joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c490
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4cadd3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004bdb0b
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004c31a7
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004c4706
test eax, eax
je 0x48c5ac
mov ecx, dword [esp + 0x3c]
call fcn.004c31d4
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x48c570
push edi
mov ecx, esi
call fcn.004c0832
mov ecx, esi
call fcn.0048c710
cmp dword [esp + 0x38], 1
jne 0x48c5a5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004c096d
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x48efc0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x48eff3
push esi
call fcn.004920d0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x48efec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x48f079
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x48f062
mov eax, dword [esi + 8]
test eax, eax
je 0x48f017
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x48f05e
cmp eax, 2
je 0x48f062
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x48f00a
cmp eax, 3
je 0x48f03d
cmp eax, 1
jne 0x48f00a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x48f00a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x48f00a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0048f0a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x48f088
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0048f0a0
add esp, 4
pop esi
ret

Function at 0x49cfb0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb6b8
push 0x4ad84c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.004ac2b0
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d160
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
test eax, eax
jne 0x49d1a1
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
je 0x49d20e
cmp dword [esp + 0x1c], 2
jne 0x49d20e
cmp dword [esp + 0x10], 5
jne 0x49d20e
cmp dword [esp + 0x14], 1
jne 0x49d20e
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x49d1f8
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x49d1e9
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
jmp 0x49d1f1
mov dword [esp + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
je 0x49d20e
pop edi
mov eax, 1
pop esi
add esp, 0xa0
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret
Function at 0x49e9d0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push eax
mov dword [esi + 8], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x49ea1a
push eax
mov eax, dword [esi + 8]
mov dword [esi + 0x18], 0
push eax
jmp 0x49ea49
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x18], 1
sub edx, ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 8]
push eax
mov dword [esi + 0x10], eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 1
jne 0x49ea8b
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x14]
sub ecx, edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 8]
pop esi
add esp, 0x10
ret 4
Function at 0x4a3c40
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5151ec]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4a3c53
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4a3c94
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x515294]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4a3cc6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4a3cca
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4a3cbb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4a3ce8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4a3cec
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4a3cdd
xor ecx, ecx
mov eax, 0x5151fc
xor ebx, ebx
mov bl, byte [ecx + 0x5152a4]
cmp byte [esp + ebx + 0x14], 0
je 0x4a3d17
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x5152bc]
cmp byte [esp + ebx + 0x14], 0
je 0x4a3d2e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4a3cfe
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4a3c87
lea edx, [esp + 0x84]
push edx
call fcn.004a3d70
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4a8b70
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4a8bb9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4a9030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cb360
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004a8be0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004a8c60
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004a8c60
lea ecx, [esi + 0xc]
call fcn.004bc4bb
lea ecx, [esi + 0x10]
call fcn.004bc4bb
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004aa200
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004aa200
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004aa200
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004bc530
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004bc530
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4aa3f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4aa456
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4aa456
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4aa437
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4be901
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4be939
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004bc98b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004bc963
jmp 0x4be945
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4bffef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c0031
call fcn.004c5bab
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c0031
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c0028
xor eax, eax
jmp 0x4c0039
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c003f
pop edi
pop esi
pop ebx
ret 4

Function at 0x4c60db
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4c6109
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4c6127
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004c6041
jmp 0x4c6127
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4c6127
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004c6041
test edi, edi
mov eax, edi
jne 0x4c6111
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x408800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44e1df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov dword [esp + 0xc], 0
push 1
push 0x5c
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 1
call fcn.0043a6d2
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 2
call fcn.0043ce1e
mov eax, dword [esp + 4]
lea ecx, [esp + 0x24]
push eax
call fcn.0043aac2
push eax
lea ecx, [esp + 0xc]
push 0
push ecx
lea ecx, [esp + 0x30]
call fcn.0043a992
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 3
call fcn.0043ca0a
lea ecx, [esp + 8]
mov byte [esp + 0x18], 2
call fcn.0043c8d1
lea ecx, [esp + 0x24]
call fcn.0043ce1e
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call fcn.0043c646
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x18], 1
call fcn.0043c8d1
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 0
call fcn.0043c8d1
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 8

Function at 0x40a6e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x44e561
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x451ddc
mov dword [esi + 4], 0x451dcc
mov dword [esi + 8], 0x451dbc
mov dword [esi + 0xc], 0x451dac
mov dword [esi + 0x10], 0x451d98
mov eax, dword [esi + 0x1d30]
mov dword [esp + 0x18], 1
push eax
call fcn.004191f0
lea edi, [esi + 0x30]
add esp, 4
mov dword [esi + 0x1d30], 0
mov dword [esp + 0xc], edi
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.004193f0
mov edi, dword [edi + 0x18]
mov byte [esp + 0x18], 0
test edi, edi
je 0x40a768
mov ecx, dword [edi]
push edi
call dword [ecx + 8]
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], 0xffffffff
call fcn.00419530
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x40b640
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
call fcn.0040b710
mov eax, dword [esi + 0x10]
xor ecx, ecx
cmp eax, ecx
mov dword [esi + 0x118], 1
mov dword [esi + 0x11c], 0xffffffff
mov dword [esi + 0x120], ecx
jne 0x40b6ff
mov eax, dword [esi + 0xc]
mov dword [esi + 0x118], 2
cmp eax, 0x40
jb 0x40b6ff
mov edx, dword [esi]
cmp word [edx], 0x5a4d
jne 0x40b6ff
mov dword [esi + 0x118], ecx
cmp word [edx + 0x18], 0x40
jae 0x40b6a6
mov dword [esi + 0x120], 1
mov ecx, dword [edx + 0x3c]
cmp ecx, eax
jg 0x40b6ff
xor eax, eax
mov dword [esi + 0x11c], ecx
mov ax, word [ecx + edx]
sub eax, 0x454c
je 0x40b6e2
sub eax, 2
je 0x40b6d6
sub eax, 0xa
jne 0x40b6ec
mov dword [esi + 0x120], 4
jmp 0x40b6ec
mov dword [esi + 0x120], 2
jmp 0x40b6ec
mov dword [esi + 0x120], 3
cmp dword [ecx + edx], 0x4550
jne 0x40b6ff
mov dword [esi + 0x120], 5
mov eax, esi
pop esi
ret 4
Function at 0x40b644
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
call fcn.0040b710
mov eax, dword [esi + 0x10]
xor ecx, ecx
cmp eax, ecx
mov dword [esi + 0x118], 1
mov dword [esi + 0x11c], 0xffffffff
mov dword [esi + 0x120], ecx
jne 0x40b6ff
mov eax, dword [esi + 0xc]
mov dword [esi + 0x118], 2
cmp eax, 0x40
jb 0x40b6ff
mov edx, dword [esi]
cmp word [edx], 0x5a4d
jne 0x40b6ff
mov dword [esi + 0x118], ecx
cmp word [edx + 0x18], 0x40
jae 0x40b6a6
mov dword [esi + 0x120], 1
mov ecx, dword [edx + 0x3c]
cmp ecx, eax
jg 0x40b6ff
xor eax, eax
mov dword [esi + 0x11c], ecx
mov ax, word [ecx + edx]
sub eax, 0x454c
je 0x40b6e2
sub eax, 2
je 0x40b6d6
sub eax, 0xa
jne 0x40b6ec
mov dword [esi + 0x120], 4
jmp 0x40b6ec
mov dword [esi + 0x120], 2
jmp 0x40b6ec
mov dword [esi + 0x120], 3
cmp dword [ecx + edx], 0x4550
jne 0x40b6ff
mov dword [esi + 0x120], 5
mov eax, esi
pop esi
ret 4

Function at 0x40b9b0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 0x124]
push ebx
push ebp
push esi
push edi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor edi, edi
mov di, word [eax + 6]
xor ebx, ebx
test edi, edi
lea edx, [ecx + eax + 0x18]
jbe 0x40ba00
mov ebp, dword [esp + 0x14]
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x40b9e2
mov eax, dword [edx + 0x10]
cmp ecx, eax
jae 0x40b9eb
mov eax, dword [edx + 0x10]
mov ecx, eax
cmp ecx, eax
jae 0x40b9eb
mov esi, dword [edx + 0xc]
cmp ebp, esi
jb 0x40b9f8
add eax, esi
cmp ebp, eax
jb 0x40ba0a
inc ebx
add edx, 0x28
cmp ebx, edi
jb 0x40b9d4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
mov eax, dword [edx + 0x14]
pop edi
sub eax, esi
pop esi
add eax, ebp
pop ebp
pop ebx
ret 4

Function at 0x40c13c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44e846
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
mov esi, ecx
push edi
push pe_nt_image_headers32
mov dword [esp + 0x10], esi
mov byte [esi + 8], al
call fcn.0043ceec
xor edi, edi
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov cl, byte [esp + 0xf]
push 0x1c
mov dword [esp + 0x20], edi
mov byte [esi + 0x14], cl
call fcn.0043ceec
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
mov dl, byte [esp + 0x13]
push 0x18
mov byte [esp + 0x24], 1
mov byte [esi + 0x20], dl
call fcn.0043ceec
mov ecx, dword [esp + 0x1c]
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edi
mov eax, dword [0x4613b8]
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [esi + 4], edi
mov dword [esi + 0x2c], edi
mov dword [esi], 0x451f60
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40d090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44e903
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x453cf4
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.0043bd06
mov dword [ebx], 0x451fac
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.0043bd06
or eax, 0xffffffff
push 0x465608
mov dword [ebx], 0x451f80
push edi
mov dword [esi], 0x451f8c
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc0c0c0
mov dword [esi + 0x3c], edi
call 0x3f7084d0
pop esp
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x41e7e0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
cmp ebx, 8
push edi
mov esi, ecx
jae 0x41e85e
mov eax, dword [esi]
mov dword [esp + 0x10], 0
shr eax, 2
and eax, 0x1ff
mov edi, 1
mov ecx, dword [eax*4 + 0x465a34]
mov dword [esp + 0x18], ecx
mov ecx, 3
mov eax, dword [esp + 0x1c]
dec ecx
mov edx, ebx
shr edx, cl
lea eax, [edi + eax*8 + 1]
mov eax, dword [esi + eax*4]
and edx, 1
mov ebp, edx
sub eax, edx
neg ebp
xor eax, ebp
mov ebp, dword [esp + 0x10]
shr eax, 2
and eax, 0x1ff
lea edi, [edx + edi*2]
add ebp, dword [eax*4 + 0x465a34]
test ecx, ecx
mov dword [esp + 0x10], ebp
ja 0x41e817
mov eax, dword [esp + 0x18]
pop edi
add eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov ecx, dword [esi]
sub ebx, 8
dec ecx
not ecx
shr ecx, 2
and ecx, 0x1ff
cmp ebx, 8
mov eax, dword [ecx*4 + 0x465a34]
jae 0x41e8f3
mov edx, dword [esi + 0x204]
mov dword [esp + 0x10], 0
shr edx, 2
and edx, 0x1ff
mov edi, 1
mov ecx, dword [edx*4 + 0x465a34]
add eax, ecx
mov ecx, 3
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
dec ecx
mov edx, ebx
shr edx, cl
lea eax, [edi + eax*8 + 0x82]
mov eax, dword [esi + eax*4]
and edx, 1
mov ebp, edx
sub eax, edx
neg ebp
xor eax, ebp
mov ebp, dword [esp + 0x10]
shr eax, 2
and eax, 0x1ff
lea edi, [edx + edi*2]
add ebp, dword [eax*4 + 0x465a34]
test ecx, ecx
mov dword [esp + 0x10], ebp
ja 0x41e8a9
mov eax, dword [esp + 0x18]
pop edi
add eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov ecx, dword [esi + 0x204]
xor ebp, ebp
dec ecx
mov edi, 1
not ecx
shr ecx, 2
and ecx, 0x1ff
mov edx, dword [ecx*4 + 0x465a34]
mov ecx, 8
add eax, edx
add ebx, 0xfffffff8
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
mov edx, dword [esp + 0x1c]
dec ecx
mov eax, dword [esi + edi*4 + 0x408]
shr edx, cl
and edx, 1
mov ebx, edx
sub eax, edx
neg ebx
xor eax, ebx
lea edi, [edx + edi*2]
shr eax, 2
and eax, 0x1ff
add ebp, dword [eax*4 + 0x465a34]
test ecx, ecx
ja 0x41e925
mov eax, dword [esp + 0x18]
pop edi
add eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x4221d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov ebp, 0xa1c8
push edi
mov edi, ecx
mov dword [esp + 0x10], ebp
xor edx, edx
cmp edx, dword [edi + 0x33678]
jae 0x4222ce
mov dword [esp + 0x14], 0
mov esi, 1
mov ecx, 6
dec ecx
mov eax, edx
shr eax, cl
add ebp, esi
mov ebp, dword [edi + ebp*4]
and eax, 1
mov ebx, eax
sub ebp, eax
neg ebx
xor ebp, ebx
mov ebx, dword [esp + 0x14]
shr ebp, 2
and ebp, 0x1ff
lea esi, [eax + esi*2]
add ebx, dword [ebp*4 + 0x465a34]
mov ebp, dword [esp + 0x10]
test ecx, ecx
mov dword [esp + 0x14], ebx
ja 0x422202
lea eax, [edx + ebp]
inc edx
cmp edx, 0xe
mov dword [edi + eax*4 + 0xa314], ebx
jb 0x4221e4
cmp edx, dword [edi + 0x33678]
jae 0x4222ce
mov dword [esp + 0x14], 0
mov esi, 1
mov ecx, 6
jmp 0x42226a
mov ebp, dword [esp + 0x10]
dec ecx
mov eax, edx
shr eax, cl
add ebp, esi
mov ebp, dword [edi + ebp*4]
and eax, 1
mov ebx, eax
sub ebp, eax
neg ebx
xor ebp, ebx
mov ebx, dword [esp + 0x14]
shr ebp, 2
and ebp, 0x1ff
lea esi, [eax + esi*2]
add ebx, dword [ebp*4 + 0x465a34]
test ecx, ecx
mov dword [esp + 0x14], ebx
ja 0x422266
mov ebp, dword [esp + 0x10]
mov ecx, edx
and ecx, 0x7fffffe
add ecx, 0x7fffff6
lea eax, [edx + ebp - 0xa1c8]
shl ecx, 5
add ecx, ebx
inc edx
mov dword [edi + eax*4 + 0x32a34], ecx
mov eax, dword [edi + 0x33678]
cmp edx, eax
jb 0x422252
add ebp, 0x40
cmp ebp, 0xa2c8
mov dword [esp + 0x10], ebp
jb 0x4221e2
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret