joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fe40
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x46fe49
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x470074
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040502c
mov eax, edi
call fcn.0040502c
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, ebx
call fcn.004461cc
test al, al
je 0x470051
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x470051
mov eax, esi
call fcn.0040309c
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x47004a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
push esi
push 0
mov eax, ebx
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x470034
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x470084
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46ff7e
push 0x4700a8
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov edx, 4
call fcn.00428798
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00428798
push dword [ebp - 0x24]
push 0x4700c4
lea eax, [ebp - 4]
mov edx, 4
call fcn.004053cc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46ff7e
cmp dword [ebp - 0x10], 1
jbe 0x46ff7e
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.00429320
mov ecx, eax
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.0040511c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4700d8
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x470034
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
call fcn.004087dc
mov ebx, eax
mov eax, dword [ebp - 0x1c]
movzx esi, word [eax + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
call fcn.004087dc
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0xc]
mov word [ebp - 0x14], ax
lea edx, [ebp - 0x28]
movzx eax, bx
call fcn.00428684
push dword [ebp - 0x28]
push 0x4700e4
lea edx, [ebp - 0x2c]
movzx eax, si
call fcn.00428684
push dword [ebp - 0x2c]
push 0x4700e4
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0x12]
call fcn.00428684
push dword [ebp - 0x30]
push 0x4700e4
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x14]
call fcn.00428684
push dword [ebp - 0x34]
mov eax, edi
mov edx, 7
call fcn.004053cc
mov eax, dword [edi]
mov edx, 0x4700f0
call fcn.00405458
jne 0x470034
mov eax, edi
call fcn.0040502c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470051
mov eax, dword [ebp - 0x18]
call fcn.004030b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47007b
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.00405050
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x4702d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [edi], eax
mov eax, ebx
call fcn.0046fd98
test al, al
je 0x470325
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x470325
push esi
push ebx
call sub.kernel32.dll_SizeofResource
mov dword [edi], eax
push esi
push ebx
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x470325
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x49232c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x492332
ret
Function at 0x4a1624
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x576eb0
test edx, edx
jne 0x4a1643
xor eax, eax
jmp 0x4a1761
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4a1660
push esi
push edx
push eax
call fcn.004a1768
add esp, 0xc
jmp 0x4a1761
push esi
push edx
push eax
call fcn.004a1a28
add esp, 0xc
jmp 0x4a1761
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4a2c1c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, ecx
mov edx, dword [ebp - 8]
cmp byte [edx], 0
jne 0x4a2c6f
xor esi, esi
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov ecx, esi
mov ebx, 8
test cl, 1
je 0x4a2c52
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x4a2c54
shr ecx, 1
dec ebx
jne 0x4a2c43
mov edx, dword [ebp - 0xc]
mov dword [edx], ecx
inc esi
add dword [ebp - 0xc], 4
cmp esi, 0x100
jne 0x4a2c3c
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov edx, dword [ebp + 8]
dec edx
test edx, edx
jl 0x4a2cb4
inc edx
xor esi, esi
cmp esi, 0x7ffffffe
jbe 0x4a2c87
call fcn.00403edc
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + esi]
xor ecx, eax
and ecx, 0xff
cmp ecx, 0xff
jbe 0x4a2ca3
call fcn.00403edc
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + ecx*4]
shr eax, 8
xor ecx, eax
mov eax, ecx
inc esi
dec edx
jne 0x4a2c7a
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4a9790
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
test ebx, ebx
je 0x4a989f
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 8], eax
call fcn.004470dc
mov byte [ebp - 9], al
xor eax, eax
call fcn.00447148
xor eax, eax
push ebp
push 0x4a9898
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.004a7fb0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a987a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004a9b88
dec eax
test eax, eax
jl 0x4a9864
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004aabe0
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 8]
je 0x4a985c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004aabe0
call fcn.004aa8c0
cmp al, 1
je 0x4a985c
xor eax, eax
push ebp
push 0x4a9852
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004aabe0
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a985c
inc dword [ebp - 4]
dec dword [ebp - 0x14]
jne 0x4a97fd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9881
lea eax, [ebp - 0x10]
call fcn.0040f894
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a9900
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
test esi, esi
je 0x4a9af3
test edi, edi
je 0x4a9997
call fcn.004a7450
xor eax, eax
push ebp
push 0x4a9990
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004a9b88
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4a997d
mov edx, ebx
mov eax, esi
call fcn.004a9b98
cmp edi, dword [eax + 4]
jne 0x4a9977
lea eax, [ebp - 8]
push eax
mov edx, ebx
mov eax, esi
call fcn.004a9b98
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetExitCodeThread
test eax, eax
je 0x4a996c
cmp dword [ebp - 8], 0x103
je 0x4a9977
mov edx, ebx
mov eax, esi
call fcn.004a96e4
jmp 0x4a997d
dec ebx
cmp ebx, 0xffffffff
jne 0x4a993b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9af3
call fcn.004a7468
ret
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount
mov edx, dword [esi + 0xc]
cmp eax, edx
jbe 0x4a99c3
sub eax, edx
cmp eax, 0x3e8
jae 0x4a99c3
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004a9900
jmp 0x4a9af3
call sub.kernel32.dll_GetTickCount
mov dword [esi + 0xc], eax
xor eax, eax
call fcn.004a7fb0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a9aec
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
call fcn.004aabd8
mov edi, eax
dec edi
test edi, edi
jl 0x4a9a63
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aabe0
mov byte [eax + 0x58], 0
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aabe0
cmp dword [eax + 0xc], 0
je 0x4a9a5f
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aabe0
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 4]
je 0x4a9a5f
lea eax, [ebp - 8]
push eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aabe0
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetExitCodeThread
test eax, eax
je 0x4a9a4d
cmp dword [ebp - 8], 0x103
je 0x4a9a5f
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aabe0
mov byte [eax + 0x58], 1
mov byte [ebp - 0xd], 1
inc ebx
dec edi
jne 0x4a99f9
cmp byte [ebp - 0xd], 0
jne 0x4a9a73
call fcn.00404a30
jmp 0x4a9af3
call fcn.004a7450
xor eax, eax
push ebp
push 0x4a9acf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004a9b88
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4a9abc
mov edx, ebx
mov eax, esi
call fcn.004a9b98
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xc]
call fcn.004a98a8
test al, al
je 0x4a9ab6
mov edx, ebx
mov eax, esi
call fcn.004a96e4
dec ebx
cmp ebx, 0xffffffff
jne 0x4a9a95
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9ad6
call fcn.004a7468
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af1e8
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, edi
call fcn.004b0cb8
mov esi, ebx
test esi, esi
jne 0x4af226
push 0x4af354
push 0x4af360
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x4af226
mov edx, dword [ebp - 4]
push edx
call eax
mov esi, eax
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 8
call fcn.004038b8
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x4af348
xor eax, eax
push ebp
push 0x4af341
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
je 0x4af260
mov ebx, dword [ebp + 8]
jmp 0x4af26f
lea edx, [ebp - 8]
mov eax, 0xcc
call fcn.0040f8b0
mov ebx, eax
xor eax, eax
push ebp
push 0x4af323
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
jne 0x4af289
mov dword [ebx], 0x10007
cmp dword [ebp + 8], 0
jne 0x4af29d
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x4af307
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x90]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetThreadSelectorEntry
test eax, eax
je 0x4af307
cmp dword [ebp + 0x1c], 0
je 0x4af2c3
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
jmp 0x4af2cc
mov eax, dword [ebx + 0xb8]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004af18c
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
movzx eax, byte [ebp + 0x18]
push eax
push esi
push 1
movzx eax, byte [ebp + 0x14]
push eax
movzx eax, byte [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push ebx
mov ecx, dword [ebx + 0xb4]
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.004af0e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af32a
cmp dword [ebp + 8], 0
jne 0x4af322
mov eax, dword [ebp - 8]
call fcn.004030b8
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4b0f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
push edi
mov byte [ebp - 0x7d], cl
mov edi, edx
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x78]
mov edx, dword [0x47408c]
call fcn.00405c60
xor eax, eax
push ebp
push 0x4b0ff6
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x4b0fda
mov eax, edi
call fcn.004b1240
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4b0fda
inc ebx
xor esi, esi
lea ecx, [ebp - 0x78]
mov edx, esi
mov eax, edi
call fcn.004b12b8
movzx eax, byte [ebp - 0x7d]
xor al, 1
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1f], 0
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
call fcn.004b1050
inc esi
dec ebx
jne 0x4b0fb2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0ffd
lea eax, [ebp - 0x78]
mov edx, dword [0x47408c]
call fcn.00405d30
ret
Function at 0x4bbb78
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4bbb99
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4bbb86
pop edi
pop esi
pop ebx
ret

Function at 0x4bbbd4
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004bbba0
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004bbba0
mov esi, eax
xor eax, eax
mov edx, dword [0x68085c]
mov dword [ebp - 8], edx
mov edx, dword [0x680860]
mov dword [ebp - 0xc], edx
mov edx, dword [0x680864]
mov dword [ebp - 0x10], edx
mov edx, dword [0x680868]
mov dword [ebp - 0x14], edx
mov edx, 0x20
add eax, 0x9e3779b9
mov ecx, esi
shl ecx, 4
mov edi, dword [ebp - 8]
xor edi, esi
add ecx, edi
mov edi, esi
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0xc]
add ebx, ecx
mov ecx, ebx
shl ecx, 4
mov edi, dword [ebp - 0x10]
xor edi, ebx
add ecx, edi
mov edi, ebx
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0x14]
add esi, ecx
dec edx
jne 0x4bbc22
mov eax, ebx
call fcn.004bbba0
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, esi
call fcn.004bbba0
mov edx, dword [ebp - 4]
add edx, 4
mov dword [edx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bbc80
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004bbba0
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004bbba0
mov esi, eax
mov eax, 0xc6ef3720
mov edx, dword [0x68085c]
mov dword [ebp - 8], edx
mov edx, dword [0x680860]
mov dword [ebp - 0xc], edx
mov edx, dword [0x680864]
mov dword [ebp - 0x10], edx
mov edx, dword [0x680868]
mov dword [ebp - 0x14], edx
mov edx, 0x20
mov ecx, ebx
shl ecx, 4
mov edi, dword [ebp - 0x10]
xor edi, ebx
add ecx, edi
mov edi, ebx
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0x14]
sub esi, ecx
mov ecx, esi
shl ecx, 4
mov edi, dword [ebp - 8]
xor edi, esi
add ecx, edi
mov edi, esi
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0xc]
sub ebx, ecx
sub eax, 0x9e3779b9
dec edx
jne 0x4bbcd1
mov eax, ebx
call fcn.004bbba0
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, esi
call fcn.004bbba0
mov edx, dword [ebp - 4]
add edx, 4
mov dword [edx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c7b4c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebx + 4], 0x12345678
mov dword [ebx + 8], 0x23456789
mov dword [ebx + 0xc], 0x34567890
mov eax, dword [ebp - 4]
call fcn.00405308
mov esi, eax
test esi, esi
jle 0x4c7bbe
mov edi, 1
mov eax, dword [ebp - 4]
movzx edx, byte [eax + edi - 1]
mov eax, dword [ebx + 4]
call fcn.0044a0ac
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
and eax, 0xff
add dword [ebx + 8], eax
imul eax, dword [ebx + 8], 0x8088405
inc eax
mov dword [ebx + 8], eax
mov edx, dword [ebx + 8]
shr edx, 0x18
mov eax, dword [ebx + 0xc]
call fcn.0044a0ac
mov dword [ebx + 0xc], eax
inc edi
dec esi
jne 0x4c7b80
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4c7bc4
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
cmp dword [ebp - 8], 0
jne 0x4c7bef
mov ecx, 0x321
mov edx, 0x4c7dd0
mov eax, 0x4c7df8
call fcn.00404f58
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c7b4c
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov eax, pe_nt_image_headers32
call fcn.00403608
mov byte [ebp - 9], al
movzx esi, word [ebx + 0xc]
and si, 0xffff
or si, 2
movzx eax, si
xor si, 1
movzx edx, si
imul edx
shr eax, 8
mov esi, eax
movzx edx, byte [ebp - 9]
mov eax, dword [ebx + 4]
call fcn.0044a0ac
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
and eax, 0xff
add dword [ebx + 8], eax
imul eax, dword [ebx + 8], 0x8088405
inc eax
mov dword [ebx + 8], eax
mov edx, dword [ebx + 8]
shr edx, 0x18
mov eax, dword [ebx + 0xc]
call fcn.0044a0ac
mov dword [ebx + 0xc], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x4c7c03
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004c7b4c
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
movzx esi, word [ebx + 0xc]
and si, 0xffff
or si, 2
movzx eax, si
xor si, 1
movzx edx, si
imul edx
shr eax, 8
mov esi, eax
movzx edx, byte [edi]
mov eax, dword [ebx + 4]
call fcn.0044a0ac
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
and eax, 0xff
add dword [ebx + 8], eax
imul eax, dword [ebx + 8], 0x8088405
inc eax
mov dword [ebx + 8], eax
mov edx, dword [ebx + 8]
shr edx, 0x18
mov eax, dword [ebx + 0xc]
call fcn.0044a0ac
mov dword [ebx + 0xc], eax
mov eax, esi
xor byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x4c7c85
movzx eax, byte [ebp + 0xa]
mov byte [ebp - 9], al
movzx esi, word [ebx + 0xc]
and si, 0xffff
or si, 2
movzx eax, si
xor si, 1
movzx edx, si
imul edx
shr eax, 8
mov esi, eax
movzx edx, byte [ebp - 9]
mov eax, dword [ebx + 4]
call fcn.0044a0ac
mov edi, eax
mov dword [ebx + 4], edi
and edi, 0xff
add dword [ebx + 8], edi
imul edi, dword [ebx + 8], 0x8088405
inc edi
mov dword [ebx + 8], edi
mov edx, edi
shr edx, 0x18
mov eax, dword [ebx + 0xc]
call fcn.0044a0ac
mov dword [ebx + 0xc], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x12], al
movzx eax, byte [ebp + 0xb]
mov byte [ebp - 9], al
movzx esi, word [ebx + 0xc]
and si, 0xffff
or si, 2
movzx eax, si
xor si, 1
movzx edx, si
imul edx
shr eax, 8
mov esi, eax
movzx edx, byte [ebp - 9]
mov eax, dword [ebx + 4]
call fcn.0044a0ac
mov edi, eax
mov dword [ebx + 4], edi
and edi, 0xff
add dword [ebx + 8], edi
imul edi, dword [ebx + 8], 0x8088405
inc edi
mov dword [ebx + 8], edi
mov edx, edi
shr edx, 0x18
mov eax, dword [ebx + 0xc]
call fcn.0044a0ac
mov dword [ebx + 0xc], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x11], al
mov byte [ebx + 0x10], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c7e34
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov esi, edx
mov edi, ecx
dec edi
test edi, edi
jl 0x4c7ec6
inc edi
movzx eax, word [ebp - 0xc]
and ax, 0xffff
or ax, 2
movzx ebx, byte [esi]
movzx edx, ax
xor ax, 1
movzx eax, ax
imul edx, eax
shr edx, 8
xor dl, bl
mov byte [ebp - 5], dl
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0044a0ac
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0xff
add dword [ebp - 0x10], eax
imul ebx, dword [ebp - 0x10], 0x8088405
inc ebx
mov dword [ebp - 0x10], ebx
mov edx, ebx
shr edx, 0x18
mov eax, dword [ebp - 0xc]
call fcn.0044a0ac
mov dword [ebp - 0xc], eax
movzx eax, byte [ebp - 5]
mov byte [esi], al
inc esi
dec edi
jne 0x4c7e65
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ca81c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004bb394
mov ebx, eax
mov eax, ebx
call fcn.00488ea8
mov byte [ebp - 0x11], al
mov eax, ebx
call fcn.00488e78
mov byte [ebp - 0x12], al
mov eax, ebx
call fcn.00488e48
mov byte [ebp - 0x13], al
cmp byte [ebp - 0x11], 0
jne 0x4ca86c
cmp byte [ebp - 0x12], 0
jne 0x4ca86c
cmp byte [ebp - 0x13], 0
jne 0x4ca86c
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4ca975
mov eax, ebx
call fcn.00488ddc
mov byte [ebp - 0x14], al
mov eax, ebx
call fcn.00488da4
mov ebx, eax
mov dl, 1
mov eax, dword [0x438d24]
call fcn.00403fdc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4ca96e
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.004a7fb0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4ca935
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004aabd8
mov esi, eax
dec esi
test esi, esi
jl 0x4ca91f
inc esi
xor edi, edi
push ebp
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
push ebx
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.004aabe0
movzx ecx, byte [ebp - 0x12]
movzx edx, byte [ebp - 0x11]
call fcn.004ca784
pop ecx
test al, al
je 0x4ca91b
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.004aabe0
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x4ca91b
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.004aabe0
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0043b4bc
inc edi
dec esi
jne 0x4ca8c6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca93c
lea eax, [ebp - 0xc]
call fcn.0040f894
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ca980
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test eax, eax
je 0x4ca9da
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ca9d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4ca9bd
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0043b61c
push eax
call sub.kernel32.dll_ResumeThread
inc esi
dec ebx
jne 0x4ca9a9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca9da
lea eax, [ebp - 4]
call fcn.0040f894
ret
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4d3b58
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
push 0
push 0
push 0xe
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
push eax
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
inc edi
mov eax, esi
mov edx, edi
call fcn.00405794
mov eax, esi
call fcn.00405564
mov edx, 1
dec edx
test eax, eax
je 0x4d3ba5
cmp edx, dword [eax - 4]
jb 0x4d3baa
call fcn.00403edc
inc edx
lea eax, [eax + edx - 1]
push eax
push edi
push 0xd
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
push eax
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SendMessageA
mov edx, eax
mov eax, esi
call fcn.00405794
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4d4180
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
movzx eax, byte [ebp - 0xe5]
and al, 0x80
cmp al, 0x80
sete al
mov esp, ebp
pop ebp
ret