joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4db3e8
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x4db4b0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x4db4b4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x4db4b0
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4db4a7
xor eax, eax
push ebp
push 0x4db4a0
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db4a7
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4db720
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4db934
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.00402874
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4db79e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x4db788
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00404614
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db7a5
mov eax, dword [ebp - 8]
call fcn.00402894
ret

Function at 0x4dcd00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.00402f8c
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x4dcd3a
cmp byte [ebp - 0xa], 0x31
jne 0x4dcd38
mov bl, 1
jmp 0x4dcd3a
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4de460
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0046d5e4
test al, al
je 0x4de51e
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
jmp 0x4de4fc
cmp word [esi + 0x5f2], 0
je 0x4de4b1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5f4]
call dword [esi + 0x5f0]
mov al, byte [esi + 0x5e8]
or al, byte [ebp - 9]
jne 0x4de4d3
cmp dword [ebp - 4], 0
jbe 0x4de4cf
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x4de4d3
xor ebx, ebx
jmp 0x4de4d5
mov bl, 1
test bl, bl
jne 0x4de51e
mov eax, dword [0x5b3894]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x4de51e
mov eax, dword [0x5b3894]
mov eax, dword [eax]
call fcn.00487550
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x4de51e
cmp byte [esi + 0x588], 0
jne 0x4de51e
mov edx, 0xfffffdf3
mov eax, esi
call fcn.004b8cb0
cmp eax, 4
jne 0x4de48e
mov byte [esi + 0x5e8], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e3324
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004048cc
xor eax, eax
push ebp
push 0x4e3389
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4e336c
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e99c8
mov eax, dword [ebp - 8]
call fcn.004e997c
push eax
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
jmp 0x4e336e
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3390
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404440
ret

Function at 0x4e3398
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004048cc
xor eax, eax
push ebp
push 0x4e3464
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4e343f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x60]
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4e3424
push pe_nt_image_headers32
lea eax, [ebx + 0x10d]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 4]
push eax
push ebx
push pe_nt_image_headers32
lea eax, [ebx + 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004e99c8
mov eax, dword [ebp - 0x10]
call fcn.004e997c
push eax
call sub.kernel32.dll_GetVolumeInformationA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
jmp 0x4e3428
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3446
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4e5858
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048cc
xor eax, eax
push ebp
push 0x4e594e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040441c
cmp dword [ebp - 4], 0
je 0x4e58b4
mov eax, dword [ebp - 4]
call fcn.004e9adc
test al, al
je 0x4e58b4
lea eax, [ebp - 0x109]
mov edx, dword [ebp - 4]
call fcn.0040a220
jmp 0x4e58c5
lea eax, [ebp - 0x109]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.0040a3c4
mov eax, dword [ebp - 0x110]
call fcn.004e9adc
test al, al
jne 0x4e5901
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x109]
call fcn.0040a3c4
mov eax, dword [ebp - 0x114]
call fcn.004e9d80
lea eax, [ebp - 0x109]
push eax
push 0
push 0x4e595c
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.0040a3c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5955
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.00404440
lea eax, [ebp - 4]
call fcn.0040441c
ret
Function at 0x4e7f90
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.004048cc
xor eax, eax
push ebp
push 0x4e8084
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004e51f4
test al, al
je 0x4e8058
xor edx, edx
push ebp
push 0x4e7ffa
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004e5964
mov edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
call fcn.00409b74
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e8004
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e5758
test al, al
jne 0x4e8032
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x524]
push eax
push 0x6232
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x98]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3200], 0
je 0x4e806e
cmp dword [ebp + 8], 0x20
je 0x4e806e
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048dc
push eax
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4e806e
mov eax, dword [ebp - 4]
add eax, 0x4d8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x3208]
call fcn.00404470
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e808b
lea eax, [ebp - 0xc]
call fcn.0040441c
ret

Function at 0x4e8524
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test edx, edx
jle 0x4e8550
mov ebx, dword [ecx]
movzx esi, byte [eax]
xor ebx, esi
and ebx, 0xff
mov esi, dword [0x5b376c]
movzx ebx, word [esi + ebx*2]
mov esi, dword [ecx]
shr esi, 8
xor ebx, esi
mov dword [ecx], ebx
inc eax
dec edx
test edx, edx
jg 0x4e852a
pop esi
pop ebx
ret

Function at 0x4e8718
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
mov edx, 0x5b5a3c
and eax, 0xff
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x5b36c0]
mov ebx, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul eax, dword [edx + 4], 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
mov ecx, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x5b36c0]
mov eax, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor eax, ecx
mov dword [edx + 8], eax
pop ebx
ret

Function at 0x4e8838
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x4e8861
call fcn.004e8818
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov al, byte [eax]
call fcn.004e8718
inc dword [esi]
dec ebx
jne 0x4e884a
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4e8868
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x4e889c
call fcn.004e8818
mov esi, eax
and esi, 0xff
mov eax, dword [edi]
mov al, byte [eax]
call fcn.004e8718
mov eax, esi
mov edx, dword [edi]
xor byte [edx], al
inc dword [edi]
dec ebx
jne 0x4e887b
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4e88c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.004048cc
xor eax, eax
push ebp
push 0x4e8973
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x4e895d
mov eax, dword [ebp + 8]
call fcn.004e877c
test eax, eax
jne 0x4e895d
xor ebx, ebx
call fcn.004e8818
xor edx, edx
mov dl, bl
xor al, byte [esi + edx + 0xc]
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
call fcn.004e8718
xor eax, eax
mov al, bl
mov dl, byte [ebp - 5]
mov byte [esi + eax], dl
inc ebx
cmp bl, 0xc
jne 0x4e8900
mov bl, byte [esi + 0xb]
and di, 8
cmp di, 8
je 0x4e894b
mov eax, dword [ebp - 4]
call fcn.0040784c
call fcn.00407850
cmp bl, al
sete al
mov ebx, eax
jmp 0x4e895d
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e897a
lea eax, [ebp + 8]
call fcn.0040441c
ret

Function at 0x4e9adc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048cc
xor eax, eax
push ebp
push 0x4e9b2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004048dc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4e9b11
test al, 0x10
jne 0x4e9b15
xor ebx, ebx
jmp 0x4e9b17
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9b34
lea eax, [ebp - 4]
call fcn.0040441c
ret

Function at 0x4e9c24
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x103
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x4e9c4c
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.0040468c
jmp 0x4e9c55
mov eax, ebx
xor edx, edx
call fcn.00404a68
add esp, 0x104
pop ebx
ret
Function at 0x4ea3a8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x4ea3c1
add esp, 0xfffffff0
call fcn.00403930
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebp + 0x10]
call fcn.004048cc
mov eax, dword [ebp + 0xc]
call fcn.004048cc
xor eax, eax
push ebp
push 0x4ea4b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx + 0x58], esi
mov eax, esi
mov dword [ebx + 0x34], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x3c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa4]
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x44], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa8]
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x2c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xac]
mov dword [ebx + 0x28], edx
mov eax, dword [eax + 0x558]
mov dword [ebx + 0x5c], eax
mov ax, word [ebp + 8]
and ax, 0xffff
cmp ax, 0xffff
jne 0x4ea461
lea edx, [ebp - 8]
mov eax, dword [ebp + 0x10]
call fcn.004e5858
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x64]
call fcn.00404470
lea eax, [ebx + 0x54]
mov edx, dword [ebp + 0xc]
call fcn.00404470
mov byte [ebx + 0x50], 1
jmp 0x4ea478
lea eax, [ebx + 0x64]
mov edx, dword [ebp + 0xc]
call fcn.00404470
lea eax, [ebx + 0x54]
call fcn.0040441c
mov byte [ebx + 0x50], 0
mov ax, word [ebp + 8]
push eax
mov ecx, dword [ebx + 0x64]
xor edx, edx
mov eax, ebx
call fcn.004e8d84
mov ax, word [ebp + 8]
mov word [ebx + 0x62], ax
mov byte [ebx + 0x60], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea4bf
lea eax, [ebp - 8]
call fcn.0040441c
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00404440
ret
Function at 0x4ee6f8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ee958
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4ee75b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004ee3a0
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e6b0
cmp al, 1
jne 0x4ee75b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004ee668
test al, al
je 0x4ee8e7
cmp dword [ebp - 8], 0
jge 0x4ee779
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004ee3a0
mov eax, dword [ebp - 0x210]
call fcn.004046dc
cmp ebx, eax
jge 0x4ee7c3
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004ee3a0
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x5b3c64]
and eax, 0xff
bt dword [edx], eax
jae 0x4ee7c3
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4ee7d7
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ee6d4
cmp ebx, dword [ebp - 8]
je 0x4ee8d9
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4ee803
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004037c8
and eax, 0x7f
movzx eax, word [eax*2 + 0x5af208]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4ee8c6
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004037c8
and eax, 0x7f
movzx eax, word [eax*2 + 0x5af208]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0046d2e0
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004037c8
and eax, 0x7f
movzx eax, word [eax*2 + 0x5af208]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0046d2e0
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee8cd
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4ee93a
cmp dword [ebp - 8], 0
jge 0x4ee8f2
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004ee3a0
mov eax, dword [ebp - 0x218]
call fcn.004046dc
cmp eax, dword [ebp - 8]
jg 0x4ee92c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004ee3a0
mov eax, dword [ebp - 0x21c]
call fcn.004046dc
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004ee6d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee95f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404440
ret
Function at 0x523e10
Capabilities:
Link many functions at runtime

Disassembly:
mov byte [0x5b062c], 0
mov eax, dword [0x5b3c84]
cmp dword [eax], 2
jne 0x523fe9
mov eax, dword [0x5b3474]
cmp dword [eax], 5
jl 0x523fe9
call fcn.00520fac
test al, al
jne 0x523e41
call fcn.00520fb8
call fcn.00520fa4
mov dword [0x5b0634], eax
push 0x523fec
mov eax, dword [0x5b0634]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b05f8], eax
cmp dword [0x5b05f8], 0
jne 0x523e9c
mov edx, 0x8000
mov eax, 0x524000
call fcn.0040f9ac
mov dword [0x5b0630], eax
mov eax, dword [0x5b0630]
mov dword [0x5b0634], eax
push 0x523fec
mov eax, dword [0x5b0634]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b05f8], eax
cmp dword [0x5b05f8], 0
je 0x523fe4
push 0x52400c
mov eax, dword [0x5b0634]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b05fc], eax
cmp dword [0x5b05fc], 0
je 0x523fe4
push 0x524018
mov eax, dword [0x5b0634]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b0600], eax
cmp dword [0x5b0600], 0
je 0x523fe4
mov byte [0x5b062c], 1
push 0x524028
mov eax, dword [0x5b0634]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b0604], eax
push 0x524034
mov eax, dword [0x5b0634]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b0608], eax
push 0x524040
mov eax, dword [0x5b0634]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b060c], eax
push 0x524050
mov eax, dword [0x5b0634]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b0610], eax
push 0x524060
mov eax, dword [0x5b0634]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b0614], eax
mov edx, 0x8000
mov eax, 0x524078
call fcn.0040f9ac
mov dword [0x5b0638], eax
cmp dword [0x5b0638], 0
je 0x523fe9
push 0x524088
mov eax, dword [0x5b0638]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b0618], eax
push 0x5240a4
mov eax, dword [0x5b0638]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b061c], eax
push 0x5240c4
mov eax, dword [0x5b0638]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b0620], eax
push 0x5240e0
mov eax, dword [0x5b0638]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b0624], eax
push 0x5240f8
mov eax, dword [0x5b0638]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x5b0628], eax
ret
call fcn.00523d90
ret
Function at 0x52671c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x526844
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00526608
mov eax, dword [esi]
call fcn.00405744
add eax, 0x28
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x51d2a0]
call fcn.00405900
add esp, 4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00402af4
mov ebx, 0x1c
mov eax, dword [ebp - 8]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00402af4
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00405744
mov dword [ebp - 0xc], eax
mov eax, dword [0x5b3b1c]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 8]
mov ecx, ebx
call fcn.0051e728
add ebx, 4
mov eax, dword [ebp - 8]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00402f8c
add ebx, 3
mov eax, dword [ebp - 8]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00405744
push eax
lea ecx, [ebp - 8]
mov eax, dword [esi]
xor edx, edx
call fcn.0051e628
mov edx, dword [ebp - 8]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.0051e440
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.0051e720
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52684b
lea eax, [ebp - 8]
mov edx, dword [0x51d2a0]
call fcn.00405a20
ret

Function at 0x539860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x5398d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
lea edx, [ebp - 8]
mov eax, dword [esi + 0x30]
call fcn.00408fc0
mov eax, dword [ebp - 8]
mov esi, dword [0x5b31bc]
mov esi, dword [esi]
mov edx, dword [ebx]
call esi
mov esi, eax
push ebx
mov ecx, esi
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.0040493c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5398d8
lea eax, [ebp - 8]
call fcn.0040441c
ret