joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450bb4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x450d5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x450d40
mov dl, 1
mov eax, dword [0x41235c]
call fcn.00403b2c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404970
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x450d2f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044234c
test al, al
je 0x450d22
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x450d70
lea eax, [ebp - 0x254]
call fcn.00409418
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x450d22
xor eax, eax
push ebp
push 0x450d1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x450da8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x450d04
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404be0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x450d04
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404be0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450d22
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x450c25
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.00416034
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450d66
lea eax, [ebp - 0x260]
call fcn.00404970
ret
Function at 0x45194c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x451963
add esp, 0xfffffff0
call fcn.00403e68
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a188
mov eax, dword [0x458900]
cmp word [eax + 2], 0
jne 0x45198b
mov eax, dword [0x458900]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00453504
mov eax, dword [0x4589a4]
cmp word [eax + 2], 0
jne 0x4519a5
mov eax, dword [0x4589a4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00453710
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411f38]
call fcn.00403b2c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411f38]
call fcn.00403b2c
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x411f38]
call fcn.00403b2c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41e4f8]
call fcn.004243c4
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x451b5c
mov eax, dword [0x45882c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00424798
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x453de4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45882c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cb54
test eax, eax
je 0x451aac
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408dd0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cb88
test eax, eax
je 0x451ac0
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404be0
mov byte [ebx + 0xd4], 0
push ebx
push 0x4530c8
call fcn.0041b304
mov dword [ebx + 0xc8], eax
mov eax, dword [0x458738]
cmp byte [eax], 0
jne 0x451b11
mov eax, ebx
call fcn.00451ca0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00453ff8
mov eax, ebx
call fcn.00454b5c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x451b51
call fcn.00403ec0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451f20
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x451fbf
cmp dword [ebx + 0x94], 0
jne 0x451fb9
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x451ea8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x451fb9
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x451f7f
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x451fb9
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004142dc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x451f8e
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x452e1c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x452e86
mov eax, ebx
call fcn.00454fc8
test al, al
jne 0x452e86
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404a60
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x452e73
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x452e93
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004049c4
jmp 0x452e93
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004049c4
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x4541dc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45424a
mov eax, esi
call fcn.0043d184
test al, al
je 0x45424a
mov eax, dword [ebx + 0x84]
call fcn.0043ce88
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45424a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45423e
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043ce88
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00434f2c
jmp 0x45424a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00454018
pop esi
pop ebx
ret
Function at 0x45671c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x456724
push ecx
mov eax, 0x4550f4
call fcn.00406728
xor eax, eax
push ebp
push 0x456859
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x458988]
mov eax, dword [eax]
call fcn.00453374
mov eax, 0x45dccc
mov edx, 0x456870
call fcn.004049c4
lea edx, [ebp - 0x18]
mov eax, dword [0x458988]
mov eax, dword [eax]
call fcn.00453afc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408c60
mov edx, dword [ebp - 0x14]
mov eax, 0x45dcc8
call fcn.004049c4
mov eax, dword [0x45dcc8]
test eax, eax
je 0x456794
sub eax, 4
mov eax, dword [eax]
mov edx, dword [0x45dcc8]
cmp byte [edx + eax - 1], 0x5c
je 0x4567b0
mov eax, 0x45dcc8
mov edx, 0x456888
call fcn.00404c3c
lea eax, [ebp - 0x1c]
mov ecx, dword [0x45dccc]
mov edx, dword [0x45dcc8]
call fcn.00404c88
mov eax, dword [ebp - 0x1c]
call fcn.00408bb4
test al, al
je 0x4567f6
push 5
lea eax, [ebp - 0x20]
mov ecx, dword [0x45dccc]
mov edx, dword [0x45dcc8]
call fcn.00404c88
mov eax, dword [ebp - 0x20]
call fcn.00404e00
push eax
call sub.kernel32.dll_WinExec
jmp 0x456832
push 0x10
push 0x456894
push dword [0x45dccc]
push 0x4568ac
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404d04
mov eax, dword [ebp - 0x24]
call fcn.00404e00
mov edx, eax
mov ecx, 0x4568bc
mov eax, dword [0x458988]
mov eax, dword [eax]
call fcn.00453594
jmp 0x45683e
mov eax, dword [0x458988]
mov eax, dword [eax]
call fcn.0045338c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456860
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.00404994
ret
Function at 0x4017a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44dc38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x460cb4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], 0
mov ebx, dword [esp + 0x30]
test ebx, ebx
mov dword [esp + 0xc], 0
je 0x4017e9
mov eax, dword [ebx]
jmp 0x4017eb
xor eax, eax
fld qword [esp + 0x38]
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x30]
sub esp, 8
fstp qword [esp]
push eax
mov eax, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [ecx + 0x250]
push edx
push edi
call eax
test eax, eax
jge 0x40182f
push 0x4570f0
push edi
push eax
call fcn.004492f0
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00401300
test ebx, ebx
je 0x401871
lea edx, [ebx + 8]
push edx
call dword [0x451254]
test eax, eax
jne 0x401871
mov eax, dword [ebx]
test eax, eax
je 0x401858
push eax
call dword [0x4512b0]
mov eax, dword [ebx + 4]
test eax, eax
je 0x401868
push eax
call fcn.00422c69
add esp, 4
push ebx
call fcn.00422c69
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 0x20
Function at 0x4226c5
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44da8b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x460cb4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0044904f
push 4
mov dword [esp + 0x20], 0
call fcn.00422c3e
mov edi, eax
add esp, 4
test edi, edi
je 0x4226c0
call fcn.00448c47
mov dword [edi], eax
call fcn.00448a7b
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004489ed
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4226b5
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00448a0e
jmp 0x4226c2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x426fbd
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x426fc6
xor eax, eax
jmp 0x42702f
cmp dword [esp + 8], 0
jne 0x426fd2
call fcn.00422d67
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.0043643b
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x42700d
push dword [esi + 0x10]
call fcn.00436180
test eax, eax
pop ecx
jne 0x42700d
mov esi, dword [esi + 0xc]
call fcn.00433dea
push esi
push dword [eax]
push 1
call fcn.0042edf9
push dword [esi + 0x10]
call fcn.004361af
test eax, eax
pop ecx
je 0x42702c
push dword [esi + 0x10]
call fcn.004360d4
push eax
call fcn.00401040
pop ecx
pop ecx
jmp 0x426ffb
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x427038
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x427042
call fcn.00422d67
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.00432d7e
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x42706f
mov esi, dword [esi + 0xc]
call fcn.00433dea
push esi
push dword [eax]
push 1
call fcn.0042edf9
pop esi
ret 8
Function at 0x4935d6
Capabilities:
Encode data using xor

Disassembly:
or ebx, dword [ebx + ecx*4 - 0x3b7cdfb5]
add al, 0xf
les eax, [edi + ecx]
mov edx, ebx
dec esp
pop es
add byte [eax + 0x15], ch
insb byte es:[edi], dx
mov byte [0x4c1831a], al
add esp, 4
and al, 8
pushfd
lea edx, [edx + 1]
mov dword [esp + 4], 0x15793eeb
pushal
push eax
mov byte [esp], ah
mov dword [esp + 0x30], edx
pop edx
call fcn.004d301d
sub eax, 0x4f040720
loop 0x493664
jno 0x49357e
jns 0x493584
insd dword es:[edi], dx
jge 0x49366b
insd dword es:[edi], dx
jne 0x4935c2
dec ecx
pop ebp
pop esp
test dword [esi - 0x11], edx
push ds
xlatb
rcr dh, cl
jnp 0x493646
sub edx, dword [edx + 0x6e]
jae 0x493631
out dx, eax
sbb eax, 0x3a2e8571
xor dl, dh
pop ebp
invalid
dec ebp
pop ecx
push ds
or al, 0x1e
imul esi, dword [ecx + 2], 0x56ce0c1a
and eax, 0x4a564635
mov byte [0x4750aab2], al
inc edi
inc edi
cwde
out 0x45, al
outsb dx, byte [esi]
mov edi, 0x5acacecf
retf 0x6aae
aaa
dec ebp
outsd dx, dword [esi]
mov al, 0x91
je 0x4936dd
jno 0x4936d2
invalid
invalid
push ss
aas
aaa
ljmp 0x6f88
add edi, 0xffffffbc
nop
push ss
push es
push 0xffffffffffffff9e
stosb byte es:[edi], al
lahf
xchg ebx, eax
sal dword [edi], cl
shl dword [edi - 0xe725a24], 1
out dx, eax
adc ebp, ebp
lodsd eax, dword [esi]
dec eax
dec ebp
push ss
mov dh, 4
or al, 0xc6
push esi
pop edx
invalid

Function at 0x49acd2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
je 0x49e265
jmp 0x4b2f51
movzx ecx, word [edi]
shr edx, 0xd
movzx edx, word [edi + 2]
pushal
cmc
clc
xor esi, esi
jmp 0x4d8437
add ecx, edx
stc
mov dword [ebp - 8], esi
clc
cmc
pushfd
stc
test ecx, ecx
call fcn.004ea362

Function at 0x4a4722
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0xc]
js 0x4c2ae3
jle 0x4e1204
lahf
rdtsc
lea esp, [esp]
neg al
daa
movzx eax, word [edi + 2]
test dx, 0x4f47
pushfd
add edx, eax
jmp 0x4aa3f9
clc
jmp 0x4f472a
pushfd
mov byte [esp], 9
push edi
lea esp, [esp + 8]
jle 0x4e1204
pushfd
lea esp, [esp + 4]
mov cl, cl
call fcn.004b7ccf
sub ebx, ebx
bt bp, 0xb
test edx, edx
jmp 0x4a2bbc

Function at 0x4a678f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
je 0x4aeca1
lea edx, [eax + 0xf1a662c]
pushfd
lahf
mov ecx, dword [ebp + 0x14]
setb ah
rdtsc
movsx ax, cl
mov edx, dword [ebp - 8]
pushal
lahf
cwde
movsx eax, dl
xchg dword [esp + 0x20], ecx
push 0x2f0143e0
lahf
lea esp, [esp + 0x24]
jb 0x4ccfc4
lahf
mov ecx, dword [ebp + 8]
not al
call fcn.0048bb45
pushal
mov ecx, dword [ebp + 8]
movzx ax, cl
movzx ax, cl
push 0x21635550
mov dword [esp + 0x20], esi
mov ah, dl
movsx ax, cl
lea eax, [edi + 0x680b954e]
mov dword [esp + 0x1c], edx
movzx ax, al
lea eax, [ebx + 0xed87baa]
mov eax, edi
pushal
lea esp, [esp + 0x3c]
call fcn.004b7104
movzx ebx, bl
call fcn.004f9bdc

Function at 0x4b07bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
jne 0x49f1d4
pushfd
call fcn.004767e5
Function at 0x4b6a1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [edi + 0xc74d7]
mov word [esp], dx
pushfd
lea edi, [edi - 0x161b0d8b]
mov byte [esp], bh
call fcn.0048a5ab
jmp 0x4d1bfb
jmp 0x4aed03

Function at 0x4bc397
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x18]
jno 0x4bf103
pushal
mov dword [esp], eax
mov dword [esp + 0x24], ebx
mov bx, dx
pop ebx
mov ebx, 0x435c9e
mov byte [esp], dh
pushal
jmp 0x48b18f

Function at 0x4c1c44
Capabilities:
Encode data using xor

Disassembly:
push 0x8660cddc
xchg dword [esp + 0x14], ebx
call fcn.004b2492

Function at 0x4c2fba
Capabilities:
Encode data using add xor sub operations

Disassembly:
pushfd
lea eax, [eax + 0x30500c30]
call fcn.004c33c8

Function at 0x4c2fc6
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
pushal
xchg dword [esp + 0x30], edi
mov dword [esp + 0x14], edx
call fcn.004d5771
mov ecx, 0x293e710c
sal byte [ecx - 0x201db3f6], cl
add ebp, dword [edi]
fcmovnu st(0), st(3)
das
invalid

Function at 0x4e8e52
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xfffffffc
jge 0x4fe904
test ebx, 0xffff0000
pushfd
pushal
pushfd
lea esp, [esp + 0x28]
jae 0x4e0a6e
je 0x50cabb
call fcn.004feefa
call fcn.004a8bdc

Function at 0x4f8e9b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x7cffe799
xchg dword [esp + 4], edi
jmp 0x4c2354
jae 0x4e13e2
pushal
mov edi, dword [edi + 0xee7ea]
call fcn.005019a9
mov edi, dword [edi + 0xee7ea]
pushfd
lea edi, [edi + 0x2a1b821b]
push edx
xchg dword [esp + 0xc], edi
pushfd
push dword [esp]
push ebx
push edx
push dword [esp + 0x1c]
ret 0x20
mov byte [esp], al
xchg dword [esp], edi
bswap edi
movsx di, bl
bswap di
mov edi, 0x41ae58
jmp 0x4a7a29
clc
clc
jmp 0x50797a
push ebx
jmp 0x4a96e6
lea esp, [esp + 4]
je 0x49e265
stc
movzx ecx, word [edi]
cmc
movzx edx, word [edi + 2]
clc
stc
pushal
xor esi, esi
pushal
add ecx, edx
jmp 0x4cb18f
mov dword [ebp - 8], esi
test cx, di
test ecx, ecx
push 0x67655662
jmp 0x509c65
call fcn.004a5fda
not di
nop
push 0xd88227e5
lea edi, [eax*4 - 0x95db8ea]
not edi
mov edi, dword [esp + 4]
lea esp, [esp + 8]
jg 0x4a2806
pushfd
pushal
pushfd
xchg dword [esp + 0x28], edi
push eax
push dword [esp]
call fcn.004a4dea
push 0xcc9519a
pop eax
rdtsc
cdq
mov ecx, dword [ebp + 0xc]
call fcn.004fc1ec

Function at 0x4fb397
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, esi
pop edx
mov edx, dword [esp + 0x30]
call fcn.0050ba7f
jmp 0x4a4716
Function at 0x509e21
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov edx, dword [ebp + 0x18]
setp cl
mov eax, dword [ebp + 0x14]
seta ch
mov ecx, dword [ebp + 0x10]
push 0x1501dbea
pushal
push dword [esp]
xchg dword [esp + 0x24], edx
pushal
lea esp, [esp + 0x44]
jge 0x4e503d
push ebx
mov edx, dword [ebp + 0xc]
call fcn.004f596b
mov ecx, dword [esi + 0x30]
mov byte [esp], 0x60
mov dword [esi + 0x3c], eax
not bl
rdtsc
mov eax, dword [ecx]
lea edx, [eax - 0x5e289bb9]
xchg di, dx
jmp 0x4a1f3b
pushal
mov edx, dword [eax + 8]
seto bh
mov edi, dword [esp + 0x24]
mov bx, word [esp]
mov bl, 0x3e
movsx bx, al
mov ebx, dword [esp + 0x28]
jmp 0x4a42b8
push dword [esp + 8]
push edx
mov byte [esp], 0xf7
mov dword [esp + 0x30], edx
mov byte [esp + 4], 0x3c
mov byte [esp], 3
push dword [esp]
pushfd
push dword [esp + 0x38]
ret 0x3c
cmc
call fcn.0049f870
pushfd
mov eax, dword [eax + 0xb1591]
mov byte [esp], 0xad
mov word [esp], 0xbafb
call fcn.004a0add
pushfd
pop edx
mov dh, 0x37
setle dh
mov edx, dword [ebp + 0xc]
pushal
mov byte [esp], 0xa9
push 0x88101678
mov dword [esp + 0x20], eax
jmp 0x4f88fd
pushfd
push dword [esp + 8]
push dword [esp + 8]
mov dword [esp + 0x28], ecx
mov byte [esp + 8], dh
push 0x4869abe7
mov dword [esp + 0x28], edx
call fcn.004741f5
pushfd
pushal
pushal
mov dword [esp + 0x40], eax
lahf
call fcn.004e8396
lea esp, [esp + 8]
je 0x49e265
sal cx, cl
pushal
dec cl
movzx ecx, word [edi]
shld dx, si, 0xb
adc edx, edi
btr dx, si
movzx edx, word [edi + 2]
jmp 0x4c8f4f

Function at 0x50cfe0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dh
mov ebx, dword [ebx + 0xc5073]
push dword [esp]
jmp 0x4e0b14
mov byte [esp + 8], al
lea esp, [esp + 0x54]
jnp 0x50c65a
push ebx
movsx bx, cl
push 0x87422373
setp bh
movsx bx, al
mov ebx, 0x445531
mov word [esp], si
jmp 0x4adf5f

Function at 0x40699a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x4069d1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4069ab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x4069a6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x4069e4
pop edi
not eax
pop esi
ret 0xc
Function at 0x402928
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x490030], 0x8088405
inc edx
mov dword [0x490030], edx
mul edx
mov eax, edx
ret

Function at 0x419960
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x419966
ret

Function at 0x4301bc
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret

Function at 0x434c00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov bl, 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x18]
dec esi
test esi, esi
jl 0x434dac
inc esi
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.00433a54
pop ecx
test al, al
jne 0x434c45
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00434ee0
xor ebx, ebx
jmp 0x434dac
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [ebp - 0x10]
ja 0x434c64
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00434ee0
xor ebx, ebx
jmp 0x434dac
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.004464d4
test eax, eax
jne 0x434c9c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00434ee0
xor ebx, ebx
jmp 0x434dac
test byte [ebp - 0xc], 1
je 0x434da5
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.00433a54
pop ecx
test al, al
jne 0x434cd0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00434ee0
xor ebx, ebx
jmp 0x434dac
mov edx, 0x431a38
mov eax, 0xc
call fcn.00403b38
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x434d78
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebp - 8]
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040385c
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.004036fc
mov edx, dword [ebp - 4]
call fcn.00433a54
pop ecx
test al, al
jne 0x434d3b
mov edx, 0x431a38
mov eax, dword [ebp - 8]
call fcn.00403b4c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00434ee0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x434dac
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00430ee0
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.00431178
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x434da5
dec esi
jne 0x434c1b
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret