joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419ee3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 4]
and dword [ebp - 4], 0
mov ecx, dword [ecx]
push ebx
push edi
push 1
pop edx
mov edi, 0x159a55e5
test eax, eax
mov ebx, 0x1f123bb5
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edx
jbe 0x41a0a7
push esi
mov esi, 0xffff
jmp 0x419f20
push 1
pop edx
mov eax, edi
and eax, esi
imul eax, eax, 0x9069
shr edi, 0x10
add edi, eax
mov eax, ebx
and eax, esi
imul eax, eax, 0x4650
shr ebx, 0x10
add ebx, eax
mov eax, edi
shl eax, 0x10
add eax, ebx
xor eax, dword [ebp + 0xc]
mov ecx, eax
and ecx, edx
shr eax, 1
test ecx, ecx
mov dword [ebp - 8], eax
je 0x41a08e
cmp dword [ebp - 4], 0x400
jb 0x41a08e
lea ecx, [ebp - 8]
call fcn.0041a0ad
mov ecx, eax
mov eax, dword [ebp - 8]
shr dword [ebp - 8], 3
and eax, 7
inc ecx
test eax, eax
mov dword [ebp - 0xc], ecx
je 0x41a057
lea ecx, [ebp - 8]
call fcn.0041a0ad
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
push 1
pop eax
shl eax, cl
cmp eax, dword [ebp - 4]
jae 0x419fac
push 1
inc ecx
pop eax
shl eax, cl
cmp eax, dword [ebp - 4]
jb 0x419f9e
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
cmp eax, ecx
mov dword [ebp - 0x10], eax
jbe 0x419fb9
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x15
mov dword [ebp - 0x18], 5
ja 0x419fcd
mov dword [ebp - 0x18], 4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
push 1
pop eax
shl eax, cl
mov ecx, edi
and ecx, esi
imul ecx, ecx, 0x9069
shr edi, 0x10
add edi, ecx
mov ecx, ebx
and ecx, esi
dec eax
imul ecx, ecx, 0x4650
shr ebx, 0x10
add ebx, ecx
mov ecx, edi
shl ecx, 0x10
add ecx, ebx
and eax, edx
xor ecx, dword [ebp + 0xc]
add eax, 6
cmp eax, dword [ebp - 0x10]
mov edx, ecx
mov dword [ebp - 8], edx
ja 0x419fd0
mov dword [ebp - 0x24], 1
mov ecx, eax
mov eax, dword [ebp - 0x24]
shl eax, cl
dec eax
and eax, edx
cmp eax, dword [ebp - 4]
jb 0x41a050
mov eax, edi
and eax, esi
imul eax, eax, 0x9069
shr edi, 0x10
add edi, eax
mov eax, ebx
and eax, esi
mov edx, edi
imul eax, eax, 0x4650
shr ebx, 0x10
add ebx, eax
shl edx, 0x10
add edx, ebx
xor edx, dword [ebp + 0xc]
jmp 0x419fd0
mov ecx, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
cmp ecx, eax
jbe 0x41a066
mov dword [ebp - 0xc], eax
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
add dword [ebp - 4], ecx
add eax, edx
mov dword [ebp - 0x24], eax
sub eax, dword [ebp - 0x18]
test ecx, ecx
jbe 0x41a09a
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x24]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 0x10]
jne 0x41a081
jmp 0x41a09a
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
inc dword [ebp - 4]
mov byte [ecx + edx], al
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x20]
jb 0x419f1d
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x41c1db
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
mov eax, ecx
jbe 0x41c2f2
mov ecx, edx
mov edx, dword [esp + 4]
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
dec ecx
jne 0x41c1eb
ret 4
Function at 0x4208ce
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4ab0a6
call fcn.004a51d0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
mov byte [esi + 0x33], bl
mov byte [esi + 0x34], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
call fcn.0042097d
lea eax, [esi + 0x8c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.004143f1
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x423238
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4ab466
call fcn.004a51d0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.00402ff3
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00423292
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4232e4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4ab4b1
call fcn.004a51d0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.0042d889
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00439dc7
push dword [esi + 0x24]
call fcn.00401e9f
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.004333bb
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004238f8
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x424ad2
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4ab6a6
call fcn.004a51d0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.00402ff3
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00402ff3
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi], fcn.004242a5
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x427c51
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4abaea
call fcn.004a51d0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.0040310b
and dword [ebp - 4], 0
lea eax, [edi + 0x1c]
push eax
lea ecx, [esi + 0x1c]
call fcn.00427e5b
mov eax, dword [edi + 0x28]
add edi, 0x34
mov dword [esi + 0x28], eax
mov al, byte [edi - 8]
mov byte [esi + 0x2c], al
mov al, byte [edi - 7]
mov byte [esi + 0x2d], al
mov eax, dword [edi - 4]
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov dword [esi + 0x30], eax
call fcn.00427dec
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42debe
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4ac02d
call fcn.004a51d0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
mov byte [esi + 0x14], bl
mov byte [esi + 0x15], bl
mov byte [esi + 0x16], bl
mov byte [esi + 0x17], bl
call fcn.00402ff3
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.00402ff3
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
call fcn.00402ff3
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 6
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov word [esi + 0x4c], bx
mov byte [esi + 0x4e], bl
mov byte [esi + 0x4f], bl
call fcn.00423292
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 7
call fcn.00423292
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42e102
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4ac0ae
call fcn.004a51d0
push ecx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esi], 0x4b35f8
mov dword [esi + 4], 0x4b3578
mov dword [esi + 8], 0x4b35e8
mov dword [esi + 0xc], 0x4b2754
mov dword [esi + 0x10], 0x4b34bc
mov dword [esi + 0x14], eax
mov byte [esi + 0x18], al
mov byte [esi + 0x19], al
mov dword [ebp - 0x10], esi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
call fcn.00402ff3
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.00402ff3
lea edi, [esi + 0x60]
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.00406b7c
lea ecx, [edi + 0x28]
call fcn.00402ff3
lea ecx, [esi + 0x98]
mov byte [ebp - 4], 5
call fcn.004188b3
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x4b35d4
mov dword [esi + 4], 0x4b35c0
mov dword [esi + 8], 0x4b35b0
mov dword [esi + 0xc], 0x4b35a0
mov dword [esi + 0x10], 0x4b358c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42e81d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4ac171
call fcn.004a51d0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x10]
push eax
call fcn.0040310b
and dword [ebp - 4], 0
lea eax, [edi + 0x1c]
push eax
lea ecx, [esi + 0x1c]
call fcn.0040310b
mov eax, dword [edi + 0x28]
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
lea eax, [edi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.0040310b
lea eax, [edi + 0x3c]
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.0040310b
mov al, byte [edi + 0x48]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x48], al
mov al, byte [edi + 0x49]
mov byte [esi + 0x49], al
mov al, byte [edi + 0x4a]
mov byte [esi + 0x4a], al
mov al, byte [edi + 0x4b]
mov byte [esi + 0x4b], al
mov al, byte [edi + 0x4c]
mov byte [esi + 0x4c], al
mov al, byte [edi + 0x4d]
mov byte [esi + 0x4d], al
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [edi + 0x68]
mov dword [esi + 0x68], eax
mov al, byte [edi + 0x6c]
mov byte [esi + 0x6c], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42e9c8
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x4ac1f9
call fcn.004a51d0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
test eax, eax
mov dword [ebx], eax
je 0x42e9ec
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
test eax, eax
mov dword [ebx + 4], eax
je 0x42ea00
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 8]
mov byte [ebp - 4], 1
test eax, eax
mov dword [ebx + 8], eax
je 0x42ea14
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi + 0xc]
mov byte [ebp - 4], 2
test eax, eax
mov dword [ebx + 0xc], eax
je 0x42ea28
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov al, byte [esi + 0x10]
lea ecx, [ebx + 0x18]
mov byte [ebx + 0x10], al
mov al, byte [esi + 0x11]
mov byte [ebx + 0x11], al
mov al, byte [esi + 0x12]
mov byte [ebx + 0x12], al
mov al, byte [esi + 0x13]
mov byte [ebx + 0x13], al
mov al, byte [esi + 0x14]
mov byte [ebx + 0x14], al
mov al, byte [esi + 0x15]
mov byte [ebx + 0x15], al
mov al, byte [esi + 0x16]
mov byte [ebx + 0x16], al
mov al, byte [esi + 0x17]
mov byte [ebx + 0x17], al
lea eax, [esi + 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.0040310b
lea eax, [esi + 0x24]
lea ecx, [ebx + 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.0040310b
lea eax, [esi + 0x30]
lea ecx, [ebx + 0x30]
push eax
mov byte [ebp - 4], 5
call fcn.0040310b
mov eax, dword [esi + 0x3c]
add esi, 0x44
mov dword [ebx + 0x3c], eax
mov eax, dword [esi - 4]
lea edi, [ebx + 0x44]
mov dword [ebx + 0x40], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x78]
mov byte [ebp - 4], 6
mov eax, dword [esi + 0x50]
mov dword [ebx + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [ebx + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [ebx + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [ebx + 0x5c], eax
mov al, byte [esi + 0x60]
mov byte [ebx + 0x60], al
mov eax, dword [esi + 0x68]
mov dword [ebx + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [ebx + 0x6c], eax
mov eax, dword [esi + 0x70]
mov dword [ebx + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [ebx + 0x74], eax
lea eax, [esi + 0x78]
push eax
call fcn.0042eb27
lea eax, [esi + 0xa8]
lea ecx, [ebx + 0xa8]
push eax
mov byte [ebp - 4], 7
call fcn.0042eb27
mov eax, dword [esi + 0xd8]
pop edi
mov dword [ebx + 0xd8], eax
mov eax, dword [esi + 0xdc]
mov dword [ebx + 0xdc], eax
mov eax, ebx
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x43b72f
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x4acf8f
call fcn.004a51d0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x18]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.00414b85
lea ecx, [esi + 0x30]
call fcn.00402ff3
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
call fcn.00402ff3
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x44bcb6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4ae31b
call fcn.004a51d0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov byte [esi + 0x18], bl
mov byte [esi + 0x19], bl
mov byte [esi + 0x1a], bl
mov byte [esi + 0x1b], bl
mov byte [esi + 0x1c], bl
mov byte [esi + 0x1d], 1
mov dword [esi + 0x20], 1
call fcn.00402ff3
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], 0x40000000
mov dword [esi + 0x34], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x454feb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, 0x200
mov esi, ecx
cmp edx, eax
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], esi
jb 0x455149
cmp word [esi], 0x5a4d
jne 0x455149
mov ecx, dword [esi + 0x3c]
cmp ecx, 0x1000
jae 0x455149
lea edi, [ecx + 0x200]
cmp edi, edx
ja 0x455149
test cl, 7
jne 0x455149
add esi, ecx
cmp dword [esi], 0x4550
jne 0x455149
movzx edi, word [esi + 4]
add esi, 4
cmp edi, eax
ja 0x45508a
je 0x455081
mov eax, edi
sub eax, 0x14c
je 0x4550b3
sub eax, 0x74
je 0x455078
dec eax
dec eax
je 0x455078
dec eax
dec eax
jne 0x455149
mov dword [ebp - 4], 0x3030701
jmp 0x4550c3
mov dword [ebp - 4], 0x3030501
jmp 0x4550c3
mov dword [ebp - 4], 0x3030401
jmp 0x4550c3
mov eax, edi
sub eax, 0x5032
je 0x4550bc
sub eax, 0x32
je 0x4550bc
sub eax, 0x3600
je 0x4550b3
sub eax, 0x2400
jne 0x455149
mov dword [ebp - 4], 0xa
jmp 0x4550c3
mov dword [ebp - 4], 0x3030103
jmp 0x4550c3
mov dword [ebp - 4], 0xb
movzx eax, word [esi + 0x10]
movzx ebx, word [esi + 2]
cmp eax, 0x400
ja 0x455149
movzx ecx, word [esi + 0x14]
add esi, 0x14
cmp ecx, 0x10b
je 0x4550e9
cmp ecx, 0x20b
jne 0x455149
mov ecx, eax
sub ecx, dword [ebp - 8]
add ecx, esi
cmp ecx, dword [ebp - 0xc]
ja 0x45513c
add esi, eax
cmp ebx, 0x40
ja 0x45513c
cmp edi, 0x8664
jne 0x45513c
xor edi, edi
test ebx, ebx
jbe 0x45513c
mov eax, esi
sub eax, dword [ebp - 8]
add eax, 0x28
cmp eax, dword [ebp - 0xc]
ja 0x45513c
push 8
push str..a64xrm
push esi
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x455135
inc edi
add esi, 0x28
cmp edi, ebx
jb 0x45510a
jmp 0x45513c
mov dword [ebp - 4], 0xa
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push 1
mov dword [eax], ecx
pop eax
jmp 0x45514b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4592a0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4aed30
call fcn.004a51d0
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0045d4b7
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea eax, [esi + 0x3c]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 2
call fcn.0044aa52
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x78]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 7
call fcn.0044aa52
lea eax, [esi + 0x90]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 9
call fcn.0044aa52
lea eax, [esi + 0xa8]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0xb
call fcn.0044aa52
lea ebx, [esi + 0xc0]
mov byte [ebp - 4], 0xc
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.0044aa52
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xd
call fcn.0044aa52
lea ebx, [esi + 0xd8]
mov byte [ebp - 4], 0xe
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.0044aa52
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xf
call fcn.0044aa52
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x45949c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4aed8f
call fcn.004a51d0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00459654
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00459709
mov al, byte [edi + 0x18]
lea ecx, [esi + 0x24]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov al, byte [edi + 0x1a]
mov byte [esi + 0x1a], al
mov al, byte [edi + 0x1b]
mov byte [esi + 0x1b], al
mov al, byte [edi + 0x1c]
mov byte [esi + 0x1c], al
mov al, byte [edi + 0x1d]
mov byte [esi + 0x1d], al
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
mov byte [ebp - 4], 1
call fcn.0040310b
mov eax, dword [edi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x45a058
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp edx, 0x10
push esi
jb 0x45a07d
lea edx, [ecx + edx - 0x10]
mov esi, dword [ecx + 0xc]
xor esi, dword [ecx + 8]
xor esi, dword [ecx + 4]
xor esi, dword [ecx]
add ecx, 0x10
xor eax, esi
cmp ecx, edx
jbe 0x45a064
sub edx, ecx
add edx, 0x10
cmp edx, 8
jb 0x45a08f
mov esi, dword [ecx + 4]
xor esi, dword [ecx]
add ecx, 8
xor eax, esi
sub edx, 8
cmp edx, 4
pop esi
jb 0x45a09a
xor eax, dword [ecx]
add ecx, 4
and edx, 3
je 0x45a0bb
cmp edx, 2
jb 0x45a0b6
jbe 0x45a0af
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
movzx ecx, byte [ecx]
xor eax, ecx
ret

Function at 0x45f863
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4af384
call fcn.004a51d0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
lea ecx, [ebx + 0x30]
mov dword [ebx], eax
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov al, byte [esi + 0x18]
mov byte [ebx + 0x18], al
mov al, byte [esi + 0x19]
mov byte [ebx + 0x19], al
mov al, byte [esi + 0x1a]
mov byte [ebx + 0x1a], al
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
lea eax, [esi + 0x30]
push eax
call fcn.00402830
and dword [ebp - 4], 0
lea eax, [esi + 0x3c]
push eax
lea ecx, [ebx + 0x3c]
call fcn.00402830
lea eax, [esi + 0x48]
lea ecx, [ebx + 0x48]
push eax
mov byte [ebp - 4], 1
call fcn.00402830
lea eax, [esi + 0x54]
lea ecx, [ebx + 0x54]
push eax
mov byte [ebp - 4], 2
call fcn.00402830
mov eax, dword [esi + 0x60]
push 0xc
mov dword [ebx + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [ebx + 0x64], eax
mov eax, dword [ebp + 8]
add esi, 0x68
lea edi, [ebx + 0x68]
pop ecx
add eax, 0x98
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x98]
mov byte [ebp - 4], 3
call fcn.0045f949
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4