joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4830bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x483118
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4830e7
call fcn.0040ee64
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004029b0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x483118
call fcn.0040ee64
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x48c3b4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x48c538
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x276]
sub al, 2
jb 0x48c51d
cmp byte [ebx + 0x268], 0
je 0x48c51d
mov eax, dword [ebp - 4]
call fcn.004938e0
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x48c516
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp - 6]
sub ax, 8
je 0x48c45a
dec ax
je 0x48c430
sub ax, 0x12
jne 0x48c474
call fcn.00403bac
jmp 0x48c51d
cmp byte [ebx + 0x269], 0
je 0x48c4fc
mov eax, ebx
call fcn.00452714
test al, al
je 0x48c4fc
xor edx, edx
mov eax, ebx
call fcn.00452738
jmp 0x48c4fc
mov eax, dword [esi]
call fcn.00404b04
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00404cec
jmp 0x48c4fc
cmp byte [ebx + 0x269], 0
je 0x48c491
mov eax, ebx
call fcn.00452714
test al, al
jne 0x48c491
mov dl, 1
mov eax, ebx
call fcn.00452738
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x48c4a9
mov eax, esi
call fcn.004048a0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
mov dx, word [ebp - 6]
call fcn.004049c8
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.00404b70
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.0048c1e4
test al, al
je 0x48c4fc
lea eax, [ebp - 0x14]
mov dx, word [ebp - 6]
call fcn.004049c8
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00404b10
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c51d
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
call fcn.00493914
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c53f
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004048b8
ret

Function at 0x490fa0
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x533a4c]
cmp dword [eax], 2
je 0x490fbe
mov ecx, 0x30e
mov edx, 0x490ff0
mov eax, 0x491024
call fcn.004040e0
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x490f40
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x534fc8], eax
cmp dword [0x534fc8], 0
jne 0x490fe5
call fcn.0040ee64
ret
Function at 0x491320
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x533308]
cmp byte [eax], 0
jne 0x49134e
mov ecx, 0xaf
mov edx, 0x49139c
mov eax, 0x4913d0
call fcn.004040e0
mov eax, ebx
call fcn.004048a0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x49138d
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00404a5c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4913e4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x533308]
cmp byte [eax], 0
jne 0x491407
mov ecx, 0xbd
mov edx, 0x491448
mov eax, 0x49147c
call fcn.004040e0
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x49143a
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x49143a
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x49143a
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x49b920
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x49b984
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404404
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004096bc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b98b
lea eax, [ebp - 0xc]
call fcn.00404184
ret

Function at 0x49c2fc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x49c3b2
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404654
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x49c39c
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.004047e0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404654
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x49c39c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x49c3c4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x49c39c
cmp dword [ebp - 8], 0x34
jne 0x49c39c
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c3b9
lea eax, [ebp - 0x10]
call fcn.00404184
ret
Function at 0x49d2cc
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x49d2e1
add esp, 0xfffffff0
call fcn.00403698
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.00403304
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.004041d8
mov eax, esi
call fcn.00404654
push eax
xor eax, eax
mov al, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexA
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x49d336
mov ecx, dword [0x5338c8]
mov dl, 1
mov eax, dword [0x49d0b4]
call fcn.004967ac
call fcn.00403b00
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x49d35d
call fcn.004036f0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x49dc4c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.0049dc08
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49dcc0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [0x536aa8], eax
mov ebx, 0x49db94
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x49dcc0
xor eax, eax
push ebp
push 0x49dcb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49dcc0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49dcc8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
call fcn.0049dc08
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49dd33
mov ebx, dword [0x536aa8]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x49dd33
xor eax, eax
push ebp
push 0x49dd2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49dd33
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualProtect
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49e944
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49eaae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x533308]
cmp byte [eax], 0
jne 0x49e99f
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.0040441c
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov eax, ebx
call fcn.0043a98c
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00404a78
jmp 0x49ea86
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00404af4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x49e9d1
mov eax, esi
call fcn.004048a0
jmp 0x49ea86
mov eax, dword [ebp - 4]
dec eax
sub eax, 2
jb 0x49ea08
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [0x533518]
call fcn.004065b8
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x43a534]
call fcn.0040d894
call fcn.00403b00
cmp dword [ebp - 8], 1
jne 0x49ea15
mov dword [ebp - 8], 2
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, esi
call fcn.00404e68
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
call fcn.00404af4
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, edi
call fcn.00404af4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x49ea76
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], 0xf
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x533a6c]
call fcn.004065b8
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x43a534]
call fcn.0040d894
call fcn.00403b00
mov eax, dword [esi]
call fcn.00404af4
mov edx, eax
mov eax, esi
call fcn.00404a08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49eab5
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004041a8
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004041a8
ret
Function at 0x49eabc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x49ebe4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
dec eax
sub eax, 2
jb 0x49eb06
mov ecx, 0x7d
mov edx, 0x49ebfc
mov eax, 0x49ec34
call fcn.004040e0
mov eax, dword [0x533308]
cmp byte [eax], 0
jne 0x49eb64
cmp esi, 1
jne 0x49eb3e
lea eax, [ebp - 8]
mov edx, edi
call fcn.0040441c
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040441c
mov edx, dword [ebp - 0xc]
mov eax, ebx
pop ecx
call fcn.0043a934
jmp 0x49ebc1
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.0040441c
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040441c
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.0043a960
jmp 0x49ebc1
mov eax, edi
call fcn.00404b04
inc eax
add eax, eax
push eax
mov eax, edi
call fcn.00404af4
push eax
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.00404af4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x49ebc1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xf
lea eax, [ebp - 0x1c]
push eax
push 0
lea edx, [ebp - 0x20]
mov eax, dword [0x533678]
call fcn.004065b8
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x43a534]
call fcn.0040d894
call fcn.00403b00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ebeb
lea eax, [ebp - 0x20]
call fcn.00404184
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004041a8
ret

Function at 0x49f5bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
mov edi, ecx
shr edi, 2
je 0x49f5d6
lea edx, [edx + edi*4]
lea eax, [eax + edi*4]
neg edi
mov ebx, dword [edx + edi*4]
xor dword [eax + edi*4], ebx
inc edi
jne 0x49f5cd
and ecx, 3
je 0x49f5e4
mov bl, byte [edx]
xor byte [eax], bl
inc eax
inc edx
dec ecx
jne 0x49f5db
pop edi
pop ebx
ret

Function at 0x49f5e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x49f615
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x49f606
and ecx, 3
je 0x49f62d
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x49f61a
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4ca388
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ca5e8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4ca3eb
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004ca030
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e25c
cmp al, 1
jne 0x4ca3eb
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004ca2f8
test al, al
je 0x4ca577
cmp dword [ebp - 8], 0
jge 0x4ca409
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004ca030
mov eax, dword [ebp - 0x210]
call fcn.00404454
cmp ebx, eax
jge 0x4ca453
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004ca030
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x533a40]
and eax, 0xff
bt dword [edx], eax
jae 0x4ca453
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4ca467
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ca364
cmp ebx, dword [ebp - 8]
je 0x4ca569
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4ca493
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403530
and eax, 0x7f
movzx eax, word [eax*2 + 0x52b8c4]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4ca556
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403530
and eax, 0x7f
movzx eax, word [eax*2 + 0x52b8c4]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00461c04
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403530
and eax, 0x7f
movzx eax, word [eax*2 + 0x52b8c4]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00461c04
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca55d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4ca5ca
cmp dword [ebp - 8], 0
jge 0x4ca582
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004ca030
mov eax, dword [ebp - 0x218]
call fcn.00404454
cmp eax, dword [ebp - 8]
jg 0x4ca5bc
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004ca030
mov eax, dword [ebp - 0x21c]
call fcn.00404454
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004ca364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca5ef
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004041a8
ret
Function at 0x500410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x500571
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [edi + 0x488]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0xc], eax
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004f8be0
mov byte [ebp - 5], al
mov eax, dword [ebp - 0xc]
mov edx, dword [edi + 0x208]
mov dword [eax + 0x20], edx
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, edi
mov esi, dword [eax]
call dword [esi + 0x1c0]
mov eax, dword [ebp - 0xc]
push edi
lea esi, [ebp - 0x20]
lea edi, [eax + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, edi
mov esi, dword [eax]
call dword [esi + 0x108]
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, edi
mov si, 0xffb0
call fcn.00403530
mov eax, dword [ebp - 0xc]
add eax, 0x1c
mov edx, dword [ebp - 0x10]
call fcn.004048dc
mov edx, dword [ebp - 4]
mov eax, dword [edi + 0x488]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edx, dword [eax + 0x58]
mov eax, dword [edi + 0x208]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov al, byte [ebp - 5]
push eax
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x148]
mov ebx, dword [edi + 0x208]
test byte [ebp - 5], 1
je 0x500514
mov esi, dword [ebx + 0xc]
mov eax, esi
call fcn.004290e4
mov edx, eax
or dl, byte [0x500584]
mov eax, esi
call fcn.004290f0
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x20]
mov ebx, eax
mov al, byte [edi + 0x2bc]
sub al, 1
jae 0x50053e
mov edx, dword [ebp - 4]
mov eax, dword [edi + 0x488]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [eax + 0xb0]
jmp 0x500551
mov edx, dword [ebp - 4]
mov eax, dword [edi + 0x488]
mov ecx, dword [eax]
call dword [ecx + 0x30]
call fcn.00510e88
add ebx, 5
cmp eax, ebx
setge al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x500578
lea eax, [ebp - 0x10]
call fcn.004048a0
ret

Function at 0x51ae34
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, 0x4c
mov ebx, 0x52de24
mov eax, dword [ebx]
call fcn.00404b04
mov edx, eax
test edx, edx
jle 0x51ae69
mov eax, 1
mov ecx, dword [ebx]
mov cx, word [ecx + eax*2 - 2]
xor cx, 0x33
mov edi, dword [ebx]
mov word [edi + eax*2 - 2], cx
inc eax
dec edx
jne 0x51ae53
mov eax, 0xe
lea edx, [ebx + 4]
xor byte [edx], 0x33
inc edx
dec eax
jne 0x51ae71
add ebx, 0x11c
dec esi
jne 0x51ae41
pop edi
pop esi
pop ebx
ret
Function at 0x107db058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.107db1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x107db07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x107db06a
add dl, dl
jne 0x107db089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x107db0dc
xor eax, eax
add dl, dl
jne 0x107db096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x107db17d
add dl, dl
jne 0x107db0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107db0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107db0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107db0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x107db0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x107db075
mov eax, 1
add dl, dl
jne 0x107db0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107db0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x107db0e1
sub eax, ebx
mov ebx, 1
jne 0x107db128
mov ecx, 1
add dl, dl
jne 0x107db10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x107db119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x107db105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x107db075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x107db13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x107db14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x107db136
cmp eax, 0x7d00
jae 0x107db16d
cmp eax, 0x500
jb 0x107db168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x107db075
cmp eax, 0x7f
ja 0x107db170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x107db075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x107db19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x107db075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx