joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441ea0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x30]
push ebx
push esi
mov dword [ebp - 0x14], ecx
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor esi, esi
mov edi, dword [eax + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, esi
mov dword [ebp - 0x10], edx
test edx, edx
je 0x441f12
mov eax, edx
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, eax
jne 0x441ee0
mov eax, dword [ebp - 8]
cmp ecx, 0xc0323159
je 0x441f16
mov eax, dword [eax]
jmp 0x441eb8
mov edx, dword [eax + 0x18]
mov eax, dword [0x67f428]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x441fab
test edx, edx
je 0x441fa4
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x441fa4
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x441fa4
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x441f95
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x441f64
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0x4f1731cb
je 0x441fc6
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x441f54
xor eax, eax
mov dword [0x67f428], eax
mov ecx, dword [ebp - 0x14]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ecx + 4]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x441fa6
Function at 0x442f00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], ecx
push ebx
push esi
push edi
cmp eax, 0xf060
jne 0x4430c5
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor esi, esi
mov edi, dword [eax + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x811c9dc5
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, esi
mov dword [esp + 0x18], edx
test edx, edx
je 0x442f8a
mov eax, edx
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [esp + 0xc]
imul ecx, ecx, 0x1000193
mov dword [esp + 0xc], ecx
cmp ebx, eax
jne 0x442f55
mov eax, dword [esp + 0x10]
cmp ecx, 0xc0323159
je 0x442f8e
mov eax, dword [eax]
jmp 0x442f2a
mov edx, dword [eax + 0x18]
mov eax, dword [0x67f490]
mov dword [esp + 0x18], edx
test eax, eax
jne 0x44302b
test edx, edx
je 0x443024
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
lea eax, [ecx + edx]
mov dword [esp + 0x10], eax
cmp eax, edx
je 0x443024
xor ecx, ecx
mov dword [esp + 0xc], ecx
cmp dword [eax + 0x18], ecx
je 0x443024
mov edi, dword [eax + 0x20]
add edi, edx
nop dword [eax + eax]
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x443013
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x442fe0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
cmp esi, 0xf1a78bf8
je 0x443092
mov eax, dword [esp + 0x10]
inc ecx
add edi, 4
mov dword [esp + 0xc], ecx
cmp ecx, dword [eax + 0x18]
jne 0x442fd0
xor eax, eax
mov dword [0x67f490], eax
mov ebx, dword [esp + 0x1c]
push dword [ebx + 4]
call eax
test eax, eax
je 0x443043
push 1
push 1
mov ecx, ebx
call fcn.00513040
lea ecx, [ebx + 0x748]
call fcn.00492a20
test eax, eax
je 0x4430ba
mov eax, dword [0x67f4f4]
cmp dword [eax + 0x50c], 4
jne 0x443072
push 1
lea ecx, [ebx + 0x748]
call fcn.00493180
mov eax, dword [0x67f4f4]
cmp dword [eax + 0x640], 1
mov ecx, ebx
jne 0x4430b0
push 0x2bc
call fcn.005127c0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x443026
push 0x258
call fcn.005127c0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0xc]
push eax
push 0x112
call fcn.00512a60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4437f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
sub esp, 0x10
mov eax, dword [eax + 0xc]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor esi, esi
mov edi, dword [eax + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, esi
mov dword [ebp - 0x10], edx
test edx, edx
je 0x443862
mov eax, edx
nop dword [eax]
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, eax
jne 0x443830
mov eax, dword [ebp - 8]
cmp ecx, 0x4f644736
je 0x443866
mov eax, dword [eax]
jmp 0x443805
mov edx, dword [eax + 0x18]
mov eax, dword [0x67f420]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x4438fb
test edx, edx
je 0x4438f4
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x4438f4
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4438f4
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x4438e5
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x4438b4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xbac83be9
je 0x443916
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x4438a4
xor eax, eax
mov dword [0x67f420], eax
push 1
push 0
push 0
push str.http:__statapi.aldtop.com_xieyi.html
push str.open
push 0
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x4438f6
Function at 0x444be0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ecx + 4]
push ebx
push esi
push edi
mov dword [esp + 0x1c], ecx
mov dword [0x67f4e0], eax
call fcn.00444db0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor esi, esi
mov edi, dword [eax + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x811c9dc5
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, esi
mov dword [esp + 0x18], edx
test edx, edx
je 0x444c69
mov eax, edx
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [esp + 0xc]
imul ecx, ecx, 0x1000193
mov dword [esp + 0xc], ecx
cmp ebx, eax
jne 0x444c34
mov eax, dword [esp + 0x10]
cmp ecx, 0xc0323159
je 0x444c6d
mov eax, dword [eax]
jmp 0x444c09
mov ecx, dword [0x67f4bc]
mov edx, dword [eax + 0x18]
mov dword [esp + 0x18], edx
test ecx, ecx
jne 0x444d10
test edx, edx
je 0x444d08
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
lea eax, [ecx + edx]
xor ecx, ecx
mov dword [esp + 0x10], eax
cmp eax, edx
je 0x444d0a
mov dword [esp + 0xc], ecx
cmp dword [eax + 0x18], ecx
je 0x444d08
mov edi, dword [eax + 0x20]
add edi, edx
nop dword [eax]
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x444cf7
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x444cc0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
cmp esi, 0xfad26938
je 0x444d8a
mov eax, dword [esp + 0x10]
inc ecx
add edi, 4
mov dword [esp + 0xc], ecx
cmp ecx, dword [eax + 0x18]
jne 0x444cb0
xor ecx, ecx
mov dword [0x67f4bc], ecx
mov eax, dword [0x67f4f4]
push 0
imul eax, dword [eax + 0xacc], 0xea60
push eax
mov eax, dword [esp + 0x24]
push 0x4a0
push dword [eax + 4]
call ecx
push 0
call fcn.00578cfa
add esp, 4
push eax
call fcn.005793d2
add esp, 4
call fcn.005793b1
xor edx, edx
mov ecx, 0x15f8f
div ecx
mov ecx, dword [0x67f4f4]
lea eax, [ecx + 0xab4]
add edx, 0x2710
cmp dword [eax + 0x14], 8
jb 0x444d6b
mov eax, dword [eax]
push edx
push dword [ecx + 4]
push eax
push str.tc_type_stc_stepshowsdsoft_drnd_d
push str.http:__downloader.aldtop.com_client_debug
push ecx
call fcn.00477f90
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + edx]
add ecx, edx
jmp 0x444d0a
Function at 0x445d50
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fadab
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x672494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x24], ebx
call fcn.005125b0
mov dword [ebx + 0x10], vtable.DuiLib::INotifyUI.0
lea ecx, [ebx + 0x14]
mov dword [ebx], vtable.CTrayIconWnd.1.0
mov dword [ebx + 0x10], vtable.CTrayIconWnd.0
call fcn.004f2110
mov dword [ebp - 4], 0
mov eax, 0x674260
mov dword [ebx + 0x6b4], 0
cmp dword [0x674274], 8
cmovae eax, dword [0x674260]
mov dword [ebp - 0x20], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor edi, edi
mov esi, dword [eax + 0x30]
and edx, 0xfffffffe
mov dword [ebp - 0x10], eax
mov ebx, 0x811c9dc5
lea ecx, [edx + esi]
inc edx
shr edx, 1
cmp esi, ecx
cmova edx, edi
mov dword [ebp - 0x14], edx
test edx, edx
je 0x445e2b
mov eax, edx
nop dword [eax]
mov dl, byte [esi]
lea ecx, [edx - 0x41]
cmp cl, 0x19
movsx ecx, dl
ja 0x445e10
or ecx, 0x20
xor ecx, ebx
inc edi
imul ebx, ecx, 0x1000193
add esi, 2
cmp edi, eax
jne 0x445e00
mov eax, dword [ebp - 0x10]
cmp ebx, 0xc0323159
je 0x445e2f
mov eax, dword [eax]
jmp 0x445dd1
mov esi, dword [eax + 0x18]
mov eax, dword [0x67f7a0]
mov dword [ebp - 0x10], esi
test eax, eax
jne 0x445eda
test esi, esi
je 0x445ed3
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
mov eax, dword [eax + esi + 0x7c]
add ecx, esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], ecx
cmp ecx, esi
je 0x445ed3
mov eax, dword [ecx + 0x18]
xor ebx, ebx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x445ed3
mov edi, dword [ecx + 0x20]
add edi, esi
mov edx, dword [edi]
add edx, esi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x445ea9
lea eax, [ecx - 0x41]
cmp al, 0x19
movsx eax, cl
ja 0x445e8f
or eax, 0x20
mov cl, byte [edx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
test cl, cl
jne 0x445e82
cmp esi, 0x6ec6601b
je 0x445eb6
mov eax, dword [ebp - 0x14]
inc ebx
add edi, 4
cmp ebx, eax
je 0x445ed3
mov esi, dword [ebp - 0x10]
jmp 0x445e72
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x445ed5
xor eax, eax
mov dword [0x67f7a0], eax
push 0x10
push 0x40
push 0x40
push 1
push dword [ebp - 0x20]
push 0
call eax
mov esi, dword [ebp - 0x24]
push 0
mov dword [esi + 0x6b8], eax
mov dword [esi + 0x6c8], 0
mov dword [esi + 0x6cc], 1
call fcn.00578cfa
mov dword [esi + 0x6c0], eax
add esp, 4
mov dword [esi + 0x6c4], edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x446590
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
call fcn.004eb790
mov ecx, ebx
mov dword [ebx + 0x6c8], eax
call fcn.00446a20
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor esi, esi
mov edi, dword [eax + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, esi
mov dword [ebp - 0x10], edx
test edx, edx
je 0x446616
mov eax, edx
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, eax
jne 0x4465e4
mov eax, dword [ebp - 8]
cmp ecx, 0xc0323159
je 0x44661a
mov eax, dword [eax]
jmp 0x4465bc
mov edx, dword [eax + 0x18]
mov eax, dword [0x67f4bc]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x4466b7
test edx, edx
je 0x4466b0
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x4466b0
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4466b0
mov edi, dword [eax + 0x20]
add edi, edx
nop dword [eax + eax]
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x4466a1
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x446670
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xfad26938
je 0x4466d3
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x446660
xor eax, eax
mov dword [0x67f4bc], eax
mov ecx, dword [ebp - 0x14]
push 0
push 0x1f4
push 1
push dword [ecx + 4]
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x4466b2
Function at 0x447580
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0x14], eax
call fcn.00443ee0
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor esi, esi
mov edi, dword [eax + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x811c9dc5
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, esi
mov dword [ebp - 0x10], edx
test edx, edx
je 0x4475f9
mov eax, edx
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [ebp - 4]
imul ecx, ecx, 0x1000193
mov dword [ebp - 4], ecx
cmp ebx, eax
jne 0x4475c7
mov eax, dword [ebp - 8]
cmp ecx, 0xc0323159
je 0x4475fd
mov eax, dword [eax]
jmp 0x44759f
mov edx, dword [eax + 0x18]
mov eax, dword [0x67f4bc]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x447697
test edx, edx
je 0x447690
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 8], eax
lea eax, [ecx + edx]
mov dword [ebp - 8], eax
cmp eax, edx
je 0x447690
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x447690
mov edi, dword [eax + 0x20]
add edi, edx
nop dword [eax + eax]
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x447681
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x447650
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp esi, 0xfad26938
je 0x4476b2
mov eax, dword [ebp - 8]
inc ecx
add edi, 4
mov dword [ebp - 4], ecx
cmp ecx, dword [eax + 0x18]
jne 0x447640
xor eax, eax
mov dword [0x67f4bc], eax
mov ecx, dword [ebp - 0x14]
push 0
push 0x927c0
push 0x496
push dword [ecx + 4]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x447692
Function at 0x4479d0
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5faea0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x672494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0x113
jne 0x447bd2
cmp dword [ebp + 0xc], 0x496
jne 0x447bd2
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx ecx, word [eax + 0x2c]
xor edi, edi
mov esi, dword [eax + 0x30]
and ecx, 0xfffffffe
mov dword [ebp + 8], eax
mov ebx, 0x811c9dc5
lea edx, [ecx + esi]
inc ecx
shr ecx, 1
cmp esi, edx
cmova ecx, edi
mov dword [ebp + 0xc], ecx
test ecx, ecx
je 0x447a7b
mov eax, ecx
nop dword [eax]
mov dl, byte [esi]
lea ecx, [edx - 0x41]
cmp cl, 0x19
movsx ecx, dl
ja 0x447a60
or ecx, 0x20
xor ecx, ebx
inc edi
imul ebx, ecx, 0x1000193
add esi, 2
cmp edi, eax
jne 0x447a50
mov eax, dword [ebp + 8]
cmp ebx, 0xc0323159
je 0x447a7f
mov eax, dword [eax]
jmp 0x447a21
mov esi, dword [eax + 0x18]
mov eax, dword [0x67f4c8]
mov dword [ebp + 8], esi
test eax, eax
jne 0x447b28
test esi, esi
je 0x447b21
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
mov eax, dword [eax + esi + 0x7c]
add ecx, esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ecx
cmp ecx, esi
je 0x447b21
mov eax, dword [ecx + 0x18]
xor ebx, ebx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x447b21
mov edi, dword [ecx + 0x20]
add edi, esi
mov edx, dword [edi]
add edx, esi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x447af9
lea eax, [ecx - 0x41]
cmp al, 0x19
movsx eax, cl
ja 0x447adf
or eax, 0x20
mov cl, byte [edx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
test cl, cl
jne 0x447ad2
cmp esi, 0xbfc61606
je 0x447b06
mov eax, dword [ebp + 0xc]
inc ebx
add edi, 4
cmp ebx, eax
je 0x447b21
mov esi, dword [ebp + 8]
jmp 0x447ac2
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + ebx*2]
mov eax, dword [ecx + eax*4]
add eax, edx
jmp 0x447b23
xor eax, eax
mov dword [0x67f4c8], eax
mov ebx, dword [ebp - 0x18]
push 0x496
push dword [ebx + 4]
call eax
push 1
push 0
mov ecx, ebx
call fcn.00513040
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp + 8], esp
push 0xd
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.install_suc_2
mov word [ecx], ax
call fcn.00417d60
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
mov dword [ebp + 0xc], esp
xor eax, eax
push 0xf
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.start_install_2
mov word [ecx], ax
call fcn.00417d60
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
xor eax, eax
push 0x10
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.start_download_2
mov word [ecx], ax
call fcn.00417d60
mov dword [ebp - 4], 0xffffffff
call fcn.004476d0
push 1
mov ecx, ebx
call fcn.005127c0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x448540
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov eax, ecx
push edi
mov dword [esp + 0x1c], eax
call fcn.00448710
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
movzx edx, word [eax + 0x2c]
xor esi, esi
mov edi, dword [eax + 0x30]
xor ebx, ebx
shr edx, 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x811c9dc5
lea ecx, [edi + edx*2]
cmp edi, ecx
cmova edx, esi
mov dword [esp + 0x18], edx
test edx, edx
je 0x4485c5
mov eax, edx
nop
mov dl, byte [edi]
lea edi, [edi + 2]
movsx esi, dl
sub dl, 0x41
mov ecx, esi
or ecx, 0x20
cmp dl, 0x19
cmova ecx, esi
inc ebx
xor ecx, dword [esp + 0xc]
imul ecx, ecx, 0x1000193
mov dword [esp + 0xc], ecx
cmp ebx, eax
jne 0x448590
mov eax, dword [esp + 0x10]
cmp ecx, 0xc0323159
je 0x4485c9
mov eax, dword [eax]
jmp 0x448563
mov edx, dword [eax + 0x18]
mov eax, dword [0x67f4bc]
mov dword [esp + 0x18], edx
test eax, eax
jne 0x448662
test edx, edx
je 0x44865b
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
lea eax, [ecx + edx]
mov dword [esp + 0x10], eax
cmp eax, edx
je 0x44865b
xor ecx, ecx
mov dword [esp + 0xc], ecx
cmp dword [eax + 0x18], ecx
je 0x44865b
mov edi, dword [eax + 0x20]
add edi, edx
mov eax, dword [edi]
mov esi, 0x811c9dc5
add eax, edx
mov bl, byte [eax]
inc eax
test bl, bl
je 0x44864a
movsx edx, bl
lea eax, [eax + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [eax - 1]
cmova ecx, edx
xor ecx, esi
imul esi, ecx, 0x1000193
test bl, bl
jne 0x448613
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
cmp esi, 0xfad26938
je 0x4486ed
mov eax, dword [esp + 0x10]
inc ecx
add edi, 4
mov dword [esp + 0xc], ecx
cmp ecx, dword [eax + 0x18]
jne 0x448603
xor eax, eax
mov dword [0x67f4bc], eax
mov ecx, dword [esp + 0x1c]
push 0
push 0xea60
push 0x497
push dword [ecx + 4]
call eax
push 0
call fcn.00578cfa
add esp, 4
push eax
call fcn.005793d2
add esp, 4
call fcn.005793b1
xor edx, edx
mov ecx, 0x15f8f
div ecx
mov eax, dword [0x67f4f4]
lea esi, [eax + 0x64c]
add edx, 0x2710
cmp dword [esi + 0x14], 8
mov edi, dword [eax + 4]
jb 0x4486b4
mov esi, dword [esi]
push edx
push ecx
push 1
push str.General
call fcn.0047f920
add esp, 4
neg eax
sbb eax, eax
neg eax
push eax
push edi
push esi
push str.ad_gjshowwinver_ssdsoft_dx64_drnd_d
push str.http:__downloader.aldtop.com_client_debug
push dword [0x67f4f4]
call fcn.00477f90
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x44865d