joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4087c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f438
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x43b3c0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x218]
mov eax, dword [eax + 8]
push edx
mov edx, dword [esp + 0x50]
lea ecx, [esi + 0x218]
push edx
lea edx, [esp + 0x30]
push edx
call eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
mov dword [esp + 0x48], 0
call fcn.00408390
lea edx, [esp + 0xc]
push 0x4370fc
push edx
mov ecx, eax
mov byte [esp + 0x50], 1
call fcn.004082c0
add esp, 0xc
mov byte [esp + 0x44], 3
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], vtable.CPureString.0
test eax, eax
je 0x40884d
push eax
call fcn.004174eb
add esp, 4
mov byte [esp + 0x44], 4
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], vtable.CPureString.0
test eax, eax
je 0x40886b
push eax
call fcn.004174eb
add esp, 4
mov edx, dword [esp + 0x10]
mov eax, 0x435d2a
test edx, edx
je 0x40887c
mov eax, dword [esp + 0xc]
lea ecx, [esi + 0x1b8]
mov esi, dword [ecx]
push edx
push eax
mov eax, dword [esi + 0x1c]
call eax
mov dword [esp + 0x44], 0xffffffff
mov esi, eax
mov eax, dword [esp + 0xc]
mov dword [esp + 8], vtable.CPureString.0
test eax, eax
je 0x4088ae
push eax
call fcn.004174eb
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x40
ret 4

Function at 0x408c50
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x43b3c0]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x408ca6
cmp byte [esp], 2
jne 0x408ca0
mov ecx, dword [esp + 2]
shr ecx, 8
cmp cl, 2
jne 0x408ca0
mov al, 1
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.004174dc
add esp, 0x19c
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x194]
xor ecx, esp
xor al, al
call fcn.004174dc
add esp, 0x19c
ret
Function at 0x408e20
Capabilities:
Connect socket
Resolve dns

Disassembly:
sub esp, 0x18
mov eax, dword [0x43b3c0]
xor eax, esp
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, 2
push edi
mov word [esp + 8], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
jne 0x408e70
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x408ece
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0xc]
mov word [esp + 6], ax
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x1c], eax
push 0x10
mov dword [esi + 0x20], ecx
mov ecx, dword [esi + 4]
lea eax, [esp + 8]
push eax
push ecx
mov dword [esi + 0x24], edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x408ef5
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
mov ecx, esi
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004174dc
add esp, 0x18
ret 4
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
mov ecx, esi
call eax
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004174dc
add esp, 0x18
ret 4
mov ecx, dword [esp + 0x14]
xor ecx, esp
mov eax, 1
call fcn.004174dc
add esp, 0x18
ret 4

Function at 0x408f50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebp, ecx
xor esi, esi
mov ecx, dword [ebp + 4]
push 0
mov eax, ebx
sub eax, esi
push eax
push edi
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x408f8c
test eax, eax
jle 0x408f83
add esi, eax
add edi, eax
cmp esi, ebx
jne 0x408f60
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8

Function at 0x408fa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
xor esi, esi
mov ebp, ecx
test ebx, ebx
jle 0x408fed
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [ebp + 4]
push 0
push 1
push edi
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x408fec
add esi, eax
cmp esi, ebx
je 0x408fe8
mov cl, byte [edi]
cmp cl, 0xd
je 0x408fe8
cmp cl, 0xa
je 0x408fe8
add edi, eax
cmp esi, ebx
jl 0x408fb4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
mov byte [edi], 0
dec esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x409000
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
push ebp
xor ebp, ebp
cmp dword [esp + 0x11c], ebp
push edi
mov edi, ecx
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], ebp
mov dword [esp + 8], ebp
jle 0x409126
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_recv]
push esi
mov esi, dword [esp + 0x124]
jmp 0x409040
cmp dword [esp + 0x10], 3
je 0x409108
mov eax, dword [edi + 4]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
lea edx, [esp + 0x28]
push edx
push 0
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x40907a
inc dword [esp + 0x10]
jmp 0x4090e4
cmp eax, 0xffffffff
je 0x4090b5
mov ecx, dword [edi + 4]
lea eax, [esp + 0x1c]
push eax
push ecx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4090e4
mov edx, dword [edi + 4]
push 0
push 1
push esi
push edx
call ebx
cmp eax, 0xffffffff
jne 0x4090ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
je 0x4090e4
cmp eax, 0x2738
je 0x4090e4
or ebp, 0xffffffff
jmp 0x409101
test eax, eax
je 0x4090f3
add ebp, eax
cmp ebp, dword [esp + 0x128]
je 0x4090f7
cmp byte [esi], 0xa
jne 0x4090e2
cmp dword [esi - 3], 0xa0d0a0d
je 0x4090fd
cmp byte [esi - 1], 0xa
jne 0x4090e2
cmp byte [esi], 0xa
je 0x4090fd
add esi, eax
cmp ebp, dword [esp + 0x128]
jl 0x409040
jmp 0x409101
xor ebp, ebp
jmp 0x409101
mov byte [esi], 0
dec ebp
jmp 0x409101
mov byte [esi + 1], 0
cmp dword [esp + 0x10], 3
jne 0x409117
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x110
ret 8
pop esi
pop ebx
pop edi
mov eax, ebp
pop ebp
add esp, 0x110
ret 8
pop edi
mov eax, ebp
pop ebp
add esp, 0x110
ret 8

Function at 0x409140
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
push esi
push ebx
mov ebp, ecx
mov eax, dword [ebp + 4]
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x409181
add esi, eax
add edi, eax
cmp esi, ebx
je 0x40918b
mov edx, dword [ebp + 4]
push 0
mov ecx, ebx
sub ecx, esi
push ecx
push edi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x409162
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x40b050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f628
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x43b3c0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esp + 0x14], 0
test byte [esi + 0x40], 1
je 0x40b09a
mov eax, dword [esi + 0x10]
mov eax, dword [eax]
push eax
call fcn.004174eb
add esp, 4
mov ecx, dword [esi + 0x10]
mov dword [ecx], 0
mov edx, dword [esi + 0x20]
mov dword [edx], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov ecx, dword [esi + 0x14]
mov dword [ecx], 0
mov edx, dword [esi + 0x24]
mov dword [edx], 0
mov eax, dword [esi + 0x34]
mov dword [eax], 0
and dword [esi + 0x40], 0xfffffffe
mov ecx, esi
mov dword [esi + 0x3c], 0
mov dword [esp + 0x14], 0xffffffff
call fcn.0040acb0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x40bb00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42f3ab
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x43b3c0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0042a7b2
push 4
mov dword [esp + 0x20], 0
call fcn.00417676
mov edi, eax
add esp, 4
test edi, edi
je 0x40bb7e
call fcn.0042a623
mov dword [edi], eax
call fcn.0042a451
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0042a773
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40bb73
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0042a79b
jmp 0x40bb80
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x40c0a0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0xffffffffffffffff
push 0x42f378
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x43b3c0]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push esi
push edi
mov eax, dword [0x43b3c0]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
xor eax, eax
mov edi, ecx
mov dword [esp + 0x14], vtable.CSocketImpl.0
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
push eax
push 1
push 2
mov dword [esp + 0x58], eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esp + 0x18], eax
movzx eax, word [esp + 0x54]
push eax
lea esi, [esp + 0x18]
call fcn.00408e20
test eax, eax
je 0x40c147
push 0x234
call fcn.00417676
add esp, 4
test eax, eax
je 0x40c147
mov ebx, esi
mov esi, eax
call fcn.00408480
jmp 0x40c149
xor eax, eax
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004174dc
add esp, 0x40
ret 4
Function at 0x4172ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x417311
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x417329
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x417358
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x41739a
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x41746e
sub edx, 0x10000
js 0x41746e
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x417380
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x417380
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x4173f1
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x4173ee
add edx, 8
jne 0x4173d5
jmp 0x41745f
add edx, 4
test eax, 0xffff
jne 0x4173fe
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x41745f
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x417432
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x417380
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x41746e
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x417380
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x41747f
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4174dc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43b3c0]
jne 0x4174e6
repz ret
jmp fcn.0041a461
Function at 0x428621
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041cb7c
and dword [ebp - 4], 0
cmp dword [0x43d61c], 0
mov ebx, eax
jne 0x4286d2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x428783
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x428783
push eax
call fcn.0041cb0a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43d61c], eax
call esi
push eax
call fcn.0041cb0a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43d620], eax
call esi
push eax
call fcn.0041cb0a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43d624], eax
call esi
push eax
call fcn.0041cb0a
pop ecx
mov dword [0x43d62c], eax
test eax, eax
je 0x4286d2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041cb0a
pop ecx
mov dword [0x43d628], eax
mov eax, dword [0x43d628]
cmp eax, ebx
je 0x42872a
cmp dword [0x43d62c], ebx
je 0x42872a
push eax
call fcn.0041cb85
push dword [0x43d62c]
mov esi, eax
call fcn.0041cb85
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42872a
test edi, edi
je 0x42872a
call esi
test eax, eax
je 0x428721
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x428721
test byte [ebp - 0xc], 1
jne 0x42872a
or dword [ebp + 0x10], 0x200000
jmp 0x428763
mov eax, dword [0x43d620]
cmp eax, ebx
je 0x428763
push eax
call fcn.0041cb85
pop ecx
test eax, eax
je 0x428763
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x428763
mov eax, dword [0x43d624]
cmp eax, ebx
je 0x428763
push eax
call fcn.0041cb85
pop ecx
test eax, eax
je 0x428763
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43d61c]
call fcn.0041cb85
pop ecx
test eax, eax
je 0x428783
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x428785
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48d9f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x74fb00]
xor edx, edx
cmp eax, edx
jne 0x48da16
xor eax, eax
mov byte [eax + 0x74fa00], al
inc eax
cmp eax, 0x100
jl 0x48d9fe
mov dword [0x74fb00], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x74fa00
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x48daa7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x48da7a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x48da48
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x48db20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x48db73
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x48db5a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x491e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x492031
cmp eax, 8
jg 0x492031
cmp dword [esp + 0x8c], 2
jl 0x492031
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x492031
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x492031
mov eax, dword [esp + 0x80]
test eax, eax
je 0x491e97
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x49201a
mov ebp, dword [fcn.0056665c]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x491ec9
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x492001
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x491ee9
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [fcn.0056664c]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x491f28
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [fcn.00566650]
lea ecx, [esp + 0x28]
push ecx
call dword [fcn.00566690]
test eax, eax
jne 0x491fe8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.00491420
cmp eax, 1
jne 0x492012
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.00491cd0
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x491edd
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x49201a
jmp 0x491eb4
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.00491020
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c
Function at 0x4945b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x494748
cmp ebp, ebx
jle 0x494748
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x49460e
dec eax
or eax, 0xfffffff8
inc eax
je 0x494615
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, 0x80000001
jns 0x494624
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x49462b
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.005508a1
add esp, 4
cmp eax, ebx
je 0x49464c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.005508a1
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x49473e
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x494725
mov al, byte [edx]
cmp al, 0xc0
jbe 0x494711
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x494706
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x494714
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x494714
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x4946b0
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x4946a1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret