joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ed80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x643470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x64346c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x643470], edx
cmp eax, 0x26f
jl 0x40ed88
mov dword [0x57efd0], 0x270
ret

Function at 0x40edc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x643474]
mov ebx, dword [eax*4 + 0x643470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x643aa4]
mov dword [eax*4 + 0x643470], edx
cmp eax, 0xe2
jl 0x40edc8
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x643474]
mov ebx, dword [eax*4 + 0x643470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x6430e4]
mov dword [eax*4 + 0x643470], edx
cmp eax, 0x26e
jl 0x40ee18
mov edx, dword [0x643470]
mov ecx, dword [0x643e2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x643aa0]
mov dword [0x643e2c], eax
mov dword [0x57efd0], 0
pop ebx
ret

Function at 0x40eea0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x57efd0]
add dword [0x57efd0], 1
mov eax, dword [0x642020]
cmp eax, dword [0x57e720]
jne 0x40eec3
cmp ebx, 0x271
jb 0x40eee4
mov eax, dword [0x642020]
call fcn.0040ed80
not dword [0x642020]
mov eax, dword [0x642020]
mov dword [0x57e720], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40ef00
call fcn.0040edc0
xor ebx, ebx
mov dword [0x57efd0], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x643470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x4109f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x57e470]
cmp ax, 0xcb
je 0x410afc
cmp ax, 0xcc
je 0x410afc
lea esi, [esi]
mov edx, dword [0x644070]
test edx, edx
je 0x410a25
mov eax, dword [0x643f20]
call edx
mov ebx, eax
jmp 0x410a2a
mov ebx, 0x643f24
cmp word [0x643f10], 0
jle 0x410a50
mov eax, 0x643ef0
call fcn.00410cb0
mov eax, ebx
call fcn.004105b0
mov eax, ebx
call fcn.00410620
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x410a72
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x410a6d
mov edx, edi
mov eax, ebx
call fcn.0040fa20
jmp 0x410a70
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x410a58
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x643f10], 0
jle 0x410afc
mov edx, 0x643e30
mov eax, ebx
call fcn.0040fb60
mov edi, eax
test edi, edi
je 0x410acc
mov eax, dword [0x643ec4]
mov dword [edi + 0xc], eax
cmp dword [0x643ec4], 0
je 0x410ac0
mov eax, dword [0x643ec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x643ec4], eax
nop
sub word [0x643f10], 1
cmp word [0x643f10], 0
sete bl
mov eax, 0x643ef0
call fcn.00410cd0
test bl, bl
je 0x410afc
mov eax, 0x643ef0
call fcn.00410ca0
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x412f70
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x643260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413150
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x643260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.004034f0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x57e4f0], eax
mov ebx, eax
jmp 0x413113
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x412ff8
cmp byte [ebx], 0
je 0x41311c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x413073
mov al, byte [ebx]
cmp al, 1
jb 0x413068
sub al, 0x20
jbe 0x413038
sub al, 2
je 0x41304c
jmp 0x413068
mov al, byte [ebp - 0x114]
test al, al
je 0x413078
add dword [ebp - 0x110], 1
jmp 0x413070
cmp byte [ebx + 1], 0x22
je 0x413063
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413070
add ebx, 1
jmp 0x413070
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413028
test dword [ebp - 0x10c], 0xffffffff
je 0x41310c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413150
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x643260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x413103
mov al, byte [ebx]
cmp al, 1
jb 0x4130f8
sub al, 0x20
jbe 0x4130c8
sub al, 2
je 0x4130dc
jmp 0x4130f8
mov al, byte [ebp - 0x114]
test al, al
je 0x413108
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x413100
cmp byte [ebx + 1], 0x22
je 0x4130f3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413100
add ebx, 1
jmp 0x413100
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x4130b8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x412ffb
mov ebx, dword [ebp - 0x10c]
mov dword [0x643250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x643260
call fcn.00410830
mov eax, dword [0x643260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4264f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov byte [ebp - 0xc], cl
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_GetLocaleInfoW
mov dword [ebp - 0x1c], eax
cmp eax, 2
jle 0x42659a
mov eax, dword [ebp - 0x1c]
sub eax, 2
test eax, eax
jl 0x4265b6
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov dx, word [ebp + edx*2 - 0x18]
mov word [ebp - 0x24], dx
mov edx, dword [ebp - 0x20]
mov dx, word [ebp + edx*2 - 0x18]
cmp dx, 0x20
jb 0x4265b6
sub dx, 0x20
je 0x426590
sub dx, 0x80
je 0x426590
sub dx, 0x1f62
jb 0x4265b6
sub dx, 1
jbe 0x426590
sub dx, 6
je 0x426590
sub dx, 0x26
jne 0x4265b6
nop
jmp 0x426590
cmp eax, dword [ebp - 0x20]
jg 0x426538
lea esi, [esi]
jmp 0x4265b6
cmp dword [ebp - 0x1c], 2
jne 0x4265aa
mov ax, word [ebp - 0x18]
mov word [ebp - 0x24], ax
jmp 0x4265b6
mov al, byte [ebp - 0xc]
call fcn.0040b110
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x24]
sub ax, 0x7f
jbe 0x426634
sub ax, 0x21
je 0x426648
sub ax, 0x17
je 0x426654
sub ax, 0x222
je 0x426660
sub ax, 0x392
je 0x426668
sub ax, 1
je 0x426670
sub ax, 0x1996
je 0x426678
sub ax, 1
je 0x426680
sub ax, 6
je 0x426688
sub ax, 0xb
je 0x426698
sub ax, 0x1b
je 0x426690
sub ax, 0x367
je 0x4266a0
jmp 0x4266a8
mov ax, word [ebp - 0x24]
call fcn.0040b1b0
mov byte [ebp - 0x10], al
jmp 0x4266b0
mov byte [ebp - 0x10], 0x20
jmp 0x4266b0
mov byte [ebp - 0x10], 0x2e
jmp 0x4266b0
mov byte [ebp - 0x10], 0x27
jmp 0x4266b0
mov byte [ebp - 0x10], 0x2c
jmp 0x4266b0
mov byte [ebp - 0x10], 0x27
jmp 0x4266b0
mov byte [ebp - 0x10], 0x20
jmp 0x4266b0
mov byte [ebp - 0x10], 0x20
jmp 0x4266b0
mov byte [ebp - 0x10], 0x20
jmp 0x4266b0
mov byte [ebp - 0x10], 0x20
jmp 0x4266b0
mov byte [ebp - 0x10], 0x2d
jmp 0x4266b0
mov byte [ebp - 0x10], 0x27
jmp 0x4266b0
mov al, byte [ebp - 0xc]
mov byte [ebp - 0x10], al
mov esi, esi
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x438490
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push dword [ebx + 4]
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x4384ac
mov dword [ebx + 0xc], 0
mov esi, esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44d320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test eax, eax
jne 0x44d32c
mov eax, 0x6432f0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x44d33f
and eax, 0x10
sete al
jmp 0x44d341
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x44d820
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
push ebx
push esi
mov dword [ebp - 0x38], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040d890
call fcn.00403e80
push eax
test eax, eax
jne 0x44d8dc
xor ebx, ebx
add ebx, 1
lea eax, [ebx*4 + 0x644b5c]
xor edx, edx
call fcn.00408850
mov dword [ebx*4 + 0x644b7c], 0xffffffff
cmp ebx, 7
jl 0x44d850
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x44d8dc
lea esi, [esi]
push 1
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.00409230
mov eax, dword [ebp - 0x38]
mov edx, 1
call fcn.00444590
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x44d8dc
push 4
push ebx
push esi
mov eax, 0x44d6f0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x44d780
push eax
call sub.kernel32.dll_EnumCalendarInfoA
nop
call fcn.0040db00
lea eax, [ebp - 0x38]
call fcn.004039c0
pop eax
test eax, eax
je 0x44d8f3
call fcn.0040dc30
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44e010
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x44]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040d890
call fcn.00403e80
push eax
test eax, eax
jne 0x44e13d
mov eax, ebx
lea edx, [ebp - 0x34]
call fcn.00443d10
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.00408850
lea eax, [ebp - 4]
mov cl, 1
mov dx, 1
call fcn.0040a060
mov eax, dword [ebp - 0x40]
xor edx, edx
call fcn.00408850
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 0x44], eax
mov ebx, eax
jmp 0x44e12c
lea ecx, [ebp - 8]
mov eax, ebx
xor dx, dx
call fcn.00409190
mov eax, dword [ebp - 8]
test eax, eax
je 0x44e0b7
mov eax, dword [eax - 4]
mov edi, eax
lea eax, [ebp - 8]
xor cl, cl
mov dx, 1
call fcn.0040a060
mov edx, dword [ebp - 8]
mov ecx, 1
mov al, 0x3d
call fcn.00409990
mov esi, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.00409830
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00443d10
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 4]
call fcn.004095d0
test eax, eax
jne 0x44e124
push dword [ebp - 0x40]
mov eax, dword [ebp - 8]
test eax, eax
je 0x44e113
mov eax, dword [eax - 4]
sub eax, esi
mov ecx, eax
lea edx, [esi + 1]
mov eax, dword [ebp - 8]
call fcn.00409830
jmp 0x44e135
lea eax, [ebx + edi]
add eax, 1
mov ebx, eax
cmp byte [ebx], 0
jne 0x44e0a0
push dword [ebp - 0x44]
call sub.kernel32.dll_FreeEnvironmentStringsA
call fcn.0040db00
lea eax, [ebp - 0x3c]
call fcn.004039c0
lea eax, [ebp - 0x38]
call fcn.004039c0
lea eax, [ebp - 0x34]
call fcn.004039c0
lea eax, [ebp - 4]
call fcn.004039c0
lea eax, [ebp - 8]
call fcn.004039c0
pop eax
test eax, eax
je 0x44e174
call fcn.0040dc30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e180
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040d890
call fcn.00403e80
push eax
test eax, eax
jne 0x44e275
mov eax, dword [ebp - 0x3c]
xor edx, edx
call fcn.0040af60
call sub.kernel32.dll_GetEnvironmentStringsW
mov edi, eax
mov esi, edi
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0044a1a0
jmp 0x44e268
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040af10
mov edx, dword [ebp - 4]
mov ecx, 1
mov al, 0x3d
call fcn.0040b6c0
mov ebx, eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebx - 1]
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.0040b610
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0044a1a0
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 8]
call fcn.0040b480
test eax, eax
jne 0x44e258
push dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
test eax, eax
je 0x44e246
mov eax, dword [eax - 4]
sub eax, ebx
mov ecx, eax
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
call fcn.0040b610
jmp 0x44e26f
mov eax, esi
call fcn.004045f0
shl eax, 1
add eax, esi
add eax, 2
mov esi, eax
cmp word [esi], 0
jne 0x44e1f0
push edi
call sub.kernel32.dll_FreeEnvironmentStringsW
call fcn.0040db00
lea eax, [ebp - 0x38]
call fcn.0040ac60
lea eax, [ebp - 0x34]
call fcn.0040ac60
lea eax, [ebp - 4]
call fcn.0040ac60
lea eax, [ebp - 8]
call fcn.0040ac60
pop eax
test eax, eax
je 0x44e2a4
call fcn.0040dc30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46b5e0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x4c]
mov byte [ebp - 4], al
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov eax, 1
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x24]
call fcn.0040d890
call fcn.00403e80
push eax
test eax, eax
jne 0x46b730
cmp byte [ebp - 4], 0
je 0x46b6dc
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.0040a790
mov eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.0040a790
lea eax, [ebp - 0x44]
call fcn.0040ac60
movzx eax, byte [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x48]
call fcn.0040b230
mov edx, dword [ebp - 0x48]
mov ecx, 0x5f0e44
lea eax, [ebp - 0x44]
call fcn.0040afa0
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x10]
call fcn.0040aea0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
jne 0x46b6dc
push 0
movzx eax, byte [ebp - 4]
add eax, 0x40
lea ecx, [ebp - 0x4c]
xor dx, dx
call fcn.00409130
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
mov ecx, 0x5f0e54
call fcn.00408950
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
jmp 0x46b730
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.0040a790
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 0x18]
call sub.kernel32.dll_GetCurrentDirectoryW
mov dword [ebp - 0x18], eax
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.0040a790
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x4c]
call fcn.0040aac0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 8]
call fcn.00408850
cmp byte [ebp - 4], 0
je 0x46b730
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
call fcn.0040db00
lea eax, [ebp - 0x4c]
call fcn.004039c0
lea eax, [ebp - 0x48]
call fcn.0040ac60
lea eax, [ebp - 0x44]
call fcn.0040ac60
lea eax, [ebp - 0xc]
call fcn.0040a1e0
lea eax, [ebp - 0x10]
call fcn.0040a1e0
lea eax, [ebp - 0x14]
call fcn.0040a1e0
pop eax
test eax, eax
je 0x46b76f
call fcn.0040dc30
mov esp, ebp
pop ebp
ret

Function at 0x46b8c0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0
mov eax, 1
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0040d890
call fcn.00403e80
push eax
test eax, eax
jne 0x46b90b
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x34]
call fcn.0040c2c0
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x46b902
mov eax, 0x6432f0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 8], eax
call fcn.0040db00
lea eax, [ebp - 0x34]
call fcn.0040ac60
pop eax
test eax, eax
je 0x46b922
call fcn.0040dc30
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x48b270
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esi, [ecx - 1]
test esi, esi
jl 0x48b2a4
mov edi, 0xffffffff
nop
add edi, 1
mov cl, al
xor cl, byte [edx]
and ecx, 0xff
mov ebx, ecx
mov ecx, eax
shr ecx, 8
xor ecx, dword [ebx*4 + 0x6451d0]
mov eax, ecx
add edx, 1
cmp esi, edi
jg 0x48b280
pop edi
pop esi
pop ebx
ret

Function at 0x48c120
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
test edx, edx
jne 0x48c130
xor ebx, ebx
jmp 0x48c24f
not eax
jmp 0x48c21b
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
mov esi, eax
shr esi, 8
xor esi, dword [edi*4 + 0x5822b0]
mov eax, esi
add edx, 1
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
mov esi, eax
shr esi, 8
xor esi, dword [edi*4 + 0x5822b0]
mov eax, esi
add edx, 1
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
mov esi, eax
shr esi, 8
xor esi, dword [edi*4 + 0x5822b0]
mov eax, esi
add edx, 1
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
mov esi, eax
shr esi, 8
xor esi, dword [edi*4 + 0x5822b0]
mov eax, esi
add edx, 1
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
mov esi, eax
shr esi, 8
xor esi, dword [edi*4 + 0x5822b0]
mov eax, esi
add edx, 1
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
mov esi, eax
shr esi, 8
xor esi, dword [edi*4 + 0x5822b0]
mov eax, esi
add edx, 1
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
mov esi, eax
shr esi, 8
xor esi, dword [edi*4 + 0x5822b0]
mov eax, esi
add edx, 1
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
mov esi, eax
shr esi, 8
xor esi, dword [edi*4 + 0x5822b0]
mov eax, esi
add edx, 1
sub ecx, 8
cmp ecx, 8
jae 0x48c138
jmp 0x48c247
movzx edi, byte [edx]
xor edi, eax
and edi, 0xff
mov esi, eax
shr esi, 8
xor esi, dword [edi*4 + 0x5822b0]
mov eax, esi
add edx, 1
sub ecx, 1
test ecx, ecx
ja 0x48c228
not eax
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4a9600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov edx, eax
xor eax, eax
lea ebx, [edx + 1]
movzx ecx, byte [edx]
add ecx, 1
and ecx, 0xff
add edx, ecx
jmp 0x4a9631
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor ecx, esi
mov eax, ecx
add ebx, 1
cmp edx, ebx
ja 0x4a9620
pop esi
pop ebx
ret
Function at 0x4b5ed0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4b5f04
mov eax, esi
call fcn.004ba450
cmp byte [esi + 0x40], 0
je 0x4b5efc
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4b5fb5
mov dword [esi + 0x14], 0xcb
nop
cmp dword [esi + 0x14], 0xcb
jne 0x4b5f94
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4b5f8c
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4b5f38
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
lea esi, [esi]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4b5f50
xor bl, bl
jmp 0x4b5fb5
cmp edi, 2
je 0x4b5f8a
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4b5f28
cmp edi, 3
je 0x4b5f68
cmp edi, 1
jne 0x4b5f28
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4b5f28
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
mov esi, esi
jmp 0x4b5f28
mov esi, esi
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4b5fac
cmp dword [esi + 0x14], 0xcc
je 0x4b5fac
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004b62f0
lea esi, [esi]
mov eax, esi
call fcn.004b5fc0
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x4d2420
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
cmp dword [eax + 0x28], 0
je 0x4d2468
mov eax, dword [0x57f0e0]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0x168]
cmp eax, dword [edx + 0x28]
jne 0x4d2468
mov eax, dword [0x57f0e0]
cmp byte [eax + 0x114], 0
jne 0x4d2468
mov eax, dword [0x57f4d0]
mov edx, dword [0x57f4d0]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov ebx, dword [ebp - 4]
mov eax, dword [0x57f4d0]
mov edx, dword [0x57f4d0]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx + 4]
jne 0x4d255f
mov eax, dword [0x57f0e0]
cmp byte [eax + 0x114], 0
jne 0x4d255f
mov eax, dword [0x57f4d0]
mov edx, dword [0x57f4d0]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.00549c10
mov eax, dword [0x57f0e0]
cmp dword [eax + 0x168], 0
je 0x4d2524
push 0x10
push 0
mov eax, dword [0x57f0e0]
mov eax, dword [eax + 0x168]
push dword [eax + 0x25c]
mov eax, dword [0x57f0e0]
mov eax, dword [eax + 0x168]
push dword [eax + 0x250]
mov eax, dword [0x57f0e0]
mov eax, dword [eax + 0x168]
push dword [eax + 0x130]
push 0
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x57f0e0]
mov eax, dword [eax + 0x168]
call fcn.004f0f60
test al, al
je 0x4d2524
push 0
mov eax, dword [0x57f0e0]
call fcn.0041fad0
push eax
call sub.user32.dll_ShowWindow
nop
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x57f0e0]
call fcn.00422900
jmp 0x4d25f8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x4d25b4
mov eax, dword [ebp - 4]
mov edx, dword [0x57f0e0]
mov eax, dword [eax + 0x28]
cmp eax, dword [edx + 0x168]
jne 0x4d25b4
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x57f0e0]
call fcn.00422900
jmp 0x4d25f8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x4d25f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
test dword [eax + 0x488], 8
je 0x4d25f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x57f4d0]
mov edx, dword [0x57f4d0]
mov edx, dword [edx]
call dword [edx + 0x8c]
mov esi, esi
pop ebx
mov esp, ebp
pop ebp
ret