joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415a76
Capabilities:
Write file on windows

Disassembly:
push 0x4c
mov eax, 0x5f66b5
call fcn.00523519
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x415b82
cmp byte [esi + 0x41], 0
je 0x415b82
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x415aac
xor al, al
jmp 0x415b84
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.00401ea3
mov dword [ebp - 4], edi
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x30]
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
mov edi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
add edi, ebx
push edi
push dword [ebp - 0x38]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x415b1c
dec eax
je 0x415b20
dec eax
dec eax
je 0x415b7e
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004108b7
mov al, bl
jmp 0x415b84
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x415b60
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0052007a
add esp, 0x10
cmp edi, eax
jne 0x415b0a
cmp byte [esi + 0x41], 0
je 0x415b7e
test edi, edi
jne 0x415aba
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.00410989
jmp 0x415aba
mov bl, 1
jmp 0x415b0c
mov al, 1
call fcn.0052359c
ret
Function at 0x425406
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0x130
mov eax, 0x5fade4
call fcn.00523519
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
mov esi, ecx
push eax
lea edi, [ebp - 0x6c]
mov dword [ebp - 0x78], esi
call fcn.005c1da9
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x6c], ebx
jne 0x42544a
mov byte [ebp - 0x6d], bl
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.00410779
mov al, byte [ebp - 0x6d]
call fcn.0052359c
ret 4
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0041186e
mov eax, esi
add esi, 0xffffffdc
neg eax
sbb eax, eax
and eax, esi
mov byte [ebp - 4], 1
push dword [eax + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4255fe
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
call fcn.0040fe4b
mov byte [ebp - 4], 2
call dword [sym.imp.USER32.dll_EmptyClipboard]
call fcn.004c1998
cmp eax, 6
setg byte [ebp - 0x6d]
cmp byte [ebp - 0x6d], bl
je 0x4254b8
cmp dword [ebp - 0x34], 8
mov esi, dword [ebp - 0x38]
lea esi, [esi + esi + 2]
jb 0x4254b3
mov eax, dword [ebp - 0x48]
jmp 0x42550a
lea eax, [ebp - 0x48]
jmp 0x42550a
sub esp, 0x1c
lea eax, [ebp - 0x4c]
mov ecx, esp
mov dword [ebp - 0x74], esp
push eax
call fcn.0041186e
lea eax, [ebp - 0x94]
push eax
call fcn.004adf6c
add esp, 0x20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0040f845
push ebx
push 1
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 2
call fcn.004108b7
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
inc esi
cmp dword [ebp - 0x18], 0x10
jae 0x42550a
lea eax, [ebp - 0x2c]
push esi
push 2
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, ebx
je 0x4255ed
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
je 0x4255e6
push esi
push dword [ebp - 0x74]
push eax
call fcn.005229e0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp byte [ebp - 0x6d], bl
push edi
je 0x425567
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, dword [ebp - 0x78]
push 0xffffffffffffffff
mov esi, eax
push ebx
lea eax, [ebp - 0x4c]
push eax
add ecx, 0x14
call fcn.004106e6
jmp 0x4255b6
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
sub esp, 0x1c
mov esi, eax
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x74], esp
push eax
call fcn.00410afb
lea eax, [ebp - 0x94]
push eax
call fcn.004ae022
add esp, 0x20
mov ecx, dword [ebp - 0x78]
push 0xffffffffffffffff
push ebx
push eax
add ecx, 0x14
mov byte [ebp - 4], 4
call fcn.004106e6
push ebx
push 1
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 2
call fcn.00410779
cmp esi, ebx
jne 0x4255ed
push str.SetClipboardData_failed___.Clipboard.cpp__113_
lea ecx, [ebp - 0x13c]
call fcn.00403e35
push eax
mov byte [ebp - 4], 5
call fcn.004b9650
pop ecx
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 2
call fcn.00401441
jmp 0x4255ed
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.004108b7
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.00410779
mov byte [ebp - 0x6d], 1
jmp 0x425434
Function at 0x425612
Capabilities:
Open clipboard

Disassembly:
push 0x64
mov eax, 0x5f9871
call fcn.00523519
mov ebx, dword [ebp + 8]
mov eax, ebx
neg eax
sbb eax, eax
lea ecx, [ebx - 0x24]
xor esi, esi
and eax, ecx
cmp dword [ebx + 0x10], esi
je 0x42579a
push dword [eax + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42579a
call fcn.004c1998
cmp eax, 6
setg byte [ebp - 0x31]
cmp byte [ebp - 0x31], 0
je 0x42565e
push 0xd
jmp 0x425660
push 1
call dword [0x71f73c]
cmp eax, esi
mov dword [ebp - 0x38], eax
je 0x425794
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
cmp edi, esi
je 0x425794
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 7
call fcn.00410c09
cmp byte [ebp - 0x31], 0
mov dword [ebp - 4], esi
je 0x4256aa
push edi
lea ecx, [ebp - 0x68]
call fcn.004120e9
mov byte [ebp - 4], 1
jmp 0x4256c8
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x44], esp
push edi
call fcn.00410b44
lea eax, [ebp - 0x68]
push eax
call fcn.004ae022
add esp, 0x20
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.004106e6
push esi
push 1
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0
call fcn.00410779
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebx + 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.00401630
test eax, eax
je 0x425789
lea eax, [ebx + 8]
mov ecx, dword [eax + 4]
mov esi, dword [ecx]
mov edi, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], edi
test edi, edi
lea eax, [ebx + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x48], ecx
je 0x425721
cmp edi, eax
je 0x425726
call fcn.0051e314
cmp esi, dword [ebp - 0x48]
je 0x425787
test edi, edi
jne 0x425734
call fcn.0051e314
cmp esi, dword [edi + 4]
jne 0x42573e
call fcn.0051e314
lea eax, [esi + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [eax]
neg eax
sbb eax, eax
test eax, fcn.0040f6ca
je 0x425774
sub esp, 0x1c
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x44], esp
push eax
call fcn.0041186e
cmp esi, dword [edi + 4]
jne 0x42576c
call fcn.0051e314
mov ecx, dword [ebp - 0x38]
call fcn.004257b6
lea edi, [ebp - 0x70]
lea esi, [ebp - 0x40]
call fcn.00454ac1
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x40]
jmp 0x425710
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x30]
call fcn.00410779
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebx + 4]
call dword [0x71f7ac]
xor eax, eax
call fcn.0052359c
ret 0x10
Function at 0x42bdeb
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5fc020
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [ecx + 0x60]
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x44], ebx
call fcn.00519640
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 1
call fcn.0042c087
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], bl
call fcn.0042ab7f
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x20]
push eax
call fcn.0051aae0
lea ecx, [esp + 0x20]
call fcn.0042ab7f
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42ead3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5f62cf
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x70b744]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov esi, ecx
push eax
lea ecx, [esp + 0x14]
call fcn.0042eb8c
and dword [esp + 0x38], 0
lea eax, [esp + 0xc]
push eax
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00419799
push 0
push 1
lea ecx, [esp + 0x14]
call fcn.004108b7
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0051d721
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x43b7d1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x43b7e8
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x43b81d
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x43b819
cmp edi, eax
jae 0x43b81d
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x43b80b
cmp edi, eax
jb 0x43b821
xor eax, eax
jmp 0x43b82b
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x43e50c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5f6137
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x70b744]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
cmp di, 0xffff
mov esi, ecx
jne 0x43e572
xor ax, ax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0051d721
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x43e59d
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x43e59d
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x43e552
mov eax, dword [esi + 0x4c]
cmp eax, ebx
jne 0x43e5aa
or ax, 0xffff
jmp 0x43e552
cmp dword [esi + 0x3c], ebx
jne 0x43e5c8
push eax
push edi
call fcn.00521336
pop ecx
cmp ax, 0xffff
pop ecx
movzx eax, di
jne 0x43e552
mov eax, 0xffff
jmp 0x43e552
movzx eax, di
push ebx
push 8
lea ecx, [esp + 0x4c]
mov dword [esp + 0x18], eax
call fcn.00401ea3
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x74], ebx
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
mov edi, dword [esp + 0x58]
mov ebx, eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
lea edx, [esp + 0x18]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x43e6d7
cmp eax, 1
jg 0x43e717
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x48]
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
mov edi, dword [esp + 0x18]
sub edi, eax
je 0x43e670
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x48]
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0052007a
add esp, 0x10
cmp edi, eax
jne 0x43e6fd
lea eax, [esp + 0x10]
cmp dword [esp + 0x1c], eax
mov byte [esi + 0x42], 1
jne 0x43e73a
test edi, edi
ja 0x43e69a
cmp dword [esp + 0x58], 0x20
jae 0x43e6fd
push 0
push 8
lea ecx, [esp + 0x4c]
call fcn.00410989
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
mov edi, dword [esp + 0x58]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [esp + 0x28]
push edx
lea edx, [esp + 0x22]
push edx
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x43e61e
or si, 0xffff
push 0
push 1
lea ecx, [esp + 0x4c]
call fcn.004108b7
mov ax, si
jmp 0x43e552
cmp eax, 3
jne 0x43e6fd
push dword [esi + 0x4c]
push dword [esp + 0x14]
call fcn.00521336
mov esi, 0xffff
cmp ax, si
pop ecx
pop ecx
je 0x43e702
movzx esi, word [ebp + 8]
jmp 0x43e702
mov si, word [ebp + 8]
jmp 0x43e702
Function at 0x43ed3f
Capabilities:
Write file on windows

Disassembly:
push 0x4c
mov eax, 0x5f66b5
call fcn.00523519
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x43ee51
cmp byte [esi + 0x42], bl
je 0x43ee51
mov eax, dword [esi]
mov edi, 0xffff
push edi
mov ecx, esi
call dword [eax + 4]
movzx eax, ax
cmp ax, di
jne 0x43ed7b
xor al, al
jmp 0x43ee53
push ebx
push 8
lea ecx, [ebp - 0x30]
call fcn.00401ea3
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x30]
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
mov edi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
add edi, ebx
push edi
push dword [ebp - 0x38]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x43edeb
dec eax
je 0x43edef
dec eax
dec eax
je 0x43ee4d
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004108b7
mov al, bl
jmp 0x43ee53
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x43ee2f
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.0041c383
mov ecx, eax
call fcn.00415e7b
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0052007a
add esp, 0x10
cmp edi, eax
jne 0x43edd9
cmp byte [esi + 0x42], 0
je 0x43ee4d
test edi, edi
jne 0x43ed89
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.00410989
jmp 0x43ed89
mov bl, 1
jmp 0x43eddb
mov al, 1
call fcn.0052359c
ret

Function at 0x443dff
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [eax - 0x30]
and esi, ecx
cmp byte [eax + 0x1c], 0
je 0x443e42
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 8], 2
jne 0x443e33
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x443e48
cmp dword [ebp + 8], 0
jne 0x443e42
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 1
je 0x443e60
mov eax, dword [ebp + 0xc]
shr eax, 0x10
movsx eax, ax
push eax
movsx eax, word [ebp + 0xc]
push eax
add esi, 0x30
push esi
call fcn.00443f08
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x453c62
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [eax - 0x34]
and esi, ecx
cmp byte [eax + 0x1c], 0
je 0x453ca5
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 8], 2
jne 0x453c96
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x453cab
cmp dword [ebp + 8], 0
jne 0x453ca5
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 1
je 0x453cc3
mov eax, dword [ebp + 0xc]
shr eax, 0x10
movsx eax, ax
push eax
movsx eax, word [ebp + 0xc]
push eax
add esi, 0x34
push esi
call fcn.00453cca
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x4549a1
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x76a2c0], 0
jne 0x454a14
push ebx
push esi
mov byte [ebp - 1], 0
push edi
mov cl, byte [ebp - 1]
xor edi, edi
mov al, 0x80
test cl, al
je 0x4549c6
xor edi, 0x80000000
test edi, edi
jns 0x4549d4
add edi, edi
xor edi, 0x4c11db7
jmp 0x4549d6
add edi, edi
shr al, 1
jne 0x4549bc
push 7
mov al, cl
pop ecx
push 8
xor bl, bl
pop esi
test al, 1
je 0x4549ee
mov dl, 1
shl dl, cl
or bl, dl
dec ecx
shr al, 1
dec esi
jne 0x4549e4
push edi
call fcn.0045497b
inc byte [ebp - 1]
pop ecx
movzx ecx, bl
mov dword [ecx*4 + 0x76a2c8], eax
jne 0x4549b5
pop edi
pop esi
mov byte [0x76a2c0], 1
pop ebx
leave
ret

Function at 0x45cb20
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x45cb71
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push 0x1c
push 1
push esi
call ecx
mov dword [esi + 0x180], eax
mov dword [eax], 0x45f460
mov dword [eax + 4], 0x45f5c0
mov byte [eax + 8], 0
add esp, 0xc
mov eax, esi
call fcn.0045f2a0
cmp byte [esi + 0x40], 0
je 0x45cb6a
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x45cbec
mov edx, dword [esi + 0x190]
cmp byte [edx + 0x10], 0
je 0x45cbdc
mov eax, dword [esi + 8]
test eax, eax
je 0x45cb96
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov ecx, dword [esi + 0x190]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
test eax, eax
je 0x45cbd8
cmp eax, 2
je 0x45cbdc
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45cb87
cmp eax, 3
je 0x45cbbe
cmp eax, 1
jne 0x45cb87
add dword [ecx + 4], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x45cb87
mov edx, dword [esi + 0x11c]
add dword [eax + 8], edx
jmp 0x45cb87
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
call fcn.0045cc20
pop esi
ret
cmp eax, 0xcc
je 0x45cc0e
mov ecx, dword [esi]
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
call fcn.0045cc20
pop esi
ret
Function at 0x4612b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x24]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1a8]
mov dword [esp + 0x18], esi
jne 0x4612d7
mov dword [esp + 8], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x4612e3
mov dword [esp + 8], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [edi + 0x64]
mov edx, dword [esp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push edi
call eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
cmp dword [edi + 0x64], ecx
mov dword [esp + 0x14], ecx
jle 0x46140c
push ebx
lea edx, [esi + 0x20]
push ebp
mov dword [esp + 0x14], edx
jmp 0x461328
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov edi, dword [edx]
cdq
idiv edi
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
je 0x461349
mov eax, dword [esi + 0x18]
add dword [eax + ecx*4], 0xff
lea eax, [eax + ecx*4]
mov edx, dword [esi + 0x18]
mov ebp, dword [edx + ecx*4]
lea eax, [edi + 0xfe]
lea esi, [edi + edi - 2]
cdq
idiv esi
xor ebx, ebx
mov dword [esp + 0x24], ebp
xor esi, esi
mov edx, eax
cmp esi, edx
jle 0x4613a1
mov ecx, ebx
lea ebp, [edi + edi - 2]
imul ecx, ecx, 0x1fe
jmp 0x461380
add ecx, 0x1fe
lea eax, [ecx + edi + 0xfe]
cdq
idiv ebp
add ebx, 1
mov edx, eax
cmp esi, edx
jg 0x461380
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
mov al, byte [esp + 0x18]
imul bl
mov byte [esi + ebp], al
add esi, 1
cmp esi, 0xff
jle 0x461366
cmp dword [esp + 0x10], 0
je 0x4613f1
mov eax, 1
lea edx, [ebp - 1]
jmp 0x4613d0
movzx ebx, byte [ebp]
mov byte [edx], bl
movzx ebx, byte [ebp + 0xff]
mov byte [eax + ebp + 0xff], bl
add eax, 1
sub edx, 1
cmp eax, 0xff
jle 0x4613d0
mov eax, dword [esp + 0x2c]
add dword [esp + 0x14], 4
add ecx, 1
cmp ecx, dword [eax + 0x64]
mov dword [esp + 0x1c], ecx
jl 0x461320
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x471090
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5fa30f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x38], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x4c], 0xf
mov dword [esi + 0x48], ebx
mov byte [esi + 0x38], bl
lea edi, [esi + 0x54]
mov byte [esp + 0x38], 2
mov ecx, edi
mov byte [esi + 0x50], 0xff
call fcn.0041b0b0
mov dword [edi], vtable.boost::io::basic_altstringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [edi + 0x3c], ebx
mov byte [edi + 0x40], bl
mov dword [edi + 0x44], 3
mov byte [esi + 0xa0], bl
cmp ebp, ebx
mov byte [esp + 0x38], 4
je 0x47117b
mov eax, ebp
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x471140
sub eax, edx
push eax
push ebp
lea ecx, [esp + 0x1c]
call fcn.00410a89
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov byte [esp + 0x3c], 5
call fcn.00471c00
cmp dword [esp + 0x2c], 0x10
jb 0x47117b
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0051d492
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
Function at 0x4727a0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5f9068
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x30]
mov esi, ecx
mov dword [esp + 0x28], 0
mov edi, dword [esi + 4]
test edi, edi
jne 0x4727e0
xor eax, eax
jmp 0x4727f6
mov ecx, dword [esi + 8]
sub ecx, edi
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, ebx
jae 0x47284a
mov ebp, dword [esi + 8]
cmp edi, ebp
jbe 0x472806
call fcn.0051e314
mov eax, dword [esi + 4]
test eax, eax
jne 0x472822
push ebp
push esi
lea ecx, [esp + 0x3c]
push ecx
sub ebx, eax
push ebx
push esi
call fcn.00472980
jmp 0x4728a7
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebp
mov eax, edx
shr eax, 0x1f
push esi
add eax, edx
lea ecx, [esp + 0x3c]
push ecx
sub ebx, eax
push ebx
push esi
call fcn.00472980
jmp 0x4728a7
test edi, edi
je 0x4728a7
mov ebp, dword [esi + 8]
mov ecx, ebp
sub ecx, edi
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x4728a7
cmp edi, ebp
jbe 0x472873
call fcn.0051e314
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
jbe 0x472880
call fcn.0051e314
imul ebx, ebx, 0x64
mov dword [esp + 0x1c], edi
add edi, ebx
cmp edi, dword [esi + 8]
ja 0x472893
cmp edi, dword [esi + 4]
jae 0x472898
call fcn.0051e314
push ebp
push esi
push edi
push esi
lea edx, [esp + 0x28]
push edx
push esi
call fcn.00472920
lea esi, [esp + 0x34]
call fcn.004726c0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x68