joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464178
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4f0c34]
cmp dword [eax + 0x30], 0
je 0x464222
cmp dword [ebx + 0x94], 0
jne 0x46421c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x464108
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46421c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4641e2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46421c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419170
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4641f1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x464d00
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x464d35
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404a58
jmp 0x464d42
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004049bc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x465e08
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x465e49
mov eax, esi
call fcn.0044bdf8
test al, al
je 0x465e49
mov eax, dword [ebx + 0x84]
call fcn.0044baf4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x465e49
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044baf4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x467ac0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x467d20
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x467b23
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00467588
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d9e0
cmp al, 1
jne 0x467b23
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004678a0
test al, al
je 0x467caf
cmp dword [ebp - 8], 0
jge 0x467b41
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00467588
mov eax, dword [ebp - 0x210]
call fcn.00404c20
cmp ebx, eax
jge 0x467b8b
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00467588
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4efaac]
and eax, 0xff
bt dword [edx], eax
jae 0x467b8b
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x467b9f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00467a9c
cmp ebx, dword [ebp - 8]
je 0x467ca1
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x467bcb
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403d18
and eax, 0x7f
movzx eax, word [eax*2 + 0x4ece34]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x467c8e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403d18
and eax, 0x7f
movzx eax, word [eax*2 + 0x4ece34]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0044baf4
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403d18
and eax, 0x7f
movzx eax, word [eax*2 + 0x4ece34]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0044baf4
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467c95
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x467d02
cmp dword [ebp - 8], 0
jge 0x467cba
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00467588
mov eax, dword [ebp - 0x218]
call fcn.00404c20
cmp eax, dword [ebp - 8]
jg 0x467cf4
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00467588
mov eax, dword [ebp - 0x21c]
call fcn.00404c20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00467a9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467d27
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.0040498c
ret
Function at 0x472ce8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00472870
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404e18
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x472d46
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4ef68c]
mov dl, 1
mov eax, dword [0x472768]
call fcn.0040d20c
call fcn.004043ac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x472d50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404e18
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x472da8
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4efae8]
mov dl, 1
mov eax, dword [0x472768]
call fcn.0040d20c
call fcn.004043ac
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004728a0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x486260
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x48628e
mov eax, ebx
call fcn.00486d18
cmp dword [ebx + 0x3c], 0
je 0x486287
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4862ff
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x4862f1
cmp dword [ebx + 8], 0
je 0x4862b0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x4862c2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4862f1
cmp dword [ebx + 8], 0
je 0x4862a3
cmp eax, 3
je 0x4862d5
dec eax
jne 0x4862a3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4862a3
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x4862a3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x48631d
cmp dword [ebx + 0x10], 0xcc
je 0x48631d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00486328
pop ebx
ret

Function at 0x4bd5d7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4ee85a
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4bd62f
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4ee87b
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4bd625
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4bd633
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4cb0f8
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4cb11d
cmp dword [esp + 4], 5
jb 0x4cb11d
mov al, 1
jmp 0x4cb11f
xor eax, eax
add esp, 0x94
ret
Function at 0x4e258c
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor eax, eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4e277e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004db7e8
push dword [ebp - 8]
push 0x4e2794
push 0x4e27a0
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404ce0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d4]
call fcn.00402ea4
lea eax, [ebp - 0x1d4]
call fcn.00402c40
call fcn.00402960
mov edx, 0x4e27b8
lea eax, [ebp - 0x1d4]
call fcn.00405034
call fcn.00403578
call fcn.00402960
push 0x4e27c8
lea edx, [ebp - 0x230]
xor eax, eax
call fcn.00402b20
push dword [ebp - 0x230]
push 0x4e27d8
lea eax, [ebp - 0x22c]
mov edx, 3
call fcn.00404ce0
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 0x1d4]
call fcn.00405034
call fcn.00403578
call fcn.00402960
push 0x4e27e4
lea edx, [ebp - 0x238]
xor eax, eax
call fcn.00402b20
push dword [ebp - 0x238]
push 0x4e27d8
push 0x4e27f8
lea eax, [ebp - 0x234]
mov edx, 4
call fcn.00404ce0
mov edx, dword [ebp - 0x234]
lea eax, [ebp - 0x1d4]
call fcn.00405034
call fcn.00403578
call fcn.00402960
mov edx, 0x4e280c
lea eax, [ebp - 0x1d4]
call fcn.00405034
call fcn.00403578
call fcn.00402960
lea eax, [ebp - 0x1d4]
call fcn.00402f6c
call fcn.00402960
lea eax, [ebp - 0x228]
xor ecx, ecx
mov edx, 0x44
call fcn.00403148
mov dword [ebp - 0x1fc], 1
mov word [ebp - 0x1f8], 0
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404e18
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4e2753
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4ef78c]
mov eax, dword [eax]
call fcn.004652c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2785
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.0040498c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040498c
ret

Function at 0x4e2880
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword fs:[0x30]
movzx ax, byte [eax + 2]
or al, al
je 0x4e2898
jne 0x4e289f
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 1
jne 0x4e28ae
mov dl, 1
cmp dword [ebp - 4], 1
jne 0x4e28b6
xor edx, edx
mov eax, edx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4e2944
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffab8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x538], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4e2adf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
lea edx, [ebp - 0x534]
lea eax, [ebp - 0xc]
mov ecx, 0x3ff
call fcn.00404a58
push 0x3ff
lea eax, [ebp - 0x534]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x538]
mov eax, dword [ebp - 0xc]
call fcn.00408fa8
mov edx, dword [ebp - 0x538]
lea eax, [ebp - 0xc]
mov ecx, 0x4e2af8
call fcn.00404c6c
xor edx, edx
mov eax, 0xf
call fcn.004cac7c
mov edi, eax
lea edx, [ebp - 0x134]
mov eax, edi
call fcn.004cac9c
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4e2a9f
lea eax, [ebp - 0x53c]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.00404bd0
mov eax, dword [ebp - 0x53c]
push eax
lea edx, [ebp - 0x540]
xor eax, eax
call fcn.00402b20
mov edx, dword [ebp - 0x540]
pop eax
call fcn.00404d64
jne 0x4e2a4c
mov eax, dword [ebp - 0x11c]
mov esi, eax
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 4], eax
jmp 0x4e2a8c
lea eax, [ebp - 0x548]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.00404bd0
mov eax, dword [ebp - 0x548]
lea edx, [ebp - 0x544]
call fcn.00408fa8
mov eax, dword [ebp - 0x544]
mov edx, dword [ebp - 0xc]
call fcn.00404d64
jne 0x4e2a8c
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x134]
mov eax, edi
call fcn.004cacbc
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4e29fa
cmp esi, dword [ebp - 8]
je 0x4e2ab9
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_TerminateProcess
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2ae6
lea eax, [ebp - 0x548]
mov edx, 5
call fcn.0040498c
lea eax, [ebp - 0xc]
call fcn.00404968
ret

Function at 0x4e2c0c
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffe8
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 0xc]
push eax
push 0x4e2c68
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 1
push 2
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
ret
Function at 0x4e2c7c
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffe8
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 0xc]
push eax
push 0x4e2cd8
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push 1
call sub.user32.dll_ExitWindowsEx
add esp, 0x18
ret

Function at 0x4e3108
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x4eee94]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x4e3144
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x4e315c
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4e3155
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403148
xor edx, edx
mov eax, 0x4ef094
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x4e31c6
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x4e317a
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4e3404
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4e341d
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4e3416
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4e342f
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4e3428
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.004e2ff8
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4e3449
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.004e3108
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x4e34ce
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4e34eb
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.004e3088
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4e3514
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e352c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4e3545
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4e353e
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4e3559
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004e2ef0
test bl, bl
jne 0x4e362c
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x4f0fec
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4e3590
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4e35a4
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004e3404
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4e35d6
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4e3585
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4e35f9
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4e360a
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4e361e
jmp 0x4e36e7
cmp bl, 1
jne 0x4e36e7
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x4f1046
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4e364c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4e3660
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004e3404
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4e3692
sub ebx, 6
inc dword [ebp - 8]
jne 0x4e3641
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4e36b9
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4e36ca
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4e36de
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004e2f74
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4e8874
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404e08
xor eax, eax
push ebp
push 0x4e892d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4727c8]
call fcn.004728c8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4e88fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.00472968
xor ecx, ecx
mov edx, 0x4e8944
mov eax, dword [ebp - 0xc]
call fcn.00472aa8
test al, al
je 0x4e88e7
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00472c70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8904
mov eax, dword [ebp - 0xc]
call fcn.00403b1c
ret
Function at 0x40a5b0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a77f
sub esp, 0x34
mov eax, dword [esp + 0x38]
cmp eax, 0x7000000
jle 0x40a752
mov eax, 0x7000000
mov dword [esp + 0x38], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x90]
mov ebx, dword [ecx + 0x94]
mov dword [ecx + 0x90], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x94], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.00453b00
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
mov edi, dword [esp + 0x24]
shr edi, 0x1b
shl ebx, 5
or edi, ebx
test esi, esi
jne 0x40a772
cmp ecx, 0x21
jae 0x40a766
mov dword [esp + 0x10], edi
lea ebx, [0x58f7c0]
movsd xmm0, qword [ebx + ebp*8]
movsd qword [esp + 0x14], xmm0
movsd xmm1, qword [ebx + ecx*8]
movsd qword [esp + 0x1c], xmm1
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0xffffffff
adc eax, 0
mov dword [esp + 4], eax
call fcn.0044e760
mov eax, dword [esp + 0x10]
and eax, 0xfffff
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0044e850
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
mulsd xmm2, qword [esp + 8]
movsd xmm1, qword [0x5025c8]
mulsd xmm1, xmm2
addsd xmm0, xmm1
movsd xmm1, qword [0x502630]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40a72d
xorps xmm0, xmm0
mov eax, dword [esp + 0x38]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x502668]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x34
ret
test eax, eax
jne 0x40a5dd
mov dword [esp + 0x3c], 0
add esp, 0x34
ret
mov eax, ecx
mov ecx, 0x21
call fcn.00453be0
mov eax, ecx
mov ecx, 0x21
call fcn.00453ca0
nop
call fcn.00452310
jmp fcn.0040a5b0