joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413a70
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x413c94
sub esp, 0x18
mov eax, dword [0x5e9834]
test eax, eax
jne 0x413c7d
nop
lea eax, [0x5e9820]
mov dword [esp], eax
call fcn.004098f0
mov eax, dword [0x5e9824]
test eax, eax
je 0x413ab9
cmp dword [eax + 8], 0xcc
jne 0x413b2f
mov edx, dword [0x5e9818]
test edx, edx
jne 0x413b11
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5ec070]
mov dword [esp + 8], eax
call fcn.0040bce0
mov eax, dword [esp + 0xc]
mov dword [0x5e9818], eax
mov ecx, dword [0x5e97dc]
mov dword [eax], ecx
mov eax, dword [0x5e9818]
mov dword [0x5e97dc], eax
movzx eax, byte [0x5e9ce0]
test al, al
jne 0x413b11
xor eax, eax
jmp 0x413c29
mov edx, dword [0x5e9818]
mov ebx, dword [edx + 4]
mov dword [0x5e9818], ebx
mov ebx, dword [0x5e9824]
mov dword [edx + 4], ebx
mov dword [0x5e9824], edx
mov edx, dword [0x5e9824]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x413c11
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402140
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x5e99f0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x413b8d
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x413b9a
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00460a20
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x5e99f0]
test edx, edx
jne 0x413bc6
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x413be7
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00460a20
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00460a20
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00460a20
nop
lea eax, [0x5e9820]
mov dword [esp], eax
call fcn.00409af0
nop
lea eax, [0x5e981c]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.004022c0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00460ab0
lea esi, [0x5e9ce0]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x413b11
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x413c73
lea edx, [0x5ae35c]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x413c1b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00460aa0
mov ecx, 5
call fcn.00460aa0
lea eax, [0x4f7c42]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00434fb0
nop
call fcn.0045f610
jmp fcn.00413a70
Function at 0x427090
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x427200
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00424e20
mov eax, dword [esp + 4]
test eax, eax
je 0x4271e9
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.00422ba0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.004098f0
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x427127
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x42718d
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x42713c
cmp byte [ebp + 6], dl
je 0x427147
cmp esi, ebx
ja 0x42718d
jne 0x427125
cmp byte [ebp + 6], dl
jbe 0x427125
jmp 0x42718d
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409af0
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x427184
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x427184
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.00426f90
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00409af0
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x4271e0
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x4271e0
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x4f9060]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00434fb0
nop
call fcn.0045f610
jmp fcn.00427090
Function at 0x427680
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42779c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x427715
cmp cl, 2
je 0x4276bd
cmp cl, 3
jne 0x427785
mov byte [eax + 8], 1
jmp 0x427781
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042c8b0
nop
lea eax, [0x5cddd8]
mov dword [esp], eax
call fcn.004098f0
nop
mov eax, dword [0x5cdda4]
sub eax, dword [0x5cdd88]
mov dword [0x5cdda4], eax
mov eax, dword [0x5cdd94]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5cdd94], ecx
nop
lea eax, [0x5cddd8]
mov dword [esp], eax
call fcn.00409af0
jmp 0x427781
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413a70
nop
lea eax, [0x5cddd8]
mov dword [esp], eax
call fcn.004098f0
nop
mov eax, dword [0x5cdd7c]
sub eax, dword [0x5cdd60]
mov dword [0x5cdd7c], eax
mov eax, dword [0x5cdd6c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5cdd6c], ecx
nop
nop
lea eax, [0x5cddd8]
mov dword [esp], eax
call fcn.00409af0
add esp, 0x14
ret
lea eax, [0x4f49cf]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00434fb0
nop
call fcn.0045f610
jmp fcn.00427680
Function at 0x42d2a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42d372
sub esp, 0x30
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42d2dd
lea eax, [0x4f2ff5]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.00439750
movzx ecx, byte [esp + 0x40]
mov dword [esp + 8], 0
mov edx, dword [esp + 0x38]
test edx, edx
jne 0x42d2f1
test cl, cl
jmp 0x42d35f
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00460bf7
lea ecx, [0x42d380]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], ecx
movzx ecx, byte [esp + 0x40]
mov byte [esp + 0x28], cl
lea edx, [esp + 8]
mov dword [esp + 0x2c], edx
lea edx, [esp + 0xc]
mov dword [esp], edx
call fcn.0045f500
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42d366
call fcn.00439880
mov eax, dword [esp + 8]
mov dword [esp + 0x44], eax
add esp, 0x30
ret
call fcn.0045f610
jmp fcn.0042d2a0
Function at 0x4501d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x450357
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x45034d
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x45022c
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x45022c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x45023f
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x450322
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x450314
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x45030b
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x450296
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x4502df
mov eax, 1
cmp eax, ecx
ja 0x4502cd
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00460b10
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x450306
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x4502d2
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x45029b
call fcn.00460ab0
xor eax, eax
mov ecx, eax
call fcn.00460aa0
call fcn.00460b10
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x450348
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x450319
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x450244
call fcn.00460ab0
xor eax, eax
mov ecx, eax
call fcn.00460aa0
nop
call fcn.0045f610
jmp fcn.004501d0
Function at 0x454720
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x454820
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00454fb0
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4d8920]
mov dword [esp], ecx
call fcn.0040b990
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x5cde70]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.00453fa0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.004533c0
add esp, 0x28
ret
call fcn.0045f610
jmp fcn.00454720
Function at 0x457d90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x457e2f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00460bf7
lea ecx, [0x457e40]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0045f500
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0045f610
jmp fcn.00457d90
Function at 0x4608d0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x5e9ac0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45f09b
je 0x45f0ee
cmp ebx, 0x20
jbe 0x45f0f4
cmp ebx, 0x40
jbe 0x45f13a
jmp 0x45f1db
test ebx, ebx
je 0x45f0e4
add eax, 0x10
test ax, 0xff0
je 0x45f0d0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x523160]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x523260]
jmp 0x45f0b8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45f0b8
pxor xmm1, xmmword [0x5e9ad0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5e9ad0]
pxor xmm2, xmmword [0x5e9ae0]
pxor xmm3, xmmword [0x5e9af0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5e9ad0]
pxor xmm2, xmmword [0x5e9ae0]
pxor xmm3, xmmword [0x5e9af0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45f23a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x5e978d], 0
je 0x4608ea
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45f060
jmp fcn.004082d0
Function at 0x4608f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x402b2e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004082d0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045f610
jmp 0x402af0
cmp byte [0x5e978d], 0
je 0x46090b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45f060
jmp 0x402af0
Function at 0x4c5220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c5345
sub esp, 0x48
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
test ecx, ecx
jne 0x4c532c
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ecx, dword [ecx + 0x10]
mov dword [esp], edx
call ecx
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 4]
mov dword [esp + 0x44], edx
mov ebx, dword [eax + 0xc]
mov ecx, dword [ecx + 0x10]
mov dword [esp], ebx
call ecx
mov eax, dword [esp + 4]
mov dword [esp], eax
mov dword [esp + 4], 0xfffffffa
call fcn.004c3000
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x50]
mov dword [esp], ecx
movzx ecx, byte [esp + 0x54]
mov byte [esp + 4], cl
movzx ecx, word [esp + 0x56]
mov word [esp + 6], cx
mov ecx, dword [esp + 0x58]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0xc], ecx
movzx ecx, byte [esp + 0x60]
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
call fcn.004c2750
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov dword [ecx], eax
mov dword [esp], ecx
call fcn.004c5350
add esp, 0x48
ret
lea eax, [0x4db020]
mov dword [esp], eax
lea eax, [0x522958]
mov dword [esp + 4], eax
call fcn.00434880
nop
call fcn.0045f610
jmp fcn.004c5220
Function at 0x4c66c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c67bc
sub esp, 0x44
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
test ecx, ecx
jne 0x4c67a3
mov ecx, dword [0x5c451c]
lea edx, [0x4db940]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.0040e480
mov eax, dword [esp + 0xc]
test byte [eax], al
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp], ecx
movzx ecx, byte [esp + 0x50]
mov byte [esp + 4], cl
movzx ecx, word [esp + 0x52]
mov word [esp + 6], cx
mov ecx, dword [esp + 0x54]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x58]
mov dword [esp + 0xc], ecx
movzx ecx, byte [esp + 0x5c]
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
call fcn.004c2750
add esp, 0x44
ret
lea eax, [0x4db020]
mov dword [esp], eax
lea eax, [0x522968]
mov dword [esp + 4], eax
call fcn.00434880
nop
call fcn.0045f610
jmp fcn.004c66c0
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x403e59
pop dword [ebp - 0x38]
mov eax, 0x403e59
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x7eb5ff7b
sub dword [ebp - 0x48], 0x3063ba30
mov dword [ebp - 0x44], 0x17d05ffd
add dword [ebp - 0x44], 0x1a62ec48
mov dword [ebp - 0x40], 0x6399f10
add dword [ebp - 0x40], 0x4612a51e
mov dword [ebp - 0x3c], 0xb6feb116
add dword [ebp - 0x3c], 0x49014eea
lea eax, [ebp - 0x48]
push eax
mov eax, 0x2daff943
sub eax, 0x2d6f88df
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x70d9cf5a
add dword [ebp - 0x48], 0x39899fc
mov dword [ebp - 0x44], 0xa3fe21e1
add dword [ebp - 0x44], 0x9d6e3f94
mov dword [ebp - 0x40], 0x99273b07
sub dword [ebp - 0x40], 0x35b7ce9b
mov dword [ebp - 0x3c], 0x62cd35a3
add dword [ebp - 0x3c], 0x9d32ca5d
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x63356903
sub eax, 0x62f4f85b
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x369e9
push 0
call eax
mov ecx, 0x42b32b77
add ecx, 0xbd4d1c06
mov esi, eax
mov edx, 0x410000
add edx, dword [ebp - 0x38]
mov edi, 0x9a08507
sub edi, 0x676f10b0
sub dword [ebp - 0x34], esi
mov ebx, dword [edx]
xor dword [ebp - 0x24], 0xbbe14429
sub ebx, edi
add dword [ebp - 4], 0x888105cb
mov dword [esi], ebx
add esi, 0xf3f42444
add esi, 0xc0bdbc0
add edx, 0x9961335b
sub edx, 0x99613357
loop 0x403f70
add eax, 0xee5bc9ce
sub eax, 0xee5ab907
xor ebx, ebx
add ebx, eax
add eax, 0x848ffa91
add eax, 0x7b700574
mov ecx, 0xa5ff7191
sub ecx, 0xa5bf7191
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10024a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10024a2f
pop dword [ebp - 0x14]
mov eax, 0x10024a2f
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xe0fd63fe
add dword [ebp - 0x24], 0x6d54e14d
mov dword [ebp - 0x20], 0xdd34aaf6
sub dword [ebp - 0x20], 0xab015eb1
mov dword [ebp - 0x1c], 0x5d996f47
add dword [ebp - 0x1c], 0xeeb2d4e7
mov dword [ebp - 0x18], 0xf9c23032
add dword [ebp - 0x18], 0x63dcfce
lea eax, [ebp - 0x24]
push eax
mov eax, 0xd69c0b9c
add eax, 0x3968652c
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x1da6055d
add dword [ebp - 0x24], 0x56cc63f9
mov dword [ebp - 0x20], 0x1cda7cdb
add dword [ebp - 0x20], 0x2491e49a
mov dword [ebp - 0x1c], 0x95b5beb7
sub dword [ebp - 0x1c], 0x3246524b
mov dword [ebp - 0x18], 0x37b74a35
add dword [ebp - 0x18], 0xc848b5cb
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xd967e95
add eax, 0x26df24f
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x4643b
push 0
call eax
mov ecx, 0xe66a1bc
add ecx, 0xf199b56c
xor esi, esi
add esi, eax
mov edx, 0x1456e398
sub edx, 0x450b398
add edx, dword [ebp - 0x14]
mov ebx, 0xc26b3ea2
xor dword [ebp - 0x10], ebx
mov edi, dword [edx]
mov dword [ebp - 4], 0xd71e6cbe
add edi, ebx
add dword [ebp - 4], edx
mov dword [esi], edi
add esi, 0x53472614
sub esi, 0x53472610
add edx, 0x1fe6f751
sub edx, 0x1fe6f74d
loop 0x10024b48
add eax, 0x14f73
mov ebx, eax
add eax, 0x95479b2
add eax, 0xf6ab8653
mov ecx, 0xb7721910
add ecx, 0x588de6f0
add ecx, dword [ebp - 0x14]
call ebx
leave
ret