joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x47b38f
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
sub eax, 1
sbb edx, 0
mov cl, byte [eax]
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
sub eax, 1
sbb edx, 0
xor cl, byte [eax]
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
sub eax, 1
sbb edx, 0
mov byte [eax], cl
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x47b330
mov esp, ebp
pop ebp
ret
Function at 0x47dc80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x47dda0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp word [eax], 0x5a4d
jne 0x47dcdd
mov eax, dword [ebp + 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
jne 0x47dcdd
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47dd7e
mov dl, 1
mov eax, dword [0x41af28]
call fcn.00404484
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x47dd77
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00403558
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00420914
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp word [eax], 0x5a4d
jne 0x47dd61
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
jne 0x47dd61
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dd7e
mov eax, dword [ebp - 0x10]
call fcn.004044b4
ret
cmp dword [ebp - 4], 0
je 0x47dd8a
mov eax, dword [ebp + 8]
add dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dda7
lea eax, [ebp - 0x18]
call fcn.00405414
ret
Function at 0x48e6bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x48e6e6
cmp dword [ebx + 0x64], 0
jne 0x48e6e6
cmp dword [ebx + 0x6c], 0
jne 0x48e6e6
mov edi, esi
jmp 0x48e76d
cmp edi, 0xffffffff
jne 0x48e6ee
dec edi
jmp 0x48e76d
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x48e76d
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0048da90
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48e73b
mov cx, word [esp]
sub cx, si
jmp 0x48e73d
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48e724
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48e763
mov cx, word [esp]
sub cx, si
jmp 0x48e765
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x48e74c
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x48e7ca
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.0048e458
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x48e7b5
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x48e7ca
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x48e6c6
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x494988
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and eax, 1
test al, al
je 0x4949b7
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x4949ba
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x49499e
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x5b3dd8], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x494993
mov byte [0x5b41d8], 1
mov esp, ebp
pop ebp
ret
Function at 0x4949e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp byte [0x5b41d8], 0
jne 0x494a0b
call fcn.00494988
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x494a4a
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x14]
and eax, 0xff
mov eax, dword [eax*4 + 0x5b3dd8]
mov edx, dword [ebp - 0x14]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x494a1e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x49de38
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x49de65
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x49dee4
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0049c090
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x49deb2
mov cx, word [esp]
sub cx, si
jmp 0x49deb4
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x49de9b
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x49deda
mov cx, word [esp]
sub cx, si
jmp 0x49dedc
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x49dec3
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x49df41
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.0049db0c
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x49df2c
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x49df41
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x49de42
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a75d4
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x4a7608
add eax, 3
sar eax, 2
test eax, eax
jle 0x4a7766
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
movzx eax, byte [eax + edx]
cmp eax, 0x3d
jg 0x4a7645
je 0x4a76ab
sub eax, 0x2b
je 0x4a7697
sub eax, 4
je 0x4a76a1
dec eax
sub eax, 0xa
jb 0x4a7681
jmp 0x4a76b3
add eax, 0xffffffbf
sub eax, 0x1a
jb 0x4a7657
add eax, 0xfffffffa
sub eax, 0x1a
jb 0x4a766b
jmp 0x4a76b3
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x41
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x4a76b3
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x61
add al, 0x1a
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x4a76b3
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x30
add al, 0x34
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x4a76b3
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3e
jmp 0x4a76b3
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3f
jmp 0x4a76b3
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0xff
inc dword [ebp - 0x1c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jne 0x4a7622
mov al, byte [ebp - 0x24]
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0x23]
shr edx, 4
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx], al
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x10], eax
cmp byte [ebp - 0x22], 0xff
je 0x4a7717
cmp byte [ebp - 0x21], 0xff
jne 0x4a7717
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x20]
add eax, 2
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x20]
jmp 0x4a7757
cmp byte [ebp - 0x22], 0xff
je 0x4a7757
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov cl, byte [ebp - 0x22]
shl ecx, 6
or cl, byte [ebp - 0x21]
mov byte [eax + edx + 2], cl
mov eax, dword [ebp - 0x20]
add eax, 3
mov dword [ebp - 0x10], eax
add dword [ebp - 0x20], 2
inc dword [ebp - 0x20]
inc dword [ebp - 0x14]
dec dword [ebp - 0x30]
jne 0x4a761d
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4a89cc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
add eax, 0x18
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0x40
call fcn.00403c0c
pop ecx
pop ecx
pop ebp
ret

Function at 0x4a955c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x5a16f0]
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
or dword [ebp - 0x10], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xe
jne 0x4a956c
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 4], 1
je 0x4a95b3
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x4a95b6
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x4a95a0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x5a12f0], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x4a9595
mov esp, ebp
pop ebp
ret
Function at 0x4a95dc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a95f4
cmp dword [ebp - 8], 0
jg 0x4a95fe
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4a9782
mov dword [ebp - 0x10], 0xdbc66688
cmp dword [0x5a12ec], 0
je 0x4a9613
call fcn.004a955c
xor dword [ebp - 0x10], 0xffffffff
cmp dword [ebp - 8], 8
jl 0x4a9747
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x5a12f0]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x5a12f0]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x5a12f0]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x5a12f0]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x5a12f0]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x5a12f0]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x5a12f0]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x5a12f0]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
sub dword [ebp - 8], 8
cmp dword [ebp - 8], 8
jge 0x4a9621
cmp dword [ebp - 8], 0
je 0x4a9779
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp - 0x10]
and eax, 0xff
mov eax, dword [eax*4 + 0x5a12f0]
mov edx, dword [ebp - 0x10]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x10], eax
inc dword [ebp - 4]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x4a974d
mov eax, dword [ebp - 0x10]
xor eax, 0xffffffff
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4b1a98
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4b1ac6
mov eax, ebx
call fcn.004b254c
cmp dword [ebx + 0x40], 0
je 0x4b1abf
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4b1b37
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4b1b29
cmp dword [ebx + 8], 0
je 0x4b1ae8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4b1afa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4b1b29
cmp dword [ebx + 8], 0
je 0x4b1adb
cmp eax, 3
je 0x4b1b0d
dec eax
jne 0x4b1adb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4b1adb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4b1adb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4b1b55
cmp dword [ebx + 0x14], 0xcc
je 0x4b1b55
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004b1b60
pop ebx
ret

Function at 0x530e30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x530e8a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00530e20
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0052ea78
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0052e590
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x530e91
lea eax, [ebp - 4]
call fcn.00405414
ret
Function at 0x53f864
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.004058a4
xor eax, eax
push ebp
push 0x53f9cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
mov edx, dword [ebp - 4]
mov word [edx + 4], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 6]
mov edx, dword [ebp - 4]
mov word [edx + 6], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 8]
mov edx, dword [ebp - 4]
mov word [edx + 8], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0xa]
mov edx, dword [ebp - 4]
mov word [edx + 0xa], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.0053ed34
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1c]
mov edx, dword [ebp - 4]
mov word [edx + 0x1c], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1e]
mov edx, dword [ebp - 4]
mov word [edx + 0x1e], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x20]
mov edx, dword [ebp - 4]
mov word [edx + 0x22], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x22]
mov edx, dword [ebp - 4]
mov word [edx + 0x24], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x24]
mov edx, dword [ebp - 4]
mov word [edx + 0x26], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x26]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2a]
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0040b690
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.005404d4
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0040b550
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0054057c
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x44], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x48], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53f9d2
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405438
ret
Function at 0x53f9d8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.004058a4
xor eax, eax
push ebp
push 0x53fb3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov word [eax + 4], 0
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
mov edx, dword [ebp - 4]
mov word [edx + 6], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 6]
mov edx, dword [ebp - 4]
mov word [edx + 8], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 8]
mov edx, dword [ebp - 4]
mov word [edx + 0xa], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa]
call fcn.0053ed34
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xe]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x16]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1a]
mov edx, dword [ebp - 4]
mov word [edx + 0x1c], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1c]
mov edx, dword [ebp - 4]
mov word [edx + 0x20], ax
mov eax, dword [ebp - 4]
mov word [eax + 0x22], 0
mov eax, dword [ebp - 4]
mov word [eax + 0x24], 0
mov eax, dword [ebp - 4]
mov word [eax + 0x26], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
cmp dword [ebp - 0xc], 0
je 0x53fafa
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0040b690
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.005404d4
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0040b550
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0054057c
jmp 0x53fb0e
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.005404d4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0054057c
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x44], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x48], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53fb46
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405438
ret