joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e8e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.0046d9f0
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x46e902
call fcn.0046da20
test byte [ebx + 0x20], 0x30
jne 0x46e91c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x4861c8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x46e95d
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x46e99d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x46e952
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x46e966
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.0046d7e0
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x4861c8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x46e95d
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x46e9b1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x46e97e

Function at 0x46e9c0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x4b8f2c]
test eax, eax
jne 0x46e9d0
xor eax, eax
ret
sub esp, 0x1c
call fcn.0046d800
mov eax, dword [0x4861c8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x46ea10
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x46ea00
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x46e9f4
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x46e9f6
call fcn.0046d8c0
test eax, eax
jne 0x46e9ed
jmp 0x46e9f4

Function at 0x46ea20
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.0046d800
mov eax, dword [0x4861c8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x46ea60
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x46ea50
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.0046d8c0
test eax, eax
jne 0x46ea3d
add esp, 0x1c
ret
Function at 0x46eb60
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.0046d800
mov eax, dword [0x4861c8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x46ebd0
test byte [ebx + 0x20], 0xc
jne 0x46eb90
mov eax, dword [0x4b8f2c]
test eax, eax
jne 0x46eba0
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.0046ca60
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x46ebc2
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x46ebc2
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x46ebe1
mov dword [esp], esi
call fcn.0046cd90
add esp, 0x14
pop ebx
pop esi
ret
call fcn.0046d8c0
mov ebx, eax
test eax, eax
jne 0x46eb81
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x46ec01
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.0046cd90
call fcn.0046ea70
nop
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x46ec90
mov dword [esp], eax
call fcn.0046c6f0
mov edi, eax
mov eax, 0xfffffffe
cmp eax, edi
mov eax, 0
sbb eax, edx
jb 0x46ecd0
call fcn.0046d800
mov eax, dword [0x4861c8]
mov esi, edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x46ed30
test edi, edi
je 0x46ecaa
call fcn.0046eb60
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x46ed08
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0046c810
call fcn.0046eb60
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.0046d800
mov eax, dword [0x4861c8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x46ed20
call fcn.0046eb60
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.0046eb60
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.0046d800
mov eax, dword [0x4861c8]
mov esi, 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x46ec62
call fcn.0046d8c0
mov ebx, eax
jmp 0x46ec62
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x46ec7e
call fcn.0046d8c0
jmp 0x46ecaa
call fcn.0046d8c0
mov ebx, eax
jmp 0x46ec5e
Function at 0x403d00
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x57fc4c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x403ed0
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call fcn.004704c0
jmp fcn.00403d00
Function at 0x409540
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword [0x57fc4c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40962a
sub esp, 0x2c
movsd xmm0, qword [esp + 0x30]
movsd qword [esp], xmm0
call fcn.00409730
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, ecx
shr ecx, 0x14
and ecx, 0x7ff
mov ebx, edx
shr edx, 0xf
and edx, 0x1f
shl ebx, 5
shr eax, 0x1b
or eax, ebx
and eax, 0xfffff
mov dword [esp + 0x10], eax
lea ebx, [0x558de0]
movsd xmm0, qword [ebx + edx*8]
movsd qword [esp + 0x14], xmm0
add ecx, 0xfffffc01
mov ebp, 0xffffffff
adc ebp, 0
add edx, 1
movsd xmm1, qword [ebx + edx*8]
movsd qword [esp + 0x1c], xmm1
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.004649b0
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00464a30
movsd xmm0, qword [esp + 0x24]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x4e1bb8]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd qword [esp + 0x38], xmm0
add esp, 0x2c
ret
call fcn.004704c0
jmp fcn.00409540

Function at 0x40cec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x57fc4c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40cfe8
sub esp, 0x20
mov eax, dword [esp + 0x24]
mov edx, dword [eax + 0x24]
bsf ebx, edx
jne 0x40cee8
mov ebx, 0x20
mov ebp, dword [eax + 0x20]
bsf esi, ebp
jne 0x40cef5
mov esi, 0x20
cmp ebp, 1
sbb edi, edi
xor edi, 0xffffffff
xchg edi, ebx
not ebx
xchg edi, ebx
and edi, ebx
lea ebx, [esi + edi]
cmp ebx, 0x40
jge 0x40cfdc
mov dword [esp + 0x10], ebp
movzx ecx, word [eax + 0x18]
lea ebp, [ebx + ecx]
movzx eax, word [eax + 0x1a]
cmp ax, bp
jbe 0x40cfdc
lea ebx, [ebx + ecx + 1]
test bx, 0x3f
jne 0x40cf45
cmp ax, bx
je 0x40cf45
mov dword [esp + 0x28], 0
add esp, 0x20
ret
mov word [esp + 0xa], bx
mov dword [esp + 0xc], edx
lea ecx, [esi + edi - 0x1f]
mov dword [esp + 0x1c], ecx
mov eax, edx
shr edx, cl
mov dword [esp + 0x18], edx
neg ecx
shl eax, cl
lea esi, [esi + edi + 1]
mov edi, ecx
mov ecx, esi
mov ebx, dword [esp + 0xc]
shr ebx, cl
mov edx, dword [esp + 0x10]
shr edx, cl
movzx ebp, bp
mov dword [esp + 0x14], ebp
cmp ecx, 0x20
sbb esi, esi
and edx, esi
and ebx, esi
cmp edi, 0x20
sbb esi, esi
and eax, esi
or eax, edx
mov edx, dword [esp + 0x1c]
cmp edx, 0x20
sbb edx, edx
mov esi, dword [esp + 0x18]
and esi, edx
or eax, esi
mov edx, dword [esp + 0x24]
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], ebx
movzx eax, word [esp + 0xa]
mov word [edx + 0x18], ax
movzx eax, word [edx + 0x3c]
inc eax
mov word [edx + 0x3c], ax
mov dword [esp], edx
call fcn.00428a60
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
imul eax, dword [edx + 0x44]
add eax, dword [esp + 4]
mov dword [esp + 0x28], eax
add esp, 0x20
ret
mov dword [esp + 0x28], 0
add esp, 0x20
ret
call fcn.004704c0
jmp fcn.0040cec0
Function at 0x416e00
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x57fc4c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x416fd6
sub esp, 0x18
mov eax, dword [0x57fb84]
test eax, eax
jne 0x416fbf
lea eax, [0x57fb74]
mov dword [esp], eax
call fcn.0040b5e0
mov eax, dword [0x57fb78]
test eax, eax
je 0x416e46
cmp dword [eax + 8], 0xcc
jne 0x416ebc
mov eax, dword [0x57fb7c]
test eax, eax
jne 0x416e9e
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x582250]
mov dword [esp + 8], eax
call fcn.0040d520
mov eax, dword [esp + 0xc]
mov dword [0x57fb7c], eax
mov ecx, dword [0x57fb80]
mov dword [eax], ecx
mov eax, dword [0x57fb7c]
mov dword [0x57fb80], eax
movzx eax, byte [0x57ffe0]
test al, al
jne 0x416e9e
xor eax, eax
jmp 0x416fb3
mov eax, dword [0x57fb7c]
mov ecx, dword [eax + 4]
mov dword [0x57fb7c], ecx
mov ecx, dword [0x57fb78]
mov dword [eax + 4], ecx
mov dword [0x57fb78], eax
mov eax, dword [0x57fb78]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
lea edx, [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.004767c0
mov eax, dword [0x57fd28]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x416f03
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
jmp 0x416f43
call fcn.00471930
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x28]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x2c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x18], esi
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x1c], esi
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov dword [edx + ecx*4 + 0x1c], ebx
mov dword [edx + ecx*4 + 0x20], ebp
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4 + 0x14], eax
lea eax, [0x57fb74]
mov dword [esp], eax
call fcn.0040b800
lea eax, [0x57fb70]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00476290
add esp, 0x18
ret
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov ebx, ecx
sub ecx, edx
lea edx, [0x5582c0]
movzx ecx, byte [edx + ecx]
lea ebp, [0x57ffe0]
mov byte [ebp + ebx], cl
lea eax, [ebx + 1]
cmp eax, 0x80
jl 0x416f87
jmp 0x416e9e
lea eax, [0x4d5651]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0046c450
nop
call fcn.004704c0
jmp fcn.00416e00
Function at 0x41b810
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x57fc4c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41b887
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0041bde0
movzx eax, byte [esp + 4]
test al, al
je 0x41b86c
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x41b870
mov dword [esp], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 8], ecx
call fcn.0041b890
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.0041be30
add esp, 0xc
ret
add esp, 0xc
ret
lea eax, [0x4d5669]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0046c450
nop
call fcn.004704c0
jmp fcn.0041b810
Function at 0x42bbc0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x57fc4c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42bd48
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42bc9f
cmp cl, 1
je 0x42bc40
cmp cl, 2
jne 0x42bd31
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.004763e0
lea eax, [0x56c228]
mov dword [esp], eax
call fcn.0040b5e0
lea eax, [0x56c200]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00417f00
lea eax, [0x56c228]
mov dword [esp], eax
call fcn.0040b800
jmp 0x42bd2d
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00416e00
lea eax, [0x56c228]
mov dword [esp], eax
call fcn.0040b5e0
lea eax, [0x56c160]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00417f00
lea eax, [0x56c228]
mov dword [esp], eax
call fcn.0040b800
jmp 0x42bd2d
cmp cl, 3
je 0x42bce8
cmp cl, 4
jne 0x42bcaf
mov byte [eax + 8], 1
jmp 0x42bd2d
cmp cl, 5
jne 0x42bd31
lea eax, [0x56c228]
mov dword [esp], eax
call fcn.0040b5e0
lea eax, [0x56c1d8]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00417f00
lea eax, [0x56c228]
mov dword [esp], eax
call fcn.0040b800
jmp 0x42bd2d
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00431570
lea eax, [0x56c228]
mov dword [esp], eax
call fcn.0040b5e0
lea eax, [0x56c188]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00417f00
lea eax, [0x56c228]
mov dword [esp], eax
call fcn.0040b800
add esp, 0x14
ret
lea eax, [0x4d3064]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.0046c450
nop
call fcn.004704c0
jmp fcn.0042bbc0
Function at 0x4566f0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x57fc4c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x456861
sub esp, 0x14
lea eax, [0x57ffd4]
mov dword [esp], eax
call fcn.00475f80
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
test eax, eax
je 0x456727
mov ecx, dword [esp + 0x18]
jmp 0x456742
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 6]
test dl, dl
je 0x456742
lea eax, [ecx + 0x30]
mov dword [esp], eax
call fcn.0040b5e0
mov ecx, dword [esp + 0x18]
mov dword [esp], ecx
call fcn.004561a0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
lea ecx, [0x4d0dac]
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
call fcn.00456160
mov eax, dword [esp + 0x10]
test eax, eax
je 0x456780
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004565e0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx + 5]
test dl, 1
je 0x4567c0
mov ebx, edx
or edx, 2
mov byte [ecx + 5], dl
test dl, 4
jne 0x4567c0
or ebx, 6
mov byte [ecx + 5], bl
mov eax, dword [ecx + 0x2c]
test byte [eax], al
add eax, 0x14
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00475ff0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0xc]
mov ebx, dword [ecx + 0x10]
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
test ebx, ebx
setg bl
xchg ebp, ebx
sete bl
xchg ebp, ebx
test edx, edx
seta dl
and ebp, edx
or ebp, ebx
xchg ebp, eax
mov byte [esp + 0xf], al
xchg ebp, eax
test eax, eax
jne 0x4567fe
movzx edx, byte [ecx + 6]
test dl, dl
je 0x4567fe
inc dword [ecx + 0x28]
mov dword [esp], ecx
call fcn.004561f0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x456815
movzx ebp, byte [esp + 0xf]
jmp 0x456857
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x456828
movzx ebp, byte [esp + 0xf]
jmp 0x456857
lea ecx, [eax + 0x30]
mov dword [esp], ecx
call fcn.0040b800
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00456250
mov eax, dword [esp + 4]
mov dword [esp], eax
call fcn.00406600
movzx ebp, byte [esp + 4]
movzx eax, byte [esp + 0xf]
or ebp, eax
xchg ebp, eax
mov byte [esp + 0x1c], al
xchg ebp, eax
add esp, 0x14
ret
call fcn.004704c0
jmp fcn.004566f0
Function at 0x4585c0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x57fc4c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4586a7
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp], eax
call fcn.004561a0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
lea ecx, [0x4d29d0]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xe
call fcn.00456160
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax + 6]
test cl, cl
jne 0x45861d
call fcn.00458420
mov eax, dword [esp + 0x10]
inc dword [eax + 8]
movzx ecx, byte [eax + 5]
test cl, 1
je 0x458671
test cl, 4
je 0x458671
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
test ebx, ebx
sete bl
xchg ebp, ebx
setg bl
xchg ebp, ebx
test edx, edx
seta dl
and ebx, edx
or ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x458671
and ecx, 0xfffffffb
mov byte [eax + 5], cl
mov ecx, dword [eax + 0x2c]
test byte [ecx], al
add ecx, 0x14
mov dword [esp], ecx
mov dword [esp + 4], 0xffffffff
call fcn.00475ff0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00456cf0
movzx eax, byte [esp + 4]
mov byte [esp + 0xf], al
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call fcn.004561f0
movzx eax, byte [esp + 0xf]
test al, al
je 0x4586a3
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.00456db0
add esp, 0x14
ret
call fcn.004704c0
jmp fcn.004585c0

Function at 0x45ea10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x57fc4c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45eab9
sub esp, 0x20
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x45ea36
mov ecx, 1
jmp 0x45ea54
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
call fcn.0045db30
movzx eax, byte [esp + 8]
xor eax, 1
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x1f], cl
test cl, cl
jne 0x45ea6a
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
jmp 0x45ea97
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
movzx eax, byte [esp + 0x30]
mov byte [esp + 0xc], al
call fcn.0045d6f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
movzx eax, byte [esp + 0x30]
mov byte [esp + 0x44], al
movzx eax, byte [esp + 0x1f]
mov byte [esp + 0x48], al
add esp, 0x20
ret
call fcn.004704c0
jmp fcn.0045ea10
Function at 0x460030
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x57fc4c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x460212
sub esp, 0x54
mov eax, dword [0x57fc4c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x50]
mov dword [esp + 0x4c], eax
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x58]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov word [esp + 8], 0x101
call fcn.0045e370
mov eax, dword [esp + 0xc]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x4c]
lea ebp, [ebx + 0xec]
mov dword [esp], ebp
mov ebp, dword [esp + 0x5c]
mov dword [esp + 4], ebp
call fcn.00462650
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov edx, dword [esp + 0x4c]
mov ebx, dword [edx + 0x54]
mov edx, dword [edx + 0x58]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x10
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 2
call fcn.0045e620
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x28]
mov dword [esp], ebx
call fcn.0044cca0
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x960]
test eax, eax
jne 0x460171
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x3c]
jmp 0x4601fe
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0044cca0
mov eax, dword [esp + 0x5c]
and eax, 1
shl eax, 5
lea ecx, [0x561130]
add eax, ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov ecx, dword [ecx + 0x960]
lea eax, [eax + ecx*8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov byte [esp + 0xc], 0x27
lea eax, [esp + 0x44]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 1
call fcn.0045e620
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.0045e6a0
add esp, 0x54
ret
call fcn.004704c0
jmp fcn.00460030