joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f51a8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
lea eax, [esp + 0x105]
push eax
push 0
push 0x4f51ec
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [esp + 0x105]
call fcn.0040e5a4
add esp, 0x20c
pop ebx
ret

Function at 0x4f6dc8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x4f6e53
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push 0
push 0xffffffffffffff80
push ebx
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x4f6e35
push 0
lea eax, [ebp - 4]
push eax
push 0x80
push esi
push ebx
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4f6e35
cmp dword [ebp - 4], 0x80
jne 0x4f6e35
lea eax, [ebp - 8]
mov edx, esi
mov ecx, 3
call fcn.004052cc
mov eax, dword [ebp - 8]
mov edx, 0x4f6e6c
call fcn.004055f8
je 0x4f6e39
xor eax, eax
jmp 0x4f6e3b
mov al, 1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f6e5a
lea eax, [ebp - 8]
call fcn.004051dc
ret

Function at 0x4f798c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x4f7a42
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
push 0xa
push ebx
push esi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4f7a24
cmp dword [ebp - 4], 0xa
jne 0x4f7a24
lea eax, [ebp - 8]
mov edx, ebx
mov ecx, 3
call fcn.004052cc
mov eax, dword [ebp - 8]
mov edx, 0x4f7a5c
call fcn.004055f8
jne 0x4f7a24
cmp byte [ebx + 4], 0xff
jae 0x4f7a24
cmp byte [ebx + 3], 2
jne 0x4f79f4
test byte [ebx + 5], 0x3f
je 0x4f7a0c
cmp byte [ebx + 3], 3
jne 0x4f7a00
test byte [ebx + 5], 0x1f
je 0x4f7a0c
cmp byte [ebx + 3], 4
jne 0x4f7a24
test byte [ebx + 5], 0xf
jne 0x4f7a24
test byte [ebx + 6], 0x80
jne 0x4f7a24
test byte [ebx + 7], 0x80
jne 0x4f7a24
test byte [ebx + 8], 0x80
jne 0x4f7a24
test byte [ebx + 9], 0x80
je 0x4f7a28
xor eax, eax
jmp 0x4f7a2a
mov al, 1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7a49
lea eax, [ebp - 8]
call fcn.004051dc
ret
Function at 0x4f82d4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f84a3
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4f8488
mov eax, dword [ebp - 4]
call fcn.004f80f0
mov edi, eax
add edi, dword [ebp - 0xc]
sub edi, 0xa
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
cmp eax, edi
setae byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4f8488
xor eax, eax
push ebp
push 0x4f8481
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 0xc]
push 0
lea eax, [ebp - 0x10]
push eax
push 6
lea eax, [ebp - 0x16]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4f8387
cmp dword [ebp - 0x10], 6
jne 0x4f8387
mov al, byte [ebp - 0x16]
add al, 0xbf
sub al, 0x1a
jb 0x4f838b
xor eax, eax
jmp 0x4f838d
mov al, 1
mov byte [ebp - 5], al
add ebx, dword [ebp - 0x10]
cmp edi, ebx
seta al
and al, byte [ebp - 5]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4f8459
movzx esi, byte [ebp - 0x13]
shl esi, 0x10
xor eax, eax
mov al, byte [ebp - 0x12]
shl eax, 8
add esi, eax
xor eax, eax
mov al, byte [ebp - 0x11]
add esi, eax
test esi, esi
jbe 0x4f8451
lea edx, [esi + 1]
lea eax, [ebp - 0x1c]
call fcn.00405838
mov eax, dword [ebp - 0x1c]
call fcn.004054ac
push eax
lea eax, [ebp - 0x1c]
call fcn.00405704
xor ecx, ecx
pop edx
call fcn.004039b0
push 0
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x1c]
call fcn.00405704
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4f8411
cmp esi, dword [ebp - 0x10]
je 0x4f8415
xor eax, eax
jmp 0x4f8417
mov al, 1
mov byte [ebp - 5], al
add ebx, dword [ebp - 0x10]
cmp edi, ebx
setae al
and al, byte [ebp - 5]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4f8459
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 3
call fcn.004052cc
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.004f8128
pop ecx
cmp edi, ebx
ja 0x4f835c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8488
cmp byte [ebp - 5], 0
jne 0x4f8480
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f84aa
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00405200
ret
Function at 0x4f84b4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f868d
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4f8672
mov eax, dword [ebp - 4]
call fcn.004f80f0
mov edi, eax
add edi, dword [ebp - 0xc]
sub edi, 0xa
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_GetFileSize_1
cmp eax, edi
setae byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4f8672
xor eax, eax
push ebp
push 0x4f866b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 0xc]
push 0
lea eax, [ebp - 0x10]
push eax
push 0xa
lea eax, [ebp - 0x1a]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4f8567
cmp dword [ebp - 0x10], 0xa
jne 0x4f8567
mov al, byte [ebp - 0x1a]
add al, 0xbf
sub al, 0x1a
jb 0x4f856b
xor eax, eax
jmp 0x4f856d
mov al, 1
mov byte [ebp - 5], al
add ebx, dword [ebp - 0x10]
cmp edi, ebx
seta al
and al, byte [ebp - 5]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4f8643
movzx esi, byte [ebp - 0x16]
shl esi, 0x18
xor eax, eax
mov al, byte [ebp - 0x15]
shl eax, 0x10
add esi, eax
xor eax, eax
mov al, byte [ebp - 0x14]
shl eax, 8
add esi, eax
xor eax, eax
mov al, byte [ebp - 0x13]
add esi, eax
test esi, esi
jbe 0x4f863b
lea edx, [esi + 2]
lea eax, [ebp - 0x20]
call fcn.00405838
mov eax, dword [ebp - 0x20]
call fcn.004054ac
push eax
lea eax, [ebp - 0x20]
call fcn.00405704
xor ecx, ecx
pop edx
call fcn.004039b0
push 0
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x20]
call fcn.00405704
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4f85fb
cmp esi, dword [ebp - 0x10]
je 0x4f85ff
xor eax, eax
jmp 0x4f8601
mov al, 1
mov byte [ebp - 5], al
add ebx, dword [ebp - 0x10]
cmp edi, ebx
setae al
and al, byte [ebp - 5]
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4f8643
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1a]
mov ecx, 4
call fcn.004052cc
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.004f8128
pop ecx
cmp edi, ebx
ja 0x4f853c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8672
cmp byte [ebp - 5], 0
jne 0x4f866a
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f8694
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00405200
ret
Function at 0x505154
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5052d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.00505548
mov eax, ebx
call fcn.00432490
dec al
je 0x505198
dec al
je 0x50519e
jmp 0x5051a4
mov byte [ebp - 0x77], 2
jmp 0x5051a8
mov byte [ebp - 0x77], 1
jmp 0x5051a8
mov byte [ebp - 0x77], 0
mov eax, dword [ebp - 0x8c]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0x8c], eax
mov eax, ebx
call fcn.0043241c
shl eax, 2
lea eax, [eax + eax*4]
mov dword [ebp - 0x84], eax
mov edi, dword [ebx + 0x18]
cmp edi, 0xff000008
je 0x5051f5
cmp edi, 0x20000000
jne 0x505201
mov dword [ebp - 0x88], 0x40000000
jmp 0x50520b
mov eax, edi
call fcn.00431cb4
mov dword [ebp - 0x7c], eax
mov eax, ebx
call fcn.00432458
test al, 1
je 0x50521d
or dword [ebp - 0x88], 1
mov eax, ebx
call fcn.00432458
test al, 2
je 0x50522f
or dword [ebp - 0x88], 2
mov eax, ebx
call fcn.00432458
test al, 4
je 0x505241
or dword [ebp - 0x88], 4
mov eax, ebx
call fcn.00432458
test al, 8
je 0x505253
or dword [ebp - 0x88], 8
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.004323a8
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x76]
mov ecx, 0x20
call fcn.0040e460
or dword [ebp - 0x8c], 0x8000000
mov eax, ebx
call fcn.004324c0
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x3c]
push eax
push 0x3c
mov eax, ebx
call fcn.004321ac
push eax
call sub.gdi32.dll_GetObjectA
test eax, eax
je 0x5052b0
or dword [ebp - 0x8c], 0x400000
mov ax, word [ebp - 0x2c]
mov word [ebp - 0x56], ax
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.00505574
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5052dd
lea eax, [ebp - 0x94]
call fcn.004051dc
ret
Function at 0x50627c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, 0x568f2c
xor eax, eax
push ebp
push 0x506402
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x591210], 1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5063e5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x506410
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x5062d7
cmp dword [ebx], 0x20
jae 0x5062d7
xor eax, eax
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x506303
push 0x506420
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x5063ce
cmp dword [ebx], 0x20
jae 0x5063ce
xor eax, eax
mov dword [ebx], eax
jmp 0x5063ce
mov byte [0x591210], 2
lea eax, [ebp - 8]
mov edx, 0x506438
call fcn.00405274
lea eax, [ebp - 8]
call fcn.004056fc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004056ac
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x5063ce
mov eax, ebx
call fcn.00402ebc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5063c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004056ac
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x5063b1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x506448
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5063b1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
and eax, 0xffff
mov ecx, 0xa
xor edx, edx
div ecx
mov byte [0x591210], al
cmp byte [0x591210], 0
jne 0x5063b1
mov byte [0x591210], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5063ce
mov eax, dword [ebp - 0x10]
call fcn.00402eec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5063ec
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x507d6c
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
call fcn.00507d38
cmp dword [0x591234], 0
jne 0x507d88
cmp dword [0x591230], 0
je 0x507d98
fld qword [ebp + 8]
fcomp dword [0x507e38]
fnstsw ax
sahf
jbe 0x507dc2
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x507da6
call fcn.00507d38
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], eax
fild qword [ebp - 0x28]
fcomp qword [ebp + 8]
fnstsw ax
sahf
jb 0x507da1
jmp 0x507e2e
fld qword [ebp + 8]
fcomp dword [0x507e3c]
fnstsw ax
sahf
jbe 0x507e2e
fld qword [ebp + 8]
fdiv dword [0x507e40]
fstp qword [ebp + 8]
wait
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
jmp 0x507e23
call fcn.00507d38
lea eax, [ebp - 0x20]
push eax
call sub.kernel32.dll_QueryPerformanceCounter_1
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x18]
sbb edx, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
fild qword [ebp - 0x28]
fild qword [0x591230]
fdivp st(1)
fstp xword [ebp - 0x10]
wait
fld xword [ebp - 0x10]
fcomp qword [ebp + 8]
fnstsw ax
sahf
jb 0x507df4
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x507f58
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x568f3c
mov esi, eax
cmp ecx, 1
jb 0x508061
test edx, edx
jne 0x507f75
xor esi, esi
jmp 0x508061
xor eax, 0xffffffff
cmp ecx, 8
jb 0x50803d
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ecx, 8
cmp ecx, 8
jae 0x507f81
test ecx, ecx
je 0x50805c
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ecx
test ecx, ecx
jne 0x508041
mov esi, eax
xor esi, 0xffffffff
mov eax, esi
pop esi
pop ebx
ret
Function at 0x50c0d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov ebx, eax
mov eax, dword [ebx + 0x60]
mov esi, eax
lea edi, [esp + 4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, dword [esp + 0x14]
test edx, edx
jns 0x50c0f7
call fcn.004042ac
xor ecx, ecx
mov eax, dword [ebx + 0x78]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x50c140
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x50c138
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [0x50b714]
call fcn.004064c0
inc edi
dec esi
jne 0x50c11f
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x44]
movzx esi, word [esp + 0xc]
test esi, esi
jle 0x50c1bd
mov edx, dword [0x50b714]
mov eax, 0x3c
call fcn.004064ac
mov dword [esp], eax
mov edx, dword [esp]
mov ecx, 0x2e
mov eax, dword [ebx + 0x78]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esp]
movzx ecx, word [eax + 0x1c]
mov eax, dword [esp]
lea edx, [eax + 0x30]
mov eax, dword [ebx + 0x78]
call fcn.00507c70
mov eax, dword [esp]
movzx edx, word [eax + 0x1e]
mov cx, 1
mov eax, dword [ebx + 0x78]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [esp]
movzx ecx, word [eax + 0x20]
mov eax, dword [esp]
lea edx, [eax + 0x34]
mov eax, dword [ebx + 0x78]
call fcn.00507c70
mov eax, dword [esp]
mov edx, dword [eax + 0x30]
mov ecx, dword [esp]
mov eax, dword [ebx + 0x30]
mov edi, dword [eax]
call dword [edi + 0x3c]
dec esi
jne 0x50c149
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
movzx edx, word [esp + 0xc]
cmp eax, edx
sete al
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x521574
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x521614
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00405230
mov eax, dword [ebp - 4]
call fcn.004054ac
test eax, eax
jle 0x5215ea
mov dword [ebp - 8], eax
mov ebx, 1
mov eax, edi
call fcn.00405704
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [edi]
movzx eax, byte [eax + ebx - 1]
add si, ax
imul ax, si, 0x7ab8
add ax, 0x6a2f
mov esi, eax
inc ebx
dec dword [ebp - 8]
jne 0x5215b5
lea edx, [ebp - 0xc]
mov eax, dword [edi]
call fcn.0052152c
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00405230
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52161b
lea eax, [ebp - 0xc]
call fcn.004051dc
ret
Function at 0x530d1c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x222], 0
je 0x530d43
mov ecx, edi
mov dl, 1
mov eax, dword [0x52faf8]
call fcn.0052fb5c
mov dword [edi + 0x294], eax
jmp 0x530e4c
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
cmp byte [edi + 0x22b], 0
je 0x530d84
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp dx, word [edi + 0x226]
jbe 0x530d79
mov edx, eax
sub dl, byte [edi + 0x226]
mov eax, edi
call fcn.005302cc
jmp 0x530dba
xor edx, edx
mov eax, edi
call fcn.005302cc
jmp 0x530dba
movzx edx, word [edi + 0x226]
mov ecx, 0x64
sub ecx, edx
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp ecx, edx
jle 0x530db1
mov edx, eax
add dl, byte [edi + 0x226]
mov eax, edi
call fcn.005302cc
jmp 0x530dba
mov dl, 0x64
mov eax, edi
call fcn.005302cc
cmp byte [edi + 0x22b], 0
je 0x530dcc
cmp byte [edi + 0x22a], 0
je 0x530dde
cmp byte [edi + 0x22b], 0
jne 0x530de9
cmp byte [edi + 0x22a], 0x64
jne 0x530de9
mov bl, byte [edi + 0x224]
xor bl, 1
jmp 0x530e19
mov eax, dword [0x56a7dc]
mov eax, dword [eax]
call fcn.0047fe98
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
movzx edx, word [edi + 0x228]
cmp eax, edx
ja 0x530e19
cmp byte [edi + 0x224], 0
jne 0x530e19
cmp byte [edi + 0x2a0], 0
je 0x530de9
test bl, bl
jne 0x530e33
cmp byte [edi + 0x224], 0
jne 0x530e33
cmp byte [edi + 0x2a0], 0
je 0x530d45
cmp byte [edi + 0x2a0], 0
jne 0x530e45
cmp byte [edi + 0x224], 0
jne 0x530e4c
mov eax, edi
call fcn.00531140
pop edi
pop esi
pop ebx
ret
Function at 0x533b50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
xor ebx, ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x254], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00405f48
lea eax, [ebp - 8]
call fcn.00405f48
xor eax, eax
push ebp
push 0x533d66
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00405cb4
je 0x533d3b
lea edx, [ebp - 0x254]
mov eax, dword [ebp - 4]
call fcn.00542bd0
mov edx, dword [ebp - 0x254]
lea eax, [ebp - 4]
call fcn.00405994
lea edx, [ebp - 0x258]
mov eax, dword [ebp - 8]
call fcn.00542bd0
mov edx, dword [ebp - 0x258]
lea eax, [ebp - 8]
call fcn.00405994
lea eax, [ebp - 0x25c]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405d38
mov eax, dword [ebp - 0x25c]
mov edx, 0x533d78
call fcn.00405cb4
je 0x533c69
lea eax, [ebp - 0x260]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405d38
mov eax, dword [ebp - 0x260]
mov edx, 0x533d8c
call fcn.00405cb4
je 0x533c69
lea eax, [ebp - 0x264]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405d38
mov eax, dword [ebp - 0x264]
mov edx, 0x533da4
call fcn.00405cb4
jne 0x533ca2
mov eax, dword [0x56a4a8]
cmp dword [eax], 4
jg 0x533ca2
push 0
push 0
mov eax, ebx
call fcn.005429cc
push eax
mov eax, dword [ebp - 4]
call fcn.00405b88
mov ecx, eax
mov edx, 0x533db4
mov eax, dword [0x56a7dc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
call fcn.00489b14
jmp 0x533d3b
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.004039b0
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov eax, 0x533db4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.00405b88
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00405b88
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24e]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
lea eax, [ebp - 0x24e]
mov dword [ebp - 0x2c], eax
mov eax, ebx
call fcn.005429cc
mov dword [ebp - 0x28], eax
or eax, 0xffffffff
call fcn.004039d0
mov dword [ebp - 0x3c], eax
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
jbe 0x533d01
push ebx
call sub.user32.dll_IsWindow
test eax, eax
jne 0x533d01
lea eax, [ebp - 0x44]
call fcn.004e7f98
and al, byte [ebp + 8]
je 0x533d3b
cmp dword [ebp - 0xc], 0
je 0x533d3b
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x533d6d
lea eax, [ebp - 0x264]
mov edx, 5
call fcn.0040594c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040594c
ret