joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465d10
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
mov esi, ebx
cmp ebx, edi
je 0x465d36
mov eax, dword [esi + 0xc]
cmp ebp, eax
jle 0x465d40
mov esi, dword [esi]
sub ebp, eax
cmp esi, edi
jne 0x465d27
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
sub eax, ebp
test byte [ebx + 0x10], 2
mov dword [esp + 0x1c], eax
je 0x465e24
movzx eax, word [ebx + 0x14]
mov ecx, dword [0x69f86c]
push ecx
mov dword [esp + 0x18], eax
call fcn.005c052e
mov edi, eax
xor eax, eax
add esp, 4
cmp edi, eax
je 0x465d36
mov dx, word [esp + 0x14]
lea ecx, [edi + 0x34]
mov word [edi + 0x14], dx
mov dword [edi + 8], ecx
xor edx, edx
xor ecx, ecx
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 2
mov dword [edi + 0x18], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov word [edi + 0x2c], dx
mov word [edi + 0x2e], cx
mov dword [edi + 0x30], eax
cmp edi, eax
je 0x465d36
mov edx, dword [ebx + 0x18]
mov eax, dword [esp + 0x20]
mov dword [edi + 0x18], edx
mov ecx, dword [ebx + 0x20]
sub ecx, eax
mov dword [edi + 0x20], ecx
mov dword [ebx + 0x20], eax
test byte [esi + 0x10], 1
jne 0x465e7f
mov eax, dword [esp + 0x1c]
cmp eax, 0xcc
jbe 0x465e15
mov edx, dword [esp + 0x24]
add dword [edi + 8], 0xcc
push edx
push ebp
push esi
call fcn.00465d10
add esp, 0xc
mov dword [edi], eax
test eax, eax
mov eax, edi
jne 0x465e06
call fcn.00464f80
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov dword [edi + 0xc], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, 0xcc
sub ecx, eax
and ecx, 0xfffffffc
add dword [edi + 8], ecx
jmp 0x465e79
cmp eax, edi
jne 0x465e34
mov eax, dword [esi]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [0x69f86c]
movzx ebx, word [esi + 0x14]
push edx
call fcn.005c052e
add esp, 4
cmp eax, edi
je 0x465e60
lea ecx, [eax + 0x18]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov word [eax + 0x14], bx
mov dword [eax + 8], ecx
mov edi, eax
test eax, eax
je 0x465d36
mov edx, 0xe8
sub edx, dword [esp + 0x1c]
and edx, 0xfffffffc
add dword [eax + 8], edx
test byte [esi + 0x10], 1
je 0x465e8e
mov eax, dword [esi + 8]
add eax, ebp
mov dword [edi + 8], eax
call fcn.00465650
jmp 0x465ea5
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 8]
mov eax, dword [edi + 8]
push ecx
add edx, ebp
push edx
push eax
call fcn.005bfdd0
add esp, 0xc
mov ecx, dword [esp + 0x1c]
mov dword [edi + 0xc], ecx
mov edx, dword [esi]
mov dword [esi + 0xc], ebp
mov dword [edi], edx
mov eax, edi
pop edi
mov dword [esi], 0
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x466910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0xc]
sub esp, 0xc
test ecx, ecx
je 0x466ade
mov eax, dword [esp + 0x14]
test eax, eax
je 0x466ade
cmp word [ecx], 0x7b
jne 0x466ade
cmp word [eax], 0x7b
jne 0x466ade
movzx eax, word [eax + 2]
mov edx, dword [0x69f2d0]
push ebx
push ebp
push esi
push edi
movzx edi, word [ecx + 2]
mov dword [esp + 0x18], eax
movzx eax, ax
movzx ecx, di
or eax, ecx
and eax, dword [0x69f2d4]
mov dword [esp + 0x14], edi
mov ebx, dword [edx + eax*4]
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x466aae
mov ebp, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x466984
mov edi, dword [esp + 0x14]
lea esi, [ebx + 0x268]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0xd0]
test eax, 0x20000000
je 0x4669a4
push esi
jmp 0x466a9a
cmp di, word [ebx + 0x3a]
je 0x4669b0
push esi
jmp 0x466a9a
mov ecx, dword [ebx + 0x2b4]
cmp ecx, dword [esp + 0x30]
je 0x4669c2
push esi
jmp 0x466a9a
test al, 4
jne 0x466a0b
mov ecx, dword [ebx + 0xbc]
test ecx, ecx
je 0x466a93
mov eax, dword [ecx + 8]
test eax, eax
je 0x466a00
test byte [eax + 0x3c], 2
jne 0x466a00
mov si, word [eax + 0x18]
mov edx, dword [esp + 0x28]
cmp si, word [edx]
jne 0x466a00
mov esi, dword [esp + 0x24]
cmp word [esi], 0x7b
jne 0x466a00
mov edx, dword [edx + 4]
cmp edx, dword [eax + 0x1c]
je 0x466a0b
mov ecx, dword [ecx]
test ecx, ecx
jne 0x4669d4
jmp 0x466a93
mov esi, dword [ebx + 0x210]
test esi, esi
je 0x466a93
lea edi, [esi + 0x57c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x28]
push eax
push esi
call fcn.00466780
add esp, 8
test eax, eax
je 0x466a90
mov cx, word [esp + 0x18]
cmp word [esi + 0x578], cx
jne 0x466a90
test dword [esi + 0x30], 0x200
jne 0x466a90
mov edx, dword [esp + 0x28]
push edx
push esi
call fcn.00466780
add esp, 8
test eax, eax
je 0x466a90
mov eax, dword [esi + 0x1c4]
test eax, eax
je 0x466a90
mov edx, dword [esp + 0x24]
movzx ecx, word [edx]
cmp word [eax + 0x74], cx
jne 0x466a8a
cmp cx, 0x7b
jne 0x466a8a
mov ebx, dword [eax + 0x78]
cmp ebx, dword [edx + 4]
je 0x466ab8
mov ebx, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x466a72
push edi
call ebp
lea eax, [ebx + 0x268]
push eax
call ebp
mov ebx, dword [ebx + 0xb0]
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x466980
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x466ac2
mov dword [ecx], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
add eax, 0x268
push eax
call ebp
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret
Function at 0x4858c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, esi
push edi
mov edi, dword [esp + 0x14]
sub ecx, edi
shr ecx, 3
add ecx, ecx
add ecx, ecx
add ecx, ecx
sub esi, ecx
sub esi, edi
mov dword [esp + 0x14], esi
test edi, edi
jbe 0x4858ff
movzx ebx, byte [edx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x666a80]
inc edx
sub edi, 1
jne 0x4858e4
shr ecx, 3
test ecx, ecx
jbe 0x4859aa
mov edi, ecx
push ebp
lea ecx, [ecx]
xor eax, dword [edx]
movzx ebp, byte [edx + 5]
mov ecx, eax
shr ecx, 0x10
mov esi, ecx
shr esi, 8
and esi, 0xff
mov esi, dword [esi*4 + 0x667a80]
mov ebx, eax
shr ebx, 8
and ebx, 0xff
xor esi, dword [ebx*4 + 0x668280]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x667e80]
and eax, 0xff
xor esi, dword [eax*4 + 0x668680]
add edx, 4
mov eax, esi
mov esi, dword [edx]
mov ecx, esi
shr ecx, 0x10
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x666a80]
xor ebx, dword [ebp*4 + 0x667280]
and esi, 0xff
xor ebx, dword [esi*4 + 0x667680]
and ecx, 0xff
xor ebx, dword [ecx*4 + 0x666e80]
add edx, 4
xor eax, ebx
sub edi, 1
jne 0x485910
mov esi, dword [esp + 0x18]
pop ebp
test esi, esi
jbe 0x4859cb
mov ecx, esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x666a80]
inc edx
sub ecx, 1
jne 0x4859b0
pop edi
pop esi
pop ebx
ret

Function at 0x4859d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
cmp esi, 4
jae 0x485a0e
mov eax, dword [esp + 8]
xor ecx, ecx
test esi, esi
jbe 0x485a36
mov edx, dword [esp + 0xc]
push edi
lea esp, [esp]
movzx edi, byte [ecx + edx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x668a80]
inc ecx
cmp ecx, esi
jb 0x4859f0
pop edi
pop esi
ret
test esi, esi
jne 0x485a18
mov eax, dword [esp + 8]
pop esi
ret
mov edx, dword [esp + 0xc]
mov eax, edx
and eax, 3
mov ecx, 4
sub ecx, eax
mov eax, dword [esp + 8]
push ecx
push esi
call fcn.004858c0
add esp, 8
pop esi
ret
Function at 0x493660
Capabilities:
Create thread

Disassembly:
cmp dword [0x69f294], 0
jne 0x4936df
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x69f258
call esi
push 0x69f240
call esi
push 0
push 0
push 0x4935c0
push 0x464e10
push 0x1000
push 0
mov dword [0x69f298], 0
mov dword [0x69f29c], 0x69f298
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x69f294], eax
pop esi
test eax, eax
jne 0x4936d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4936d5
mov eax, dword [0x69f864]
test eax, eax
je 0x4936df
push str.ERROR:_Creating_sctp_iterator_thread_failed._n
call eax
add esp, 4
ret
mov dword [0x69f858], 1
ret
Function at 0x4942e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
mov byte [ecx], 0
movzx edx, word [esi]
sub edx, 2
push edi
mov edi, dword [esp + 0x10]
je 0x49436c
sub edx, 0x15
jne 0x494375
mov byte [ecx + 1], 2
cmp edi, 0x14
jb 0x494375
cmp ebx, 0x1c
jl 0x494375
mov dx, word [esi + 2]
xor dx, word [eax]
lea edi, [esi + 8]
mov word [ecx + 2], dx
push ebp
lea esi, [edi + 2]
add ecx, 5
sub edi, eax
mov ebp, 4
lea esp, [esp]
movzx edx, byte [edi + eax]
xor dl, byte [eax]
add eax, 4
mov byte [ecx - 1], dl
movzx edx, byte [eax - 3]
xor dl, byte [esi - 1]
add ecx, 4
mov byte [ecx - 4], dl
movzx edx, byte [eax - 2]
xor dl, byte [esi]
add esi, 4
mov byte [ecx - 3], dl
movzx edx, byte [eax - 1]
xor dl, byte [esi - 3]
sub ebp, 1
mov byte [ecx - 2], dl
jne 0x494330
lea eax, [ebp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
ret
mov byte [ecx + 1], 1
cmp edi, 8
jae 0x49437c
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
cmp ebx, 0x10
jl 0x494375
mov dx, word [esi + 2]
xor dx, word [eax]
pop edi
mov word [ecx + 2], dx
movzx edx, byte [eax]
xor dl, byte [esi + 4]
mov byte [ecx + 4], dl
movzx edx, byte [esi + 5]
xor dl, byte [eax + 1]
mov byte [ecx + 5], dl
movzx edx, byte [esi + 6]
xor dl, byte [eax + 2]
mov byte [ecx + 6], dl
movzx edx, byte [esi + 7]
xor dl, byte [eax + 3]
pop esi
mov byte [ecx + 7], dl
mov eax, 8
pop ebx
ret

Function at 0x494dc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
cmp esi, 4
jae 0x494dd5
pop edi
or eax, 0xffffffff
pop esi
ret
movzx eax, byte [edx + 1]
sub eax, 1
push ebx
je 0x494e59
sub eax, 1
je 0x494dea
pop ebx
pop edi
mov eax, esi
pop esi
ret
mov eax, 0x14
cmp esi, eax
jb 0x494e62
mov esi, 0x17
mov word [ecx], si
mov dword [ecx + 0x80], 0x1c
mov si, word [edx + 2]
xor si, word [edi]
add ecx, 8
mov word [ecx - 6], si
push ebp
lea esi, [edi + 2]
add edx, 5
sub edi, ecx
lea ebp, [eax - 0x10]
nop
movzx ebx, byte [edi + ecx]
xor bl, byte [edx - 1]
add ecx, 4
mov byte [ecx - 4], bl
movzx ebx, byte [esi - 1]
xor bl, byte [edx]
add edx, 4
mov byte [ecx - 3], bl
movzx ebx, byte [edx - 3]
xor bl, byte [esi]
add esi, 4
mov byte [ecx - 2], bl
movzx ebx, byte [edx - 2]
xor bl, byte [esi - 3]
sub ebp, 1
mov byte [ecx - 1], bl
jne 0x494e20
pop ebp
pop ebx
pop edi
pop esi
ret
mov eax, 8
cmp esi, eax
jae 0x494e69
pop ebx
pop edi
or eax, 0xffffffff
pop esi
ret
mov dword [ecx + 0x80], 0x10
mov esi, 2
mov word [ecx], si
mov si, word [edx + 2]
xor si, word [edi]
mov word [ecx + 2], si
movzx ebx, byte [edx + 4]
xor bl, byte [edi]
mov byte [ecx + 4], bl
movzx ebx, byte [edx + 5]
xor bl, byte [edi + 1]
mov byte [ecx + 5], bl
movzx ebx, byte [edx + 6]
xor bl, byte [edi + 2]
mov byte [ecx + 6], bl
mov dl, byte [edx + 7]
xor dl, byte [edi + 3]
pop ebx
pop edi
mov byte [ecx + 7], dl
pop esi
ret
Function at 0x496440
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x69db88], 0
jne 0x496467
xor edx, edx
jmp 0x496450
mov eax, edx
call fcn.004963c0
mov dword [edx*4 + 0x69db88], eax
inc edx
cmp edx, 0x100
jb 0x496450
mov edx, dword [esp + 4]
or eax, 0xffffffff
test ecx, ecx
je 0x49648e
push esi
push edi
movzx esi, byte [edx]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x69db88]
dec ecx
inc edx
test ecx, ecx
jne 0x496474
pop edi
pop esi
not eax
ret

Function at 0x496d70
Capabilities:
Hash data using sha1

Disassembly:
movzx eax, ax
sub eax, 1
jne 0x496da6
push 0x60
push eax
push esi
call fcn.005bfd50
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
ret

Function at 0x496dd0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x18c
mov eax, dword [0x698b9c]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x194]
push ebp
mov ebp, dword [esp + 0x19c]
push esi
mov esi, ecx
push edi
test esi, esi
je 0x496f38
test ebx, ebx
je 0x496f38
test ebp, ebp
je 0x496f38
mov eax, 1
call fcn.00496d50
mov edi, eax
test edi, edi
je 0x496f38
push 0x40
lea eax, [esp + 0x74]
push 0
push eax
call fcn.005bfd50
push 0x40
lea ecx, [esp + 0x100]
push 0
push ecx
call fcn.005bfd50
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [esp + 0x88], edx
mov edx, dword [esi + 0xc]
mov dword [esp + 0x8c], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x90], ecx
mov ecx, dword [esi]
mov dword [esp + 0x94], edx
mov edx, dword [esi + 4]
mov dword [esp + 0x98], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x108], ecx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x10c], edx
mov edx, dword [esi + 0x10]
add esp, 0x18
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfc], ecx
mov dword [esp + 0x100], edx
xor eax, eax
lea ebx, [ebx]
xor byte [esp + eax + 0x70], 0x36
xor byte [esp + eax + 0xf0], 0x5c
inc eax
cmp eax, 0x40
jb 0x496eb0
lea esi, [esp + 0x10]
mov eax, 1
call fcn.00496d70
push 0x40
lea eax, [esp + 0x74]
push eax
mov ecx, esi
push ecx
call fcn.0040eb00
push 4
mov edx, esi
push ebx
push edx
call fcn.0040eb00
mov eax, esi
push eax
lea ecx, [esp + 0x190]
push ecx
call fcn.0040ebe0
mov eax, 1
call fcn.00496d70
push 0x40
lea edx, [esp + 0x114]
push edx
mov eax, esi
push eax
call fcn.0040eb00
push edi
lea ecx, [esp + 0x1a4]
push ecx
mov edx, esi
push edx
call fcn.0040eb00
mov eax, esi
push eax
push ebp
call fcn.0040ebe0
add esp, 0x40
mov eax, edi
jmp 0x496f3a
xor eax, eax
mov ecx, dword [esp + 0x194]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005bfcb8
add esp, 0x18c
ret
Function at 0x496f60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x190
mov eax, dword [0x698b9c]
xor eax, esp
mov dword [esp + 0x18c], eax
mov eax, dword [esp + 0x19c]
push ebx
mov ebx, dword [esp + 0x1a4]
push ebp
mov ebp, dword [esp + 0x1a0]
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
test edi, edi
je 0x497131
test ebp, ebp
je 0x497131
test eax, eax
je 0x497131
test ecx, ecx
je 0x497131
mov eax, dword [esp + 0x1a4]
movzx ecx, ax
sub ecx, 1
jne 0x497131
cmp ebp, 0x40
jbe 0x497006
lea esi, [esp + 0x18]
call fcn.00496d70
mov eax, esi
push ebp
push eax
mov eax, dword [esp + 0x1ac]
mov ecx, edi
call fcn.00496db0
mov ecx, esi
push ecx
lea edx, [esp + 0x84]
push edx
call fcn.0040ebe0
add esp, 0x10
mov ebp, 0x14
lea edi, [esp + 0x78]
push 0x40
lea eax, [esp + 0x9c]
push 0
push eax
call fcn.005bfd50
push 0x40
lea ecx, [esp + 0x128]
push 0
push ecx
call fcn.005bfd50
push ebp
lea edx, [esp + 0xb4]
push edi
push edx
call fcn.005bfdd0
push ebp
lea eax, [esp + 0x140]
push edi
push eax
call fcn.005bfdd0
add esp, 0x30
xor eax, eax
jmp 0x497050
xor byte [esp + eax + 0x98], 0x36
xor byte [esp + eax + 0x118], 0x5c
inc eax
cmp eax, 0x40
jb 0x497050
mov edi, dword [esp + 0x1a4]
lea esi, [esp + 0x18]
mov eax, edi
call fcn.00496d70
push 0x40
lea ecx, [esp + 0x9c]
push ecx
mov edx, esi
push edx
call fcn.0040eb00
mov esi, dword [esp + 0x20]
add esp, 0xc
mov eax, dword [esi + 0xc]
cmp ebx, eax
jb 0x4970a2
mov esi, dword [esi]
sub ebx, eax
test esi, esi
jne 0x497091
jmp 0x4970dc
cmp dword [esi], 0
jne 0x4970bb
mov eax, dword [esp + 0x1b4]
test eax, eax
je 0x4970bb
mov ecx, dword [esi + 0xc]
sub ecx, ebx
sub ecx, eax
jmp 0x4970c0
mov ecx, dword [esi + 0xc]
sub ecx, ebx
mov edx, dword [esi + 8]
push ecx
add edx, ebx
push edx
lea eax, [esp + 0x20]
push eax
call fcn.0040eb00
mov esi, dword [esi]
add esp, 0xc
xor ebx, ebx
test esi, esi
jne 0x4970a2
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x7c]
push edx
call fcn.0040ebe0
lea esi, [esp + 0x20]
mov eax, edi
call fcn.00496d70
push 0x40
lea eax, [esp + 0x124]
push eax
mov ecx, esi
push ecx
call fcn.0040eb00
push 0x14
lea edx, [esp + 0x90]
push edx
mov eax, esi
push eax
call fcn.0040eb00
mov edx, dword [esp + 0x30]
mov ecx, esi
push ecx
push edx
call fcn.0040ebe0
add esp, 0x28
mov eax, 0x14
jmp 0x497133
xor eax, eax
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005bfcb8
add esp, 0x190
ret

Function at 0x4abdd0
Capabilities:
Encode data using xor

Disassembly:
test byte [eax + 0x10], 4
mov ecx, dword [eax + 4]
push esi
lea esi, [ecx - 1]
je 0x4abde3
pop esi
jmp fcn.004abd40
test ecx, ecx
jne 0x4abdeb
xor eax, eax
pop esi
ret
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
call fcn.004abcb0
shl esi, 5
add eax, esi
pop esi
ret
Function at 0x4af2a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x3c]
push esi
push edi
mov ecx, ebp
mov edi, 1
shl edi, cl
mov ecx, dword [esp + 0x38]
cmp ecx, dword [eax + 8]
mov dword [esp + 0x44], ebx
jle 0x4af2d4
push ecx
mov esi, eax
call fcn.004abf60
add esp, 4
test eax, eax
jne 0x4af2e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
cmp ebp, 3
jg 0x4af345
xor esi, esi
cmp dword [esp + 0x38], esi
jle 0x4af4a0
xor edx, edx
xor ecx, ecx
test edi, edi
jle 0x4af327
lea esp, [esp]
mov eax, ecx
xor eax, dword [esp + 0x40]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [ebx + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, edi
jl 0x4af300
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
mov dword [eax + esi*4], edx
lea eax, [edi*4]
inc esi
add ebx, eax
cmp esi, dword [esp + 0x38]
jl 0x4af2f1
jmp 0x4af4a0
mov edx, dword [esp + 0x40]
lea ecx, [ebp - 2]
mov eax, edx
sar eax, cl
mov ebx, 1
shl ebx, cl
lea esi, [eax - 1]
shr esi, 0x1f
lea ecx, [ebx - 1]
and edx, ecx
mov dword [esp + 0x40], edx
mov edx, eax
not edx
shr edx, 0x1f
and esi, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg esi
neg edx
neg ebp
neg ecx
and esi, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg esi
cmp dword [esp + 0x38], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
jle 0x4af4a0
lea edx, [edi*4]
mov dword [esp + 0x2c], edx
xor edi, edi
cmp ebx, edi
mov dword [esp + 0x18], edi
jle 0x4af47c
mov eax, dword [esp + 0x44]
lea edx, [eax + ebx*4]
mov dword [esp + 0x14], edx
lea edx, [eax + ebx*8]
mov dword [esp + 0x10], edx
lea edx, [ebx + ebx*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x3c], eax
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
or edx, ecx
mov eax, edi
xor eax, dword [esp + 0x40]
inc edi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x44]
mov eax, dword [eax + edi*4 - 4]
neg ecx
and ecx, 1
and eax, esi
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x20]
mov eax, 4
add dword [esp + 0x3c], eax
add dword [esp + 0x10], eax
add dword [esp + 0x14], eax
cmp edi, ebx
jl 0x4af410
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x34]
mov edx, dword [edx]
mov edi, dword [esp + 0x18]
mov dword [edx + eax*4], edi
mov edx, dword [esp + 0x2c]
add dword [esp + 0x44], edx
inc eax
cmp eax, dword [esp + 0x38]
mov dword [esp + 0x24], eax
jl 0x4af3e6
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, 1
pop ebx
add esp, 0x20
ret
Function at 0x4b1ff0
Capabilities:
Lock the desktop

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x606e90
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x698b9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0xc], 2
jne 0x4b207c
push str.__dlg_scut__nscreen_.active_.click___set_status_Remote_has_cancelled_blank_screen__1_
push 0x25
lea ecx, [ebp - 0x10]
call fcn.004b25f0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
call fcn.004efe20
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x24]
push edx
mov ecx, dword [0x69c0a0]
call fcn.004b2530
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004b2620
mov ecx, dword [0x69c0a0]
call fcn.004b25d0
test eax, eax
je 0x4b207c
call dword [sym.imp.USER32.dll_LockWorkStation]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b8f10
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x698b9c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.004b8c60
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004b8ea0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4b8f7b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.004b8c90
mov eax, dword [ebp - 0x224]
jmp 0x4b900c
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4b8fe1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004b8f10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4b8fd8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.004b8c90
mov eax, dword [ebp - 0x228]
jmp 0x4b900c
mov dword [ebp - 4], pe_nt_image_headers32
jmp 0x4b8f82
lea ecx, [ebp - 0x14]
call fcn.004b8dd0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.004b8d10
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.004b8c90
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005bfcb8
mov esp, ebp
pop ebp
ret 4
Function at 0x4b9600
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x4b9609
xor ecx, ecx
jne 0x4b9609
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x4b962a
mov eax, 0xd
jmp 0x4b9685
xor eax, eax
jne 0x4b9611
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x4b963b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8