joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d9e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c678d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 3
call fcn.0041c730
mov ecx, esi
call fcn.00419220
lea ecx, [esi + 0x8c]
mov byte [esp + 0x18], 2
call fcn.00412830
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
call dword [0x4ce78c]
mov eax, dword [esi + 0x24]
xor edi, edi
cmp eax, edi
je 0x41da4d
push eax
call fcn.00485196
add esp, 4
mov eax, dword [esi + 0x18]
push eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
call fcn.00485196
mov eax, dword [esi + 0xc]
add esp, 4
cmp eax, edi
je 0x41da72
push eax
call fcn.00485196
add esp, 4
mov ecx, dword [esi]
push ecx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.00485196
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x430500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x40]
sub eax, dword [edi + 0x3c]
xor esi, esi
sar eax, 2
cmp eax, esi
mov dword [esp + 0x14], eax
jle 0x430612
push ebx
mov dword [esp + 0xc], esi
push ebp
push esi
lea ecx, [edi + 0x30]
call dword [0x4ce6f8]
cmp dword [eax], 1
jne 0x43054e
push esi
lea ecx, [edi + 0x78]
call dword [0x4ce6f8]
push esi
lea ecx, [edi + 0x60]
mov ebx, eax
call dword [0x4ce6f8]
mov ecx, dword [edi + 0xc]
jmp 0x43056d
cmp dword [edi + 8], 0
je 0x430596
push esi
lea ecx, [edi + 0x78]
call dword [0x4ce6f8]
push esi
lea ecx, [edi + 0x60]
mov ebx, eax
call dword [0x4ce6f8]
mov ecx, dword [edi + 8]
push esi
add ecx, 0x68
mov ebp, eax
call dword [0x4ce6cc]
fldz
mov ecx, dword [eax]
sub esp, 0xc
fstp dword [esp + 8]
fild dword [ebx]
fstp dword [esp + 4]
fild dword [ebp]
fstp dword [esp]
call dword [0x4ce6ac]
mov eax, dword [edi + 0x20]
sub eax, dword [edi + 0x1c]
sar eax, 4
cmp esi, eax
jb 0x4305a8
call fcn.00496353
mov ebx, dword [edi + 0x1c]
add ebx, dword [esp + 0x10]
push esi
lea ecx, [edi + 0x78]
call dword [0x4ce6f8]
mov ebp, dword [eax]
add ebp, dword [edi + 0x28]
push esi
lea ecx, [edi + 0x60]
call dword [0x4ce6f8]
mov ecx, dword [edi + 0x2c]
add ecx, dword [eax]
push esi
mov dword [esp + 0x18], ecx
lea ecx, [edi + 0x78]
call dword [0x4ce6f8]
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
push esi
lea ecx, [edi + 0x60]
call dword [0x4ce6f8]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [eax]
push ebp
push edx
push ecx
push eax
push ebx
call dword [0x4ce578]
add dword [esp + 0x10], 0x10
inc esi
cmp esi, dword [esp + 0x1c]
jl 0x430524
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x431b10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c73cf
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x10]
call fcn.0043de60
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], edi
call dword [0x4ce778]
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 1
call dword [0x4ce778]
lea ecx, [esi + 0x60]
mov byte [esp + 0x18], 2
call dword [0x4ce778]
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 3
call dword [0x4ce778]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x90], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x434a80
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + 0x200]
xor eax, eax
test edx, edx
jbe 0x434aab
lea esp, [esp]
sub edx, eax
mov dl, byte [edx + ecx - 1]
xor dl, 0x7f
mov byte [ecx + eax + 0x210], dl
mov edx, dword [ecx + 0x200]
inc eax
cmp eax, edx
jb 0x434a90
mov edx, dword [ecx + 0x204]
xor eax, eax
test edx, edx
jbe 0x434ad2
sub edx, eax
mov dl, byte [edx + ecx + 0x7f]
xor dl, 0x60
mov byte [ecx + eax + 0x290], dl
mov edx, dword [ecx + 0x204]
inc eax
cmp eax, edx
jb 0x434ab7
mov edx, dword [ecx + 0x208]
xor eax, eax
test edx, edx
jbe 0x434afe
mov edi, edi
sub edx, eax
mov dl, byte [edx + ecx + 0xff]
xor dl, 0x40
mov byte [ecx + eax + 0x310], dl
mov edx, dword [ecx + 0x208]
inc eax
cmp eax, edx
jb 0x434ae0
mov edx, dword [ecx + 0x20c]
xor eax, eax
test edx, edx
jbe 0x434b2e
lea ebx, [ebx]
sub edx, eax
mov dl, byte [edx + ecx + 0x17f]
xor dl, 0x20
mov byte [ecx + eax + 0x390], dl
mov edx, dword [ecx + 0x20c]
inc eax
cmp eax, edx
jb 0x434b10
ret

Function at 0x436430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c758a
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esi + 0xec]
mov dword [esp + 0x14], 6
test eax, eax
je 0x436473
push eax
call fcn.00497e19
add esp, 4
lea ecx, [esi + 0xc0]
mov dword [esi + 0xf0], 0x80
mov dword [esi + 0xf4], 0
call dword [0x4ce78c]
lea ecx, [esi + 0xa8]
mov byte [esp + 0x14], 5
call dword [0x4ce78c]
lea ecx, [esi + 0x90]
mov byte [esp + 0x14], 4
call dword [0x4ce78c]
lea ecx, [esi + 0x78]
mov byte [esp + 0x14], 3
call dword [0x4ce78c]
lea ecx, [esi + 0x60]
mov byte [esp + 0x14], 2
call dword [0x4ce78c]
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 1
call dword [0x4ce78c]
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call dword [0x4ce78c]
lea ecx, [esi + 0x18]
mov dword [esp + 0x14], 0xffffffff
call dword [0x4ce78c]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x437bf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c7638
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
or ecx, 0xffffffff
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov edi, dword [esi + 0x6b10]
mov dword [esp + 0x44], eax
mov dword [esi + 0x60dc], eax
mov eax, dword [esi + 0x60d4]
sub eax, dword [esi + 0x60d0]
sar eax, 2
cmp edi, eax
jb 0x437c74
call fcn.00496353
mov ecx, dword [esi + 0x60d0]
mov edi, dword [ecx + edi*4]
mov edx, dword [esp + 0x4c]
mov eax, dword [edx + 0xac]
mov dword [edi + 0xac], eax
mov ecx, dword [esi + 0x6b10]
mov edx, dword [esi + 0x8958]
push 1
push edx
mov dword [esi + 0x60e0], ecx
lea eax, [esi + 0x78d8]
push eax
lea ecx, [esi + 0x1450]
push ecx
lea ecx, [esi + 0x5fb8]
call fcn.0041ac00
mov edx, dword [esp + 0x5c]
mov eax, dword [edi + 0xac]
push edx
push eax
mov ecx, esi
call fcn.00434f80
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x3c
ret 0x14

Function at 0x4395b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
mov esi, ecx
mov byte [esp + 0xf], 0
call fcn.00498215
add esp, 4
test eax, eax
jne 0x439630
push ebp
mov ebp, 0xea60
push edi
push 1
lea eax, [esp + 0x17]
push 1
push eax
call fcn.00495b99
mov ecx, dword [esi + 8]
inc ecx
add esp, 0x10
cmp dword [esi + 4], ecx
jge 0x43960d
lea esp, [esp]
add dword [esi + 4], ebp
mov eax, dword [esi + 4]
mov edx, dword [esi]
push eax
push edx
call fcn.00497ae5
mov dword [esi], eax
mov eax, dword [esi + 8]
inc eax
add esp, 8
cmp dword [esi + 4], eax
jl 0x4395f0
mov edx, dword [esi + 8]
add edx, dword [esi]
push 1
lea ecx, [esp + 0x13]
push ecx
push edx
call fcn.00497eb0
inc dword [esi + 8]
push edi
call fcn.00498215
add esp, 0x10
test eax, eax
je 0x4395d1
pop ebp
pop edi
pop esi
pop ecx
ret 4
Function at 0x43e730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c7bc2
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call dword [0x4ce68c]
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
mov dword [esp + 0x1c], 0
call dword [0x4ce68c]
lea ecx, [edi + 0x30]
push ecx
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], 1
call dword [0x4ce68c]
lea edx, [edi + 0x48]
push edx
lea ecx, [esi + 0x48]
mov byte [esp + 0x1c], 2
call fcn.0043dbb0
lea eax, [edi + 0x60]
push eax
lea ecx, [esi + 0x60]
mov byte [esp + 0x1c], 3
call fcn.0043dbb0
lea ecx, [edi + 0x78]
push ecx
lea ecx, [esi + 0x78]
mov byte [esp + 0x1c], 4
call fcn.0043dbb0
lea edx, [edi + 0x90]
push edx
lea ecx, [esi + 0x90]
mov byte [esp + 0x1c], 5
call fcn.0043dab0
mov eax, dword [edi + 0xa8]
mov dword [esi + 0xa8], eax
mov ecx, dword [edi + 0xac]
mov dword [esi + 0xac], ecx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x440390
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c7d48
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
xor eax, eax
or edx, 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], eax
mov dword [esp + 8], edx
mov dword [esp + 4], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
cmp dword [ecx + 0x78f4], 1
mov dword [esp + 0x3c], eax
jne 0x440400
mov dword [ecx + 0x78f4], eax
call fcn.0043f740
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
add esp, 0x3c
ret

Function at 0x440cd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c7da8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
call dword [0x4ce778]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0
mov dword [esp + 0x2c], 0
push 0x4ce97b
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.00436d40
lea edi, [esi + 0x124]
push 0
mov ecx, edi
call dword [0x4ce6f8]
mov eax, dword [eax]
push 0x4ce97b
mov ecx, esi
mov dword [esi + 0x7c38], eax
mov dword [esi + 0x7c4c], 1
call fcn.00436ef0
cmp eax, 1
jne 0x440d7a
push 0
lea ecx, [esi + 0x14c]
call dword [0x4ce6f8]
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.0043ec20
jmp 0x440d84
push 1
mov ecx, edi
call dword [0x4ce6f8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call dword [0x4ce78c]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x441ff0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c7e6b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x34]
lea esi, [edi + 0x10]
push ecx
mov ecx, esi
call fcn.0040fb50
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [edi], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x24], 0
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp esi, ebx
je 0x442083
mov eax, dword [esi + 0x18]
mov ecx, dword [esi]
mov edx, dword [eax]
push eax
push ecx
push edx
push ecx
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call fcn.004108b0
push ebx
mov ecx, esi
call fcn.00412c00
mov ecx, dword [esp + 0x30]
mov dword [edi + 0x30], ecx
jmp 0x44208a
mov edx, dword [esp + 0x30]
mov dword [edi + 0x30], edx
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 0x18
Function at 0x45bc10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x9c0]
cmp eax, 0x270
jl 0x45bcfb
cmp eax, 0x271
jne 0x45bc48
push 0
call fcn.0049911e
push eax
call fcn.00499588
add esp, 8
call fcn.0049959a
push eax
mov ecx, esi
call fcn.0045bb20
xor eax, eax
lea ebx, [ebx]
mov ecx, dword [esi + eax*4 + 4]
xor ecx, dword [esi + eax*4]
inc eax
and ecx, 0x7fffffff
xor ecx, dword [esi + eax*4 - 4]
mov edx, ecx
shr ecx, 1
and edx, 1
xor ecx, dword [edx*4 + 0x5176b0]
xor ecx, dword [esi + eax*4 + 0x630]
cmp eax, 0xe3
mov dword [esi + eax*4 - 4], ecx
jl 0x45bc50
cmp eax, 0x26f
jge 0x45bcc2
lea esp, [esp]
mov ecx, dword [esi + eax*4 + 4]
xor ecx, dword [esi + eax*4]
inc eax
and ecx, 0x7fffffff
xor ecx, dword [esi + eax*4 - 4]
mov edx, ecx
shr ecx, 1
and edx, 1
xor ecx, dword [edx*4 + 0x5176b0]
xor ecx, dword [esi + eax*4 - 0x390]
cmp eax, 0x26f
mov dword [esi + eax*4 - 4], ecx
jl 0x45bc90
mov eax, dword [esi]
xor eax, dword [esi + 0x9bc]
and eax, 0x7fffffff
xor eax, dword [esi + 0x9bc]
mov ecx, eax
and ecx, 1
mov edx, dword [ecx*4 + 0x5176b0]
xor edx, dword [esi + 0x630]
shr eax, 1
xor edx, eax
mov dword [esi + 0x9bc], edx
mov dword [esi + 0x9c0], 0
mov eax, dword [esi + 0x9c0]
mov ecx, dword [esi + eax*4]
inc eax
mov dword [esi + 0x9c0], eax
mov esi, dword [esp + 8]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov edx, ecx
shr edx, 0x12
xor ecx, edx
mov eax, ecx
cmp esi, ecx
jae 0x45bd47
xor edx, edx
div esi
imul eax, esi
sub ecx, eax
mov eax, ecx
pop esi
ret 4

Function at 0x45d4d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c94d4
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call dword [0x4ce778]
lea ecx, [esi + 0x18]
mov dword [esp + 0x14], 0
call dword [0x4ce778]
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call dword [0x4ce778]
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 2
call fcn.0043de60
lea ecx, [esi + 0x60]
mov byte [esp + 0x14], 3
call dword [0x4ce778]
lea ecx, [esi + 0x78]
mov byte [esp + 0x14], 4
call dword [0x4ce778]
lea ecx, [esi + 0x98]
mov byte [esp + 0x14], 5
call dword [0x4ce778]
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x45e720
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c9607
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x18]
mov dword [esi], vtable.BottonGG.0
call dword [0x4ce778]
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], edi
call dword [0x4ce778]
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 1
call dword [0x4ce778]
lea ecx, [esi + 0x60]
mov byte [esp + 0x18], 2
call dword [0x4ce778]
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 3
call dword [0x4ce778]
lea ecx, [esi + 0x90]
mov byte [esp + 0x18], 4
call dword [0x4ce778]
lea ecx, [esi + 0xa8]
mov byte [esp + 0x18], 5
call dword [0x4ce778]
lea ecx, [esi + 0xc0]
mov byte [esp + 0x18], 6
call dword [0x4ce778]
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
mov ecx, esi
mov byte [esp + 0x18], 8
call fcn.0045e300
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x473370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx + 0x8b8], 1
jne 0x47337e
jmp fcn.00471160
xor eax, eax
cmp dword [ecx + 0x1c], eax
jne 0x47338e
cmp dword [ecx + 0x24c], 0xffffffff
je 0x47339a
mov dword [ecx + 0x210], eax
mov dword [ecx + 0x230], eax
ret 8
Function at 0x4777b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cab2c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push 0
push 0x4d42ac
lea edi, [esi + 0x50]
push edi
push eax
push ecx
mov ecx, esi
call fcn.00480d90
push edi
mov dword [esp + 0x20], 0
mov dword [esi], vtable.CAsyncReader.0
mov dword [esi + 0xc], vtable.CAsyncReader.2.0
mov dword [esi + 0x10], vtable.CAsyncReader.1.0
call dword [0x4ce110]
mov edx, dword [esp + 0x2c]
lea ebx, [esi + 0x68]
push edx
mov ecx, ebx
mov byte [esp + 0x20], 1
call fcn.004764e0
mov eax, dword [esp + 0x30]
push edi
push ebx
push esi
push eax
lea ecx, [esi + 0xf0]
mov byte [esp + 0x2c], 2
call fcn.00477730
lea ecx, [esi + 0x1a0]
mov byte [esp + 0x1c], 3
call fcn.0047e3e0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10

Function at 0x480490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cad43
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x521da0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esi + 0x30]
mov dword [esp + 0x14], 1
test eax, eax
je 0x4804ce
push eax
call dword [0x4ce154]
cmp dword [esi + 0x58], 0
je 0x4804df
mov eax, dword [esi + 0x58]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esi + 0x10]
push eax
call dword [0x4ce114]
lea ecx, [esi + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00481e30
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x414470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, eax
shl ecx, 0x10
lea ebx, [edi + 1]
mov esi, eax
sar ebx, 1
sar ecx, 0x1e
and esi, 0x3fff
cmp ebx, ecx
jne 0x4144a0
cmp esi, 0x1021
jl 0x41451b
inc edx
xor esi, esi
inc esi
xor ecx, ecx
cmp esi, 2
jl 0x4144c0
lea ebx, [ebx]
movzx edi, word [ecx*2 + 0x4b86c4]
inc ecx
cmp esi, edi
jge 0x4144b0
mov edi, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x4b86d0]
add edx, ecx
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3fff
sar eax, 0x1e
mov dword [ebp + 0xc], edx
test edi, edi
je 0x41454d
sar edi, 1
cmp edi, eax
jne 0x4144f0
cmp ecx, 0x1021
jl 0x414540
inc edx
mov dword [ebp + 0xc], edx
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 2
jl 0x414510
lea ebx, [ebx]
movzx edx, word [eax*2 + 0x4b86c4]
inc eax
cmp ecx, edx
jge 0x414500
mov edx, dword [ebp + 0xc]
movzx eax, byte [eax + 0x4b86d0]
add edx, eax
jmp 0x41454f
xor ecx, ecx
cmp esi, 2
jl 0x414532
movzx edi, word [ecx*2 + 0x4b86c4]
inc ecx
cmp esi, edi
jge 0x414522
mov edi, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x4b86d0]
sub edx, ecx
jmp 0x4144a2
call fcn.004140e0
sub dword [ebp + 0xc], eax
mov edx, dword [ebp + 0xc]
jmp 0x4144f2
mov edi, eax
mov eax, dword [ebp + 8]
shl edi, 0x10
and ebx, 3
or edi, ebx
shl edi, 0xe
and esi, 0x3fff
and ecx, 0x3fff
or edi, esi
shl ecx, 0x10
xor edi, ecx
mov dword [eax + 4], edi
pop edi
pop esi
mov dword [eax], edx
pop ebx
pop ebp
ret
Function at 0x41deb0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
cmp ecx, edx
je 0x41df46
push ebx
push esi
mov esi, dword [ecx]
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov esi, dword [ecx + 4]
xor eax, eax
push edi
cmp esi, edx
jle 0x41defe
lea ebx, [ebx]
mov edi, dword [ecx]
movzx edi, byte [edi + edx]
mov ebx, eax
shr ebx, 0x18
xor edi, ebx
shl eax, 8
xor eax, dword [edi*4 + 0x4a9198]
inc edx
cmp edx, esi
jl 0x41dee0
xor edx, edx
mov esi, dword [ecx + 0xc]
cmp esi, edx
jle 0x41df22
mov edi, dword [ecx + 8]
movzx edi, byte [edi + edx]
mov ebx, eax
shr ebx, 0x18
xor edi, ebx
shl eax, 8
xor eax, dword [edi*4 + 0x4a9198]
inc edx
cmp edx, esi
jl 0x41df05
mov edx, dword [ecx]
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
pop edi
shr eax, 0x18
pop esi
mov byte [ecx + 0x19], al
pop ebx
ret

Function at 0x41fe66
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x41fe96
call fcn.00424cfb
cmp byte [esi + 0x40], 0
je 0x41fe8f
mov dword [esi + 0x14], 0xcf
mov al, 1
jmp 0x41ff26
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x41ff03
mov eax, dword [esi + 0x1a0]
cmp byte [eax + 0x10], 0
je 0x41fef8
mov eax, dword [esi + 8]
test eax, eax
je 0x41feb7
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1a0]
push esi
call dword [eax]
pop ecx
test eax, eax
je 0x41fef4
cmp eax, 2
je 0x41fef8
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41feac
cmp eax, 3
je 0x41fedb
cmp eax, 1
jne 0x41feac
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x41feac
mov ecx, dword [esi + 0x120]
add dword [eax + 8], ecx
jmp 0x41feac
xor al, al
jmp 0x41ff26
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x41ff21
cmp eax, 0xcc
je 0x41ff21
mov eax, dword [esi]
mov dword [eax + 0x14], 0x15
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.0041ff29
pop esi
pop ebp
ret
Function at 0x4245c1
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push 0x54
mov dword [edi + 4], ebx
mov dword [ebp - 8], 0xf4240
call dword [sym.imp.MSVCR100.dll_malloc]
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x4245f7
mov eax, dword [edi]
mov dword [eax + 0x14], 0x38
mov eax, dword [edi]
mov dword [eax + 0x18], ebx
mov eax, dword [edi]
push edi
call dword [eax]
pop ecx
mov dword [esi], fcn.00423c28
mov dword [esi + 4], fcn.00423d2b
mov dword [esi + 8], fcn.00423db8
mov dword [esi + 0xc], fcn.00423e4a
mov dword [esi + 0x10], 0x423ee8
mov dword [esi + 0x14], 0x423f49
mov dword [esi + 0x18], 0x423faa
mov dword [esi + 0x1c], 0x424277
mov dword [esi + 0x20], 0x424397
mov dword [esi + 0x24], fcn.004244bd
mov dword [esi + 0x28], 0x424598
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [ebp - 8]
xor ecx, ecx
mov dword [esi + 0x2c], eax
inc ecx
lea eax, [esi + 0x40]
mov dword [eax - 8], ebx
mov dword [eax], ebx
dec ecx
sub eax, 4
cmp ecx, ebx
jge 0x424656
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCR100.dll_getenv]
pop ecx
cmp eax, ebx
je 0x4246c5
lea ecx, [ebp - 1]
push ecx
lea ecx, [ebp - 8]
push ecx
push str._ld_c
push eax
mov byte [ebp - 1], 0x78
call dword [sym.imp.MSVCR100.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x4246c5
cmp byte [ebp - 1], 0x6d
je 0x4246ae
cmp byte [ebp - 1], 0x4d
jne 0x4246b9
mov eax, dword [ebp - 8]
imul eax, eax, 0x3e8
jmp 0x4246bc
mov eax, dword [ebp - 8]
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop esi
pop ebx
leave
ret