joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437fd8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x44800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00402980
push dword [ebp + 8]
mov ecx, esi
push eax
call fcn.00404e90
mov dword [ebp - 4], 0
lea ecx, [esi + 0x30]
mov eax, dword [ecx]
mov dword [esi], 0x440574
mov dword [esi + 0xc], 0x440bbc
mov dword [esi + 0x10], 0x440bb0
mov dword [esi + 0x78], 0x440bdc
call dword [eax + 4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x8c]
mov dword [esi + 0x80], eax
mov eax, esi
mov dword [esi], 0x440574
mov dword [esi + 0xc], 0x440bbc
mov dword [esi + 0x10], 0x440bb0
mov dword [esi + 0x78], 0x440bdc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x409b10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438040
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.00409e10
mov dword [ebp - 4], 0
mov ecx, ebx
push ebx
push 0x44148c
mov dword [ebx], 0x440064
mov dword [ebx + 0xc], 0x43fce4
mov dword [ebx + 0x10], 0x44076c
call fcn.0040a840
mov dword [ebp - 4], 1
lea esi, [ebx + 0x7c]
push ebx
push 0x4401b0
mov ecx, ebx
mov dword [ebx], 0x440840
mov dword [ebx + 0xc], 0x4416e4
mov dword [ebx + 0x10], 0x440f1c
mov dword [esi], 0x441194
mov dword [ebx + 0x80], edi
call fcn.0040a840
push esi
push 0x440488
mov ecx, ebx
call fcn.0040a840
push esi
push 0x44147c
mov ecx, ebx
call fcn.0040a840
mov eax, dword [ebx + 0x30]
lea ecx, [ebx + 0x30]
call dword [eax + 0x20]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x409be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438070
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.00409f30
mov dword [ebp - 4], 0
mov ecx, ebx
push ebx
push 0x44148c
mov dword [ebx], 0x43fe00
mov dword [ebx + 0xc], 0x4415fc
mov dword [ebx + 0x10], 0x4408b8
call fcn.0040a840
mov dword [ebp - 4], 1
lea esi, [ebx + 0x6c]
push ebx
push 0x43fb48
mov ecx, ebx
mov dword [ebx], 0x44158c
mov dword [ebx + 0xc], 0x441374
mov dword [ebx + 0x10], 0x440b80
mov dword [esi], 0x440a38
mov dword [ebx + 0x70], edi
call fcn.0040a840
push esi
push 0x440488
mov ecx, ebx
call fcn.0040a840
push esi
push 0x44147c
mov ecx, ebx
call fcn.0040a840
mov eax, dword [ebx + 0x30]
lea ecx, [ebx + 0x30]
call dword [eax + 0x20]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40a1f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4381f0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call fcn.0040a2c0
mov dword [ebp - 4], 0
mov ecx, ebx
push ebx
push 0x44148c
mov dword [ebx], 0x440fb4
mov dword [ebx + 0xc], 0x440038
mov dword [ebx + 0x10], 0x440428
call fcn.0040a8d0
mov dword [ebp - 4], 1
lea esi, [ebx + 0x70]
push ebx
push 0x440d38
mov ecx, ebx
mov dword [ebx], 0x44110c
mov dword [ebx + 0xc], 0x44156c
mov dword [ebx + 0x10], 0x43fb58
mov dword [esi], 0x4401c0
mov dword [ebx + 0x74], edi
call fcn.0040a8d0
push esi
push 0x440488
mov ecx, ebx
call fcn.0040a8d0
push esi
push 0x44147c
mov ecx, ebx
call fcn.0040a8d0
mov eax, dword [ebx + 0x30]
lea ecx, [ebx + 0x30]
call dword [eax + 0x20]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40d0b0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x18
mov eax, dword [0x44800c]
xor eax, esp
mov dword [esp + 0x14], eax
push 8
lea eax, [esp + 4]
push eax
push 0x441e54
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x40d0e5
xor al, al
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00420d88
add esp, 0x18
ret
xor eax, eax
mov word [esp + 0xe], ax
lea eax, [esp]
push 0x441e44
push eax
call fcn.0042432f
add esp, 8
test eax, eax
je 0x40d127
lea eax, [esp]
push 0x441e50
push eax
call fcn.0042432f
add esp, 8
test eax, eax
je 0x40d127
xor eax, eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00420d88
add esp, 0x18
ret
mov ecx, dword [esp + 0x14]
mov eax, 1
xor ecx, esp
call fcn.00420d88
add esp, 0x18
ret
Function at 0x40d380
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43863c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebx], 0x441ea0
mov dword [ebx + 4], 0
mov dword [ebx + 8], edi
mov eax, dword [edi]
push 0x4411b0
call dword [eax + 4]
mov dword [ebx + 0xc], eax
lea esi, [ebx + 0x18]
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x14], eax
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040ca30
mov dword [esi], eax
lea esi, [ebx + 0x20]
mov dword [ebp - 4], 0
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040e5e0
mov dword [esi], eax
lea esi, [ebx + 0x28]
mov byte [ebp - 4], 1
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040e5e0
mov dword [esi], eax
lea esi, [ebx + 0x30]
mov byte [ebp - 4], 2
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040e5e0
mov dword [esi], eax
mov byte [ebp - 4], 3
mov ecx, edi
mov dword [ebx + 0x38], 0xffffffff
mov eax, dword [edi]
call dword [eax + 0x10]
mov edx, dword [eax]
cmp edx, 0x4412a8
jne 0x40d471
mov eax, dword [eax + 0x78]
jmp 0x40d479
mov ecx, eax
call dword [edx + 0x88]
shr eax, 1
not al
and al, 1
mov byte [ebx + 0x3c], al
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41ae20
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x44800c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [ecx + 4]
push edi
mov edi, dword [esp + 0x18]
test eax, eax
je 0x41ae61
push dword [esp + 0x1c]
push edi
push dword [esp + 0x1c]
push dword [ecx + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
pop edi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00420d88
add esp, 0xc
ret 0xc
mov eax, dword [ecx + 0xc]
push ebx
mov ebx, dword [ecx + 8]
push ebp
mov ebp, dword [ecx]
push esi
push dword [esp + 0x28]
mov dword [esp + 0x14], eax
push edi
push dword [esp + 0x28]
push eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov esi, eax
cmp esi, 0x3fd
jne 0x41aed3
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0x2001f
push 1
push 0
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
js 0x41aed3
push dword [esp + 0x28]
push edi
push dword [esp + 0x28]
push 0
push dword [esp + 0x20]
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
call fcn.00420d88
add esp, 0xc
ret 0xc
Function at 0x41be50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x44800c]
xor eax, esp
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ecx + 4]
mov dword [esp], 0xb
test eax, eax
je 0x41be99
push esi
lea esi, [esp + 8]
push esi
push edx
lea edx, [esp + 0xc]
push edx
push 0x40
push dword [ecx + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
pop esi
jmp 0x41beb4
lea eax, [esp + 4]
push eax
push edx
lea eax, [esp + 8]
push eax
push 0x40
push dword [ecx + 0xc]
push dword [ecx + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x41bec6
xor ecx, ecx
mov eax, 3
cmp dword [esp], 0xb
cmove eax, ecx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00420d88
add esp, 0xc
ret 0xc

Function at 0x41c040
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x44800c]
xor eax, esp
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ecx + 4]
mov dword [esp], 4
test eax, eax
je 0x41c089
push esi
lea esi, [esp + 8]
push esi
push edx
lea edx, [esp + 0xc]
push edx
push 0x10
push dword [ecx + 0xc]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
pop esi
jmp 0x41c0a4
lea eax, [esp + 4]
push eax
push edx
lea eax, [esp + 8]
push eax
push 0x10
push dword [ecx + 0xc]
push dword [ecx + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x41c0b6
xor ecx, ecx
mov eax, 3
cmp dword [esp], 4
cmove eax, ecx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00420d88
add esp, 0xc
ret 0xc
Function at 0x41cff0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
mov eax, dword [0x44800c]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x20]
lea eax, [esp + 4]
push ebp
mov ebp, dword [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0x10
push eax
push ebp
push 0xffff
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp eax, 0x490
je 0x41d107
cmp eax, 2
je 0x41d107
test eax, eax
je 0x41d04d
cmp eax, 0xea
jne 0x41d074
push esi
push edi
mov edi, dword [ebp]
call fcn.0041af90
mov esi, eax
cmp dword [esi + 8], 0
je 0x41d06d
nop
cmp dword [esi], edi
je 0x41d087
add esi, 0x18
cmp dword [esi + 8], 0
jne 0x41d060
pop edi
mov eax, 0xf
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00420d88
add esp, 0x18
ret 0xc
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x41d0c6
mov ecx, dword [esi + 8]
push 0x7d
push eax
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
test al, al
jne 0x41d0c6
mov eax, dword [esp + 0x30]
and eax, 0x260
cmp eax, 0x260
jne 0x41d0dd
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [ebp], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00420d88
add esp, 0x18
ret 0xc
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00420d88
add esp, 0x18
ret 0xc
test byte [esp + 0x28], 0xc0
jne 0x41d126
pop ebp
mov eax, 0xe
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00420d88
add esp, 0x18
ret 0xc
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [ebp], 0
pop ebp
pop ebx
xor ecx, esp
call fcn.00420d88
add esp, 0x18
ret 0xc
Function at 0x41d150
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
mov eax, dword [0x44800c]
xor eax, esp
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push esi
mov esi, dword [edx + 0x14]
test esi, esi
je 0x41d189
push dword [edx + 0x18]
mov eax, dword [ecx]
push esi
call dword [eax + 0x3c]
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00420d88
add esp, 0x14
ret 8
mov ecx, dword [eax + 0x14]
mov esi, dword [edx + 8]
push ebx
mov ebx, dword [edx]
push ebp
mov ebp, dword [eax + 0x10]
mov eax, dword [eax]
push edi
mov edi, dword [edx + 4]
push ebp
push ecx
push eax
push esi
push edi
push ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov esi, eax
cmp esi, 0x3fd
jne 0x41d205
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0x2001f
push 1
push 0
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
js 0x41d205
push ebp
push dword [esp + 0x14]
push dword [esp + 0x1c]
push 0
push dword [esp + 0x28]
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.00420d88
add esp, 0x14
ret 8
Function at 0x4a8830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x477a98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebp
push edi
mov edi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x48]
push ebp
push eax
push ecx
lea ecx, [edi + 0x104]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.004a3750
test eax, eax
jne 0x4a889c
push ebp
push 0x4a0f3c
mov ecx, edi
call fcn.004a7ab0
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
pop edi
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
mov edx, dword [esp + 0x48]
push ebx
mov ebx, dword [esp + 0x50]
push esi
push ebp
push ebp
push ebx
lea ecx, [edx + 0x14]
call fcn.004a3180
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.00499e40
push ebx
mov dword [esp + 0x4c], ebp
call fcn.004a3900
add esp, 4
test eax, eax
je 0x4a893f
add esi, 0x18
push esi
call 0x4e3b40
add esi, eax
push esi
call 0x4e3b40
mov ecx, dword [esp + 0x60]
add esp, 8
cmp ecx, 3
lea eax, [esi + eax + 8]
ja 0x4a8c42
jmp dword [ecx*4 + 0x416080]
mov eax, dword [esi]
push ebp
push eax
mov ecx, edi
call fcn.004a7bf0
mov ebx, dword [esp + 0x58]
mov ebp, eax
lea edi, [esi + 0x18]
mov edx, dword [ebp + 0x28]
lea ecx, [ebx + ebx*4]
mov esi, edi
lea eax, [edx + ecx*4]
push esi
mov dword [esp + 0x5c], eax
call 0x4e3b40
add esi, eax
push esi
call 0x4e3b40
add esi, eax
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x4a8990
mov ecx, dword [esi + 0x1c]
push ecx
call dword [fcn.0047c530]
test eax, eax
je 0x4a8990
mov eax, 1
jmp 0x4a8992
xor eax, eax
cmp ebx, 8
jge 0x4a8bf7
cmp ebx, 7
ja 0x4a8c42
jmp dword [ebx*4 + 0x416090]
test eax, eax
jne 0x4a8c0a
mov ecx, dword [esp + 0x10]
push eax
push 0x4a0f28
call fcn.004a7ab0
push 6
call dword [ebp + 0x2c]
lea edx, [esp + 0x1c]
xor ecx, ecx
add ebx, 0xfffffff8
push edx
mov dword [esp + 0x20], ecx
push ebx
push esi
mov dword [esp + 0x2c], ecx
call eax
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
call fcn.004a9150
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov esi, eax
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x2c], 0x4895b8
call fcn.0049a040
mov ecx, dword [esp + 0x40]
mov eax, esi
pop esi
mov edx, edi
pop ebx
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
Function at 0x4b1630
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4b8b10]
xor edx, edx
cmp eax, edx
jne 0x4b1656
xor eax, eax
mov byte [eax + 0x4b8a10], al
inc eax
cmp eax, 0x100
jl 0x4b163e
mov dword [0x4b8b10], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4b8a10
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4b16e7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4b16ba
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4b1688
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4b1760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4b17b3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4b179a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b5a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x78]
push ebx
push esi
cmp eax, 1
push edi
mov dword [esp + 0x14], ecx
jl 0x4b5c71
cmp eax, 8
jg 0x4b5c71
cmp dword [esp + 0x8c], 2
jl 0x4b5c71
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x4b5c71
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x4b5c71
mov eax, dword [esp + 0x80]
test eax, eax
je 0x4b5ad7
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x4b5c5a
mov ebp, dword [fcn.0047c4c0]
mov eax, ebx
mov dword [esp + 0x10], 0x32
sub eax, edx
cmp eax, 0x32
jg 0x4b5b09
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x4b5c41
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
sub ecx, eax
cmp ecx, 0x32
jle 0x4b5b29
mov ecx, 0x32
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x20]
push ecx
push ebx
push edx
lea edx, [esp + 0x34]
push eax
push edx
call dword [fcn.0047c4a4]
push edi
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4b5b68
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [fcn.0047c4a8]
lea ecx, [esp + 0x28]
push ecx
call dword [fcn.0047c4f4]
test eax, eax
jne 0x4b5c28
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
neg eax
neg ecx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call ebp
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], edx
lea edx, [esp + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x94]
sub ecx, edi
sub eax, esi
push edx
push ecx
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x9c]
push eax
call fcn.004b5060
cmp eax, 1
jne 0x4b5c52
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.004b5910
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x14]
mov eax, ebx
cmp eax, ecx
jl 0x4b5b1d
mov ebx, dword [esp + 0x24]
add edx, dword [esp + 0x10]
cmp edx, ebx
mov dword [esp + 0x14], edx
jge 0x4b5c5a
jmp 0x4b5af4
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
call fcn.004b4c60
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c
Function at 0x4bfe10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x478ea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x6c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x74]
push edi
push eax
mov eax, dword [esp + 0x74]
push ecx
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.004c0990
lea edx, [esp + 0x18]
push eax
push edx
call dword [fcn.0047c474]
mov eax, dword [esp + 0x18]
xor edi, edi
xor ecx, ecx
cmp eax, edi
setl cl
dec ecx
xor edx, edx
and ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, edi
mov dword [esp + 0x18], ecx
setl dl
dec edx
and edx, eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x20], edx
call dword [fcn.0047c4f4]
test eax, eax
je 0x4bfeb9
mov eax, dword [esp + 0x6c]
push ebx
mov ebx, eax
xor ecx, ecx
xor edx, edx
xor esi, esi
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edi
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004bfaa0
mov edx, eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push ecx
push eax
lea eax, [esp + 0x20]
push eax
call dword [fcn.0047c4c0]
push edi
lea ecx, [esp + 0x4c]
call 0x50399c
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x70], edi
call fcn.004cf450
mov edx, dword [esp + 0x5c]
add esp, 0xc
lea ecx, [esp + 0x18]
push 2
push ecx
push edx
call dword [fcn.0047c08c]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x38]
push eax
push ecx
call dword [fcn.0047c51c]
lea edx, [esp + 0x38]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
call dword [fcn.0047c4a8]
mov esi, dword [esp + 0x6c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, esi
mov dword [esp + 0x64], 0xffffffff
mov dword [edx], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x48]
call 0x503a0e
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x60
ret 0x14