joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8ccba7
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0x8cc92e
dec ebx
call fcn.008ccbd7
dec ebx
xor dword [edi], esi
dec ebx
mov edx, 0x7083c12f
inc edi
or ebx, edx
add edx, 0xd6a58c28
sub edx, 0xcbfa725e
cmp edi, ecx
jne fcn.008ccba7
and edx, edx
or ebx, edx
sub edx, edx
ret
Function at 0x402d40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402d99
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402bdc
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402bdc
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402d83
inc ebx
jmp 0x402d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402da0
lea eax, [ebp - 8]
call fcn.00404274
ret

Function at 0x402da8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404274
test esi, esi
jne 0x402ddf
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404364
jmp 0x402e00
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402bdc
mov dword [esp], eax
test esi, esi
je 0x402e00
cmp dword [ebx], 0
je 0x402e00
dec esi
jmp 0x402de7
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x402f8c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x419008], 0x8088405
inc edx
mov dword [ebx + 0x419008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4033b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x419024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40344c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40342c
xor eax, eax
push ebp
push 0x403425
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403468
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40342c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x419024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x419024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040f0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41b044], 0
je 0x404151
cmp word [0x41b218], 0xd7b2
jne 0x404119
cmp dword [0x41b220], 0
jbe 0x404119
mov eax, 0x41b214
call dword [0x41b230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x419070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404178
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x419034], 0
jne 0x40416d
push 0
push 0x419068
push 0x419070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405d34
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405d9a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004044e4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402fa8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405d84
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405da1
lea eax, [ebp - 0x10]
call fcn.00404274
ret

Function at 0x4078ac
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404734
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x4078ce
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40a0dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a115
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404364
jmp 0x40a11e
mov eax, ebx
mov edx, esi
call fcn.004042c8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a128
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a149
mov al, byte [esp]
jmp 0x40a14b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a7e0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a648
mov eax, dword [0x41a5d8]
cmp byte [eax], 0
je 0x40a85c
mov eax, dword [0x41a4e0]
call fcn.00402e98
call fcn.00402b08
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407a30
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a8a4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a892
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x41a4bc]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x41b660]
call fcn.004051dc
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40b5a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b608
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044e4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004075a4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b60f
lea eax, [ebp - 0xc]
call fcn.00404274
ret

Function at 0x417438
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push esi
push edi
push eax
push edx
mov eax, dword [eax]
mov edx, dword [edx]
mov ebx, 0
mov esi, 0
mov edi, dword [0x41c908]
shl edi, 2
xor edx, dword [esi + 0x41b880]
ror edx, 0x10
mov bl, dh
mov ecx, dword [ebx*4 + 0x41b908]
mov bl, dl
add ecx, dword [ebx*4 + 0x41bd08]
rol edx, 0x10
mov bl, dh
xor ecx, dword [ebx*4 + 0x41c108]
mov bl, dl
add ecx, dword [ebx*4 + 0x41c508]
xor eax, ecx
xchg edx, eax
add esi, 4
cmp esi, edi
jne 0x417455
xchg edx, eax
xor eax, dword [esi + 0x41b880]
xor edx, dword [esi + 0x41b884]
mov ebx, edx
pop edx
mov dword [edx], ebx
mov ebx, eax
pop eax
mov dword [eax], ebx
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x4174ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push esi
push eax
push edx
mov eax, dword [eax]
mov edx, dword [edx]
mov ebx, 0
mov esi, dword [0x41c908]
inc esi
shl esi, 2
xor edx, dword [esi + 0x41b880]
ror edx, 0x10
mov bl, dh
mov ecx, dword [ebx*4 + 0x41b908]
mov bl, dl
add ecx, dword [ebx*4 + 0x41bd08]
rol edx, 0x10
mov bl, dh
xor ecx, dword [ebx*4 + 0x41c108]
mov bl, dl
add ecx, dword [ebx*4 + 0x41c508]
xor eax, ecx
xchg edx, eax
sub esi, 4
cmp esi, 4
jne 0x4174c4
xchg edx, eax
xor eax, dword [0x41b884]
xor edx, dword [0x41b880]
mov ebx, edx
pop edx
mov dword [edx], ebx
mov ebx, eax
pop eax
mov dword [eax], ebx
pop esi
pop ecx
pop ebx
ret
Function at 0x4177a4
Capabilities:
Encrypt data using blowfish

Disassembly:
push esi
push edi
mov dword [0x41c908], 0x10
mov esi, 0x4193cc
mov edi, 0x41b880
mov ecx, 0x422
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret

Function at 0x41858c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
push esp
push 0x3ff
call sub.kernel32.dll_GetTempPathA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404364
add esp, 0x400
pop ebx
ret
Function at 0x4033f4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4e2008], 0x8088405
inc edx
mov dword [ebx + 0x4e2008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4099f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x409a46
test eax, edx
je 0x409a49
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x409a09
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x409a2f
add ecx, 4
js 0x409a1f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x409a2c
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x409a55
test edx, edx
jne 0x4099fc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4275c8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4275ce
ret
Function at 0x486b4c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4eff28
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x486b6e
shr eax, 1
xor eax, 0xedb88320
jmp 0x486b70
shr eax, 1
dec edx
jne 0x486b5c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x486b55
mov byte [0x4f0328], 1
pop esi
pop ebx
ret

Function at 0x486b8c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4f0328], 0
jne 0x486ba3
call fcn.00486b4c
mov eax, edi
dec eax
test eax, eax
jl 0x486bcb
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4eff28]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x486bad
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x489508
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4895a2.0
jmp dword [ecx*4 + 0x48953b]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x48956d
sub dl, 8
je 0x48957c
jmp case.0x4895a2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4891b4
jmp case.0x4895a2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x48920c
jmp case.0x4895a2.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4895a2.0
movzx ecx, byte [ecx + 0x4895a9]
jmp dword [ecx*4 + 0x4895ba]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4892b8
jmp case.0x4895a2.0
cmp dl, 3
jne 0x4895e7
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x48930c
jmp case.0x4895a2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4892c8
jmp case.0x4895a2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x489350
jmp case.0x4895a2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x489612
sub dl, 8
je 0x48961e
jmp case.0x4895a2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x48937c
jmp case.0x4895a2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4893e8
jmp case.0x4895a2.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x48963d
sub dl, 8
je 0x489649
jmp case.0x4895a2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4894a4
jmp case.0x4895a2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4894cc
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x4896ed
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004886c0
test eax, eax
je 0x4896ed
mov eax, ebx
call fcn.004896f8
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x489686
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4896f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x489729
dec al
je 0x489764
dec al
je 0x4897a9
dec al
je 0x489812
jmp 0x48989c
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x48989c
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x489739
jmp 0x48989c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48989c
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x489774
jmp 0x48989c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48989c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4897d8
xor ebp, ebp
jmp 0x4897e8
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4897f1
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4897b9
jmp 0x48989c
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48989c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x48986b
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00486bd4
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x489826
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4918c4
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x4918d9
or edx, 0x200
test eax, 0x20000000
je 0x49190c
test eax, 0x40000000
je 0x4918f8
test eax, 0x80000000
je 0x4918f3
or edx, 0x40
jmp 0x491933
or edx, 0x20
jmp 0x491933
test eax, 0x80000000
je 0x491907
or edx, 0x80
jmp 0x491933
or edx, 0x10
jmp 0x491933
test eax, 0x40000000
je 0x491924
test eax, 0x80000000
je 0x49191f
or edx, 4
jmp 0x491933
or edx, 2
jmp 0x491933
test eax, 0x80000000
je 0x491930
or edx, 8
jmp 0x491933
or edx, 1
mov eax, edx
pop ebp
ret 4

Function at 0x4952c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4952ee
mov eax, ebx
call fcn.00495d74
cmp dword [ebx + 0x40], 0
je 0x4952e7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x49535f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x495351
cmp dword [ebx + 8], 0
je 0x495310
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x495322
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x495351
cmp dword [ebx + 8], 0
je 0x495303
cmp eax, 3
je 0x495335
dec eax
jne 0x495303
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x495303
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x495303
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x49537d
cmp dword [ebx + 0x14], 0xcc
je 0x49537d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00495388
pop ebx
ret
Function at 0x4a6c48
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
mov esi, eax
xor eax, eax
mov dword [edx], esi
mov ecx, dword [edx]
cmp word [ecx], 0x5a4d
jne 0x4a6c96
mov edx, dword [edx]
mov edx, dword [edx + 0x3c]
add edx, esi
mov dword [ebx], edx
mov edx, dword [ebx]
cmp dword [edx], 0x4550
jne 0x4a6c96
mov edx, dword [ebx]
mov edi, dword [edx + 0xa0]
test edi, edi
je 0x4a6c96
mov edx, dword [ebx]
test byte [edx + 0x16], 1
jne 0x4a6c96
mov edx, edi
mov eax, esi
call fcn.004a6c40
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4abf14
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x4abf29
or edx, 0x200
test eax, 0x20000000
je 0x4abf5c
test eax, 0x40000000
je 0x4abf48
test eax, 0x80000000
je 0x4abf43
or edx, 0x40
jmp 0x4abf83
or edx, 0x20
jmp 0x4abf83
test eax, 0x80000000
je 0x4abf57
or edx, 0x80
jmp 0x4abf83
or edx, 0x10
jmp 0x4abf83
test eax, 0x40000000
je 0x4abf74
test eax, 0x80000000
je 0x4abf6f
or edx, 4
jmp 0x4abf83
or edx, 2
jmp 0x4abf83
test eax, 0x80000000
je 0x4abf80
or edx, 8
jmp 0x4abf83
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x4ac07c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor ecx, ecx
push ebp
push 0x4ac297
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, dword [esi]
lea eax, [ebp - 0x48]
mov ecx, 0x40
call fcn.00408370
cmp word [ebp - 0x48], 0x5a4d
je 0x4ac0d6
mov eax, 0x4f1934
mov edx, 0x4ac2cc
call fcn.0040517c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac2b7
mov edx, dword [esi]
add edx, dword [ebp - 0xc]
lea eax, [ebp - 0x140]
mov ecx, 0xf8
call fcn.00408370
cmp dword [ebp - 0x140], 0x4550
je 0x4ac113
mov eax, 0x4f1934
mov edx, 0x4ac304
call fcn.0040517c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac2b7
push 4
push 0x2000
mov eax, dword [ebp - 0xf0]
push eax
mov eax, dword [ebp - 0x10c]
push eax
call fcn.00407a90
mov ebx, eax
test ebx, ebx
jne 0x4ac14a
push 4
push 0x2000
mov eax, dword [ebp - 0xf0]
push eax
push 0
call fcn.00407a90
mov ebx, eax
test ebx, ebx
jne 0x4ac16a
mov eax, 0x4f1934
mov edx, 0x4ac340
call fcn.0040517c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac2b7
push 0x11
push 0
call fcn.00407908
push eax
call fcn.00407988
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ebx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x10], 0
push 4
push 0x1000
mov eax, dword [ebp - 0xf0]
push eax
push ebx
call fcn.00407a90
push 4
push 0x1000
mov eax, dword [ebp - 0xec]
push eax
push ebx
call fcn.00407a90
mov edi, eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0xec]
mov edx, dword [esi]
mov eax, edi
call fcn.00408370
mov eax, edi
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov edi, ebx
mov dword [eax + 0x34], edi
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x140]
push eax
mov eax, dword [esi]
push eax
call fcn.004abb30
mov eax, edi
sub eax, dword [ebp - 0x10c]
test eax, eax
je 0x4ac20d
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.004abbd8
mov eax, dword [ebp - 8]
push eax
call fcn.004abc90
test al, al
jne 0x4ac22e
mov eax, 0x4f1934
mov edx, 0x4ac370
call fcn.004053f4
call fcn.0040dd24
mov eax, dword [ebp - 8]
push eax
call fcn.004abf8c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4ac28d
mov edx, eax
add edx, edi
mov esi, edx
test edx, edx
jne 0x4ac261
mov eax, 0x4f1934
mov edx, 0x4ac3a8
call fcn.0040517c
call fcn.0040dd24
push 0
push 1
push edi
call esi
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4ac286
mov eax, 0x4f1934
mov edx, 0x4ac3dc
call fcn.0040517c
call fcn.0040dd24
mov eax, dword [ebp - 8]
mov byte [eax + 0x10], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ac2b1
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc