joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d00
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x491e8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x284
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x8c]
mov esi, ecx
xor ebx, ebx
push 0x104
push eax
push ebx
mov dword [esi + 0x37ec], 2
mov dword [esi + 0x3808], ebx
mov dword [esi + 0x3804], ebx
mov dword [esi + 0x8d4], ebx
call fcn.004fb90f
nop
lea ecx, [esp + 0x8c]
push 0x5c
push ecx
call fcn.00454868
add esp, 8
lea ebp, [esi + 0x37f0]
lea edx, [esp + 0x8c]
mov ecx, ebp
push edx
mov word [eax + 2], bx
call fcn.00489b62
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x20]
mov edx, eax
push str.Sun_ExtA
mov dword [esp + 0x18], edx
lea edx, [esi + 0x37f4]
mov edi, edx
xor edx, edx
mov dword [edi], ebx
mov dword [edi + 4], edx
mov dword [edi + 8], ecx
mov ecx, 0x17
mov dword [edi + 0xc], eax
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x1c], 0x28
push eax
mov byte [esp + 0x34], bl
mov dword [esp + 0x30], 0x320
mov byte [esp + 0x37], 1
mov byte [esp + 0x38], 4
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], 3
mov byte [esp + 0x3b], bl
call fcn.004539f9
jmp loc.0051c3b7
Function at 0x411770
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx + 0x6048]
mov ebx, dword [ecx + 0x6054]
mov esi, dword [ecx + 0x6050]
lea eax, [edi + 0x205]
shl eax, 4
mov edx, dword [eax + ecx]
xor eax, eax
cmp ebx, eax
jg 0x41182e
jl 0x4117a6
cmp esi, edx
jae 0x41182e
sub edx, esi
mov esi, dword [esp + 0x18]
sbb eax, ebx
xor ebx, ebx
cmp ebx, eax
jg 0x4117ba
jl 0x4117bc
cmp esi, edx
jb 0x4117bc
mov esi, edx
shl edi, 4
xor eax, eax
mov ax, word [edi + ecx + 0x2056]
lea edx, [edi + ecx]
shl eax, 8
lea ebp, [eax + ecx + 0x44]
xor eax, eax
mov ax, word [edx + 0x2054]
sub eax, 0
je 0x411803
dec eax
jne 0x41182e
xor eax, eax
test esi, esi
jle 0x41182e
mov ecx, dword [esp + 0x14]
mov dl, byte [eax + ecx]
inc eax
not dl
mov byte [eax + ecx - 1], dl
cmp eax, esi
jl 0x4117ee
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [ecx + 0x6050]
xor ecx, ecx
and eax, 0xff
test esi, esi
jle 0x41182e
mov edi, dword [esp + 0x14]
mov dl, byte [eax + ebp]
mov bl, byte [ecx + edi]
xor bl, dl
inc eax
mov byte [ecx + edi], bl
and eax, 0xff
inc ecx
cmp ecx, esi
jl 0x411818
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x411c01
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x28]
push ebx
cdq
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, eax
push edi
mov edi, dword [esp + 0x30]
mov ebx, ecx
mov ecx, edx
add esi, ebp
mov dword [esp + 0x10], ebx
adc ecx, edi
xor eax, eax
test ebp, ebp
setl al
dec eax
xor edi, edi
and eax, ebp
cmp edi, ecx
cdq
mov dword [esp + 0x24], edx
mov edx, dword [ebx + 0x24]
mov dword [esp + 0x14], edx
jg 0x411baa
jl 0x411ba4
cmp edx, esi
jae 0x411baa
mov dword [esp + 0x1c], edi
jmp 0x411bb0
mov edx, esi
mov dword [esp + 0x1c], ecx
mov edi, dword [ebx + 0x20]
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x38], edi
xor edi, edi
cmp edi, ebx
jl 0x411bd3
jg 0x411bc9
cmp dword [esp + 0x38], ebp
jbe 0x411bd3
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x18], ebx
jmp 0x411bdb
mov edi, dword [esp + 0x30]
mov dword [esp + 0x18], ebp
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x14]
add ebx, edi
xor edi, edi
cmp edi, ecx
jg 0x411bfd
jl 0x411bf5
cmp ebx, esi
jae 0x411bfd
mov esi, ebx
mov dword [esp + 0x30], edi
jmp 0x411c01
mov dword [esp + 0x30], ecx
sub edx, eax
mov edi, edx
mov edx, dword [esp + 0x18]
sub esi, edx
test edi, edi
mov ebx, esi
jle 0x411c52
mov edx, dword [esp + 0x34]
mov ecx, dword [0x4b5580]
mov esi, eax
push 0
sub esi, ebp
push ecx
add esi, edx
mov edx, dword [esp + 0x2c]
push edx
push eax
call fcn.00455100
xor ecx, ecx
test edi, edi
jle 0x411c52
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x28]
mov dl, byte [edx + eax]
xor byte [ecx + esi], dl
inc eax
xor edx, edx
div dword [0x4b5580]
inc ecx
cmp ecx, edi
mov eax, edx
jl 0x411c35
test ebx, ebx
jle 0x411c9b
mov eax, dword [esp + 0x18]
mov ecx, dword [0x4b5580]
mov edx, dword [esp + 0x1c]
mov esi, eax
push 0
sub esi, ebp
mov ebp, dword [esp + 0x38]
push ecx
push edx
push eax
add esi, ebp
call fcn.00455100
xor ecx, ecx
test ebx, ebx
jle 0x411c9b
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x28]
mov dl, byte [edx + eax]
xor byte [ecx + esi], dl
inc eax
xor edx, edx
div dword [0x4b5580]
inc ecx
cmp ecx, ebx
mov eax, edx
jl 0x411c7e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x41b950
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x492600
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 8], 0x499a98
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], ebx
call fcn.00411ee0
mov eax, dword [esp + 0x10]
lea edx, [esp + 8]
mov dword [esp + 0x34], edx
lea ecx, [esp + 0x20]
cdq
mov byte [esp + 0x48], 1
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
call fcn.00412c90
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x20]
push eax
push ecx
call fcn.0041b850
lea ecx, [esp + 0x20]
mov esi, eax
mov byte [esp + 0x48], bl
call fcn.00411f20
mov ecx, dword [esp + 0x40]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 0xc
Function at 0x424ec8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x492a21
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov ebp, dword [0x49835c]
push edi
mov edi, ecx
xor ebx, ebx
xor esi, esi
mov eax, dword [edi + 0x70]
mov dword [esp + 0x10], edi
cmp eax, ebx
jne 0x424f51
add edi, 0xa4
push edi
call ebp
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp dword [ecx + 0xc8], ebx
sete al
cmp eax, ebx
je 0x424f39
push 0x98
call fcn.00489704
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
cmp esi, ebx
mov dword [esp + 0x20], ebx
je 0x424f27
lea eax, [esi + 4]
push eax
call fcn.00508084
nop
mov dword [esi + 0x2c], 0x499b80
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 0x11
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], 0xa
push 0xa
lea ecx, [esi + 0x50]
mov byte [esp + 0x24], 2
call fcn.004259a0
mov eax, dword [0x4c99a0]
mov dword [esp + 0x20], 0xffffffff
mov dword [esi + 0x8c], eax
mov byte [esi + 0x84], bl
jmp 0x424f46
xor esi, esi
mov dword [esp + 0x20], 0xffffffff
mov byte [esi + 0x84], bl
jmp 0x424f46
add ecx, 0xbc
call fcn.00485f25
mov esi, eax
push edi
call dword [0x498360]
mov edi, dword [esp + 0x10]
lea eax, [esi + 4]
push eax
call ebp
mov eax, dword [esi + 0x38]
mov dword [esi + 0x1c], ebx
cmp eax, ebx
mov dword [esi], 0xffffffff
mov dword [esi + 0x20], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x88], ebx
je 0x424fbd
mov ebp, dword [esi + 0x30]
cmp ebp, ebx
je 0x424fa0
mov eax, dword [esi + 0x34]
cmp eax, ebx
jbe 0x424fa0
mov ecx, ebp
mov edx, eax
mov eax, dword [ecx]
cmp eax, ebx
je 0x424f9a
mov eax, dword [eax]
cmp eax, ebx
jne 0x424f94
add ecx, 4
dec edx
jne 0x424f8e
push ebp
call fcn.0048972d
mov ecx, dword [esi + 0x40]
add esp, 4
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
call fcn.00485fc3
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x5c], ebx
je 0x425003
mov ebp, dword [esi + 0x54]
cmp ebp, ebx
je 0x424fe6
mov eax, dword [esi + 0x58]
cmp eax, ebx
jbe 0x424fe6
mov ecx, ebp
mov edx, eax
mov eax, dword [ecx]
cmp eax, ebx
je 0x424fe0
mov eax, dword [eax]
cmp eax, ebx
jne 0x424fda
add ecx, 4
dec edx
jne 0x424fd4
push ebp
call fcn.0048972d
mov ecx, dword [esi + 0x64]
add esp, 4
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
call fcn.00485fc3
mov dword [esi + 0x64], ebx
or eax, 0xffffffff
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov edx, dword [edi]
push esi
mov ecx, edi
call dword [edx + 8]
lea eax, [esi + 4]
push eax
call dword [0x498360]
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x42d860
Capabilities:
Access peb ldr_data
Enumerate devices by category

Disassembly:
push 0xffffffffffffffff
push 0x493260
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
xor ebx, ebx
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x30], ebx
push eax
push 0x4b6688
push 0x17
push ebx
push 0x49e300
call dword [0x4987cc]
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x10]
lea edx, [esp + 8]
push ebx
push edx
mov ecx, dword [eax]
push 0x49e2c0
push eax
mov byte [esp + 0x40], 1
call dword [ecx + 0xc]
test eax, eax
jl 0x42da05
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x42da09
push ebp
push esi
push edi
mov dword [esp + 0x10], ebx
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push ebx
push edx
push 1
push eax
mov byte [esp + 0x4c], 2
call dword [ecx + 0xc]
test eax, eax
jne 0x42d9ef
mov edi, dword [0x498434]
mov ebp, dword [0x498438]
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 0x4a1960
mov ecx, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x50], 3
call dword [ecx + 0x24]
mov word [esp + 0x24], bx
push 0x4b65bc
call edi
mov esi, eax
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x24]
push ebx
push edx
mov ecx, dword [eax]
push esi
push eax
mov byte [esp + 0x4c], 5
call dword [ecx + 0xc]
push esi
mov byte [esp + 0x40], 4
call ebp
mov eax, dword [esp + 0x2c]
push eax
push 0x4d3b70
call fcn.004552a4
add esp, 8
test eax, eax
je 0x42d9a5
lea ecx, [esp + 0x24]
push ecx
call dword [0x498430]
mov eax, dword [esp + 0x18]
mov byte [esp + 0x3c], 2
cmp eax, ebx
je 0x42d97e
mov edx, dword [eax]
push eax
call dword [edx + 8]
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.00413ff0
lea edx, [esp + 0x10]
push ebx
mov eax, dword [esp + 0x18]
push edx
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
je 0x42d8fb
jmp 0x42d9ef
mov eax, dword [esp + 0x48]
cmp eax, ebx
je 0x42d9bb
mov ecx, dword [esp + 0x2c]
push ecx
push eax
call fcn.004539f9
add esp, 8
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x10]
push ecx
push 0x49e180
mov edx, dword [eax]
push ebx
push ebx
push eax
call dword [edx + 0x20]
lea edx, [esp + 0x24]
push edx
call dword [0x498430]
mov eax, dword [esp + 0x18]
mov byte [esp + 0x3c], 2
cmp eax, ebx
je 0x42d9ef
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
pop edi
cmp eax, ebx
pop esi
mov byte [esp + 0x34], 1
pop ebp
je 0x42da05
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 8]
cmp eax, ebx
mov byte [esp + 0x30], bl
je 0x42da17
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
cmp eax, ebx
je 0x42da2d
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x38]
cmp dword [eax], ebx
jne 0x42da5f
push eax
push 0x4b3258
push 0x17
push ebx
push str._h7y
call dword [0x4987cc]
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x42da5f
push str.DSound_Render
push eax
call fcn.004539f9
add esp, 8
mov ecx, dword [esp + 0x28]
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 8
Function at 0x42e0b0
Capabilities:
Create thread

Disassembly:
sub esp, 0x20
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
lea eax, [esp]
push ebp
push eax
push 0
push ecx
push edx
push 0
push 0
mov dword [esp + 0x1c], 0
call fcn.00454b93
mov ebp, eax
add esp, 0x18
test ebp, ebp
jne 0x42e0e6
pop ebp
add esp, 0x20
ret 8
push 0x32
push ebp
call dword [0x498328]
test eax, eax
je 0x42e14c
push ebx
mov ebx, dword [0x4985a0]
push esi
jmp loc.0052eeb7

Function at 0x433ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x493a88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1c]
push edi
mov dword [esp + 8], esi
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
lea eax, [esi + 0x34]
xor edx, edx
mov ecx, eax
mov dword [esi], 0x49a9e8
xor edi, edi
push 0x1f800
mov dword [ecx], edx
mov dword [esp + 0x18], edi
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], edx
mov dword [eax], esi
mov dword [esi + 0x38], 0x434bc0
call fcn.00489704
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
add eax, 0xfc00
mov dword [esi + 0x28], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x435110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x493bfd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
xor ebx, ebx
mov dword [esp + 0x1c], ebx
lea esi, [edi + 0x2c8]
mov dword [esp + 0x10], esi
mov dword [esi], 0x49a670
mov dword [esi + 0xc], 0x49a634
mov dword [esi + 0x10], 0x49a620
mov eax, dword [esi + 0x6b4]
mov byte [esp + 0x1c], 8
push eax
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
call fcn.0048972d
add esp, 4
lea ecx, [esi + 0x688]
call fcn.00448b70
lea ecx, [esi + 0x238]
mov byte [esp + 0x1c], 7
call fcn.00416350
lea ecx, [esi + 0x188]
mov byte [esp + 0x1c], 6
call fcn.00443ef0
lea ecx, [esi + 0xa0]
mov byte [esp + 0x1c], 5
call fcn.00446400
mov ecx, esi
mov byte [esp + 0x1c], 4
call fcn.00443330
lea esi, [edi + 0x30]
mov dword [esp + 0x10], esi
mov dword [esi], 0x49a490
mov dword [esi + 0xc], 0x49a454
mov dword [esi + 0x10], 0x49a440
lea ecx, [esi + 0x238]
mov byte [esp + 0x1c], 0xb
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
call fcn.00442dc0
lea ecx, [esi + 0x188]
mov byte [esp + 0x1c], 0xa
call fcn.00443ef0
lea ecx, [esi + 0xa0]
mov byte [esp + 0x1c], 9
call fcn.00446400
mov ecx, esi
mov byte [esp + 0x1c], 3
call fcn.00443330
mov eax, dword [edi + 0x2c]
mov byte [esp + 0x1c], 2
cmp eax, ebx
je 0x435231
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi + 0x28]
mov byte [esp + 0x1c], 1
cmp eax, ebx
je 0x435243
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [edi + 0x24]
mov byte [esp + 0x1c], bl
cmp eax, ebx
je 0x435254
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [edi + 0x20]
mov dword [esp + 0x1c], 0xffffffff
cmp edi, ebx
je 0x435269
mov edx, dword [edi]
push edi
call dword [edx + 8]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x436f00
Capabilities:
Create thread

Disassembly:
jmp 0x436f10
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
cmp ecx, 0x69
jne 0x436f2f
mov eax, dword [esp + 0xc]
mov dword [esi + 0x21c], eax
mov eax, 1
pop esi
ret 0xc
cmp ecx, 2
jne 0x436f3e
mov eax, dword [esi + 0x21c]
pop esi
ret 0xc
mov eax, dword [esi + 0x22c]
test eax, eax
je case.0x436f79.8
mov edx, dword [esi + 0x230]
test edx, edx
je case.0x436f79.8
mov edx, dword [esi + 0x224]
test edx, edx
jne case.0x436f79.8
cmp ecx, 0x6a
ja case.0x436f79.8
xor edx, edx
mov dl, byte [ecx + 0x437088]
jmp dword [edx*4 + 0x437064]
lea edx, [esp + 0x10]
mov dword [esp + 0xc], 0
mov ecx, dword [eax]
push edx
lea edx, [esp + 0xc]
push edx
lea edx, [esp + 0x14]
push edx
push eax
call dword [ecx + 0x10]
mov eax, dword [esp + 0xc]
pop esi
ret 0xc
mov eax, dword [esi + 0x378]
pop esi
ret 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.00437200
pop esi
ret 0xc
push 1
mov ecx, esi
call fcn.004376d0
pop esi
ret 0xc
push 0
mov ecx, esi
call fcn.004376d0
pop esi
ret 0xc
mov edx, dword [esi + 0x220]
push edx
call dword [0x49837c]
lea eax, [esp + 0xc]
mov dword [esi + 0x220], 0
push eax
push 0
push esi
push 0x4379c0
push 0
push 0
mov dword [esi + 0x224], 1
mov dword [esp + 0x24], 0
call fcn.00454b93
add esp, 0x18
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0x220], eax
mov eax, ecx
pop esi
ret 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
mov ecx, esi
call fcn.004386b0
pop esi
ret 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
mov ecx, esi
call fcn.00437340
pop esi
ret 0xc
xor eax, eax
pop esi
ret 0xc
Function at 0x436fec
Capabilities:
Create thread

Disassembly:
jmp 0x436f10
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
cmp ecx, 0x69
jne 0x436f2f
mov eax, dword [esp + 0xc]
mov dword [esi + 0x21c], eax
mov eax, 1
pop esi
ret 0xc
cmp ecx, 2
jne 0x436f3e
mov eax, dword [esi + 0x21c]
pop esi
ret 0xc
mov eax, dword [esi + 0x22c]
test eax, eax
je case.0x436f79.8
mov edx, dword [esi + 0x230]
test edx, edx
je case.0x436f79.8
mov edx, dword [esi + 0x224]
test edx, edx
jne case.0x436f79.8
cmp ecx, 0x6a
ja case.0x436f79.8
xor edx, edx
mov dl, byte [ecx + 0x437088]
jmp dword [edx*4 + 0x437064]
lea edx, [esp + 0x10]
mov dword [esp + 0xc], 0
mov ecx, dword [eax]
push edx
lea edx, [esp + 0xc]
push edx
lea edx, [esp + 0x14]
push edx
push eax
call dword [ecx + 0x10]
mov eax, dword [esp + 0xc]
pop esi
ret 0xc
mov eax, dword [esi + 0x378]
pop esi
ret 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.00437200
pop esi
ret 0xc
push 1
mov ecx, esi
call fcn.004376d0
pop esi
ret 0xc
push 0
mov ecx, esi
call fcn.004376d0
pop esi
ret 0xc
mov edx, dword [esi + 0x220]
push edx
call dword [0x49837c]
lea eax, [esp + 0xc]
mov dword [esi + 0x220], 0
push eax
push 0
push esi
push 0x4379c0
push 0
push 0
mov dword [esi + 0x224], 1
mov dword [esp + 0x24], 0
call fcn.00454b93
add esp, 0x18
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0x220], eax
mov eax, ecx
pop esi
ret 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
mov ecx, esi
call fcn.004386b0
pop esi
ret 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
mov ecx, esi
call fcn.00437340
pop esi
ret 0xc
xor eax, eax
pop esi
ret 0xc
Function at 0x443330
Capabilities:
Packed with generic packer

Disassembly:
push 0xffffffffffffffff
push 0x49453e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov ecx, dword [esi + 0x8c]
mov dword [esp + 0x14], 2
test ecx, ecx
je 0x443367
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
mov ecx, dword [esi + 0x90]
test ecx, ecx
je 0x443378
mov edx, dword [ecx]
push 1
call dword [edx + 0xc]
jmp 0x51b668

Function at 0x44a2f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x494c44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 0x4c]
mov dword [esi], 0x49e878
mov dword [esi + 4], edi
push 2
lea ecx, [esi + 0x14]
mov dword [esp + 0x1c], 0
call fcn.0044ac40
push 2
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], 1
call fcn.0044ac40
push 2
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.0044ac40
push 0x18
mov byte [esp + 0x1c], 3
mov dword [esi], 0x49eaec
mov dword [esi + 0x10], 2
mov dword [esi + 0x68], 1
mov dword [esi + 0xc], 0
call fcn.00489704
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov byte [esp + 0x18], 4
je 0x44a38d
push 0x20
mov ecx, eax
call fcn.0044aa80
jmp 0x44a38f
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 8], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x44a7f0
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [ecx], 0x49eb20
jmp fcn.0044a3d0

Function at 0x454180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov ecx, edi
test edi, edi
mov dword [ebp - 4], edi
mov dword [ebp + 8], ecx
jne 0x454103
xor eax, eax
jmp 0x4541ac
mov esi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
je 0x454116
mov eax, dword [esi + 0x18]
mov dword [ebp + 0x14], eax
jmp 0x454122
mov dword [ebp + 0x14], 0x1000
jmp 0x454122
mov ecx, dword [ebp + 8]
test word [esi + 0xc], 0x10c
je 0x454154
mov eax, dword [esi + 4]
test eax, eax
je 0x454154
cmp ecx, eax
mov edi, ecx
jb 0x454139
mov edi, eax
push edi
push dword [esi]
push ebx
call fcn.00455e80
sub dword [ebp + 8], edi
sub dword [esi + 4], edi
add dword [esi], edi
add esp, 0xc
add ebx, edi
mov edi, dword [ebp - 4]
jmp 0x45419f
cmp ecx, dword [ebp + 0x14]
jb 0x454187
cmp dword [ebp + 0x14], 0
mov eax, ecx
je 0x45416a
xor edx, edx
div dword [ebp + 0x14]
mov eax, ecx
sub eax, edx
push eax
push ebx
push dword [esi + 0x10]
call fcn.004589bc
add esp, 0xc
test eax, eax
je 0x4541b1
cmp eax, 0xffffffff
je 0x4541b7
sub dword [ebp + 8], eax
add ebx, eax
jmp 0x45419f
push esi
call fcn.004588e0
cmp eax, 0xffffffff
pop ecx
je 0x4541bb
mov byte [ebx], al
mov eax, dword [esi + 0x18]
inc ebx
dec dword [ebp + 8]
mov dword [ebp + 0x14], eax
cmp dword [ebp + 8], 0
jne 0x45411f
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret
or dword [esi + 0xc], 0x10
jmp 0x4541bb
or dword [esi + 0xc], 0x20
mov eax, edi
xor edx, edx
sub eax, dword [ebp + 8]
div dword [ebp + 0xc]
jmp 0x4541ac
Function at 0x466c80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2288
push 0x4535d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004fb91e
nop
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x466d1b
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x466d1b
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
mov esi, dword [ebp + 0xc]
cmp esi, edi
jb 0x466d1b
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x466d1b
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret