joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f0dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49f33c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x49f13f
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0049eba4
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040dd4c
cmp al, 1
jne 0x49f13f
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0049eebc
test al, al
je 0x49f2cb
cmp dword [ebp - 8], 0
jge 0x49f15d
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0049eba4
mov eax, dword [ebp - 0x210]
call fcn.00405218
cmp ebx, eax
jge 0x49f1a7
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0049eba4
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4c1288]
and eax, 0xff
bt dword [edx], eax
jae 0x49f1a7
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x49f1bb
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049f0b8
cmp ebx, dword [ebp - 8]
je 0x49f2bd
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x49f1e7
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404394
and eax, 0x7f
movzx eax, word [eax*2 + 0x4c0cdc]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x49f2aa
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404394
and eax, 0x7f
movzx eax, word [eax*2 + 0x4c0cdc]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004660f4
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404394
and eax, 0x7f
movzx eax, word [eax*2 + 0x4c0cdc]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004660f4
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f2b1
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x49f31e
cmp dword [ebp - 8], 0
jge 0x49f2d6
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0049eba4
mov eax, dword [ebp - 0x218]
call fcn.00405218
cmp eax, dword [ebp - 8]
jg 0x49f310
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0049eba4
mov eax, dword [ebp - 0x21c]
call fcn.00405218
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0049f0b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f343
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404f7c
ret
Function at 0x4bbf0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4bbf14
push ecx
push ebx
push esi
mov esi, edx
xor eax, eax
push ebp
push 0x4bc156
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00404f58
mov eax, dword [0x4c3584]
call fcn.0040626c
cmp eax, 5
jle 0x4bc0fd
mov eax, dword [0x4c3584]
cmp byte [eax], 0xf1
jne 0x4bbf6a
mov eax, dword [0x4c3584]
call fcn.0040626c
mov edx, dword [0x4c3584]
cmp byte [edx + eax - 1], 0xf2
je 0x4bbf82
lea edx, [ebp - 8]
mov eax, 0x4bc168
call fcn.004821b0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.004051e0
xor ebx, ebx
mov eax, dword [0x4c3584]
call fcn.0040626c
sub eax, 3
test eax, eax
jle 0x4bbfaa
mov edx, 1
mov ecx, dword [0x4c3584]
movzx ecx, byte [ecx + edx]
xor ebx, ecx
inc edx
dec eax
jne 0x4bbf9a
mov eax, dword [0x4c3584]
call fcn.0040626c
mov edx, dword [0x4c3584]
movzx eax, byte [edx + eax - 2]
cmp ebx, eax
je 0x4bbff3
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004057ec
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, 0x4bc18c
call fcn.004821b0
mov edx, dword [ebp - 0x10]
pop eax
call fcn.00405818
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004051e0
mov eax, dword [0x4c3584]
cmp byte [eax + 3], 2
jne 0x4bc115
mov eax, dword [0x4c3584]
cmp byte [eax + 4], 0x45
jne 0x4bc115
mov eax, dword [0x4c3584]
mov al, byte [eax + 5]
dec al
je 0x4bc032
dec al
je 0x4bc067
dec al
je 0x4bc099
dec al
je 0x4bc0cb
jmp 0x4bc115
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.004057ec
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, 0x4bc1c0
call fcn.004821b0
mov edx, dword [ebp - 0x18]
pop eax
call fcn.00405818
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.004051e0
jmp 0x4bc115
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
call fcn.004057ec
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, 0x4bc18c
call fcn.004821b0
mov edx, dword [ebp - 0x20]
pop eax
call fcn.00405818
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.004051e0
jmp 0x4bc115
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 4]
call fcn.004057ec
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x4bc1e0
call fcn.004821b0
mov edx, dword [ebp - 0x28]
pop eax
call fcn.00405818
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.004051e0
jmp 0x4bc115
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
call fcn.004057ec
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, 0x4bc20c
call fcn.004821b0
mov edx, dword [ebp - 0x30]
pop eax
call fcn.00405818
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.004051e0
jmp 0x4bc115
lea edx, [ebp - 0x34]
mov eax, 0x4bc168
call fcn.004821b0
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.004051e0
cmp dword [ebp - 4], 0
jne 0x4bc129
mov eax, esi
mov edx, 0x4bc238
call fcn.00404fac
jmp 0x4bc133
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404fac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc15d
lea eax, [ebp - 0x34]
mov edx, 0xc
call fcn.004056b8
lea eax, [ebp - 4]
call fcn.00404f58
ret
Function at 0x4bc35c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea esi, [ebp - 0xe]
xor eax, eax
push ebp
push 0x4bc5aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffff
mov byte [esi], 0xf1
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x300]
mov byte [esi + 1], al
mov byte [esi + 2], 0x93
mov byte [esi + 3], 0
mov byte [esi + 4], 0
mov ebx, 3
lea eax, [esi + 1]
mov dl, byte [eax]
xor byte [esi + 4], dl
inc eax
dec ebx
jne 0x4bc3b6
mov byte [esi + 5], 0xf2
mov eax, dword [0x4c3578]
mov edx, dword [eax + 0x304]
mov eax, dword [0x4c3578]
call fcn.004bba34
mov edx, esi
mov ecx, 5
mov eax, dword [0x4c3578]
call fcn.004bbb10
mov edx, 6
mov eax, dword [0x4c3578]
call fcn.004bbc9c
mov eax, dword [0x4c3584]
call fcn.0040626c
cmp eax, 4
jle 0x4bc438
mov eax, dword [0x4c3584]
movzx esi, byte [eax + 5]
shl esi, 8
mov eax, dword [0x4c3584]
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [0x4c3584]
xor edx, edx
mov dl, byte [eax + 3]
imul edx, esi
add edx, 2
mov eax, dword [0x4c3578]
call fcn.004bbc9c
mov eax, dword [0x4c3578]
call fcn.004bbb04
mov edx, 0x4c3580
mov eax, dword [0x4c3578]
call fcn.004bbf0c
mov eax, dword [0x4c3580]
mov edx, 0x4bc5c0
call fcn.00405364
jne 0x4bc56f
mov eax, dword [0x4c3584]
movzx esi, byte [eax + 5]
shl esi, 8
mov eax, dword [0x4c3584]
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 8]
mov dword [eax], esi
test esi, esi
jle 0x4bc555
mov eax, dword [0x4c3584]
movzx edi, byte [eax + 3]
imul edi, esi
dec edi
test edi, edi
jl 0x4bc4d1
inc edi
xor ebx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0040626c
inc eax
push eax
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x4bc33c]
call fcn.00406448
add esp, 4
mov eax, dword [0x4c3584]
mov al, byte [eax + ebx + 6]
mov edx, dword [ebp - 0x14]
mov byte [edx + ebx], al
inc ebx
dec edi
jne 0x4bc49e
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x300]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00406274
mov edx, eax
mov ecx, esi
mov eax, dword [ebp - 0x14]
call fcn.004858e0
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x300]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00406274
mov edx, eax
mov ecx, esi
mov eax, dword [ebp - 0x14]
call fcn.004837ec
test al, al
je 0x4bc539
push 0x4bc5c0
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00409788
push dword [ebp - 0x18]
push 0x4bc5d0
mov eax, 0x4c3580
mov edx, 3
call fcn.004052d8
jmp 0x4bc56f
lea edx, [ebp - 0x1c]
mov eax, 0x4bc5ec
call fcn.004821b0
mov edx, dword [ebp - 0x1c]
mov eax, 0x4c3580
call fcn.004051e0
jmp 0x4bc56f
lea edx, [ebp - 0x20]
mov eax, 0x4bc608
call fcn.004821b0
mov edx, dword [ebp - 0x20]
mov eax, 0x4c3580
call fcn.004051e0
mov eax, dword [0x4c3578]
call fcn.004bc240
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc5b1
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004056b8
lea eax, [ebp - 0x18]
call fcn.00404f58
lea eax, [ebp - 0x14]
mov edx, dword [0x4bc33c]
call fcn.00406454
ret
Function at 0x4bc630
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, eax
mov esi, 0x4c3578
mov edi, esp
mov byte [edi], 0xf1
mov al, byte [ebx + 0x300]
mov byte [edi + 1], al
mov byte [edi + 2], 0x90
mov byte [edi + 3], 0
mov byte [edi + 4], 0
mov edx, 3
lea eax, [edi + 1]
mov cl, byte [eax]
xor byte [edi + 4], cl
inc eax
dec edx
jne 0x4bc65f
mov byte [edi + 5], 0xf2
mov eax, dword [esi]
mov edx, dword [eax + 0x304]
mov eax, dword [esi]
call fcn.004bba34
mov edx, edi
mov ecx, 5
mov eax, dword [esi]
call fcn.004bbb10
mov edx, 0x14
mov eax, dword [esi]
call fcn.004bbc9c
mov eax, dword [esi]
call fcn.004bbb04
mov edx, 0x4c3580
mov eax, dword [esi]
call fcn.004bbf0c
mov eax, dword [0x4c3580]
mov edx, 0x4bc7e0
call fcn.00405364
jne 0x4bc7ca
lea eax, [ebx + 0xa18]
mov edx, dword [0x4c3584]
mov dl, byte [edx + 4]
mov byte [eax], dl
mov edx, dword [0x4c3584]
mov dl, byte [edx + 5]
mov byte [eax + 1], dl
mov edx, dword [0x4c3584]
mov dl, byte [edx + 6]
mov byte [eax + 2], dl
mov edx, dword [0x4c3584]
mov dl, byte [edx + 7]
mov byte [eax + 3], dl
mov edx, dword [0x4c3584]
mov dl, byte [edx + 8]
mov byte [eax + 4], dl
mov edx, 0xa
cmp byte [eax + 0xd], 0
jne 0x4bc719
mov ecx, dword [0x4c3584]
cmp byte [ecx + edx], 0
ja 0x4bc719
xor ecx, ecx
jmp 0x4bc71b
mov cl, 1
mov byte [eax + 0xd], cl
inc edx
cmp edx, 0x12
jne 0x4bc703
mov byte [eax + 5], 0
mov byte [eax + 6], 0
mov byte [eax + 7], 0
mov byte [eax + 8], 0
mov byte [eax + 9], 0
mov byte [eax + 0xa], 0
mov byte [eax + 0xb], 0
mov byte [eax + 0xc], 0
cmp byte [eax + 0xd], 0
je 0x4bc7aa
mov edx, dword [0x4c3584]
mov dl, byte [edx + 0xa]
mov byte [eax + 5], dl
mov edx, dword [0x4c3584]
mov dl, byte [edx + 0xb]
mov byte [eax + 6], dl
mov edx, dword [0x4c3584]
mov dl, byte [edx + 0xc]
mov byte [eax + 7], dl
mov edx, dword [0x4c3584]
mov dl, byte [edx + 0xd]
mov byte [eax + 8], dl
mov edx, dword [0x4c3584]
mov dl, byte [edx + 0xe]
mov byte [eax + 9], dl
mov edx, dword [0x4c3584]
mov dl, byte [edx + 0xf]
mov byte [eax + 0xa], dl
mov edx, dword [0x4c3584]
mov dl, byte [edx + 0x10]
mov byte [eax + 0xb], dl
mov edx, dword [0x4c3584]
mov dl, byte [edx + 0x11]
mov byte [eax + 0xc], dl
mov eax, dword [0x4c0f7c]
cmp byte [eax], 3
je 0x4bc7bd
mov eax, ebx
call fcn.004bde10
jmp 0x4bc7ca
mov edx, dword [ebx + 0x300]
mov eax, ebx
call fcn.004bd9bc
mov eax, dword [esi]
call fcn.004bc240
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4bc7e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4bc7f0
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bc9a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x14
lea edx, [ebp - 0x1c]
mov byte [edx], 0
inc edx
dec eax
jne 0x4bc813
mov byte [ebp - 0x1c], 0xf1
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x300]
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], 0x80
mov byte [ebp - 0x19], 0xe
mov eax, dword [ebp - 4]
lea esi, [eax + 0xa18]
mov bl, byte [esi]
mov byte [ebp - 0x18], bl
mov al, byte [esi + 1]
mov byte [ebp - 0x17], al
mov al, byte [esi + 2]
mov byte [ebp - 0x16], al
mov al, byte [esi + 3]
mov byte [ebp - 0x15], al
mov al, byte [esi + 4]
mov byte [ebp - 0x14], al
lea edx, [ebp - 0x24]
xor eax, eax
mov al, bl
call fcn.00409788
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x20]
mov edx, 2
call fcn.00485d28
push dword [ebp - 0x20]
push 0x4bc9b8
lea edx, [ebp - 0x2c]
xor eax, eax
mov al, byte [esi + 1]
call fcn.00409788
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
mov edx, 2
call fcn.00485d28
push dword [ebp - 0x28]
push 0x4bc9b8
lea edx, [ebp - 0x34]
xor eax, eax
mov al, byte [esi + 2]
call fcn.00409788
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
mov edx, 2
call fcn.00485d28
push dword [ebp - 0x30]
lea eax, [ebp - 8]
mov edx, 5
call fcn.004052d8
mov eax, dword [ebp - 8]
call fcn.0040c998
add esp, 0xfffffff8
fstp qword [esp]
wait
call fcn.0040b434
dec eax
mov byte [ebp - 0x13], al
cmp byte [esi + 0xd], 0
je 0x4bc91c
mov al, byte [esi + 5]
mov byte [ebp - 0x12], al
mov al, byte [esi + 6]
mov byte [ebp - 0x11], al
mov al, byte [esi + 7]
mov byte [ebp - 0x10], al
mov al, byte [esi + 8]
mov byte [ebp - 0xf], al
mov al, byte [esi + 9]
mov byte [ebp - 0xe], al
mov al, byte [esi + 0xa]
mov byte [ebp - 0xd], al
mov al, byte [esi + 0xb]
mov byte [ebp - 0xc], al
mov al, byte [esi + 0xc]
mov byte [ebp - 0xb], al
mov byte [ebp - 0xa], 0
mov eax, 0x11
lea edx, [ebp - 0x1b]
mov cl, byte [edx]
xor byte [ebp - 0xa], cl
inc edx
dec eax
jne 0x4bc928
mov byte [ebp - 9], 0xf2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x304]
mov eax, dword [ebp - 4]
call fcn.004bba34
lea edx, [ebp - 0x1c]
mov ecx, 0x13
mov eax, dword [ebp - 4]
call fcn.004bbb10
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.004bbc9c
mov eax, dword [ebp - 4]
call fcn.004bbb04
mov edx, 0x4c3580
mov eax, dword [ebp - 4]
call fcn.004bbf0c
mov eax, dword [ebp - 4]
call fcn.004bc240
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc9aa
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.00404f7c
lea eax, [ebp - 8]
call fcn.00404f58
ret
Function at 0x4bc9bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bcbb0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x4c3580]
mov edx, 0x4bcbc8
call fcn.00405364
je 0x4bca1e
lea eax, [ebp - 0x28]
mov edx, dword [0x4c3580]
call fcn.004057ec
mov eax, dword [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, 0x4bcbd4
call fcn.004821b0
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00405928
jne 0x4bcb45
mov byte [ebp - 0x24], 0xf1
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x300]
mov byte [ebp - 0x23], al
mov byte [ebp - 0x22], 0x91
mov byte [ebp - 0x21], 0x1a
mov byte [ebp - 0x20], bl
mov eax, 0x19
lea edx, [ebp - 0x1f]
mov byte [edx], 0
inc edx
dec eax
jne 0x4bca41
mov byte [ebp - 6], 0
mov eax, 0x1d
lea edx, [ebp - 0x23]
mov cl, byte [edx]
xor byte [ebp - 6], cl
inc edx
dec eax
jne 0x4bca54
mov byte [ebp - 5], 0xf2
mov eax, dword [0x4c3578]
mov edx, dword [eax + 0x304]
mov eax, dword [0x4c3578]
call fcn.004bba34
lea edx, [ebp - 0x24]
mov ecx, 0x1f
mov eax, dword [0x4c3578]
call fcn.004bbb10
mov edx, 0x20
mov eax, dword [0x4c3578]
call fcn.004bbc9c
mov eax, dword [0x4c3578]
call fcn.004bbb04
push 0xc8
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4c10a8]
mov eax, dword [eax]
call fcn.0047f668
mov edx, 0x4c3580
mov eax, dword [0x4c3578]
call fcn.004bbf0c
mov eax, dword [0x4c3580]
mov edx, 0x4bcbc8
call fcn.00405364
jne 0x4bcb3b
xor eax, eax
lea edx, [ebx + ebx*4]
add edx, eax
lea edx, [edx + edx*4]
mov ecx, dword [ebp - 4]
lea ecx, [ecx + edx*4 + 0x310]
lea edx, [eax + eax*4]
add edx, 5
mov esi, dword [0x4c3584]
movzx esi, byte [esi + edx]
mov dword [ecx + 0x10], esi
mov esi, dword [0x4c3584]
movzx esi, byte [esi + edx + 1]
mov dword [ecx], esi
mov esi, dword [0x4c3584]
movzx esi, byte [esi + edx + 2]
mov dword [ecx + 4], esi
mov esi, dword [0x4c3584]
movzx esi, byte [esi + edx + 3]
mov dword [ecx + 8], esi
mov esi, dword [0x4c3584]
movzx edx, byte [esi + edx + 4]
mov dword [ecx + 0xc], edx
inc eax
cmp eax, 5
jne 0x4bcad9
mov eax, dword [0x4c3578]
call fcn.004bc240
inc ebx
cmp ebx, 0xa
jne 0x4bc9df
mov eax, dword [0x4c3580]
mov edx, 0x4bcbc8
call fcn.00405364
jne 0x4bcb84
mov eax, dword [0x4c0f7c]
cmp byte [eax], 3
je 0x4bcb84
mov eax, dword [0x4c0f90]
mov eax, dword [eax]
call fcn.004b40f8
mov eax, dword [0x4c0f90]
mov eax, dword [eax]
call fcn.004b3894
jmp 0x4bcb95
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x300]
mov eax, dword [ebp - 4]
call fcn.004be050
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcbb7
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004056b8
ret
Function at 0x4bcbf4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bcd9e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [0x4c3580]
mov edx, 0x4bcdb4
call fcn.00405364
je 0x4bcc58
lea eax, [ebp - 0x2c]
mov edx, dword [0x4c3580]
call fcn.004057ec
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x30]
mov eax, 0x4bcdc0
call fcn.004821b0
mov edx, dword [ebp - 0x30]
pop eax
call fcn.00405928
jne 0x4bcd43
mov byte [ebp - 0x28], 0xf1
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x300]
mov byte [ebp - 0x27], al
mov byte [ebp - 0x26], 0x81
mov byte [ebp - 0x25], 0x1a
mov al, byte [ebp - 8]
mov byte [ebp - 0x24], al
xor eax, eax
mov edx, dword [ebp - 8]
lea edx, [edx + edx*4]
add edx, eax
lea edx, [edx + edx*4]
mov ecx, dword [ebp - 4]
lea ecx, [ecx + edx*4 + 0x310]
lea edx, [eax + eax*4]
add edx, 5
mov bl, byte [ecx + 0x10]
mov byte [ebp + edx - 0x28], bl
mov bl, byte [ecx]
mov byte [ebp + edx - 0x27], bl
mov bl, byte [ecx + 4]
mov byte [ebp + edx - 0x26], bl
mov bl, byte [ecx + 8]
mov byte [ebp + edx - 0x25], bl
mov cl, byte [ecx + 0xc]
mov byte [ebp + edx - 0x24], cl
inc eax
cmp eax, 5
jne 0x4bcc78
mov byte [ebp - 0xa], 0
mov eax, 0x1d
lea edx, [ebp - 0x27]
mov cl, byte [edx]
xor byte [ebp - 0xa], cl
inc edx
dec eax
jne 0x4bccc7
mov byte [ebp - 9], 0xf2
mov eax, dword [0x4c3578]
mov edx, dword [eax + 0x304]
mov eax, dword [0x4c3578]
call fcn.004bba34
lea edx, [ebp - 0x28]
mov ecx, 0x1f
mov eax, dword [0x4c3578]
call fcn.004bbb10
mov edx, 6
mov eax, dword [0x4c3578]
call fcn.004bbc9c
mov eax, dword [0x4c3578]
call fcn.004bbb04
push 0xc8
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4c10a8]
mov eax, dword [eax]
call fcn.0047f668
mov edx, 0x4c3580
mov eax, dword [0x4c3578]
call fcn.004bbf0c
mov eax, dword [0x4c3578]
call fcn.004bc240
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xa
jne 0x4bcc19
mov eax, dword [0x4c3580]
mov edx, 0x4bcdb4
call fcn.00405364
jne 0x4bcd83
mov eax, dword [0x4c0f7c]
cmp byte [eax], 3
je 0x4bcd83
mov eax, dword [0x4c0f90]
mov eax, dword [eax]
call fcn.004b40f8
mov eax, dword [0x4c0f90]
mov eax, dword [eax]
call fcn.004b3894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcda5
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.004056b8
ret
Function at 0x4bcde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bcfc7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x4c3580]
mov edx, 0x4bcfdc
call fcn.00405364
je 0x4bce42
lea eax, [ebp - 0x24]
mov edx, dword [0x4c3580]
call fcn.004057ec
mov eax, dword [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
mov eax, 0x4bcfe8
call fcn.004821b0
mov edx, dword [ebp - 0x28]
pop eax
call fcn.00405928
jne 0x4bcf5c
mov byte [ebp - 0x1f], 0xf1
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x300]
mov byte [ebp - 0x1e], al
mov byte [ebp - 0x1d], 0x92
mov byte [ebp - 0x1c], 0x15
mov byte [ebp - 0x1b], bl
mov eax, 0x14
lea edx, [ebp - 0x1a]
mov byte [edx], 0
inc edx
dec eax
jne 0x4bce65
mov byte [ebp - 6], 0
mov eax, 0x18
lea edx, [ebp - 0x1e]
mov cl, byte [edx]
xor byte [ebp - 6], cl
inc edx
dec eax
jne 0x4bce78
mov byte [ebp - 5], 0xf2
mov eax, dword [0x4c3578]
mov edx, dword [eax + 0x304]
mov eax, dword [0x4c3578]
call fcn.004bba34
lea edx, [ebp - 0x1f]
mov ecx, 0x1a
mov eax, dword [0x4c3578]
call fcn.004bbb10
mov edx, 0x1b
mov eax, dword [0x4c3578]
call fcn.004bbc9c
mov eax, dword [0x4c3578]
call fcn.004bbb04
push 0xc8
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4c10a8]
mov eax, dword [eax]
call fcn.0047f668
mov edx, 0x4c3580
mov eax, dword [0x4c3578]
call fcn.004bbf0c
mov eax, dword [0x4c3580]
mov edx, 0x4bcfdc
call fcn.00405364
jne 0x4bcf52
xor eax, eax
lea edx, [ebx + ebx*4]
add edx, eax
add edx, edx
mov ecx, dword [ebp - 4]
lea ecx, [ecx + edx*8 + 0x6f8]
mov edx, eax
shl edx, 2
add edx, 5
mov esi, dword [0x4c3584]
movzx esi, byte [esi + edx]
mov dword [ecx + 0xc], esi
mov esi, dword [0x4c3584]
movzx esi, byte [esi + edx + 1]
mov dword [ecx], esi
mov esi, dword [0x4c3584]
movzx esi, byte [esi + edx + 2]
mov dword [ecx + 4], esi
mov esi, dword [0x4c3584]
movzx edx, byte [esi + edx + 3]
mov dword [ecx + 8], edx
inc eax
cmp eax, 5
jne 0x4bcefd
mov eax, dword [0x4c3578]
call fcn.004bc240
inc ebx
cmp ebx, 0xa
jne 0x4bce03
mov eax, dword [0x4c3580]
mov edx, 0x4bcfdc
call fcn.00405364
jne 0x4bcf9b
mov eax, dword [0x4c0f7c]
cmp byte [eax], 3
je 0x4bcf9b
mov eax, dword [0x4c1160]
mov eax, dword [eax]
call fcn.004b55e0
mov eax, dword [0x4c1160]
mov eax, dword [eax]
call fcn.004b4f80
jmp 0x4bcfac
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x300]
mov eax, dword [ebp - 4]
call fcn.004be2d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcfce
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004056b8
ret