joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59534a
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x6214e0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
call fcn.004130a0
push 0xffffffffffffffff
push 0
lea edi, [esi + 0xd68]
push eax
mov ecx, edi
mov dword [esp + 0x3c], 0
call fcn.0040ba20
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x30], 0xffffffff
jb 0x415e67
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0058fc40
add esp, 4
push edi
mov ecx, esi
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.00411d30
push edi
mov ecx, esi
call fcn.0040f250
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret

Function at 0x425600
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x596e43
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x6214e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [0x5a067c]
xor ebp, ebp
mov dword [esi + 4], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], eax
mov dword [esi], 0x5a33e0
mov dword [esi + 0x34], ebp
mov dword [esp + 0x1c], ebp
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x40], ebp
mov dword [esi + 0x44], ebp
push 0x425ba0
push 0x425b90
push 2
push 0x14
lea edi, [esi + 0x278]
push edi
mov byte [esp + 0x30], 3
call fcn.0058fe8a
and byte [esi + 0x38], 0xfe
xor eax, eax
mov dword [esi + 0x260], eax
mov dword [esi + 0x264], eax
mov dword [esi + 0x268], eax
mov dword [esi + 0x26c], eax
mov dword [esi + 0x270], eax
mov dword [esi + 0x274], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov cl, byte [esi + 0x38]
mov edi, dword [0x5a06e4]
and byte [esi + 0x39], 0xf1
and cl, 0x1f
or cl, 0x60
push 0xf
mov dword [esi + 0x28], ebp
mov byte [esi + 0x38], cl
call edi
push 0x12
mov dword [esi + 0x48], eax
call edi
push 0xf
mov dword [esi + 0x4c], eax
call edi
push 0x12
mov dword [esi + 0x50], eax
call edi
and byte [esi + 0x38], 0xfd
push 0x208
lea edx, [esi + 0x58]
push ebp
mov dword [esi + 0x54], eax
mov dword [esi + 0x34], ebp
push edx
mov dword [esi + 0x44], ebp
call fcn.0058fdc6
and byte [esi + 0x39], 0xfe
add esp, 0xc
and byte [esi + 0x38], 0xe3
mov dword [esi + 0x30], ebp
mov dword [esi + 0x2c], 0x64
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x43aa60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x59848b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x6214e0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov byte [esi + 0x20], bl
mov byte [esi + 0x21], bl
mov edi, 0xf
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], ebx
mov byte [esi + 0x28], bl
mov dword [esi + 0x40], ebx
mov dword [esi], 0x5a472c
mov dword [esi + 0x60], edi
mov dword [esi + 0x5c], ebx
mov dword [esp + 0x38], ebx
mov byte [esi + 0x4c], bl
mov dword [esi + 0x7c], edi
mov dword [esi + 0x78], ebx
mov byte [esi + 0x68], bl
mov dword [esi + 0x98], edi
mov dword [esi + 0x94], ebx
mov byte [esi + 0x84], bl
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb0], ebx
mov byte [esi + 0xa0], bl
mov dword [esi + 0xd0], edi
mov dword [esi + 0xcc], ebx
mov byte [esi + 0xbc], bl
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xf8], edi
mov dword [esi + 0xf4], ebx
mov byte [esi + 0xe4], bl
mov byte [esi + 0xfc], bl
mov dword [esi + 0x118], edi
mov dword [esi + 0x114], ebx
mov byte [esi + 0x104], bl
mov eax, dword [esp + 0x40]
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], eax
mov dword [esi + 0x144], edi
mov dword [esi + 0x140], ebx
mov byte [esi + 0x130], bl
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
lea ecx, [esi + 0x154]
mov byte [esp + 0x38], 9
call fcn.0040bd20
mov dword [esi + 0x188], edi
mov dword [esi + 0x184], ebx
mov byte [esi + 0x174], bl
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov dword [esi + 0x18c], ecx
mov dword [esi + 0x190], edx
mov dword [esi + 0x194], 0xffffffff
mov byte [esp + 0x38], 0xb
cmp dword [0x6197a8], ebx
jne 0x43ac00
call fcn.004675c0
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00465140
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x619794
mov byte [esp + 0x44], 0xc
call fcn.0040ba20
cmp dword [esp + 0x2c], 0x10
jb 0x43ac00
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0058fc40
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 0xc
Function at 0x43ae30
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5984be
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [0x6214e0]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x18c], 0
je 0x43af72
xor edi, edi
cmp byte [esi + 0x20], 0
je 0x43af72
mov ebx, dword [0x5a02d8]
mov ecx, esi
call fcn.0043a2d0
test al, al
jne 0x43ae97
cmp edi, dword [esi + 0x18c]
jge 0x43ae97
push 0x64
add edi, 0x64
call ebx
cmp byte [esi + 0x20], 0
jne 0x43ae77
cmp byte [esi + 0x20], 0
je 0x43af72
cmp byte [esi + 0xfc], 0
je 0x43af67
cmp dword [esi + 0xf4], 0
setne al
test al, al
jne 0x43af72
mov eax, dword [esi + 0x18c]
cmp edi, eax
jl 0x43af72
cdq
push edx
push eax
lea eax, [esp + 0x50]
push eax
call fcn.0040edc0
push eax
lea ecx, [esp + 0x3c]
push str.disconnected_by_timeout
push ecx
mov dword [esp + 0x84], 0
call fcn.0040c6f0
push 0x5a4730
push eax
lea edx, [esp + 0x30]
mov bl, 1
push edx
mov byte [esp + 0x90], bl
call fcn.0040c7b0
add esp, 0x24
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esi + 0x24]
mov byte [esp + 0x78], 2
call fcn.0040ba20
lea ecx, [esp + 0x10]
call fcn.004639d0
lea ecx, [esp + 0x2c]
call fcn.004639d0
lea ecx, [esp + 0x48]
mov dword [esp + 0x6c], 0xffffffff
call fcn.004639d0
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
mov byte [esi + 0x21], bl
call edx
xor al, al
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x60
ret
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jmp 0x43aeba
mov al, 1
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x60
ret
Function at 0x442c70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5993ab
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push esi
mov eax, dword [0x6214e0]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
push 1
push 2
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], 0
call fcn.0040e8e0
mov esi, dword [esp + 0xc0]
push 0x5a0d04
push esi
lea eax, [esp + 0x34]
push str.Error_code:
push eax
mov dword [esp + 0xc4], 1
call fcn.00419d20
add esp, 8
mov ecx, eax
call fcn.0044c110
push eax
call fcn.00419d20
add esp, 8
push 0
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x800
push esi
push 0
push 0x1100
call dword [0x5a01ec]
test eax, eax
jne 0x442d2b
call dword [0x5a020c]
push eax
lea edx, [esp + 0x30]
push str.FormatMessage_error___code
push edx
call fcn.00419d20
add esp, 8
mov ecx, eax
call fcn.0044c110
jmp 0x442d77
mov eax, dword [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.0043e890
push eax
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0xc4], 2
call fcn.0041a170
add esp, 0x10
cmp dword [esp + 0x28], 0x10
mov byte [esp + 0xb4], 1
jb 0x442d6c
mov eax, dword [esp + 0x14]
push eax
call fcn.0058fc40
add esp, 4
mov ecx, dword [esp + 8]
push ecx
call dword [0x5a01e8]
mov esi, dword [esp + 0xbc]
push esi
lea ecx, [esp + 0x30]
call fcn.0040ced0
lea ecx, [esp + 0x78]
mov dword [esp + 0xc], 1
mov byte [esp + 0xb4], 0
call fcn.0040ac70
lea edx, [esp + 0x78]
push edx
mov dword [esp + 0x7c], 0x5a0978
call fcn.0058f787
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xb0
ret

Function at 0x443950
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x599554
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x6214e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x24], 0
call fcn.0043d840
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x14]
push edx
push eax
push esi
call fcn.00443800
add esp, 0x14
mov bl, al
test esi, esi
je 0x4439c2
push esi
call fcn.0058fcbc
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x444690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x599773
mov eax, dword fs:[0]
push eax
mov eax, 0x184c
call fcn.0058fe10
mov eax, dword [0x6214e0]
xor eax, esp
mov dword [esp + 0x1848], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6214e0]
xor eax, esp
push eax
lea eax, [esp + 0x1860]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1870]
lea eax, [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x78]
push ecx
call fcn.0058fa7c
test eax, eax
jne 0x44477c
lea edx, [esp + 0x54]
push edx
call fcn.0042a630
push eax
lea eax, [esp + 0x1078]
push str.EnumProcesses_error:
xor edi, edi
push eax
mov dword [esp + 0x1878], edi
call fcn.0040c6f0
add esp, 0x10
push 0xffffffffffffffff
push edi
push eax
mov ecx, 0x6197d0
mov byte [esp + 0x1874], 1
call fcn.0040ba20
mov esi, 0x10
cmp dword [esp + 0x1088], esi
jb 0x44474f
mov ecx, dword [esp + 0x1074]
push ecx
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x1088], 0xf
mov dword [esp + 0x1084], edi
mov byte [esp + 0x1074], 0
cmp dword [esp + 0x6c], esi
jb 0x4448f5
mov edx, dword [esp + 0x58]
jmp 0x4448ec
mov ebp, dword [esp + 0x14]
shr ebp, 2
call dword [0x5a01f8]
xor ebx, ebx
mov dword [esp + 0x18], eax
test ebp, ebp
jbe 0x444870
mov eax, dword [esp + ebx*4 + 0x70]
cmp dword [esp + 0x18], eax
je 0x444867
push eax
mov eax, dword [esp + 0x1878]
push 0
or eax, 0x410
push eax
call dword [0x5a01f4]
mov esi, eax
test esi, esi
je 0x444867
push 0x3e8
lea ecx, [esp + 0x1090]
push ecx
push 0
push esi
call fcn.0058fa76
lea edx, [esp + 0x108c]
push edx
lea eax, [esp + 0x1074]
push eax
call fcn.0043e890
lea ecx, [esp + 0x1078]
push ecx
mov dword [esp + 0x1874], 2
call fcn.0043e530
mov eax, dword [edi + 0x14]
add esp, 0xc
cmp dword [edi + 0x18], 0x10
jb 0x444818
mov ecx, dword [edi + 4]
jmp 0x44481b
lea ecx, [edi + 4]
mov edx, dword [esp + 0x1084]
push eax
push ecx
push edx
push 0
lea ecx, [esp + 0x1080]
call fcn.0040a680
test eax, eax
je 0x44491f
push esi
call dword [0x5a02e8]
cmp dword [esp + 0x1088], 0x10
mov dword [esp + 0x1868], 0xffffffff
jb 0x444867
mov eax, dword [esp + 0x1074]
push eax
call fcn.0058fc40
add esp, 4
inc ebx
cmp ebx, ebp
jb 0x444797
push edi
lea edx, [esp + 0x3c]
push str.Process
push edx
call fcn.0040c6f0
push str._not_found
push eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x1880], 3
call fcn.0040c7b0
add esp, 0x18
push 0xffffffffffffffff
push 0
push eax
mov ecx, 0x6197d0
mov byte [esp + 0x1874], 4
call fcn.0040ba20
mov esi, 0x10
cmp dword [esp + 0x34], esi
jb 0x4448cd
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
cmp dword [esp + 0x50], esi
jb 0x4448f5
mov edx, dword [esp + 0x3c]
push edx
call fcn.0058fc40
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x1860]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1848]
xor ecx, esp
call fcn.0058fcd6
add esp, 0x1858
ret
cmp dword [esp + 0x1088], 0x10
jb 0x444939
mov ecx, dword [esp + 0x1074]
push ecx
call fcn.0058fc40
add esp, 4
mov eax, esi
jmp 0x4448f7
Function at 0x445c90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x599a6f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x6214e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x24], 0
call fcn.0043d840
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x14]
push edx
push eax
push esi
call fcn.00445000
add esp, 0x14
mov bl, al
test esi, esi
je 0x445d02
push esi
call fcn.0058fcbc
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x451be0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x59b0e3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6214e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
xor edi, edi
mov word [esi + 0xe], ax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov byte [esp + 0x18], 1
cmp dword [esi + 0x10], edi
jne 0x451c7e
push 0x14
call fcn.0058fcec
add esp, 4
cmp eax, edi
je 0x451c76
mov dword [eax], edi
mov dword [eax + 4], 0x10000
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
jmp 0x451c78
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0xc

Function at 0x4552a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59b4e5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6214e0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 0xc], eax
mov ecx, 7
xor edx, edx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x24], eax
mov dword [esp + 0x14], eax
mov word [esi + 0x14], dx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x40], eax
mov word [esi + 0x30], dx
mov dword [esi + 0x60], ecx
xor ecx, ecx
mov dword [esi + 0x5c], eax
mov word [esi + 0x4c], cx
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
push eax
push eax
push eax
mov eax, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
push edx
push eax
mov ecx, esi
mov byte [esp + 0x34], 3
call fcn.00454ea0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x14
Function at 0x45bee0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59bfb5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x6214e0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, dword [esp + 0x40]
add ecx, 0x74
xor ebx, ebx
push ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
call fcn.0043fb50
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0040c870
push 0x5a35b8
push eax
push esi
mov dword [esp + 0x50], 1
call fcn.0040c7b0
add esp, 0x18
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], bl
jb 0x45bf62
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0058fc40
add esp, 4
push esi
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.00443530
add esp, 4
test al, al
jne 0x45bf8f
call fcn.0043fb50
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.0040ba20
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret 4
Function at 0x45fcb0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x59cc75
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6214e0]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
push 9
xor ebx, ebx
mov esi, 0xf
push str.Installed
lea ecx, [esp + 0x54]
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
call fcn.0040bc40
push 0x1f
push str.SoftwareLavasoftWeb_Companion
lea ecx, [esp + 0x1c]
mov dword [esp + 0x94], ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.0040bc40
push 0x3e7
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x80000002
mov byte [esp + 0x9c], 1
call fcn.0043da30
mov ebp, 0x10
add esp, 0x10
mov edi, eax
cmp dword [esp + 0x2c], ebp
jb 0x45fd5e
mov edx, dword [esp + 0x18]
push edx
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov dword [esp + 0x8c], 0xffffffff
cmp dword [esp + 0x64], ebp
jb 0x45fd88
mov eax, dword [esp + 0x50]
push eax
call fcn.0058fc40
add esp, 4
cmp edi, 0x3e7
jne 0x45fe34
push 9
push str.Installed
lea ecx, [esp + 0x70]
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
call fcn.0040bc40
push 0x2b
push str.SoftwareWow6432NodeLavasoftWeb_Companion
lea ecx, [esp + 0x38]
mov dword [esp + 0x94], 2
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.0040bc40
push edi
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0x38]
push edx
push 0x80000002
mov byte [esp + 0x9c], 3
call fcn.0043da30
add esp, 0x10
mov edi, eax
cmp dword [esp + 0x48], ebp
jb 0x45fe12
mov eax, dword [esp + 0x34]
push eax
call fcn.0058fc40
add esp, 4
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
cmp dword [esp + 0x80], ebp
jb 0x45fe34
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.0058fc40
add esp, 4
xor eax, eax
cmp edi, 0x3e7
setne al
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret
Function at 0x465140
Capabilities:
Reference http user-agent string

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push esi
mov dword [esp + 4], 0
cmp eax, 4
ja case.default.0x465153
jmp dword [eax*4 + 0x4651e0]
mov esi, dword [esp + 0xc]
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1_
mov ecx, esi
call fcn.0040c130
mov eax, esi
pop esi
pop ecx
ret
mov esi, dword [esp + 0xc]
push str.Mozilla_5.0__X11__U__Linux_i686__ru__rv:1.9.2.14__Gecko_20110221_Ubuntu_10.10__maverick__Firefox_3.6.14
mov ecx, esi
call fcn.0040c130
mov eax, esi
pop esi
pop ecx
ret
mov esi, dword [esp + 0xc]
push str.Opera_9.80__X11__Linux_i686__U__ru__Presto_2.7.62_Version_11.01
mov ecx, esi
call fcn.0040c130
mov eax, esi
pop esi
pop ecx
ret
mov esi, dword [esp + 0xc]
push str.Mozilla_5.0__Windows__U__Windows_NT_5.1__en_US__AppleWebKit_534.13__KHTML__like_Gecko__Chrome_9.0.597.107_Safari_534.13
mov ecx, esi
call fcn.0040c130
mov eax, esi
pop esi
pop ecx
ret
mov esi, dword [esp + 0xc]
push str.Mozilla_5.0__Macintosh__U__Intel_Mac_OS_X_10_6_6__en_US__AppleWebKit_534.13__KHTML__like_Gecko__Chrome_9.0.597.102_Safari_534.13
mov ecx, esi
call fcn.0040c130
mov eax, esi
pop esi
pop ecx
ret
push str._installer
call fcn.004408a0
mov esi, dword [esp + 0x10]
push eax
push esi
call fcn.0040c7b0
add esp, 0xc
mov eax, esi
pop esi
pop ecx
ret
Function at 0x46f450
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
ret
Function at 0x48cc10
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + eax]
mov ebx, 0x1505
cmp esi, edi
jae 0x48cc00
movzx eax, byte [esi]
push eax
call fcn.00490b30
mov edx, ebx
shl edx, 5
movsx ecx, al
add edx, ebx
xor ecx, edx
inc esi
add esp, 4
mov ebx, ecx
cmp esi, edi
jb 0x48cbe1
pop edi
pop esi
movzx eax, bl
pop ebx
ret
push ecx
push esi
mov esi, eax
test esi, esi
je 0x48cc3d
call fcn.0048ca10
test eax, eax
jne 0x48cc3d
lea eax, [esp + 4]
push eax
call fcn.0048cb70
add esp, 4
mov ecx, eax
mov eax, dword [esp + 4]
pop esi
add esp, 4
jmp 0x48cbd0
xor eax, eax
pop esi
pop ecx
ret
Function at 0x49336b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1b8
mov eax, dword [0x6214e0]
xor eax, esp
mov dword [esp + 0x1b4], eax
cmp dword [0x6222a8], 0
push esi
mov esi, ecx
mov dword [esp + 0x18], esi
jne 0x493387
call fcn.00493340
test eax, eax
je 0x49339f
mov dword [0x6222a8], 1
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1b4]
xor ecx, esp
call fcn.0058fcd6
add esp, 0x1b8
ret
mov eax, dword [esi + 0xa38]
test eax, eax
je 0x4933c0
push 0x400
push eax
call fcn.004c11b0
add esp, 8
call fcn.00493340
test eax, eax
jne 0x493387
push ebx
push ebp
push edi
mov esi, 2
lea edi, [esp + 0x84]
mov dword [esp + 0x20], 4
jmp 0x4933e0
lea eax, [esp + 0x34]
push eax
call fcn.00492d70
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax]
mov ebp, dword [eax + 4]
push 1
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
call fcn.004af670
add esp, 8
push ebp
push ebx
lea eax, [esi - 1]
push 0
push eax
call fcn.0058fe50
lea ecx, [esp + 0x74]
mov ebx, esi
imul ebx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
call fcn.00492d70
mov eax, dword [eax + 8]
cdq
mov dword [esp + 0x34], edx
lea edx, [esp + 0x68]
push edx
mov ebp, eax
call fcn.00492d70
mov ecx, dword [esp + 0x38]
add esp, 8
add ebp, dword [eax]
push 0
adc ecx, dword [eax + 4]
lea edx, [esi + 1]
push edx
push ecx
push ebp
mov dword [esp + 0x38], edx
call fcn.0058fe50
shld edx, eax, 8
xor dword [esp + 0x14], edx
shl eax, 8
xor dword [esp + 0x10], eax
lea eax, [esp + 0x44]
push eax
call fcn.00492d70
lea ecx, [esp + 0x58]
push ecx
lea ebp, [eax + 8]
call fcn.00492d70
mov edx, dword [ebp]
add edx, dword [eax]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add esi, 2
imul edx, esi
mov esi, dword [esp + 0x30]
shl edx, 0x10
mov dword [edi], eax
xor ebx, edx
mov edx, dword [esp + 0x24]
mov dword [edi + 4], ecx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], edx
add esp, 8
add edi, 0x10
sub dword [esp + 0x20], 1
jne 0x4933e0
fld qword [0x5b0ef0]
sub esp, 8
fstp qword [esp]
lea eax, [esp + 0x8c]
push 0x40
push eax
call fcn.004c1130
add esp, 0x10
call fcn.00493340
test eax, eax
je 0x4933c3
lea ecx, [esp + 0xc4]
push 0x100
push ecx
mov byte [esp + 0xcc], 0
call fcn.004c1330
add esp, 8
cmp byte [esp + 0xc4], 0
pop edi
pop ebp
pop ebx
je 0x493537
lea edx, [esp + 0xb8]
push 0x400
push edx
call fcn.004c11b0
add esp, 8
call fcn.00493340
test eax, eax
jne 0x493387
mov eax, dword [esp + 0x18]
push str.libcurl_is_now_using_a_weak_random_seed__n
push eax
call fcn.0048a2e0
add esp, 8
call fcn.00493340
mov ecx, dword [esp + 0x1b8]
neg eax
sbb eax, eax
and eax, 0xffffffdd
pop esi
xor ecx, esp
add eax, 0x23
call fcn.0058fcd6
add esp, 0x1b8
ret