joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104ec54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.010399d6
add esp, 0xc
cmp edi, 0x3454
ror eax, 0x18
ror eax, 8
ja 0x104ec96
pushf
clc
xor ecx, dword [esp + 0x10]
xor ecx, dword [esp + 0x10]
popf
mov esp, esp
xchg edx, edx
jbe 0x104ec96
mov eax, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
dec eax
inc eax
add ebx, 0xcae
sub ebx, 0xcae
lea edx, [edx]
or esp, 0
jge 0x104ecea
xchg edi, ebx
xchg edi, ebx
lea edx, [edx]
xchg esp, esp
xchg ecx, ebx
xchg ecx, ebx
jl 0x104ecea
ljmp 0x1e9:0x80f04d8a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
shr esp, 0
stc
ja 0x104ed62
pushf
jp 0x104ed54
rol esp, 0
je 0x104ed59
popf
mov ecx, ecx
jae 0x104ed5f
jbe 0x104ed62
add eax, 0xfee563e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.0103d2ca
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x104ed74
xor eax, eax
jmp 0x104edb3
xchg ebx, ebx
jo 0x104ed90
pushf
xor esp, 0
and esp, 0xffffffff
jg 0x104ed82
or esp, 0
popf
jge 0x104ed89
mov esp, esp
jne 0x104ed8d
jno 0x104ed90
jmp 0x51f53321
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0103a999
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.010399d6
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x104f702
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.010399d6
add esp, 0xc
push 0x21
push 0x10295ac
lea ecx, [ebp - 0x138]
push ecx
call fcn.010437c8
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x104f80a
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.010399d6
add esp, 0xc
push 0xb
push 0x10295d0
lea edx, [ebp - 0x138]
push edx
call fcn.010437c8
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x104f7fd
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.010437c8
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x104f80c
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x104f810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0x19
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.010399d6
add esp, 0xc
lea esp, [esp]
xor esi, 0
jle 0x104f83f
jns 0x104f83a
xchg edi, edi
jg 0x104f83f
mov ecx, 0x44dc45c6
mov byte [ebp - 0x24], 0x44
mov byte [ebp - 0x1f], 0x66
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x15], 0x33
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x1e], 0x55
mov byte [ebp - 0x19], 0x66
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0x22], 0x66
mov byte [ebp - 0x1d], 0x70
mov byte [ebp - 0x18], 0x6d
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x70
or ecx, ecx
push edx
add edx, 0x4fe4
ror edx, 0xc
pop edx
jmp 0x104f88a
ror edx, 0x17
ror edx, 9
jle 0x104f8a5
pushf
xchg edi, ecx
xchg edi, ecx
sub eax, 0
test dword [esp], edi
popf
jge 0x104f8a2
jg 0x104f8a5
add eax, 0x62df45c6
mov byte [ebp - 0x21], 0x62
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x12], 0x62
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 0x20], 0x75
mov byte [ebp - 0x1b], 0x6d
mov byte [ebp - 0x16], 0x34
mov byte [ebp - 0x11], 0x71
mov byte [ebp - 0xc], 0
mov cl, byte [ebp - 0x24]
sub cl, 1
mov byte [ebp - 0x24], cl
mov dl, byte [ebp - 0x1f]
sub dl, 1
mov byte [ebp - 0x1f], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x23]
sub al, 1
mov byte [ebp - 0x23], al
mov cl, byte [ebp - 0x1e]
sub cl, 1
mov byte [ebp - 0x1e], cl
mov dl, byte [ebp - 0x19]
sub dl, 1
mov byte [ebp - 0x19], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x22]
sub dl, 1
mov byte [ebp - 0x22], dl
mov al, byte [ebp - 0x1d]
sub al, 1
mov byte [ebp - 0x1d], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
and ecx, 0xffffffff
shr esp, 0
xor ebx, 0
jnp 0x104f95f
jge 0x104f95c
jp 0x104f95f
mov ecx, 0x80df4d8a
jmp 0xe0528169
mov cl, byte [ebp - 0x21]
sub cl, 1
mov byte [ebp - 0x21], cl
mov dl, byte [ebp - 0x1c]
sub dl, 1
mov byte [ebp - 0x1c], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x20]
sub al, 1
mov byte [ebp - 0x20], al
mov cl, byte [ebp - 0x1b]
sub cl, 1
mov byte [ebp - 0x1b], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
Function at 0x104fa75
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.010399d6
add esp, 0xc
mov esp, esp
rol ecx, 0
push ebx
pop ebx
jb 0x104faa5
lea edx, [edx]
jnp 0x104fa9b
je 0x104fa9d
xchg esi, edi
xchg esi, edi
jae 0x104faa5
mov esp, 0xe845c65a
inc edi
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
ja 0x104fadf
dec edi
inc edi
xchg edx, esi
xchg edx, esi
jg 0x104fb03
pushf
test esp, 0x4eb0
lea eax, [eax + 0x829]
sub eax, 0x829
popf
jbe 0x104fafe
jbe 0x104fb00
jle 0x104fb03
jmp 0x81ed4891
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.0103d2ca
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x104fb86
xor eax, eax
jmp 0x104fc00
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0103a999
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.010399d6
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x104fbfe
cmp edx, dword [esp]
shl esp, 0
cmc
jge 0x104fbb5
jae 0x104fbbc
jge 0x104fbb9
jb 0x104fbbc
lcall 0x80e8, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.01036c45
xor eax, eax
Function at 0x10536e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x40158f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov eax, 0x4041a4
push esp
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ax, word [esp + 2]
mov dword [0x4041a0], eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x4c], 0x30
mov eax, 3
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 8]
mov dword [0x404190], eax
mov eax, edi
mov dword [ebp - 0x44], 0x401488
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.pieta
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push edi
push dword [ebp - 0x38]
push edi
push edi
push 0x190
push 0x258
push 0xffffee08
push 0xffffee6c
push 0
push str.novice
push str.pieta
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x404198], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x404198]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401679
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x40165e
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40954c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40959e
test eax, edx
je 0x4095a1
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x409561
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x409587
add ecx, 4
js 0x409577
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x409584
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x4095ad
test edx, edx
jne 0x409554
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x428594
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42859a
ret
Function at 0x443478
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x443633
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.0040554c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x44364c
call fcn.004050e0
mov eax, ebx
call fcn.004227d0
mov edi, eax
dec edi
test edi, edi
jl 0x443530
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004227a4
mov edx, dword [0x435538]
call fcn.00404030
test al, al
je 0x44352c
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.004227a4
lea edx, [ebp - 0x14]
call fcn.00453084
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.0040554c
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040515c
inc esi
dec edi
jne 0x4434de
movzx eax, byte [0x443650]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x44365c
mov eax, dword [ebp - 8]
call fcn.0040fa08
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00404e60
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00453084
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x44364c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.00453084
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x44364c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x44364c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x443668
call fcn.0040b5b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44363a
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404dec
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404dec
lea eax, [ebp - 0x14]
call fcn.00404dc8
lea eax, [ebp - 0x10]
call fcn.00404dc8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404dec
ret
Function at 0x47dad8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a368
cmp ebx, dword [ebp - 8]
jge 0x47db3b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a790
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a790
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042a7bc
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x47db01
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x47db44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a368
cmp ebx, dword [ebp - 8]
jge 0x47dba7
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a790
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a790
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042a7bc
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x47db6d
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4c5020
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4c504e
mov eax, ebx
call fcn.004c5ad4
cmp dword [ebx + 0x40], 0
je 0x4c5047
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4c50bf
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4c50b1
cmp dword [ebx + 8], 0
je 0x4c5070
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4c5082
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4c50b1
cmp dword [ebx + 8], 0
je 0x4c5063
cmp eax, 3
je 0x4c5095
dec eax
jne 0x4c5063
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4c5063
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4c5063
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4c50dd
cmp dword [ebx + 0x14], 0xcc
je 0x4c50dd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004c50e8
pop ebx
ret

Function at 0x4d72bc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
add eax, 0x18
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0x40
call fcn.004037c4
pop ecx
pop ecx
pop ebp
ret
Function at 0x4dad68
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00405248
xor eax, eax
push ebp
push 0x4daecf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
mov edx, dword [ebp - 4]
mov word [edx + 4], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 6]
mov edx, dword [ebp - 4]
mov word [edx + 6], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 8]
mov edx, dword [ebp - 4]
mov word [edx + 8], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0xa]
mov edx, dword [ebp - 4]
mov word [edx + 0xa], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.004da234
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1c]
mov edx, dword [ebp - 4]
mov word [edx + 0x1c], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1e]
mov edx, dword [ebp - 4]
mov word [edx + 0x1e], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x20]
mov edx, dword [ebp - 4]
mov word [edx + 0x22], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x22]
mov edx, dword [ebp - 4]
mov word [edx + 0x24], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x24]
mov edx, dword [ebp - 4]
mov word [edx + 0x26], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x26]
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2a]
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0040a930
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004db9d8
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0040a7f0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004dba80
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x44], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x48], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4daed6
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404dec
ret
Function at 0x4daedc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.00405248
xor eax, eax
push ebp
push 0x4db043
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov word [eax + 4], 0
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
mov edx, dword [ebp - 4]
mov word [edx + 6], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 6]
mov edx, dword [ebp - 4]
mov word [edx + 8], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 8]
mov edx, dword [ebp - 4]
mov word [edx + 0xa], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xa]
call fcn.004da234
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xe]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x12]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x16]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1a]
mov edx, dword [ebp - 4]
mov word [edx + 0x1c], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 0x1c]
mov edx, dword [ebp - 4]
mov word [edx + 0x20], ax
mov eax, dword [ebp - 4]
mov word [eax + 0x22], 0
mov eax, dword [ebp - 4]
mov word [eax + 0x24], 0
mov eax, dword [ebp - 4]
mov word [eax + 0x26], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
cmp dword [ebp - 0xc], 0
je 0x4daffe
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0040a930
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004db9d8
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0040a7f0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004dba80
jmp 0x4db012
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004db9d8
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004dba80
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x44], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x48], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db04a
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404dec
ret