joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426960
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4fa278
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, ecx
mov ebx, dword [edi + esi*4 + 0x110]
test ebx, ebx
jne 0x4269a2
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
lea ecx, [esp + 0x10]
call fcn.004161fe
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], 0
and al, 0xf9
mov dword [esp + 0xc], 0
and al, 0xf7
and al, 0xfe
or al, 0xf0
and esi, 0xf
and al, 0xf
shl esi, 4
or esi, eax
lea eax, [esp + 0xc]
push eax
push ebx
push edi
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], esi
call fcn.0041f510
add esp, 0xc
lea ecx, [esp + 0x10]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.004161d4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4

Function at 0x42a910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fa6c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 1
lea eax, [esi + 0x20]
lea ecx, [esp + 0x1c]
push eax
call fcn.004f398c
mov edi, dword [esp + 0x34]
xor ebp, ebp
push edi
mov dword [esp + 0x30], ebp
call fcn.00416834
xor edx, edx
div dword [esi + 0xc]
mov esi, dword [esi + 8]
cmp esi, ebp
je 0x42a98a
mov esi, dword [esi + edx*4]
cmp esi, ebp
je 0x42a98a
mov ebx, dword [0x511e0c]
mov eax, dword [esi + 8]
push edi
push eax
call ebx
add esp, 8
test eax, eax
je 0x42a97c
mov esi, dword [esi]
test esi, esi
jne 0x42a966
jmp 0x42a98a
test esi, esi
je 0x42a98a
mov ecx, dword [esi + 0x10]
mov ebp, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004f3986
mov ecx, dword [esp + 0x24]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x42b590
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov cl, byte [eax + 0x5146e4]
xor cl, 0x7d
mov byte [eax + 0x5a991c], cl
inc eax
cmp eax, 0x6fb5
jb 0x42b592
mov eax, 0x5a991c
ret
Function at 0x42b600
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fa809
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
lea esi, [edi + 4]
mov ecx, esi
mov dword [esp + 0x14], esi
call fcn.004161fe
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [esp + 0x20], ebx
call fcn.004161fe
mov al, byte [esp + 0x28]
mov cl, byte [esp + 0x28]
mov byte [esi + 0xc], al
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov byte [esi + 0x1c], cl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
lea ebx, [edi + 0x3c]
push 0xa
mov ecx, ebx
mov dword [esp + 0x24], 1
call fcn.004f3a76
lea ebp, [edi + 0x58]
push 0xa
mov ecx, ebp
mov byte [esp + 0x24], 2
call fcn.004f3a70
mov edx, dword [esp + 0x28]
push 0x5a9818
push edx
mov ecx, esi
mov byte [esp + 0x28], 3
mov dword [edi], 0x51b69c
call fcn.00418550
push 1
push 0x1000
mov ecx, ebx
call fcn.004f3a6a
push 1
push 0x1000
mov ecx, ebp
call fcn.004f3a64
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x5a852c
call fcn.00416450
push esi
mov ecx, edi
call fcn.0042b9d0
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 4

Function at 0x42c540
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4faa4f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x38]
push 0x5a852c
push eax
mov dword [esp + 0x30], 2
xor esi, esi
nop
call 0x750783c0
add esp, 8
test eax, eax
je 0x42c591
push esi
lea ecx, [esp + 0x3c]
call fcn.00416318
mov esi, dword [eax]
xor ecx, ecx
lea edx, [esp + 0x10]
mov dword [esp + 0x12], ecx
push edx
mov dword [esp + 0x1a], ecx
push esi
mov dword [esp + 0x22], ecx
mov word [esp + 0x18], 0
mov word [esp + 0x26], cx
push ecx
lea ecx, [esp + 0x40]
call fcn.00416318
push eax
mov ecx, edi
call fcn.0042c360
lea ecx, [esp + 8]
call fcn.004161fe
cmp word [esp + 0x10], 8
mov byte [esp + 0x28], 3
jne 0x42c5e7
mov eax, dword [esp + 0x18]
lea ecx, [esp + 8]
push eax
call fcn.004f3aac
mov esi, dword [esp + 0x30]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0041644a
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x28], 2
call fcn.004161d4
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 1
call fcn.004161d4
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 0
call fcn.004161d4
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x42f150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4faed8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
push eax
nop
call 0x75eb3ed5
mov esi, dword [esp + 0x30]
test esi, esi
je 0x42f193
mov eax, dword [esi]
jmp 0x42f195
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
push eax
push edi
call dword [ecx + 0x6c]
test eax, eax
jge 0x42f1b1
push 0x59cff0
push edi
push eax
call fcn.00417083
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, edi
test esi, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov word [esp + 0xc], 0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
je 0x42f211
lea eax, [esi + 8]
push eax
nop
call 0x75bd13f0
test eax, eax
jne 0x42f211
mov eax, dword [esi]
test eax, eax
je 0x42f1f8
push eax
nop
call 0x75eb3e59
mov eax, dword [esi + 4]
test eax, eax
je 0x42f208
push eax
call fcn.00416306
add esp, 4
push esi
call fcn.00416306
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8

Function at 0x42f2d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4faf18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
push eax
nop
call 0x75eb3ed5
mov esi, dword [esp + 0x30]
test esi, esi
je 0x42f313
mov eax, dword [esi]
jmp 0x42f315
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x38]
push edx
push eax
push edi
call dword [ecx + 0x74]
test eax, eax
jge 0x42f336
push 0x59cff0
push edi
push eax
call fcn.00417083
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, edi
test esi, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov word [esp + 0xc], 0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
je 0x42f396
lea eax, [esi + 8]
push eax
nop
call 0x75bd13f0
test eax, eax
jne 0x42f396
mov eax, dword [esi]
test eax, eax
je 0x42f37d
push eax
nop
call 0x75eb3e59
mov eax, dword [esi + 4]
test eax, eax
je 0x42f38d
push eax
call fcn.00416306
add esp, 4
push esi
call fcn.00416306
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x430a10
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4fb2d4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [esp + 0x34]
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0041644a
lea eax, [edi + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x30], 0
call fcn.0041644a
lea ecx, [edi + 8]
mov byte [esp + 0x2c], 1
push ecx
lea ecx, [esi + 8]
call fcn.0041644a
lea edx, [edi + 0xc]
lea ecx, [esi + 0xc]
push edx
mov byte [esp + 0x30], 2
call fcn.0041644a
mov eax, dword [edi + 0x10]
lea ebx, [esi + 0x18]
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov ecx, ebx
mov byte [esp + 0x2c], 3
mov dword [esp + 0x34], ebx
call fcn.0041680a
lea edx, [edi + 0x18]
mov ecx, ebx
push edx
mov byte [esp + 0x30], 4
mov dword [ebx], 0x514470
call fcn.004f3962
lea ecx, [esp + 0x10]
call fcn.0041680a
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x514470
call fcn.00416804
lea ebx, [esi + 0x2c]
mov byte [esp + 0x2c], 5
mov ecx, ebx
mov dword [esp + 0x34], ebx
call fcn.0041680a
add edi, 0x2c
mov ecx, ebx
push edi
mov byte [esp + 0x30], 6
mov dword [ebx], 0x514470
call fcn.004f3962
lea ecx, [esp + 0x10]
call fcn.0041680a
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x514470
call fcn.00416804
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x436740
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4fb5bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.004368a0
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x5a852c
nop
call 0x75076afd
mov al, byte [esi]
mov ecx, dword [0x511cc4]
mov byte [esp + 0x24], al
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov edx, dword [ecx]
lea ecx, [esp + 0x24]
push edx
push ebx
push esi
mov byte [esp + 0x48], 1
nop
call 0x74a35552
mov eax, dword [0x511c30]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x4367eb
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4367e2
cmp al, 0xff
je 0x4367e2
dec al
mov byte [ecx], al
jmp 0x4367eb
push ecx
call fcn.00416306
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.004a47c0
mov eax, dword [esp + 0x28]
mov ecx, dword [0x511c30]
cmp eax, ebx
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x18], ecx
je 0x436837
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x43682e
cmp al, 0xff
je 0x43682e
dec al
mov byte [ecx], al
jmp 0x436837
push ecx
call fcn.00416306
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
nop
call 0x750614e3
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x43b5e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fbe08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
mov esi, ecx
mov eax, dword [esi + 0x30fc]
mov ecx, dword [esi + 0x3100]
mov dx, word [esi + 0x3104]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x3108]
mov dword [esp + 8], ecx
mov cx, word [esi + 0x310c]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x3110]
mov word [esp + 0xc], dx
mov dx, word [esi + 0x310e]
mov word [esp + 0x14], cx
mov ecx, dword [esi + 0x3114]
mov dword [esp + 0x18], eax
mov word [esp + 0x16], dx
mov edx, dword [esi + 0x3118]
lea eax, [esi + 0x311c]
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.0041644a
mov ecx, dword [esi + 0x3120]
mov edx, dword [esi + 0x3128]
mov eax, dword [esi + 0x3124]
mov dword [esp + 0x28], ecx
mov ecx, dword [esi + 0x3130]
mov dword [esp + 0x30], edx
mov edx, dword [esi + 0x3134]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
lea ecx, [esi + 0x3158]
xor edx, edx
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x50]
or al, 0xf0
cmp ecx, edx
mov dword [esp + 0x48], edx
mov dword [esp + 4], ecx
mov dword [esp + 0x2c], eax
je 0x43b6d1
mov eax, dword [esi + 0x3114]
cmp eax, edx
je 0x43b6cb
mov dword [esp + 0x1c], eax
jmp 0x43b6d5
mov dword [esp + 0x1c], esi
jmp 0x43b6d5
mov dword [esp + 0x1c], edx
lea edx, [esp + 4]
push edx
call fcn.00437e80
add esp, 4
lea ecx, [esp + 0x24]
mov esi, eax
mov dword [esp + 0x48], 0xffffffff
call fcn.004161d4
mov ecx, dword [esp + 0x40]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x48
ret 4
Function at 0x44c570
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4fd2d7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0
call fcn.004161fe
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], 1
call fcn.004161fe
lea ecx, [esp + 8]
mov byte [esp + 0x44], 2
call fcn.004161fe
push 0xa
lea ecx, [esp + 0x24]
mov byte [esp + 0x48], 3
call fcn.004f3a70
mov edi, dword [esp + 0x50]
lea ecx, [esp + 8]
push edi
mov byte [esp + 0x48], 4
call fcn.00416366
push 0x28
push edi
nop
call 0x7505dbeb
mov esi, eax
add esp, 8
test esi, esi
je 0x44c627
push esi
lea ecx, [esp + 0x14]
call fcn.00416366
sub esi, edi
lea eax, [esp + 0x50]
push esi
push eax
lea ecx, [esp + 0x10]
call fcn.004164f8
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x48], 5
call fcn.00416330
lea ecx, [esp + 0x50]
mov byte [esp + 0x44], 4
call fcn.004161d4
lea ecx, [esp + 8]
call fcn.004f3938
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.004f3b00
test eax, eax
jne 0x44c74d
mov eax, dword [esp + 8]
xor esi, esi
mov ecx, dword [eax - 8]
test ecx, ecx
jbe 0x44c68b
mov edi, dword [0x511e78]
mov al, byte [esi + eax]
mov byte [esp + 0x50], al
mov ecx, dword [esp + 0x50]
and ecx, 0xff
push ecx
call edi
add esp, 4
test eax, eax
mov eax, dword [esp + 8]
jne 0x44c683
cmp byte [esi + eax], 0x5f
jne 0x44c69e
mov ecx, dword [eax - 8]
inc esi
cmp esi, ecx
jb 0x44c65e
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
call fcn.00416330
jmp 0x44c733
push ebp
push 0x56
lea ecx, [esp + 0x14]
call fcn.004f3944
mov eax, dword [esp + 0xc]
mov ebp, dword [0x511e6c]
xor esi, esi
mov edi, dword [eax - 8]
xor ecx, ecx
push 8
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
push ecx
lea ecx, [esp + 0x14]
call fcn.00416318
lea edx, [eax + esi*8]
lea eax, [esp + 0x20]
push edx
push eax
call ebp
add esp, 0xc
xor eax, eax
mov cl, byte [eax + 0x59e100]
mov dl, byte [esp + eax + 0x1c]
add cl, al
xor dl, cl
mov byte [esp + eax + 0x1c], dl
inc eax
cmp eax, 8
jb 0x44c6df
lea edx, [esp + 0x1c]
push 8
lea eax, [esp + 0x58]
push edx
push eax
call fcn.00410fd0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], 6
call fcn.0041635a
lea ecx, [esp + 0x54]
mov byte [esp + 0x48], 4
call fcn.004161d4
mov ecx, edi
inc esi
shr ecx, 3
cmp esi, ecx
jbe 0x44c6b9
pop ebp
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push edx
push eax
lea ecx, [esp + 0x28]
call fcn.004f3932
mov ecx, eax
call fcn.00416366
mov esi, dword [esp + 0x4c]
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
push edx
push esi
call fcn.0041634e
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 3
call fcn.004f39e6
lea ecx, [esp + 8]
mov byte [esp + 0x44], 2
call fcn.004161d4
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 1
call fcn.004161d4
lea ecx, [esp + 0xc]
mov byte [esp + 0x44], 0
call fcn.004161d4
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x44e4f6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fd728
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0041679e
xor edi, edi
mov ecx, esi
mov dword [esp + 0x14], edi
mov dword [esi], 0x52da30
call fcn.00416798
xor eax, eax
xor ecx, ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x34], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x44fc38
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fd973
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0041679e
lea ecx, [esi + 0x30]
mov dword [esp + 0x20], 0
call fcn.004544f0
mov ecx, esi
mov byte [esp + 0x20], 1
mov dword [esi], 0x52e178
call fcn.00416798
xor ecx, ecx
xor eax, eax
push ecx
push ecx
mov dword [esi + 0x20], eax
push ecx
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], ecx
nop
call 0x75bd4c6b
mov dword [esi + 0x2c], eax
lea eax, [esp + 8]
push eax
mov ecx, esi
mov dword [esp + 0x14], 0
mov word [esp + 0xc], 2
call fcn.00451470
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x454870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fe089
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 8]
mov dword [esp + 0x1c], 1
mov ecx, edi
call fcn.004161fe
lea ebp, [esi + 0xc]
mov byte [esp + 0x1c], 2
mov ecx, ebp
call fcn.004161fe
lea ebx, [esi + 0x10]
mov byte [esp + 0x1c], 3
mov ecx, ebx
call fcn.004161fe
lea ecx, [esi + 0x14]
mov byte [esp + 0x1c], 4
call fcn.004161fe
push 0x5a852c
mov ecx, ebx
mov byte [esp + 0x20], 5
call fcn.00416366
lea eax, [esp + 0x28]
lea ecx, [esi + 0x14]
push eax
call fcn.00416330
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x1c], ecx
xor ebx, ebx
push 0x59b208
lea ecx, [esp + 0x28]
mov dword [esi], edx
mov dword [esi + 0x18], ebx
call fcn.004f39f8
push 0x5c
lea ecx, [esp + 0x28]
call fcn.00416468
push eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
call fcn.004164f8
push eax
mov ecx, ebp
mov byte [esp + 0x20], 6
call fcn.00416330
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 5
call fcn.004161d4
push 0x59b208
mov ecx, ebp
call fcn.00416504
mov ecx, dword [esp + 0x24]
push 0x5c
mov ebp, dword [ecx - 8]
lea ecx, [esp + 0x28]
call fcn.00416468
sub ebp, eax
lea edx, [esp + 0x2c]
push ebp
push edx
lea ecx, [esp + 0x2c]
call fcn.004164fe
push eax
mov ecx, edi
mov byte [esp + 0x20], 7
call fcn.00416330
mov byte [esp + 0x1c], 5
lea ecx, [esp + 0x2c]
call fcn.004161d4
push 0x59b208
mov ecx, edi
call fcn.004f39f8
push 0x59b208
mov ecx, edi
call fcn.00416504
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.00454a60
lea ecx, [esp + 0x2c]
call fcn.004161d4
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.004161d4
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004161d4
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10

Function at 0x4557f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x59e754
lea eax, [esp + 0x14]
push 0x5a9600
push eax
call fcn.0041631e
mov eax, dword [eax]
mov ebp, dword [0x511dec]
push 0x59b884
push eax
call ebp
add esp, 8
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.004161d4
mov ebx, dword [0x511dfc]
test edi, edi
je 0x455858
xor esi, esi
xor ecx, ecx
push edi
mov cl, byte [esi + 0x52e4f8]
xor ecx, 0x7d
push ecx
call ebx
add esp, 8
inc esi
cmp esi, 0xee28
jb 0x455833
push edi
nop
call 0x75063d79
add esp, 4
push 0x59e740
lea edx, [esp + 0x14]
push 0x5a9600
push edx
call fcn.0041631e
mov eax, dword [eax]
push 0x59b884
push eax
call ebp
add esp, 8
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.004161d4
test edi, edi
je 0x4558af
xor esi, esi
xor eax, eax
push edi
mov al, byte [esi + 0x53d320]
xor eax, 0x7d
push eax
call ebx
add esp, 8
inc esi
cmp esi, 0x16c60
jb 0x45588a
push edi
nop
call 0x75063d79
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x457ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fe578
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x55408c
mov eax, dword [esi + 0x28]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x14], edi
je 0x457f27
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x457f34
mov edx, dword [eax]
push eax
call dword [edx + 0x20]
mov eax, dword [esi + 0x28]
cmp eax, edi
je 0x457f44
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x28], edi
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x457f54
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x24], edi
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x457f64
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x20], edi
mov edx, dword [esi + 0x34]
mov edi, dword [0x511284]
push edx
call edi
mov eax, dword [esi + 0x38]
push eax
call edi
mov ecx, dword [esi + 0x30]
push ecx
call edi
mov edx, dword [esi + 0x2c]
push edx
call edi
mov ecx, esi
call fcn.00456d80
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00456d80
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x45b2e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 4], eax
lea edi, [ecx + ecx + 2]
push edi
nop
call 0x75059cee
mov esi, eax
add esp, 4
test esi, esi
jne 0x45b319
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push ebx
push esi
nop
call 0x750603a6
push esi
nop
call 0x7505fb25
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp + 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
cmp ecx, 1
mov eax, dword [eax + 0xc]
lea edx, [eax + 0xc]
mov dword [ebp + 8], edx
jne 0x45b35a
mov ebx, dword [edx]
mov dword [ebp + 8], edx
jmp 0x45b380
cmp ecx, 2
jne 0x45b36b
add eax, 0x14
mov edx, eax
mov dword [ebp + 8], eax
mov ebx, dword [edx]
jmp 0x45b380
cmp ecx, 3
jne 0x45b376
add eax, 0x1c
mov dword [ebp + 8], eax
mov edx, dword [ebp + 8]
mov ebx, dword [edx]
jmp 0x45b380
mov ecx, dword [ebp + 0xc]
mov esi, ebx
lea eax, [ecx*8]
sub esi, eax
mov ecx, 0x12
add esi, 8
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x250]
push eax
push ecx
nop
call 0x7506d4f8
lea edx, [ebp - 0x250]
push edx
nop
call 0x7505fb25
mov ecx, dword [ebp - 8]
push ecx
push eax
nop
call 0x7505bf71
add esp, 0x14
test eax, eax
je 0x45b3de
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov dword [ebp - 4], 1
mov dword [edx], eax
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [ecx + 4], edx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x50]
cmp eax, 1
je 0x45b3fb
cmp eax, 2
jne 0x45b3f3
mov ebx, dword [ebp - 0x48]
jmp 0x45b3fb
cmp eax, 3
jne 0x45b3fb
mov ebx, dword [ebp - 0x40]
cmp ebx, dword [ebp + 8]
jne 0x45b37d
mov eax, dword [ebp - 8]
push eax
nop
call 0x75059894
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret