joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5a10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov eax, dword [edi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
je 0x4a5a3e
mov ecx, dword [ebp + 0x1c]
push 0
push 0
push ecx
mov ecx, dword [edi + 4]
call fcn.004a54c0
pop edi
pop ebp
ret 0x18
mov edx, dword [ebp + 8]
mov eax, dword [edx]
cmp eax, 0xffffffff
jne 0x4a5a60
mov eax, dword [ebp + 0x1c]
mov ecx, dword [edi + 4]
push 0
push 0x2719
push eax
call fcn.004a54c0
pop edi
pop ebp
ret 0x18
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
push 0
push esi
push ecx
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
push edx
mov edx, dword [ebp + 0xc]
push ecx
push edx
push eax
mov dword [ebp + 0x18], 0
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
jne 0x4a5a9a
mov eax, 0x274d
test ebx, ebx
je 0x4a5aba
cmp eax, 0x3e5
je 0x4a5aba
mov ecx, dword [ebp + 0x18]
push ecx
mov ecx, dword [edi + 4]
push eax
push esi
call fcn.004a54c0
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov ecx, dword [edi + 4]
push esi
call fcn.004a5450
pop esi
pop ebx
pop edi
pop ebp
ret 0x18

Function at 0x4a5ad0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov eax, dword [edi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
je 0x4a5afe
mov ecx, dword [ebp + 0x1c]
push 0
push 0
push ecx
mov ecx, dword [edi + 4]
call fcn.004a54c0
pop edi
pop ebp
ret 0x18
mov edx, dword [ebp + 8]
mov eax, dword [edx]
cmp eax, 0xffffffff
jne 0x4a5b20
mov eax, dword [ebp + 0x1c]
mov ecx, dword [edi + 4]
push 0
push 0x2719
push eax
call fcn.004a54c0
pop edi
pop ebp
ret 0x18
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
push 0
push esi
mov dword [ebp + 8], ecx
lea edx, [ebp + 8]
push edx
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push ecx
push eax
mov dword [ebp + 0x18], 0
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x4a5b60
mov eax, 0x2746
jmp 0x4a5b6c
cmp eax, 0x4d2
jne 0x4a5b6c
mov eax, 0x274d
test ebx, ebx
je 0x4a5b8c
cmp eax, 0x3e5
je 0x4a5b8c
mov edx, dword [ebp + 0x18]
mov ecx, dword [edi + 4]
push edx
push eax
push esi
call fcn.004a54c0
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov ecx, dword [edi + 4]
push esi
call fcn.004a5450
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
Function at 0x4ac450
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0
push 0
push 1
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, dword [ebp + 8]
mov edi, eax
mov dword [esi + 4], edi
test edi, edi
jne 0x4ac4a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.0046ab70
mov dword [ebp - 8], eax
cmp dword [ebp + 8], edi
je 0x4ac4a9
push str.thread.entry_event
lea ecx, [ebp - 0xc]
push ecx
call fcn.00404e40
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 8], eax
mov dword [esi + 8], eax
cmp dword [ebx + 8], 0
jne 0x4ac4f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
mov dword [ebp + 8], eax
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
call fcn.0046ab70
cmp dword [ebp + 8], 0
mov dword [ebp - 8], eax
je 0x4ac4f8
push str.thread.exit_event
lea edx, [ebp - 0xc]
push edx
call fcn.00404e40
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x4a2dc0
push ecx
push 0
mov dword [ebp - 4], 0
call fcn.004bf7f7
add esp, 0x18
mov dword [ebx + 4], eax
test eax, eax
jne 0x4ac56c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
mov dword [ebp + 8], eax
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
test edi, edi
je 0x4ac53e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4ac54c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], esi
call fcn.0046ab70
mov dword [ebp - 8], eax
test esi, esi
je 0x4ac56c
push str.thread
lea ecx, [ebp - 0xc]
push ecx
call fcn.00404e40
test edi, edi
je 0x4ac580
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ac590
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d6df
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5bf094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov dword [esi], vtable.boost::asio::detail::win_iocp_io_service.0
mov dword [ebp - 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
mov dword [esi + 0x2c], edi
call fcn.004a2cd0
mov ebx, eax
call fcn.0046ab70
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
cmp ebx, edi
je 0x4ac617
push str.mutex
lea ecx, [ebp - 0x18]
push ecx
call fcn.00404e40
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
or ecx, 0xffffffff
mov byte [ebp - 4], 5
mov dword [ebp + 8], ecx
lea eax, [ebp + 8]
cmp dword [ebp + 0xc], ecx
ja 0x4ac635
lea eax, [ebp + 0xc]
mov edx, dword [eax]
push edx
push edi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x14], eax
cmp eax, edi
jne 0x4ac66d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x18], ebx
call fcn.0046ab70
mov dword [ebp - 0x14], eax
cmp ebx, edi
je 0x4ac66d
push str.iocp
lea eax, [ebp - 0x18]
push eax
call fcn.00404e40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ad810
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56d949
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x5bf094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x5c164c
mov dword [ebp - 0x1ac], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x4ad870
lea eax, [ebp - 0x1a0]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
push 0x5c1650
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
push 0x5c1650
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov edi, eax
test edi, edi
je 0x4ad8a5
call fcn.0046ab70
push str.winsock
lea ecx, [ebp - 0x1a8]
push ecx
mov dword [ebp - 0x1a8], edi
mov dword [ebp - 0x1a4], eax
call fcn.00404e40
push 0x20
mov dword [ebp - 4], 0
call fcn.004b92c6
add esp, 4
mov dword [ebp - 0x1a4], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x4ad8d2
push 0xffffffffffffffff
push 0
push esi
mov ecx, eax
call fcn.004acf60
jmp 0x4ad8d4
xor eax, eax
mov dword [esi + 4], eax
mov edx, dword [eax + 0x1c]
mov dword [esi + 8], edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b92b7
mov esp, ebp
pop ebp
ret

Function at 0x4ae100
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56db28
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5bf094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
push edi
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
jne 0x4ae16c
push 1
add esi, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
xor esi, esi
call fcn.0046ab70
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov dword [ecx], esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x5c16d0]
push ecx
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x5c16d0]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, edx
push eax
push ecx
mov dword [ebp - 0x14], edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
push ebx
push 1
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.004ad5d0
test eax, eax
je 0x4ae1c4
lea esp, [esp]
cmp edi, 0xffffffff
je 0x4ae1b6
inc edi
push ebx
push 1
mov ecx, esi
call fcn.004ad5d0
test eax, eax
jne 0x4ae1b0
mov edx, dword [ebp - 0x10]
mov eax, dword [0x5c16d0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4afd10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56e62b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x5bf094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push 0x4ae6e0
lea edx, [ebp - 0x18]
xor ebx, ebx
push edx
mov dword [ebp - 0x18], 0x5be638
mov dword [ebp - 0x14], ebx
call fcn.004a3d30
mov dword [esi], eax
lea eax, [esi + 4]
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x1c], 2
mov byte [eax + 0x20], bl
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x24], 2
mov dword [eax + 0x28], ebx
mov ecx, dword [esi]
push eax
add ecx, 0x14
mov dword [ebp - 4], ebx
call fcn.004a7b10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b2d80
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
mov esi, ecx
push 0
lea edi, [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4b2dcc
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push 0x4b2380
lea edx, [ebp - 8]
push edx
mov dword [ebp - 8], 0x5be570
mov dword [ebp - 4], 0
call fcn.004a3d30
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ebx, dword [ebp + 8]
test byte [ebx + 4], 3
mov esi, dword [ebp + 0xc]
jne 0x4b2e51
mov edi, dword [ebx]
cmp edi, 0xffffffff
jne 0x4b2e04
mov edi, 0x2719
call fcn.0046ab70
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x14]
push esi
call fcn.004a6360
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea eax, [ebp + 8]
push eax
push 0x8004667e
push edi
mov dword [ebp + 8], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edi, eax
call fcn.0046ab70
mov dword [ebp + 0xc], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
test edi, edi
js 0x4b2def
xor edi, edi
call fcn.0046ab70
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], eax
or byte [ebx + 4], 2
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx]
lea edi, [esi + 0x20]
push edi
push edx
push eax
push ecx
call fcn.004a4020
add esp, 0x10
test eax, eax
je 0x4b2def
call fcn.0046ab70
cmp dword [edi + 4], eax
jne 0x4b2e7e
cmp dword [edi], 0x2734
je 0x4b2e98
call fcn.0046ab70
cmp dword [edi + 4], eax
jne 0x4b2def
cmp dword [edi], 0x2733
jne 0x4b2def
call fcn.0046ab70
xor ecx, ecx
push ecx
push esi
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
lea edx, [ebx + 0x10]
mov dword [edi + 4], eax
mov eax, dword [ebx]
push edx
push eax
push 3
call fcn.004b0e50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b6550
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56ef21
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5bf094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 9
xor eax, eax
mov esi, 7
xor edi, edi
push str.EnableLUA
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], edi
mov word [ebp - 0x48], ax
call fcn.00403510
xor ecx, ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], cx
push str.SOFTWARE_Microsoft_Windows_CurrentVersion_Policies_System
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00404090
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
push 1
push reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.00404ef0
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], 0xffffffff
jae 0x4b65f0
lea eax, [ebp - 0x48]
mov ebx, dword [ebp - 0x64]
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0x54]
push ecx
push edi
push eax
push ebx
mov dword [ebp - 0x58], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x4b6617
mov esi, eax
jmp 0x4b6624
mov esi, dword [ebp - 0x54]
sub esi, 4
neg esi
sbb esi, esi
and esi, 0xd
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
neg esi
sbb esi, esi
not esi
and esi, dword [ebp - 0x50]
cmp esi, edi
setne byte [ebp - 0x49]
cmp ebx, edi
je 0x4b6645
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 8
cmp dword [ebp - 0x18], esi
jb 0x4b665b
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004b8946
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], ax
cmp dword [ebp - 0x34], esi
jb 0x4b667c
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.004b8946
add esp, 4
mov al, byte [ebp - 0x49]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b92b7
mov esp, ebp
pop ebp
ret
Function at 0x4b92b7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5bf094]
jne 0x4b92c1
repz ret
jmp fcn.004c1b55

Function at 0x4cd91f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5bf094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004c0fff
and dword [ebp - 0x14], 0
cmp dword [0x5c3620], 0
mov dword [ebp - 0x18], eax
jne 0x4cd9d2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4cda7a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x591160
push ebx
call edi
test eax, eax
je 0x4cda7a
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x591150
push ebx
mov dword [0x5c3620], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x5c3624], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5c3628], eax
call edi
push eax
call esi
mov dword [0x5c3630], eax
test eax, eax
je 0x4cd9d2
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5c362c], eax
mov eax, dword [0x5c362c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4cda2b
cmp dword [0x5c3630], ecx
je 0x4cda2b
push eax
call esi
push dword [0x5c3630]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4cda2b
test ebx, ebx
je 0x4cda2b
call edi
test eax, eax
je 0x4cda22
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4cda22
test byte [ebp - 8], 1
jne 0x4cda2b
or dword [ebp + 0x10], 0x200000
jmp 0x4cda5e
mov eax, dword [0x5c3624]
cmp eax, dword [ebp - 0x18]
je 0x4cda5e
push eax
call esi
test eax, eax
je 0x4cda5e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4cda5e
mov eax, dword [0x5c3628]
cmp eax, dword [ebp - 0x18]
je 0x4cda5e
push eax
call esi
test eax, eax
je 0x4cda5e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5c3620]
call esi
test eax, eax
je 0x4cda7a
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4cda7c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b92b7
leave
ret
Function at 0x4dd100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56faaf
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5bf094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
xor ebx, ebx
push 8
mov dword [esi], ebx
call fcn.004b92c6
add esp, 4
cmp eax, ebx
je 0x4dd1e4
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea edi, [esi + 0x18]
push 8
mov dword [ebp - 4], ebx
mov dword [edi], ebx
call fcn.004b92c6
add esp, 4
cmp eax, ebx
je 0x4dd1c0
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [edi]
mov dword [ecx], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov eax, 0xf
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov byte [esi + 0x60], bl
mov word [esi + 0x7c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], ebx
call fcn.004b912a
push 0x5a0f40
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], vtable.std::bad_alloc.0
call fcn.004b9346
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], ebx
call fcn.004b912a
push 0x5a0f40
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x30], vtable.std::bad_alloc.0
call fcn.004b9346
int3

Function at 0x4e4b70
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x4e4b9d
push esi
push edi
jmp 0x4e4b80
movzx esi, byte [edx]
movzx esi, byte [esi + 0x5932a0]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x4e4b80
pop edi
pop esi
ret
Function at 0x4ec880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, edi
test edi, edi
jne 0x4ec89e
xor ebx, ebx
mov dword [ebp - 8], ebx
jmp 0x4ec8b4
cmp byte [edi], al
je 0x4ec8a7
inc ecx
cmp byte [ecx], al
jne 0x4ec8a2
sub ecx, edi
and ecx, 0x3fffffff
mov ebx, ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x14]
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ecx
test ecx, ecx
jle 0x4ec9b5
jmp 0x4ec8d3
mov edi, dword [ebp + 0xc]
cmp esi, 2
jge 0x4ec8db
xor esi, 1
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4ec93b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov edx, esi
shl edx, 4
mov edi, dword [edx + eax]
mov dl, byte [ecx]
test dl, dl
je 0x4ec91d
jmp 0x4ec900
movzx eax, byte [edi]
movzx edx, dl
mov dl, byte [edx + 0x5932a0]
cmp dl, byte [eax + 0x5932a0]
jne 0x4ec91d
mov dl, byte [ecx + 1]
inc ecx
inc edi
test dl, dl
jne 0x4ec900
movzx ecx, byte [ecx]
movzx edx, byte [edi]
movzx edx, byte [edx + 0x5932a0]
movzx ecx, byte [ecx + 0x5932a0]
sub ecx, edx
mov eax, dword [ebp - 4]
jne 0x4ec9a5
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
add esi, esi
mov esi, dword [eax + esi*8 + 0xc]
cmp dword [esi + 0x14], 0
je 0x4ec988
xor eax, eax
mov edx, ebx
mov ecx, edi
test ebx, ebx
jle 0x4ec97e
jmp 0x4ec960
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x5932a0]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x4ec960
mov ebx, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
xor edx, edx
div dword [esi + 8]
jmp 0x4ec98a
xor edx, edx
push ebx
push edi
lea eax, [esi + 8]
call fcn.004e4c00
add esp, 8
test eax, eax
je 0x4ec9bc
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4ec9b5
mov esi, dword [ebp - 0xc]
inc esi
mov dword [ebp - 0xc], esi
cmp esi, dword [ebp - 0x10]
jl 0x4ec8d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4ec9a5
Function at 0x4ec9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], esi
mov ecx, eax
test eax, eax
jne 0x4ec9ed
xor ebx, ebx
mov dword [ebp - 0xc], ebx
jmp 0x4eca05
cmp byte [eax], 0
je 0x4ec9f8
inc ecx
cmp byte [ecx], 0
jne 0x4ec9f2
sub ecx, eax
and ecx, 0x3fffffff
mov ebx, ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [edx + 0x14]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
jle 0x4ecae7
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x10], ecx
push edi
nop
mov ecx, eax
cmp eax, 2
jge 0x4eca2a
xor ecx, 1
mov edx, dword [ebp + 0xc]
shl ecx, 4
add ecx, dword [ebp - 0x10]
mov edi, dword [ecx + 0xc]
test edx, edx
je 0x4eca7a
mov esi, dword [ecx]
mov cl, byte [edx]
test cl, cl
je 0x4eca62
movzx eax, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x5932a0]
cmp cl, byte [eax + 0x5932a0]
jne 0x4eca5f
mov cl, byte [edx + 1]
inc edx
inc esi
test cl, cl
jne 0x4eca42
mov eax, dword [ebp - 4]
movzx edx, byte [edx]
movzx ecx, byte [esi]
movzx ecx, byte [ecx + 0x5932a0]
movzx edx, byte [edx + 0x5932a0]
sub edx, ecx
jne 0x4ecad6
cmp dword [edi + 0x24], 0
lea esi, [edi + 0x18]
je 0x4ecab4
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x4ecaae
mov edi, edi
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x5932a0]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x4eca90
mov ebx, dword [ebp - 0xc]
xor edx, edx
div dword [esi]
jmp 0x4ecab6
xor edx, edx
mov eax, dword [ebp + 8]
push ebx
push eax
mov eax, esi
call fcn.004e4c00
add esp, 8
test eax, eax
je 0x4ecaed
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
test eax, eax
jne 0x4ecae6
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x14]
jl 0x4eca20
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], 0
jmp 0x4ecad3