joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40bdb9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40bdc8
pop dword [ebp - 0x20]
mov eax, 0x1d668d2b
add eax, 0xe2da309d
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x18203807
sub dword [ebp - 0x30], 0xc9cdf2bc
mov dword [ebp - 0x2c], 0x14f66f07
sub dword [ebp - 0x2c], 0xe2c322c2
mov dword [ebp - 0x28], 0x52327dbb
sub dword [ebp - 0x28], 0x5e6398d
mov dword [ebp - 0x24], 0xfed49569
sub dword [ebp - 0x24], 0xfed49569
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x48a8d05e
sub dword [ebp - 0x30], 0xd4366708
mov dword [ebp - 0x2c], 0x2d4687ed
sub dword [ebp - 0x2c], 0xebda2678
mov dword [ebp - 0x28], 0xf919aaa8
add dword [ebp - 0x28], 0x6a55c1c4
mov dword [ebp - 0x24], 0xaace0fa1
sub dword [ebp - 0x24], 0xaace0fa1
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x374aa
push 0
call eax
mov ecx, 0x3f16
xor ebx, ebx
add ebx, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x20]
mov edx, 0x920fac21
sub edx, 0xcb904ab8
add dword [ebp - 0x10], ebx
mov edi, dword [esi]
sub dword [ebp - 0x18], ecx
xor edi, edx
add dword [ebp - 0xc], eax
mov dword [ebx], edi
add dword [ebp - 0x1c], 0x45da6127
add ebx, 0xf540cf14
add ebx, 0xabf30f0
add esi, 0x9055f3d6
sub esi, 0x9055f3d2
loop 0x40bed6
add eax, 0x710eecd9
sub eax, 0x710dfdae
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x405289
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xff64b96f
xor byte [eax + 0xde9], dl
add byte [edx - 0x12], bh
dec ecx
cmp dword [ecx + 0x6a], 0x1c
xor al, 0x8b
invalid
jg 0x405249
cmp dword [ecx + ecx*4 + 0x20], esp
inc ecx
pop esi
xor byte [esi + ecx + 7], cl
loop 0x40528c
std
mov ecx, 0x8b1632b4
in al, dx
add al, 0x57
pop esp
cmp dl, byte [edx]
mov al, byte [0xd195cc0f]
in al, 0xd7
std
stc
call 0x4e083994
push esi
dec ecx
rcl dword [ecx + 0x38]
arpl cx, bx
or dword [esp + ebx*8 + 0x36], eax
imul ecx, dword [edx - 0x1b197594], 0x6b
add byte [edx], cl
aad 0x1c
jle 0x40525f
mov eax, dword [0x2793697d]
leave
pop edi
aaa
jno 0x405344
mov ebx, 0xa757f2bf
xchg ebp, eax
adc eax, 0x66598ae8
add eax, 0xa44bab1
popfd
popfd
add esp, ebx
aas
add cl, bh
bound esp, qword [eax - 0x7c32b8e2]
mov al, 0x48
out dx, eax
jge 0x4052e6
mov eax, 0xef3f3502
mov ah, 0x65
stosb byte es:[edi], al
out 0xed, eax
aam 0xb6
push 0x37
lcall 0x486, 0xe1614d64
jno 0x405310
pop ss
jg 0x40537a
inc esp
mov dl, 0xbc
in al, dx
xchg esi, eax
aam 0xa8
mov bl, 0xf2
push ebp
lodsd eax, dword [esi]
xchg esi, eax
retf 0x93a3
pop esi
fisub dword [esi - 0x557bb3ca]
mov dword [0x4e0c8020], eax
imul ebx, dword [eax + ebx*4], 0x218c6e5c
dec ebp
mov ebx, 0x49470a27
int1
xor dl, byte [edi + 0x32]
sbb esp, dword [edx - 0x42]
cmp al, 0x4e
nop
push ds
sti
mov dword [0x11b453a6], eax
add eax, 0xfedda1dd
and al, 0x8d
arpl word [edx + esi*8], ax
mov ebp, 0xb793d972
xor byte [edx + ebx*2 + 0x21be029d], dh
cmp byte [esi - 0x1a9577bc], dl
fst dword [ebx + 0x5ab430b7]
popfd
add bh, byte [esi + 0x44963821]
mov byte [edx - 0x1b], ch
and dword [ebp + 0x6b86c4f8], esp
pop es
push 0xffffffffffffffcd
lds eax, [eax + 0x26]
stosd dword es:[edi], eax
and al, 0x43
test eax, 0xc3495b1
arpl word [ebx - 0x4a], si
mov ecx, 0x9c5c91db
stosb byte es:[edi], al
retf 0x61a8
Function at 0x406a06
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406a2a
xor eax, eax
test eax, eax
je 0x406a3d
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406a3d
xor ecx, ecx
jmp 0x406a40
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b63
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4275ec], 0
push esi
jne 0x406b9a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b74
mov dword [ecx*4 + 0x4275e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b6f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406bcb
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4275e8]
xor eax, esi
inc ecx
dec edx
jne 0x406bad
pop edi
not eax
pop esi
ret 0xc

Function at 0x401440
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xbbeaf81f
xor ebx, 0xbfeaf81f
jmp 0x4014f0
mov edx, 0xa919783e
xor edx, 0xa919783a
mov ecx, 0x25135daf
xor ecx, 0x25136daf
mov eax, 0x500
ror eax, 0x1c
push edx
push ecx
push eax
mov edx, dword [ebp - 0xb4]
rol edx, 4
rol edx, 0xa
mov dword [ebp - 8], edx
push ebx
call fcn.00401644
push esi
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4014f0
sub ebx, 0x86b78ac7
mov dword [ebp - 0x10], ebx
ret

Function at 0x484cee
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x484a08
mov edi, edi
call fcn.00484d16
dec edx
add edx, edi
xor dword [esi], ebx
sub edi, edi
add esi, 2
and edx, edx
cmp esi, eax
jl fcn.00484cee
or edi, edi
or edx, edi
mov edi, edi
ret
Function at 0x40b5b0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40b77e
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40b5db
mov eax, 0x7000000
jmp 0x40b5e3
test eax, eax
je 0x40b759
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.00456a70
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x67a540]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40b771
cmp ecx, 0x21
jae 0x40b765
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004508d0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.004509a0
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x7c9a0c]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x7c9b64]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40b734
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x7c9c04]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00456b50
mov eax, ecx
mov ecx, 0x21
call fcn.00456c40
nop
call fcn.00455690
jmp fcn.0040b5b0
Function at 0x4133a0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4135c4
sub esp, 0x18
mov eax, dword [0x900aac]
test eax, eax
jne 0x4135ad
nop
lea eax, [0x900a98]
mov dword [esp], eax
call fcn.004096c0
mov eax, dword [0x900a9c]
test eax, eax
je 0x4133e9
cmp dword [eax + 8], 0xcc
jne 0x41345f
mov edx, dword [0x900a90]
test edx, edx
jne 0x413441
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x905f90]
mov dword [esp + 8], eax
call fcn.0040b790
mov eax, dword [esp + 0xc]
mov dword [0x900a90], eax
mov ecx, dword [0x900a54]
mov dword [eax], ecx
mov eax, dword [0x900a90]
mov dword [0x900a54], eax
movzx eax, byte [0x9012a0]
test al, al
jne 0x413441
xor eax, eax
jmp 0x413559
mov edx, dword [0x900a90]
mov ebx, dword [edx + 4]
mov dword [0x900a90], ebx
mov ebx, dword [0x900a9c]
mov dword [edx + 4], ebx
mov dword [0x900a9c], edx
mov edx, dword [0x900a9c]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x413541
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004029e0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x900e70]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x4134bd
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x4134ca
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00456ac0
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x900e70]
test edx, edx
jne 0x4134f6
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x413517
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00456ac0
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00456ac0
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00456ac0
nop
lea eax, [0x900a98]
mov dword [esp], eax
call fcn.004098c0
nop
lea eax, [0x900a94]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402b60
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00456b50
lea esi, [0x9012a0]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x413441
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x4135a3
lea edx, [0x673178]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x41354b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.00456b40
mov ecx, 5
call fcn.00456b40
lea eax, [0x770640]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00430b40
nop
call fcn.00455690
jmp fcn.004133a0
Function at 0x41b160
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41b38e
sub esp, 0x20
mov eax, dword [esp + 0x24]
test eax, 3
jne 0x41b377
mov edx, dword [esp + 0x30]
mov ebx, dword [edx + 0x2c]
test byte [ebx], al
nop
movzx ebp, byte [0x9009f7]
mov ecx, dword [esp + 0x38]
mov esi, ecx
shr ecx, 3
mov dword [esp + 0x1c], ecx
mov edi, esi
and esi, 7
mov ecx, esi
mov eax, 1
shl eax, cl
mov esi, dword [esp + 0x1c]
mov ecx, eax
lea eax, [ebx + esi]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x41b288
mov ebp, dword [0x90108c]
test ebp, ebp
jle 0x41b1ec
cmp dword [edx + 0x58], edi
ja 0x41b1ec
mov ebp, dword [edx + 0x28]
test byte [ebp], al
movzx ebp, byte [ebp + esi]
nop
xchg ebp, eax
test cl, al
xchg ebp, eax
je 0x41b2fe
movzx ebx, byte [esi + ebx]
test cl, bl
jne 0x41b284
nop
mov dword [esp], eax
mov byte [esp + 4], cl
call fcn.00402b30
mov eax, dword [0x8e0b1c]
test byte [eax], al
nop
nop
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0xc]
nop
mov ebx, edx
shr edx, 0x16
mov edx, dword [eax + edx*4]
test byte [edx], al
mov ebp, ebx
shr ebx, 0x10
and ebx, 0x3f
movzx esi, byte [edx + ebx + 0x21840]
lea edx, [edx + ebx + 0x21840]
shr ebp, 0xd
and ebp, 7
mov eax, ecx
mov ecx, ebp
mov ebx, 1
shl ebx, cl
xchg esi, eax
test bl, al
xchg esi, eax
jne 0x41b25f
mov dword [esp], edx
mov byte [esp + 4], bl
call fcn.00402b30
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + 0x3a]
test dl, 1
je 0x41b2b9
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx + 8]
mov ebx, dword [ecx + 0xc]
mov eax, dword [eax + 0x40]
add edx, eax
adc ebx, 0
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], ebx
add esp, 0x20
ret
add esp, 0x20
ret
mov edx, dword [esp + 0x24]
mov dword [esp], edx
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], cl
mov dword [esp + 0x14], edi
call fcn.00412d30
movzx eax, byte [esp + 0x18]
test al, al
jne 0x41b2f0
mov edx, dword [esp + 0x34]
mov ebx, dword [edx]
test ebx, ebx
je 0x41b2dc
mov eax, dword [ebx + 0xc]
cmp eax, 0x1fc
je 0x41b2dc
jae 0x41b2f4
mov ecx, dword [esp + 0x24]
mov dword [ebx + eax*4 + 0x10], ecx
inc dword [ebx + 0xc]
jmp 0x41b2ec
mov dword [esp], edx
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00421570
add esp, 0x20
ret
add esp, 0x20
ret
mov ecx, 0x1fc
call fcn.00456b40
lea eax, [0x769a79]
mov dword [esp], eax
mov dword [esp + 4], 4
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
call fcn.0041b3a0
lea eax, [0x769950]
mov dword [esp], eax
mov dword [esp + 4], 3
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
call fcn.0041b3a0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x9d], 2
lea eax, [0x76ddf2]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.00430b40
lea eax, [0x77500f]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.00430b40
nop
call fcn.00455690
jmp fcn.0041b160
Function at 0x4242b0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x424420
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.00422360
mov eax, dword [esp + 4]
test eax, eax
je 0x424409
mov dword [esp + 0xc], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0x18]
nop
inc dword [edx + 0x7c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call fcn.004205d0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub eax, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x24]
movzx ebx, byte [edx + 6]
mov byte [esp + 0xb], bl
lea ebp, [ecx + 0x48]
mov dword [esp + 0x18], ebp
nop
mov dword [esp], ebp
call fcn.004096c0
mov eax, dword [esp + 0xc]
lea ecx, [eax + 0x4c]
movzx edx, byte [esp + 0xb]
mov ebx, dword [esp + 0x10]
jmp 0x424347
mov ecx, ebp
mov ebp, dword [ecx]
test ebp, ebp
je 0x4243ad
movzx esi, word [ebp + 4]
cmp esi, ebx
jne 0x42435c
cmp byte [ebp + 6], dl
je 0x424367
cmp esi, ebx
ja 0x4243ad
jne 0x424345
cmp byte [ebp + 6], dl
jbe 0x424345
jmp 0x4243ad
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004098c0
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x4243a4
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x4243a4
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
mov edx, dword [esp + 0x24]
mov word [edx + 4], bx
mov ebx, dword [ecx]
mov dword [edx], ebx
mov dword [ecx], edx
mov dword [esp], eax
call fcn.004241b0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004098c0
nop
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x7c]
lea ebx, [edx - 1]
mov dword [ecx + 0x7c], ebx
cmp edx, 1
jne 0x424400
movzx ecx, byte [eax + 0x65]
test cl, cl
je 0x424400
mov dword [eax + 8], 0xfffffade
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
lea eax, [0x772850]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00430b40
nop
call fcn.00455690
jmp fcn.004242b0
Function at 0x4248a0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4249bc
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x424935
cmp cl, 2
je 0x4248dd
cmp cl, 3
jne 0x4249a5
mov byte [eax + 8], 1
jmp 0x4249a1
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00429100
nop
lea eax, [0x8e5038]
mov dword [esp], eax
call fcn.004096c0
nop
mov eax, dword [0x8e5004]
sub eax, dword [0x8e4fe8]
mov dword [0x8e5004], eax
mov eax, dword [0x8e4ff4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x8e4ff4], ecx
nop
lea eax, [0x8e5038]
mov dword [esp], eax
call fcn.004098c0
jmp 0x4249a1
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.004133a0
nop
lea eax, [0x8e5038]
mov dword [esp], eax
call fcn.004096c0
nop
mov eax, dword [0x8e4fdc]
sub eax, dword [0x8e4fc0]
mov dword [0x8e4fdc], eax
mov eax, dword [0x8e4fcc]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x8e4fcc], ecx
nop
nop
lea eax, [0x8e5038]
mov dword [esp], eax
call fcn.004098c0
add esp, 0x14
ret
lea eax, [0x76c9f0]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00430b40
nop
call fcn.00455690
jmp fcn.004248a0
Function at 0x448080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x448207
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x4481fd
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x4480dc
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x4480dc
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x4480ef
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x4481d2
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x4481c4
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x4481bb
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x448146
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x44818f
mov eax, 1
cmp eax, ecx
ja 0x44817d
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x2c], ebx
sub ecx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00456bb0
lea esi, [ecx + 7]
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
cmp eax, ecx
jae 0x4481b6
movzx edi, byte [eax + ebx]
lea ebp, [eax + 1]
mov eax, edi
and edi, 0x7f
mov ecx, esi
shl edi, cl
or edx, edi
test al, 0x80
jne 0x448182
mov ecx, dword [esp + 8]
mov eax, ebp
mov ebp, dword [esp + 0xc]
jmp 0x44814b
call fcn.00456b50
xor eax, eax
mov ecx, eax
call fcn.00456b40
call fcn.00456bb0
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
mov eax, edi
cmp ecx, eax
jbe 0x4481f8
movzx esi, byte [eax + edx]
lea edi, [eax + 1]
mov eax, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
or ebx, esi
test al, 0x80
jne 0x4481c9
mov ecx, dword [esp + 0x18]
mov eax, edi
jmp 0x4480f4
call fcn.00456b50
xor eax, eax
mov ecx, eax
call fcn.00456b40
nop
call fcn.00455690
jmp fcn.00448080
Function at 0x44c580
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44c680
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.0044ce10
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x730020]
mov dword [esp], ecx
call fcn.0040b440
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0x8e50d0]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.0044be50
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.0044b270
add esp, 0x28
ret
call fcn.00455690
jmp fcn.0044c580

Function at 0x44e280
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44e31f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00456d57
lea ecx, [0x44e330]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00455580
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00455690
jmp fcn.0044e280