], esi
call fcn.005c7bd1
mov ebx, eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov edx, edi
call fcn.00491ec0
add esp, 8
mov dword [ebx], eax
call fcn.005c7bd1
cmp dword [eax], esi
jne 0x4613b8
mov eax, ebp
sub eax, dword [esp + 0x28]
mov edx, esi
sbb edx, dword [esp + 0x2c]
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.005bfcb8
add esp, 0xb8
ret
call fcn.005c7bd1
mov dword [eax], 0x16
mov ecx, dword [esp + 0xbc]
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
xor ecx, esp
or edx, eax
call fcn.005bfcb8
add esp, 0xb8
ret
Function at 0x463b60
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x8bf4]
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
test eax, eax
je 0x463be2
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x463be2
cmp dword [ecx + 0x14], 0
je 0x463be2
cmp dword [ecx], 0
je 0x463b92
mov ecx, dword [ecx]
cmp dword [ecx], 4
je 0x463be2
movzx ecx, word [eax + 0x10]
lea esi, [eax + 0x10]
cmp cx, word [ebx]
jne 0x463be2
movzx ecx, cx
sub ecx, 2
je 0x463bcc
sub ecx, 0x15
jne 0x463be2
lea edx, [ecx + 0x10]
lea ecx, [ebx + 8]
mov edi, esi
sub edi, ecx
add edi, 8
mov ebp, dword [ecx + edi]
cmp ebp, dword [ecx]
jne 0x463be2
sub edx, 4
add ecx, 4
cmp edx, 4
jae 0x463bb8
jmp 0x463bd4
mov ecx, dword [esi + 4]
cmp ecx, dword [ebx + 4]
jne 0x463be2
mov dx, word [esi + 2]
cmp dx, word [ebx + 2]
je 0x463d59
mov esi, dword [esp + 0x20]
mov eax, dword [esi + 0x5d6c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
test eax, eax
jle 0x463c9c
add esi, 0x5c78
mov dword [esp + 0x14], esi
lea ebx, [ebx]
mov edi, dword [esi]
mov eax, dword [edi]
test eax, eax
je 0x463c1d
cmp dword [eax], 4
je 0x463c7a
mov ecx, dword [edi + 4]
movzx eax, word [ecx + 0x170]
add ecx, 0x170
cmp ax, word [ebx]
jne 0x463c7a
movzx eax, ax
sub eax, 2
je 0x463c64
sub eax, 0x15
jne 0x463c7a
lea edx, [eax + 0x10]
lea eax, [ebx + 8]
mov esi, ecx
sub esi, eax
add esi, 8
lea esp, [esp]
mov ebp, dword [eax + esi]
cmp ebp, dword [eax]
jne 0x463c7a
sub edx, 4
add eax, 4
cmp edx, 4
jae 0x463c50
jmp 0x463c6c
mov edx, dword [ecx + 4]
cmp edx, dword [ebx + 4]
jne 0x463c7a
mov ax, word [ecx + 2]
cmp ax, word [ebx + 2]
je 0x463d06
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
inc eax
add esi, 4
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
jl 0x463c10
mov esi, dword [esp + 0x20]
mov eax, dword [esi + 0x8bf0]
xor ebp, ebp
mov dword [esp + 0x20], eax
test eax, eax
jle 0x463d57
lea edx, [esi + 0x5d7c]
lea ecx, [edx - 0xc]
mov dword [esp + 0x18], ecx
mov ecx, dword [edx]
test ecx, ecx
je 0x463ccf
cmp dword [ecx], 0
je 0x463ccf
mov eax, dword [ecx]
cmp dword [eax], 4
je 0x463d46
movzx ecx, word [edx + 4]
cmp cx, word [ebx]
jne 0x463d46
movzx ecx, cx
sub ecx, 2
je 0x463d34
sub ecx, 0x15
jne 0x463d46
lea esi, [ecx + 0x10]
lea ecx, [ebx + 8]
mov eax, edx
sub eax, ecx
lea edi, [eax + 0xc]
mov eax, dword [ecx + edi]
cmp eax, dword [ecx]
jne 0x463d46
sub esi, 4
add ecx, 4
cmp esi, 4
jae 0x463cf2
jmp 0x463d3c
mov esi, dword [esp + 0x20]
mov edx, dword [esi + 0x8bf0]
xor ecx, ecx
test edx, edx
jle 0x463c9c
lea eax, [esi + 0x5d70]
lea esp, [esp]
cmp dword [eax + 0xc], edi
je 0x463d59
inc ecx
add eax, 0xc0
cmp ecx, edx
jl 0x463d20
jmp 0x463c9c
mov eax, dword [edx + 8]
cmp eax, dword [ebx + 4]
jne 0x463d46
mov cx, word [edx + 6]
cmp cx, word [ebx + 2]
je 0x463d61
inc ebp
add edx, 0xc0
cmp ebp, dword [esp + 0x20]
jl 0x463cb6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4641b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_recvfrom]
push esi
push edi
mov dword [esp + 0x10], 0xa
lea edi, [ebx + 0x80]
lea ecx, [ecx]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edi
push ebx
push 0
push 0x1000
push eax
push ecx
mov dword [edi], 0x80
call ebp
mov esi, eax
test esi, esi
jge 0x46422b
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2746
je 0x464215
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2744
je 0x464215
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x274d
jne 0x464235
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
test eax, eax
jg 0x4641d0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
push edi
push ebx
call fcn.00496090
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x464240
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [0x698b9c]
xor eax, esp
mov dword [esp + 0xa0], eax
cmp dword [ebp + 0x14], 0x17
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
jne 0x4642c6
cmp word [esi], 2
jne 0x4642c6
mov ecx, 0x22
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
cmp ax, 2
jne 0x4642b7
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x14]
lea esi, [esp + 0xa4]
call fcn.00496130
add esp, 4
mov eax, dword [esp + 0xa0]
push eax
lea ecx, [esp + 0x24]
push ecx
jmp 0x4642ce
mov ecx, dword [esi + 0x80]
push ecx
push esi
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push 0
push edx
push ebx
push eax
call sub.WS2_32.dll_sendto
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005bfcb8
mov esp, ebp
pop ebp
ret
Function at 0x464370
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, 0x10b0
call fcn.005c1bc0
mov eax, dword [0x698b9c]
xor eax, esp
mov dword [esp + 0x10ac], eax
push ebx
push ebp
mov ebp, dword [esp + 0x10bc]
push esi
xor eax, eax
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], eax
mov edi, ecx
lea eax, [esp + 0xb0]
push eax
lea ecx, [esp + 0x34]
push ecx
push ebp
mov dword [esp + 0x24], edi
mov dword [esp + 0xbc], 0x80
call sub.WS2_32.dll_getsockname
test eax, eax
je 0x4643cd
or eax, 0xffffffff
jmp 0x464503
lea esi, [esp + 0x30]
call fcn.00495f90
test eax, eax
jne 0x4643eb
mov ecx, 0x22
rep movsd dword es:[edi], dword [esi]
mov eax, 1
jmp 0x464503
lea edx, [esp + 0x30]
call fcn.00495ef0
push 0
push 0
movzx edx, ax
lea eax, [esp + 0x2c]
push eax
push 0x1000
lea ecx, [esp + 0xc8]
push ecx
push 0
push 0
push 0x48000016
push ebp
mov dword [esp + 0x4c], edx
mov ebx, edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x4643c5
cmp dword [esp + 0xb8], eax
mov dword [esp + 0x1c], eax
jle 0x4644ff
mov eax, 0xffffff80
lea ecx, [esp + 0xc0]
sub eax, edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], eax
mov edi, edi
mov esi, dword [ecx - 4]
movzx eax, word [esi]
mov edi, dword [ecx]
cmp ax, 2
je 0x46446b
cmp ax, 0x17
jne 0x4644de
cmp word [esp + 0x30], ax
jne 0x4644de
call fcn.00496000
test eax, eax
jne 0x4644de
mov edx, dword [esp + 0x2c]
lea ebp, [ebx + 0x80]
lea ecx, [edx + ebp]
mov eax, 0x78787879
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
push eax
push esi
call fcn.00464300
add esp, 8
test eax, eax
jne 0x4644de
mov eax, dword [esp + 0x18]
inc dword [esp + 0x14]
add eax, 0xa18
cmp ebx, eax
je 0x4644de
push edi
push esi
push ebx
call fcn.005bfdd0
add esp, 0xc
push ebp
push ebx
mov dword [ebp], edi
call fcn.00496090
mov edx, dword [esp + 0x30]
add esp, 8
mov esi, ebx
call fcn.00495f40
add ebx, 0x88
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
inc eax
add ecx, 8
cmp eax, dword [esp + 0xb8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jl 0x464450
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10bc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005bfcb8
add esp, 0x10b0
ret
Function at 0x464670
Capabilities:
Create thread

Disassembly:
mov eax, 0x1c24
call fcn.005c1bc0
mov eax, dword [0x698b9c]
xor eax, esp
mov dword [esp + 0x1c1c], eax
push ebx
push ebp
push esi
mov esi, ecx
cmp dword [esi + 0x30], 0
push edi
jne 0x46469b
mov dword [esi + 0x30], 2
mov ecx, 1
cmp dword [esi + 0x2c], ecx
je 0x4646ba
mov eax, dword [esi + 0x18]
mov dword [esi + 0x2c], ecx
test eax, eax
je 0x4646ba
mov edx, dword [esi + 0x28]
push edx
push ecx
push esi
call eax
add esp, 0xc
mov cx, word [esi + 0x14]
mov dx, word [esi + 0x16]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov word [esp + 0x18], cx
mov word [esp + 0x1a], dx
call fcn.0045f940
add esp, 4
test eax, eax
je 0x4646f6
or eax, 0xffffffff
jmp 0x464861
mov ecx, dword [esi + 0x8c18]
push ecx
lea ecx, [esp + 0x214]
call fcn.00464370
mov edi, eax
add esp, 4
test edi, edi
jge 0x464716
xor edi, edi
jmp 0x464722
je 0x464722
cmp edi, 0x13
jle 0x464722
mov edi, 0x13
mov edx, dword [esi + 0x28]
add edx, 0x3c
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
test edi, edi
jle 0x46477f
lea ebp, [esp + 0x210]
lea esp, [esp]
mov ecx, dword [esi + 0x29a0]
lea eax, [esp + 0x18]
push eax
push ebp
push ecx
push 1
call fcn.00495720
add esp, 0x10
test eax, eax
jne 0x464774
cmp dword [esi + 0x29a0], 9
jge 0x46477f
lea edx, [esi + 0x38]
push edx
lea eax, [esp + 0x1c]
call fcn.004958d0
add esp, 4
inc ebx
add ebp, 0x88
cmp ebx, edi
jl 0x464740
lea eax, [esi + 0x38]
push eax
call fcn.00495970
xor ebx, ebx
add esp, 4
cmp dword [esi + 0x29a0], ebx
jle 0x4647e8
lea edi, [esi + 0x240]
jmp 0x4647a0
cmp dword [edi], 1
jne 0x4647d9
lea ecx, [esp + 0xc28]
push 0x1000
push ecx
mov eax, edi
call fcn.00495c20
add esp, 8
test eax, eax
jl 0x4647d9
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4647d9
mov edx, dword [esi + 0x28]
push edx
lea ecx, [esp + 0xc2c]
push ecx
push esi
call eax
add esp, 0xc
inc ebx
add edi, 0x1f8
cmp ebx, dword [esi + 0x29a0]
jl 0x4647a0
mov ecx, 2
cmp dword [esi + 0x2c], ecx
je 0x464807
mov eax, dword [esi + 0x18]
mov dword [esi + 0x2c], ecx
test eax, eax
je 0x464807
mov edx, dword [esi + 0x28]
push edx
push ecx
push esi
call eax
add esp, 0xc
mov eax, dword [esi + 0x28]
add eax, 0x3c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push 1
push 0
push 0xc
call eax
mov esi, dword [esi + 0x28]
add esi, 0x14
cmp dword [esi + 4], 0
jne 0x46485f
mov edx, dword [esi + 0xc]
lea ecx, [esi + 8]
push ecx
push 0x10000
push edx
push 0x401070
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x46485f
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov ecx, dword [esp + 0x1c2c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005bfcb8
add esp, 0x1c24
ret
Function at 0x464e30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor ecx, ecx
test esi, esi
jbe 0x464e53
push ebx
sub edx, eax
push edi
nop
movzx edi, byte [edx + eax]
movzx ebx, byte [eax]
xor edi, ebx
or ecx, edi
inc eax
sub esi, 1
jne 0x464e40
pop edi
pop ebx
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x4651d0
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x14
push ebx
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], ebp
jle 0x465208
mov ecx, dword [esp + 0x28]
mov esi, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
cdq
cmp ecx, edx
jg 0x465200
jl 0x4651f8
cmp esi, eax
jae 0x465200
mov ebx, esi
mov dword [esp + 0x20], ecx
jmp 0x465216
mov ebx, eax
mov dword [esp + 0x20], edx
jmp 0x465216
mov eax, dword [esp + 0x28]
mov ebx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x20], eax
cmp edi, 0xcc
jge 0x46533d
mov eax, edi
cdq
add eax, ebx
adc edx, dword [esp + 0x20]
js 0x46523a
jg 0x465234
cmp eax, 1
jbe 0x46523a
mov dword [esp + 0x18], edx
jmp 0x465243
mov eax, 1
mov dword [esp + 0x18], ebp
mov ecx, dword [esp + 0x2c]
push ebp
push ecx
push 1
push eax
call fcn.00464fc0
add esp, 0x10
mov dword [esp + 0x14], eax
cmp eax, ebp
je 0x46533d
add dword [eax + 8], edi
mov esi, eax
mov eax, dword [esi + 0x10]
test al, 1
je 0x46528c
test al, 8
jne 0x465288
mov edx, dword [esi + 0x44]
mov eax, dword [edx]
cmp eax, 1
jne 0x465288
mov ecx, dword [esi + 0x40]
sub ecx, dword [esi + 0xc]
sub ecx, dword [esi + 8]
add ecx, dword [esi + 0x34]
jmp 0x46529a
xor ecx, ecx
jmp 0x46529a
mov ecx, esi
sub ecx, dword [esi + 0xc]
sub ecx, dword [esi + 8]
add ecx, 0x100
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x20]
cdq
mov edi, ebx
sub edi, eax
sbb ebp, edx
mov eax, ecx
cdq
cmp edx, ebp
jg 0x4652f2
jl 0x4652b6
cmp eax, edi
jae 0x4652f2
mov eax, dword [esi + 0x10]
test al, 1
je 0x4652e1
test al, 8
jne 0x4652db
mov ecx, dword [esi + 0x44]
mov edx, dword [ecx]
cmp edx, 1
jne 0x4652db
mov eax, dword [esi + 0x40]
sub eax, dword [esi + 0xc]
sub eax, dword [esi + 8]
add eax, dword [esi + 0x34]
mov ebp, eax
jmp 0x4652f4
xor eax, eax
mov ebp, eax
jmp 0x4652f4
mov eax, esi
sub eax, dword [esi + 0xc]
sub eax, dword [esi + 8]
add eax, 0x100
mov ebp, eax
jmp 0x4652f4
mov ebp, edi
mov eax, dword [esi + 8]
mov edi, dword [esp + 0x28]
push ebp
push eax
call fcn.004611c0
add esp, 8
test eax, eax
jne 0x465334
add dword [esp + 0x10], ebp
test byte [esp + 0x2c], 2
mov dword [esi + 0xc], ebp
je 0x46531e
mov eax, dword [esp + 0x14]
add dword [eax + 0x20], ebp
mov esi, dword [esi]
test esi, esi
jne 0x465265
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x14]
call fcn.004653c0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret