joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bc6c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x44be62
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCurrentThreadId_1
mov ebx, eax
mov eax, dword [0x56b554]
cmp dword [eax], 0
jne 0x44bcbc
mov eax, dword [0x56b554]
mov dword [eax], ebx
lea eax, [ebp - 4]
mov edx, 0x44be78
call fcn.004050c4
jmp 0x44bcde
mov eax, dword [0x56b554]
cmp ebx, dword [eax]
jne 0x44bcd4
lea eax, [ebp - 4]
mov edx, 0x44be78
call fcn.004050c4
jmp 0x44bcde
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0044bc08
cmp dword [0x670454], 0
jne 0x44bd37
cmp dword [0x670450], 0
jne 0x44bd37
call fcn.00466718
push edx
push eax
mov eax, 0x670450
call fcn.0044bbf0
mov eax, dword [0x670450]
mov dword [0x670458], eax
mov eax, dword [0x670454]
mov dword [0x67045c], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
jmp 0x44bda0
call fcn.00466718
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0044bbf0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [0x670450]
sbb edx, dword [0x670454]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [0x670458]
sbb edx, dword [0x67045c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [0x670458], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x67045c], eax
push 0x44be88
push dword [ebp - 4]
push 0x44be94
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x34]
call fcn.0044bc38
push dword [ebp - 0x34]
push 0x44bea0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x38]
call fcn.0044bc38
push dword [ebp - 0x38]
push 0x44beac
lea eax, [ebp - 8]
mov edx, 7
call fcn.004053cc
mov eax, dword [ebp - 8]
call fcn.00405308
cmp eax, 0x19
jge 0x44be22
push dword [ebp - 8]
mov eax, dword [ebp - 8]
call fcn.00405308
mov edx, 0x19
sub edx, eax
lea ecx, [ebp - 0x3c]
mov al, 0x20
call fcn.004057f8
push dword [ebp - 0x3c]
push esi
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
jmp 0x44be2c
lea eax, [ebp - 8]
mov edx, esi
call fcn.00405314
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44be69
lea eax, [ebp - 0x3c]
mov edx, 3
call fcn.00405050
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret
Function at 0x4579e4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
je 0x457a83
push 0
push 0
mov eax, ebx
call fcn.0043e3b0
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
lea edx, [ebp - 0x44]
mov ecx, 0x40
mov eax, ebx
call fcn.0043e5bc
cmp word [ebp - 0x44], 0x5a4d
jne 0x457a83
cmp dword [ebp - 8], 0
je 0x457a83
mov eax, 0x110
call fcn.0040304c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cdq
push edx
push eax
mov eax, ebx
call fcn.0043e3b0
mov edx, dword [ebp - 4]
mov ecx, 0x108
mov eax, ebx
call fcn.0043e5bc
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x457a71
lea eax, [ebp - 4]
xor edx, edx
call fcn.00446ac4
jmp 0x457a83
mov eax, dword [ebp - 8]
cdq
mov ecx, dword [ebp - 4]
add ecx, 0x108
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45bbb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040550c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45bc08
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x56b564]
mov dl, 1
mov eax, dword [0x45b6d4]
call fcn.0042c788
call fcn.00404984
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0045b7dc
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45f304
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f41e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6704fc], 0
jne 0x45f359
push 0x45f42c
call fcn.0040dbac
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x6704fc], eax
push 0x45f42c
call fcn.0040dbac
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x670500], eax
mov eax, dword [0x45f444]
mov dword [ebp - 0xb], eax
mov ax, word [0x45f448]
mov word [ebp - 7], ax
mov al, byte [0x45f44a]
mov byte [ebp - 5], al
push 6
lea eax, [ebp - 0xb]
push eax
push 0x1004
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 4]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040529c
call sub.kernel32.dll_GetACP_1
mov edx, eax
test edx, edx
jns 0x45f3ab
call fcn.00403edc
mov eax, dword [ebp - 4]
call fcn.004287a4
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x30]
lea eax, [ebp - 0x10]
mov ecx, 2
call fcn.0045f2e4
mov eax, dword [ebp - 0x30]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.004286e8
push dword [ebp - 0x34]
push 0x45f454
mov eax, dword [ebp - 0x2c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x38]
call fcn.004286e8
push dword [ebp - 0x38]
mov eax, ebx
mov edx, 3
call fcn.004053cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f425
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.00405050
lea eax, [ebp - 4]
call fcn.0040502c
ret

Function at 0x45f498
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [ebp - 1], 0
push 0x45f554
call fcn.0040db78
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
test ebx, ebx
je 0x45f515
lea eax, [ebp - 0x41]
xor ecx, ecx
mov edx, 0x40
call fcn.004038b8
mov dword [ebp - 0x41], 0x40
lea eax, [ebp - 0x41]
push eax
call ebx
test eax, eax
je 0x45f515
mov eax, dword [ebp - 0x39]
mov dword [edi], eax
mov eax, dword [ebp - 0x35]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x31]
mov dword [esi], eax
mov eax, dword [ebp - 0x2d]
mov dword [esi + 4], eax
mov byte [ebp - 1], 1
jmp 0x45f548
lea eax, [ebp - 0x64]
xor ecx, ecx
mov edx, 0x20
call fcn.004038b8
mov dword [ebp - 0x64], 0x20
lea eax, [ebp - 0x64]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x5c]
xor edx, edx
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, dword [ebp - 0x58]
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461a00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x461b24
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x564880], 0xff
je 0x461a2e
movzx ebx, byte [0x564880]
jmp 0x461b09
xor ebx, ebx
call fcn.0040ed60
test al, al
jne 0x461b09
mov eax, dword [0x56afcc]
cmp dword [eax], 0
je 0x461b09
push 4
lea eax, [ebp - 4]
push eax
push 0x461b34
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x461b09
push 4
lea eax, [ebp - 4]
push eax
push 0x461b4c
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
ja 0x461b09
call fcn.00403544
mov esi, eax
test esi, esi
jle 0x461ab8
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004035a4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00427c80
mov eax, dword [ebp - 8]
mov edx, 0x461b68
call fcn.00405458
je 0x461b09
inc dword [ebp - 4]
dec esi
jne 0x461a8d
xor eax, eax
call fcn.00447050
test al, al
je 0x461afd
xor edx, edx
xor eax, eax
call fcn.0044705c
xor eax, eax
push ebp
push 0x461af6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004618dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461b02
mov dl, 1
xor eax, eax
call fcn.0044705c
ret
call fcn.004618dc
movzx ebx, byte [0x564880]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461b2b
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405050
ret
Function at 0x467710
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x46786a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x46774c
mov ecx, 0x40b
mov edx, 0x467884
mov eax, 0x4678ac
call fcn.00404f58
test edi, edi
jne 0x467764
mov ecx, 0x40c
mov edx, 0x467884
mov eax, 0x4678ac
call fcn.00404f58
mov edx, ebx
mov eax, 0x4678c8
call fcn.00405650
test eax, eax
je 0x467788
mov ecx, 0x40d
mov edx, 0x467884
mov eax, 0x4678ac
call fcn.00404f58
mov edx, ebx
mov eax, 0x4678d4
call fcn.00405650
test eax, eax
je 0x4677ac
mov ecx, 0x40e
mov edx, 0x467884
mov eax, 0x4678ac
call fcn.00404f58
cmp byte [0x67053c], 0
je 0x4677e4
mov eax, dword [ebp - 4]
push eax
push esi
push dword [0x670540]
push 0x4678c8
push ebx
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
mov edx, dword [ebp - 8]
mov ecx, edi
mov eax, 0x80000001
call fcn.00467158
jmp 0x46784f
mov eax, esi
mov edx, 0x2800
call fcn.00405794
mov eax, dword [0x670540]
call fcn.0040550c
push eax
mov eax, dword [esi]
call fcn.00405308
test eax, eax
jns 0x46780b
call fcn.00403edc
push eax
mov eax, dword [esi]
call fcn.0040550c
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
mov eax, edi
call fcn.0040550c
push eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov edx, eax
mov eax, esi
call fcn.00405794
lea edx, [ebp - 0xc]
mov eax, dword [esi]
call fcn.00466f0c
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00405080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467871
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405050
ret
Function at 0x469828
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x469a1f
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x469887
lea edx, [ebp - 0x28]
mov eax, dword [0x56aed0]
call fcn.0040765c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0041f64c
mov eax, dword [ebp - 0x24]
mov ecx, 0x9e8
mov edx, 0x469a38
call fcn.00404f58
mov byte [ebp - 0x11], 1
mov dl, 1
mov eax, dword [0x4392e0]
call fcn.00403fdc
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x4699b5
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00469278
push dword [ebp - 4]
push 0x469a60
push 0x469a6c
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.004053cc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, 0x3f
call fcn.00469424
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x46999f
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
push dword [ebp - 4]
push 0x469a60
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x30]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
mov bl, 1
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x46994a
test al, 0x10
je 0x46994a
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ebp - 9]
mov eax, dword [ebp - 8]
call fcn.00469828
mov ebx, eax
jmp 0x469985
cmp dword [ebp - 0x10], 0
je 0x46995a
mov edx, eax
mov eax, dword [ebp - 8]
call dword [ebp - 0x10]
mov ebx, eax
test bl, bl
je 0x469985
push 0x80
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x469985
mov eax, dword [ebp - 8]
call fcn.00428db8
mov ebx, eax
test bl, bl
jne 0x469993
mov byte [ebp - 0x11], 0
cmp byte [ebp - 9], 0
jne 0x46999f
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x4698f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4699bc
lea eax, [ebp - 0x18]
call fcn.0042e4f8
ret
Function at 0x46ad34
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov edi, edx
test edi, edi
jbe 0x46aeac
mov ebx, eax
mov eax, edi
mov esi, 3
xor edx, edx
div esi
mov esi, eax
test esi, esi
jns 0x46ad59
call fcn.00403edc
test esi, esi
jle 0x46aded
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
movzx edx, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ad88
call fcn.00403edc
movzx edx, byte [edx + 0x56534c]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ada3
call fcn.00403edc
movzx edx, byte [edx + 0x56534c]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46adbf
call fcn.00403edc
movzx edx, byte [edx + 0x56534c]
mov byte [ecx + 2], dl
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46add6
call fcn.00403edc
movzx eax, byte [eax + 0x56534c]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec esi
jne 0x46ad61
mov eax, edi
mov esi, 3
xor edx, edx
div esi
dec edx
je 0x46ae03
dec edx
je 0x46ae48
jmp 0x46aeac
movzx eax, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ae1b
call fcn.00403edc
movzx edx, byte [edx + 0x56534c]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46ae34
call fcn.00403edc
movzx eax, byte [eax + 0x56534c]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x46aeac
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ae69
call fcn.00403edc
movzx edx, byte [edx + 0x56534c]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ae84
call fcn.00403edc
movzx edx, byte [edx + 0x56534c]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46ae9e
call fcn.00403edc
movzx eax, byte [eax + 0x56534c]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
pop edi
pop esi
pop ebx
ret
Function at 0x4a12b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x566ea4
test edx, edx
jne 0x4a12cf
xor eax, eax
jmp 0x4a13ed
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4a12ec
push esi
push edx
push eax
call fcn.004a13f4
add esp, 0xc
jmp 0x4a13ed
push esi
push edx
push eax
call fcn.004a16b4
add esp, 0xc
jmp 0x4a13ed
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4bb804
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4bb825
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4bb812
pop edi
pop esi
pop ebx
ret

Function at 0x4bb860
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004bb82c
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004bb82c
mov esi, eax
xor eax, eax
mov edx, dword [0x67085c]
mov dword [ebp - 8], edx
mov edx, dword [0x670860]
mov dword [ebp - 0xc], edx
mov edx, dword [0x670864]
mov dword [ebp - 0x10], edx
mov edx, dword [0x670868]
mov dword [ebp - 0x14], edx
mov edx, 0x20
add eax, 0x9e3779b9
mov ecx, esi
shl ecx, 4
mov edi, dword [ebp - 8]
xor edi, esi
add ecx, edi
mov edi, esi
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0xc]
add ebx, ecx
mov ecx, ebx
shl ecx, 4
mov edi, dword [ebp - 0x10]
xor edi, ebx
add ecx, edi
mov edi, ebx
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0x14]
add esi, ecx
dec edx
jne 0x4bb8ae
mov eax, ebx
call fcn.004bb82c
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, esi
call fcn.004bb82c
mov edx, dword [ebp - 4]
add edx, 4
mov dword [edx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bb90c
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004bb82c
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004bb82c
mov esi, eax
mov eax, 0xc6ef3720
mov edx, dword [0x67085c]
mov dword [ebp - 8], edx
mov edx, dword [0x670860]
mov dword [ebp - 0xc], edx
mov edx, dword [0x670864]
mov dword [ebp - 0x10], edx
mov edx, dword [0x670868]
mov dword [ebp - 0x14], edx
mov edx, 0x20
mov ecx, ebx
shl ecx, 4
mov edi, dword [ebp - 0x10]
xor edi, ebx
add ecx, edi
mov edi, ebx
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0x14]
sub esi, ecx
mov ecx, esi
shl ecx, 4
mov edi, dword [ebp - 8]
xor edi, esi
add ecx, edi
mov edi, esi
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0xc]
sub ebx, ecx
sub eax, 0x9e3779b9
dec edx
jne 0x4bb95d
mov eax, ebx
call fcn.004bb82c
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, esi
call fcn.004bb82c
mov edx, dword [ebp - 4]
add edx, 4
mov dword [edx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ddbc0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x4ddbde
mov byte [ebp - 5], 1
jmp 0x4ddcb6
mov byte [ebp - 5], 0
mov esi, dword [ebp - 4]
cmp esi, 0x10000
jb 0x4ddcb6
cmp esi, ebx
jb 0x4ddcb6
mov eax, esi
sub eax, ebx
cmp eax, 0x7ffffffe
jge 0x4ddcb6
mov edx, esi
sub edx, ebx
inc edx
mov eax, ebx
call fcn.0040ea20
test al, al
je 0x4ddcb6
xor eax, eax
push ebp
push 0x4ddcac
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4ddc96
lea ecx, [ebp - 0x58]
xor edx, edx
mov eax, ebx
call fcn.00414188
cmp byte [ebp - 0x4f], 0
je 0x4ddc43
cmp ebx, dword [ebp - 0x54]
jne 0x4ddc4d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ddcb6
mov ebx, dword [ebp - 0x54]
mov esi, dword [ebp - 0x48]
cmp esi, 0xcc
je 0x4ddc8c
cmp esi, 0xc2
je 0x4ddc8c
cmp esi, 0xc3
je 0x4ddc8c
cmp byte [ebp - 0x35], 0
je 0x4ddc96
mov edi, dword [ebp - 0x48]
cmp edi, 0xe9
je 0x4ddc8c
cmp edi, 0xe8
je 0x4ddc8c
cmp edi, 0xff
jne 0x4ddc96
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ddcb6
mov eax, dword [ebp - 4]
dec eax
cmp eax, ebx
ja 0x4ddc2c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ddcb6
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f2f64
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004054fc
xor eax, eax
push ebp
push 0x4f3099
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4f306c
xor edx, edx
push ebp
push 0x4f3065
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x4f2fb1
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4f303a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x4f3029
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4f2ff0
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.0040550c
lea ecx, [ebx + 1]
mov edx, esi
call fcn.00403348
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3030
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x56adf8]
mov dl, 1
mov eax, dword [0x426e1c]
call fcn.0042c74c
call fcn.00404984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f30a0
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x4f30a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4f3263
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.004057f8
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x4f327c
call fcn.00405358
mov eax, ebx
call fcn.00445414
mov edi, eax
dec edi
test edi, edi
jl 0x4f3160
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004453e8
mov edx, dword [0x4e7a44]
call fcn.00404198
test al, al
je 0x4f315c
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.004453e8
lea edx, [ebp - 0x14]
call fcn.00512d38
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.004057f8
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
inc esi
dec edi
jne 0x4f310e
movzx eax, byte [0x4f3280]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4f328c
mov eax, dword [ebp - 8]
call fcn.0042dbd8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.004050c4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00512d38
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4f327c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.00512d38
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4f327c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4f327c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x4f3298
call fcn.004299f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f326a
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00405050
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405050
lea eax, [ebp - 0x14]
call fcn.0040502c
lea eax, [ebp - 0x10]
call fcn.0040502c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret