joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4327f0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x432a50
sub esp, 0x3c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
mov eax, dword [0x7d3344]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x28]
lea ebx, [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.00434320
mov eax, dword [esp + 0x2c]
cmp eax, 0xa
jb 0x4328eb
jne 0x43286e
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x43286e
mov eax, dword [esp + 0x30]
and eax, 0xffff
cmp eax, 0x3ad7
jb 0x4328eb
mov eax, dword [0x7d3340]
mov dword [esp], eax
call fcn.00434240
mov eax, dword [esp + 4]
add eax, 3
mov dword [esp + 0x38], eax
movzx ecx, byte [eax]
mov byte [esp + 0x27], cl
or ecx, 0xffffff80
mov byte [eax], cl
lea ecx, [0x7f9a6a]
mov dword [esp], ecx
mov dword [esp + 4], 0x20
mov dword [esp + 8], 0x21
call fcn.004330c0
mov ecx, dword [0x7f8bb8]
cmp ecx, 0x105
ja 0x432a45
mov dword [esp + 0x34], ecx
lea eax, [0x7f9880]
mov dword [esp], eax
lea edx, [0x7f93e0]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00464cc0
mov eax, dword [esp + 0x34]
xor ecx, ecx
jmp 0x4328f6
add esp, 0x3c
ret
xchg esi, eax
mov byte [edx + ebx + 1], al
xchg esi, eax
inc ecx
cmp ecx, 0x20
jge 0x432963
lea edx, [eax + ecx*2]
lea ebx, [ecx + 0x1ea]
cmp ebx, 0x20b
jae 0x432a39
lea ebx, [0x7f9880]
movzx ebp, byte [ecx + ebx + 0x1ea]
xchg ebp, eax
shr al, 4
xchg ebp, eax
xchg ebp, eax
movzx eax, al
xchg ebp, eax
lea esi, [0x61e29e]
movzx ebp, byte [esi + ebp]
cmp edx, 0x20b
jae 0x432a2d
xchg ebp, eax
mov byte [ebx + edx], al
xchg ebp, eax
lea ebp, [eax + ecx*2 + 1]
movzx edi, byte [ecx + ebx + 0x1ea]
and edi, 0xf
movzx esi, byte [edi + esi]
cmp ebp, 0x20b
jb 0x4328ef
jmp 0x432a21
lea edx, [eax + 0x40]
jmp 0x432973
lea ebx, [0x7f9880]
mov byte [ebx + edx], 0x41
inc edx
cmp edx, 0x20a
jge 0x432988
cmp edx, 0x20b
jb 0x432968
jmp 0x432a15
mov eax, dword [sym.imp.kernel32.dll_CreateFileA]
lea ecx, [0x7f9880]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.00434460
call fcn.00465090
cmp dword [esp], 3
jne 0x432a0a
movzx eax, byte [esp + 0x27]
mov ecx, dword [esp + 0x38]
mov byte [ecx], al
call fcn.004388b0
lea eax, [0x62becc]
mov dword [esp], eax
mov dword [esp + 4], 0x5f
call fcn.004391b0
call fcn.00438920
add esp, 0x3c
ret
mov byte [0x7f8aa4], 1
add esp, 0x3c
ret
mov eax, edx
mov ecx, 0x20b
call fcn.00464400
mov eax, ebp
mov ecx, 0x20b
call fcn.00464400
mov eax, edx
mov ecx, 0x20b
call fcn.00464400
mov eax, ebx
mov ecx, 0x20b
call fcn.00464400
mov edx, 0x105
call fcn.00464430
nop
call fcn.00462f70
jmp fcn.004327f0
Function at 0x432a60
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x432b99
sub esp, 0x3c
mov edx, dword [0x7f8db0]
test edx, edx
jne 0x432a91
lea edx, [0x465000]
mov dword [0x7d3360], edx
jmp 0x432aa2
lea edi, [0x7d3360]
lea eax, [0x465000]
call fcn.00464380
xor eax, eax
jmp 0x432ab7
lea esi, [0x7f9060]
mov byte [esi + eax], bl
inc dword [0x7f8b04]
mov eax, ebp
cmp eax, 0x36
jge 0x432b07
lea edx, [0x62a920]
movzx ebx, byte [edx + eax]
cmp ebx, 0x80
jge 0x432ad3
lea ebp, [eax + 1]
jmp 0x432afd
mov dword [esp + 0x14], eax
mov dword [esp], edx
mov dword [esp + 4], 0x36
mov dword [esp + 8], eax
call fcn.0045d2f0
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea edx, [0x62a920]
cmp eax, 0x64
jb 0x432aa6
jmp 0x432b8e
call fcn.00431e40
call fcn.0044a390
call fcn.0044a3f0
call fcn.00432780
mov byte [esp], 0
call fcn.00432700
mov eax, dword [esp + 4]
mov dword [0x7f8bbc], eax
call fcn.004327f0
call fcn.00432630
mov eax, dword [esp]
mov dword [0x7f8b68], eax
lea edi, [esp + 0x18]
xor eax, eax
call fcn.004645c7
mov eax, dword [sym.imp.kernel32.dll_GetSystemInfo]
lea ecx, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00434280
mov eax, dword [esp + 0x1c]
mov dword [0x7f8b94], eax
mov eax, dword [sym.imp.kernel32.dll_SetProcessPriorityBoost]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 1
call fcn.004342d0
add esp, 0x3c
ret
mov ecx, 0x64
call fcn.00464400
nop
call fcn.00462f70
jmp fcn.00432a60
Function at 0x433bc0
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x28
mov eax, dword [sym.imp.kernel32.dll_CreateThread]
lea ecx, [0x465130]
mov edx, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00434410
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x433c21
mov ecx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00434280
add esp, 0x28
ret
lea eax, [0x7f8b18]
mov dword [esp], eax
call fcn.00402370
mov eax, dword [esp + 4]
test eax, eax
jne 0x433ce4
mov eax, dword [0x7d4668]
mov ecx, dword [0x7d4678]
sub eax, ecx
mov dword [esp + 0x24], eax
call fcn.00465090
mov eax, dword [esp]
mov dword [esp + 0x20], eax
call fcn.004388b0
lea eax, [0x629412]
mov dword [esp], eax
mov dword [esp + 4], 0x2e
call fcn.004391b0
mov eax, dword [esp + 0x24]
mov ecx, eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00438fb0
lea eax, [0x61e1fe]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004391b0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00438e30
lea eax, [0x61a767]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.004391b0
call fcn.00438920
lea eax, [0x61ed21]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00436e90
nop
lea eax, [0x7f8b10]
mov dword [esp], eax
call fcn.0040a140
nop
lea eax, [0x7f8b10]
mov dword [esp], eax
call fcn.0040a140
jmp 0x433c3b
Function at 0x435660
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43572d
sub esp, 0xc
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
cmp dword [ecx + 0x50], eax
jne 0x435716
mov dword [esp + 8], eax
call fcn.004357c0
mov eax, dword [esp]
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x435700
mov ecx, dword [0x7f8db0]
mov edx, dword [esp + 8]
mov ebx, dword [edx + 0x14]
test ecx, ecx
jne 0x4356c5
mov dword [eax + 0x14], ebx
mov dword [edx + 0x14], eax
mov ecx, dword [esp + 0x10]
mov dword [eax + 0xc], ecx
jmp 0x4356e9
lea edi, [eax + 0x14]
mov ecx, eax
mov eax, ebx
call fcn.00464380
lea edi, [edx + 0x14]
mov eax, ecx
call fcn.00464380
lea edi, [eax + 0xc]
mov eax, dword [esp + 0x10]
call fcn.00464380
mov eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x10]
mov dword [eax + 4], ecx
call fcn.00464310
add esp, 0xc
ret
lea eax, [0x627d8a]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00436e90
lea eax, [0x620bd0]
mov dword [esp], eax
mov dword [esp + 4], 0x15
call fcn.00436e90
nop
call fcn.00462f70
jmp fcn.00435660

Function at 0x435d10
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x435e24
sub esp, 0x18
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
jmp 0x435d52
mov dword [esp], edx
call fcn.004359e0
mov edx, dword [esp + 0xc]
mov eax, dword [edx]
call eax
mov eax, dword [esp + 8]
mov ecx, eax
mov edx, dword [ecx + 0x14]
test edx, edx
je 0x435e09
lea ebx, [esp + 0x1c]
cmp dword [edx + 4], ebx
jne 0x435e05
lea edi, [ecx + 0x14]
mov dword [esp + 0x14], edi
movzx ebp, byte [edx + 2]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x435dc1
mov ebp, dword [edx + 0xc]
mov esi, dword [0x7f8db0]
test esi, esi
jne 0x435d91
mov dword [edx + 0xc], 0
jmp 0x435da1
lea esi, [edx + 0xc]
xor eax, eax
mov edi, esi
call fcn.00464380
mov edi, dword [esp + 0x14]
mov dword [esp + 0xc], ebp
mov esi, dword [0x7f8db0]
mov eax, dword [edx + 0x14]
test esi, esi
jne 0x435db7
mov dword [ecx + 0x14], eax
jmp 0x435d3c
call fcn.00464380
jmp 0x435d3c
mov dword [esp + 0x10], edx
mov dword [esp], edx
call fcn.004363e0
movzx eax, byte [esp + 4]
test al, al
je 0x435e0d
mov ecx, dword [0x7f8db0]
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x14]
test ecx, ecx
jne 0x435df0
mov ecx, dword [esp + 8]
mov dword [ecx + 0x14], eax
jmp 0x435df9
mov edi, dword [esp + 0x14]
call fcn.00464380
mov dword [esp], edx
call fcn.004359e0
add esp, 0x18
ret
add esp, 0x18
ret
add esp, 0x18
ret
lea eax, [0x628b50]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00436e90
nop
call fcn.00462f70
jmp fcn.00435d10
Function at 0x43b0f0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43b2a7
sub esp, 0x10
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0x1001]
cmp ecx, 3
jbe 0x43b123
cmp eax, 0x1009
jne 0x43b1ff
mov ecx, eax
and eax, 0xffffefff
mov edx, dword [esp + 0x1c]
cmp edx, eax
jne 0x43b158
mov eax, dword [esp + 0x14]
test byte [eax], al
lea ebx, [eax + 0x48]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.00402390
movzx eax, byte [esp + 0xc]
test al, al
je 0x43b158
add esp, 0x10
ret
call fcn.004388b0
lea eax, [0x627ac2]
mov dword [esp], eax
mov dword [esp + 4], 0x27
call fcn.004391b0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00439130
lea eax, [0x61bbd9]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.004391b0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00439030
lea eax, [0x61bbd0]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.004391b0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00439030
call fcn.00438ad0
call fcn.00438920
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0043a9f0
lea eax, [0x62a427]
mov dword [esp], eax
mov dword [esp + 4], 0x34
call fcn.00436e90
call fcn.004388b0
lea eax, [0x628aa4]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.004391b0
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00439130
lea eax, [0x61bbd9]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.004391b0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00439030
lea eax, [0x61bbd0]
mov dword [esp], eax
mov dword [esp + 4], 9
call fcn.004391b0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00439030
call fcn.00438ad0
call fcn.00438920
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0043a9f0
lea eax, [0x62aa31]
mov dword [esp], eax
mov dword [esp + 4], 0x37
call fcn.00436e90
nop
call fcn.00462f70
jmp fcn.0043b0f0
Function at 0x43d0b0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43d230
sub esp, 0x18
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
nop
inc dword [ecx + 0x7c]
test byte [eax], al
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], ecx
call fcn.0043c8b0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 0x5c], ecx
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
test ecx, ecx
je 0x43d1e0
mov ecx, dword [ecx + 0x18]
test ecx, ecx
je 0x43d1e0
mov dword [esp + 0x14], eax
mov edx, dword [ecx + 0x144]
test edx, edx
jne 0x43d14b
movzx ecx, byte [ecx + 0x8c]
test cl, cl
je 0x43d1e0
nop
lea eax, [0x7f8de0]
mov dword [esp], eax
call fcn.0040a140
mov eax, dword [0x7f8df0]
test eax, eax
je 0x43d219
mov eax, dword [0x7f8de4]
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0xbc], eax
nop
mov dword [0x7f8de4], ecx
movzx eax, byte [0x7f8de8]
test al, al
je 0x43d19f
mov byte [0x7f8de8], 0
lea eax, [0x7f8dec]
mov dword [esp], eax
call fcn.0040a430
nop
nop
lea eax, [0x7f8de0]
mov dword [esp], eax
call fcn.0040a340
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x43d1dc
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x43d1dc
mov dword [eax + 8], 0xfffffade
add esp, 0x18
ret
mov dword [esp], eax
call fcn.0043d240
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x43d215
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x43d215
mov dword [eax + 8], 0xfffffade
add esp, 0x18
ret
lea eax, [0x62867c]
mov dword [esp], eax
mov dword [esp + 4], 0x2a
call fcn.00436e90
nop
call fcn.00462f70
jmp fcn.0043d0b0
Function at 0x43de40
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43df89
sub esp, 0x10
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0xc0]
test edx, edx
je 0x43df72
mov edx, dword [edx + 0x98]
cmp edx, ecx
jne 0x43df72
mov dword [esp + 0xc], eax
mov ecx, dword [ecx + 0x58]
test ecx, ecx
je 0x43de9a
call fcn.00443b90
call fcn.0043d960
mov dword [esp], 1
call fcn.00443d10
call fcn.0043c190
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0xc0]
test byte [ecx], al
add ecx, 0x48
mov dword [esp], ecx
call fcn.00402370
mov eax, dword [esp + 4]
mov ecx, eax
and eax, 0xffffefff
cmp eax, 1
jne 0x43def9
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x5c]
mov dword [esp], ecx
call fcn.00443a10
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
mov dword [eax + 0x5c], 0
add esp, 0x10
ret
mov dword [esp + 8], ecx
call fcn.004388b0
lea eax, [0x628afa]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.004391b0
mov dword [esp + 4], 0
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.00438e30
lea eax, [0x626b18]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.004391b0
call fcn.00438920
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0xc0]
mov dword [esp], eax
call fcn.0043a9f0
lea eax, [0x622e53]
mov dword [esp], eax
mov dword [esp + 4], 0x19
call fcn.00436e90
lea eax, [0x6260c5]
mov dword [esp], eax
mov dword [esp + 4], 0x21
call fcn.00436e90
nop
call fcn.00462f70
jmp fcn.0043de40
Function at 0x4459f0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x445b61
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00445d80
movzx eax, byte [esp + 4]
test al, al
je 0x445b4a
mov eax, dword [esp + 0x24]
test eax, eax
sete cl
mov edx, dword [esp + 0x28]
test edx, edx
sete dl
and edx, ecx
test dl, dl
jne 0x445a40
mov ecx, dword [esp + 0x28]
jmp 0x445a4d
nop
call fcn.00465240
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x20]
mov dword [esp], edx
call fcn.00445940
mov eax, dword [0x7d3bec]
mov ecx, dword [0x7d3be8]
mov edx, dword [esp + 0x20]
mov ebx, dword [edx]
mov ebp, ebx
sar ebx, 0x1f
shr ebx, 0x1b
add ebx, ebp
mov esi, ebx
and ebx, 0xffffffe0
sub ebp, ebx
test ebp, ebp
jl 0x445b45
cmp ebp, 0x20
sbb ebx, ebx
sar esi, 5
mov edi, ecx
mov ecx, ebp
mov edx, 1
shl edx, cl
and edx, ebx
cmp eax, esi
jbe 0x445b3c
lea eax, [edi + esi*4]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00402660
mov eax, dword [0x7d4684]
mov ecx, dword [esp + 0x20]
mov dword [ecx + 8], eax
nop
mov dword [0x7d4684], ecx
nop
lea ecx, [0x7d4688]
mov dword [esp], ecx
mov dword [esp + 4], 1
call fcn.00402470
mov eax, dword [esp + 0x20]
add eax, 0x948
mov dword [esp], eax
mov byte [esp + 4], 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], ecx
call fcn.0041aa80
movzx eax, byte [esp + 0x10]
test al, al
je 0x445b26
mov eax, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
add esp, 0x1c
ret
lea eax, [0x627e2a]
mov dword [esp], eax
mov dword [esp + 4], 0x28
call fcn.00436e90
mov ecx, eax
mov eax, esi
call fcn.00464400
call fcn.004355a0
lea eax, [0x626996]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00436e90
nop
call fcn.00462f70
jmp fcn.004459f0
Function at 0x44e9b0
Capabilities:
Reference sql statements

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44ea79
sub esp, 0x10
lea eax, [0x6057e0]
mov dword [esp + 8], eax
lea eax, [0x7f8bcc]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
movzx ecx, byte [eax + 0xf]
test cl, 0x40
jne 0x44ea62
lea ecx, [0x7f8da0]
lea edx, [0x7921a0]
jmp 0x44e9fe
mov edx, dword [edx + 0x118]
test edx, edx
je 0x44ea14
cmp dword [edx + 0xa0], ecx
ja 0x44e9f8
cmp dword [edx + 0x88], ecx
jbe 0x44e9f8
jmp 0x44ea16
xor edx, edx
test edx, edx
je 0x44ea4c
mov ecx, dword [eax]
lea ebx, [ecx + 7]
and ebx, 0xfffffff8
neg ebx
mov ebp, dword [eax + 4]
mov eax, dword [eax + 0x14]
sub eax, dword [edx + 0x9c]
mov dword [0x7f8da0], ebx
mov dword [0x7f8da4], ecx
mov dword [0x7f8da8], ebp
mov dword [0x7f8dac], eax
add esp, 0x10
ret
lea eax, [0x6288f6]
mov dword [esp], eax
mov dword [esp + 4], 0x2b
call fcn.00436e90
lea eax, [0x62b20b]
mov dword [esp], eax
mov dword [esp + 4], 0x3d
call fcn.00436e90
nop
call fcn.00462f70
jmp fcn.0044e9b0
Function at 0x452670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4527f7
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x4527ed
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x4526cc
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4526cc
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x4526df
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x4527c2
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x4527b4
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x4527ab
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x452736
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x45277f
mov eax, 1
cmp eax, ecx
ja 0x45276d
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00464470
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x4527a6
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x452772
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x45273b
call fcn.00464410
xor eax, eax
mov ecx, eax
call fcn.00464400
call fcn.00464470
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x4527e8
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x4527b9
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x4526e4
call fcn.00464410
xor eax, eax
mov ecx, eax
call fcn.00464400
nop
call fcn.00462f70
jmp fcn.00452670
Function at 0x456bc0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x456cc0
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00457450
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x5ead00]
mov dword [esp], ecx
call fcn.0040c1e0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x7dd190]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.00456440
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00455860
add esp, 0x28
ret
call fcn.00462f70
jmp fcn.00456bc0
Function at 0x45a230
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45a2cf
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004645c7
lea ecx, [0x45a2e0]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00462e60
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00462f70
jmp fcn.0045a230