joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469040
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x469237
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x46909f
lea edx, [ebp - 0x28]
mov eax, dword [0x55c69c]
call fcn.004075e0
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0041f5c8
mov eax, dword [ebp - 0x24]
mov ecx, 0x9e8
mov edx, 0x469250
call fcn.00404f58
mov byte [ebp - 0x11], 1
mov dl, 1
mov eax, dword [0x439130]
call fcn.00403fdc
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x4691cd
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00468a90
push dword [ebp - 4]
push 0x469278
push 0x469284
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.004053cc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, 0x3f
call fcn.00468c3c
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4691b7
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
push dword [ebp - 4]
push 0x469278
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x30]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
mov bl, 1
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x469162
test al, 0x10
je 0x469162
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ebp - 9]
mov eax, dword [ebp - 8]
call fcn.00469040
mov ebx, eax
jmp 0x46919d
cmp dword [ebp - 0x10], 0
je 0x469172
mov edx, eax
mov eax, dword [ebp - 8]
call dword [ebp - 0x10]
mov ebx, eax
test bl, bl
je 0x46919d
push 0x80
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x46919d
mov eax, dword [ebp - 8]
call fcn.00428c10
mov ebx, eax
test bl, bl
jne 0x4691ab
mov byte [ebp - 0x11], 0
cmp byte [ebp - 9], 0
jne 0x4691b7
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x469110
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4691d4
lea eax, [ebp - 0x18]
call fcn.0042e350
ret
Function at 0x469398
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4693a0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4694f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040502c
lea eax, [ebp - 4]
call fcn.00469320
cmp dword [ebp - 4], 0
jne 0x4693e5
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004035a4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.00428d44
test esi, esi
jne 0x46948c
lea eax, [ebp - 0x18]
push eax
call fcn.00427a98
lea edx, [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.0045b86c
movzx eax, byte [0x469508]
push eax
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
mov edx, 0x469514
mov eax, dword [ebp - 8]
call fcn.004463b4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
call fcn.004050c4
movzx eax, byte [0x469518]
push eax
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
mov edx, 0x469524
mov eax, dword [ebp - 8]
call fcn.004463b4
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
call fcn.004050c4
movzx eax, byte [0x469518]
push eax
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov edx, 0x469530
mov eax, dword [ebp - 8]
call fcn.004463b4
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 8]
call fcn.004050c4
push dword [ebp - 4]
push dword [ebp - 8]
push 0x46953c
mov eax, ebx
mov edx, 3
call fcn.004053cc
jmp 0x4694d0
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00405794
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
push 0
mov eax, esi
call fcn.0040550c
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x4694d0
lea eax, [ebp - 8]
call fcn.004678f4
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00405080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4694ff
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00405050
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret
Function at 0x46a54c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov edi, edx
test edi, edi
jbe 0x46a6c4
mov ebx, eax
mov eax, edi
mov esi, 3
xor edx, edx
div esi
mov esi, eax
test esi, esi
jns 0x46a571
call fcn.00403edc
test esi, esi
jle 0x46a605
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
movzx edx, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46a5a0
call fcn.00403edc
movzx edx, byte [edx + 0x55734c]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46a5bb
call fcn.00403edc
movzx edx, byte [edx + 0x55734c]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46a5d7
call fcn.00403edc
movzx edx, byte [edx + 0x55734c]
mov byte [ecx + 2], dl
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46a5ee
call fcn.00403edc
movzx eax, byte [eax + 0x55734c]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec esi
jne 0x46a579
mov eax, edi
mov esi, 3
xor edx, edx
div esi
dec edx
je 0x46a61b
dec edx
je 0x46a660
jmp 0x46a6c4
movzx eax, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46a633
call fcn.00403edc
movzx edx, byte [edx + 0x55734c]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46a64c
call fcn.00403edc
movzx eax, byte [eax + 0x55734c]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x46a6c4
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46a681
call fcn.00403edc
movzx edx, byte [edx + 0x55734c]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46a69c
call fcn.00403edc
movzx edx, byte [edx + 0x55734c]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46a6b6
call fcn.00403edc
movzx eax, byte [eax + 0x55734c]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
pop edi
pop esi
pop ebx
ret
Function at 0x46f5a8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x46f5b1
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46f7dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040502c
mov eax, edi
call fcn.0040502c
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, ebx
call fcn.00445f6c
test al, al
je 0x46f7b9
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x46f7b9
mov eax, esi
call fcn.0040309c
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x46f7b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
push esi
push 0
mov eax, ebx
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x46f79c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x46f7ec
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46f6e6
push 0x46f810
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov edx, 4
call fcn.00428684
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00428684
push dword [ebp - 0x24]
push 0x46f82c
lea eax, [ebp - 4]
mov edx, 4
call fcn.004053cc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46f6e6
cmp dword [ebp - 0x10], 1
jbe 0x46f6e6
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.004290f0
mov ecx, eax
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.0040511c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x46f840
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46f79c
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
call fcn.004086d0
mov ebx, eax
mov eax, dword [ebp - 0x1c]
movzx esi, word [eax + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
call fcn.004086d0
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0xc]
mov word [ebp - 0x14], ax
lea edx, [ebp - 0x28]
movzx eax, bx
call fcn.00428570
push dword [ebp - 0x28]
push 0x46f84c
lea edx, [ebp - 0x2c]
movzx eax, si
call fcn.00428570
push dword [ebp - 0x2c]
push 0x46f84c
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0x12]
call fcn.00428570
push dword [ebp - 0x30]
push 0x46f84c
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x14]
call fcn.00428570
push dword [ebp - 0x34]
mov eax, edi
mov edx, 7
call fcn.004053cc
mov eax, dword [edi]
mov edx, 0x46f858
call fcn.00405458
jne 0x46f79c
mov eax, edi
call fcn.0040502c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f7b9
mov eax, dword [ebp - 0x18]
call fcn.004030b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f7e3
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.00405050
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x46fa38
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [edi], eax
mov eax, ebx
call fcn.0046f500
test al, al
je 0x46fa8d
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x46fa8d
push esi
push ebx
call sub.kernel32.dll_SizeofResource
mov dword [edi], eax
push esi
push ebx
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x46fa8d
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x491a6c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x491a72
ret
Function at 0x4a09b4
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x558ea4
test edx, edx
jne 0x4a09d3
xor eax, eax
jmp 0x4a0af1
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4a09f0
push esi
push edx
push eax
call fcn.004a0af8
add esp, 0xc
jmp 0x4a0af1
push esi
push edx
push eax
call fcn.004a0db8
add esp, 0xc
jmp 0x4a0af1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4a1fac
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, ecx
mov edx, dword [ebp - 8]
cmp byte [edx], 0
jne 0x4a1fff
xor esi, esi
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov ecx, esi
mov ebx, 8
test cl, 1
je 0x4a1fe2
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x4a1fe4
shr ecx, 1
dec ebx
jne 0x4a1fd3
mov edx, dword [ebp - 0xc]
mov dword [edx], ecx
inc esi
add dword [ebp - 0xc], 4
cmp esi, 0x100
jne 0x4a1fcc
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov edx, dword [ebp + 8]
dec edx
test edx, edx
jl 0x4a2044
inc edx
xor esi, esi
cmp esi, 0x7ffffffe
jbe 0x4a2017
call fcn.00403edc
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + esi]
xor ecx, eax
and ecx, 0xff
cmp ecx, 0xff
jbe 0x4a2033
call fcn.00403edc
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + ecx*4]
shr eax, 8
xor ecx, eax
mov eax, ecx
inc esi
dec edx
jne 0x4a200a
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4a8b20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
test ebx, ebx
je 0x4a8c2f
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 8], eax
call fcn.00446e7c
mov byte [ebp - 9], al
xor eax, eax
call fcn.00446ee8
xor eax, eax
push ebp
push 0x4a8c28
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.004a7340
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a8c0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004a8f18
dec eax
test eax, eax
jl 0x4a8bf4
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004a9f70
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 8]
je 0x4a8bec
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004a9f70
call fcn.004a9c50
cmp al, 1
je 0x4a8bec
xor eax, eax
push ebp
push 0x4a8be2
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004a9f70
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a8bec
inc dword [ebp - 4]
dec dword [ebp - 0x14]
jne 0x4a8b8d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8c11
lea eax, [ebp - 0x10]
call fcn.0040f788
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a8c90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
test esi, esi
je 0x4a8e83
test edi, edi
je 0x4a8d27
call fcn.004a67e0
xor eax, eax
push ebp
push 0x4a8d20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004a8f18
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4a8d0d
mov edx, ebx
mov eax, esi
call fcn.004a8f28
cmp edi, dword [eax + 4]
jne 0x4a8d07
lea eax, [ebp - 8]
push eax
mov edx, ebx
mov eax, esi
call fcn.004a8f28
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetExitCodeThread
test eax, eax
je 0x4a8cfc
cmp dword [ebp - 8], 0x103
je 0x4a8d07
mov edx, ebx
mov eax, esi
call fcn.004a8a74
jmp 0x4a8d0d
dec ebx
cmp ebx, 0xffffffff
jne 0x4a8ccb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8e83
call fcn.004a67f8
ret
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount
mov edx, dword [esi + 0xc]
cmp eax, edx
jbe 0x4a8d53
sub eax, edx
cmp eax, 0x3e8
jae 0x4a8d53
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004a8c90
jmp 0x4a8e83
call sub.kernel32.dll_GetTickCount
mov dword [esi + 0xc], eax
xor eax, eax
call fcn.004a7340
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a8e7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
call fcn.004a9f68
mov edi, eax
dec edi
test edi, edi
jl 0x4a8df3
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004a9f70
mov byte [eax + 0x58], 0
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004a9f70
cmp dword [eax + 0xc], 0
je 0x4a8def
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004a9f70
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 4]
je 0x4a8def
lea eax, [ebp - 8]
push eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004a9f70
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetExitCodeThread
test eax, eax
je 0x4a8ddd
cmp dword [ebp - 8], 0x103
je 0x4a8def
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004a9f70
mov byte [eax + 0x58], 1
mov byte [ebp - 0xd], 1
inc ebx
dec edi
jne 0x4a8d89
cmp byte [ebp - 0xd], 0
jne 0x4a8e03
call fcn.00404a30
jmp 0x4a8e83
call fcn.004a67e0
xor eax, eax
push ebp
push 0x4a8e5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004a8f18
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4a8e4c
mov edx, ebx
mov eax, esi
call fcn.004a8f28
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xc]
call fcn.004a8c38
test al, al
je 0x4a8e46
mov edx, ebx
mov eax, esi
call fcn.004a8a74
dec ebx
cmp ebx, 0xffffffff
jne 0x4a8e25
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8e66
call fcn.004a67f8
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ae578
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, edi
call fcn.004b0048
mov esi, ebx
test esi, esi
jne 0x4ae5b6
push 0x4ae6e4
push 0x4ae6f0
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x4ae5b6
mov edx, dword [ebp - 4]
push edx
call eax
mov esi, eax
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 8
call fcn.004038b8
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x4ae6d8
xor eax, eax
push ebp
push 0x4ae6d1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
je 0x4ae5f0
mov ebx, dword [ebp + 8]
jmp 0x4ae5ff
lea edx, [ebp - 8]
mov eax, 0xcc
call fcn.0040f7a4
mov ebx, eax
xor eax, eax
push ebp
push 0x4ae6b3
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
jne 0x4ae619
mov dword [ebx], 0x10007
cmp dword [ebp + 8], 0
jne 0x4ae62d
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x4ae697
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x90]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetThreadSelectorEntry
test eax, eax
je 0x4ae697
cmp dword [ebp + 0x1c], 0
je 0x4ae653
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
jmp 0x4ae65c
mov eax, dword [ebx + 0xb8]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ae51c
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
movzx eax, byte [ebp + 0x18]
push eax
push esi
push 1
movzx eax, byte [ebp + 0x14]
push eax
movzx eax, byte [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push ebx
mov ecx, dword [ebx + 0xb4]
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.004ae478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae6ba
cmp dword [ebp + 8], 0
jne 0x4ae6b2
mov eax, dword [ebp - 8]
call fcn.004030b8
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4b0300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
push edi
mov byte [ebp - 0x7d], cl
mov edi, edx
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x78]
mov edx, dword [0x4737f4]
call fcn.00405c60
xor eax, eax
push ebp
push 0x4b0386
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x4b036a
mov eax, edi
call fcn.004b05d0
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4b036a
inc ebx
xor esi, esi
lea ecx, [ebp - 0x78]
mov edx, esi
mov eax, edi
call fcn.004b0648
movzx eax, byte [ebp - 0x7d]
xor al, 1
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1f], 0
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
call fcn.004b03e0
inc esi
dec ebx
jne 0x4b0342
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b038d
lea eax, [ebp - 0x78]
mov edx, dword [0x4737f4]
call fcn.00405d30
ret
Function at 0x4baf08
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4baf29
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4baf16
pop edi
pop esi
pop ebx
ret

Function at 0x4baf64
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004baf30
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004baf30
mov esi, eax
xor eax, eax
mov edx, dword [0x66185c]
mov dword [ebp - 8], edx
mov edx, dword [0x661860]
mov dword [ebp - 0xc], edx
mov edx, dword [0x661864]
mov dword [ebp - 0x10], edx
mov edx, dword [0x661868]
mov dword [ebp - 0x14], edx
mov edx, 0x20
add eax, 0x9e3779b9
mov ecx, esi
shl ecx, 4
mov edi, dword [ebp - 8]
xor edi, esi
add ecx, edi
mov edi, esi
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0xc]
add ebx, ecx
mov ecx, ebx
shl ecx, 4
mov edi, dword [ebp - 0x10]
xor edi, ebx
add ecx, edi
mov edi, ebx
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0x14]
add esi, ecx
dec edx
jne 0x4bafb2
mov eax, ebx
call fcn.004baf30
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, esi
call fcn.004baf30
mov edx, dword [ebp - 4]
add edx, 4
mov dword [edx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bb010
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004baf30
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004baf30
mov esi, eax
mov eax, 0xc6ef3720
mov edx, dword [0x66185c]
mov dword [ebp - 8], edx
mov edx, dword [0x661860]
mov dword [ebp - 0xc], edx
mov edx, dword [0x661864]
mov dword [ebp - 0x10], edx
mov edx, dword [0x661868]
mov dword [ebp - 0x14], edx
mov edx, 0x20
mov ecx, ebx
shl ecx, 4
mov edi, dword [ebp - 0x10]
xor edi, ebx
add ecx, edi
mov edi, ebx
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0x14]
sub esi, ecx
mov ecx, esi
shl ecx, 4
mov edi, dword [ebp - 8]
xor edi, esi
add ecx, edi
mov edi, esi
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0xc]
sub ebx, ecx
sub eax, 0x9e3779b9
dec edx
jne 0x4bb061
mov eax, ebx
call fcn.004baf30
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, esi
call fcn.004baf30
mov edx, dword [ebp - 4]
add edx, 4
mov dword [edx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c6edc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebx + 4], 0x12345678
mov dword [ebx + 8], 0x23456789
mov dword [ebx + 0xc], 0x34567890
mov eax, dword [ebp - 4]
call fcn.00405308
mov esi, eax
test esi, esi
jle 0x4c6f4e
mov edi, 1
mov eax, dword [ebp - 4]
movzx edx, byte [eax + edi - 1]
mov eax, dword [ebx + 4]
call fcn.00449e4c
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
and eax, 0xff
add dword [ebx + 8], eax
imul eax, dword [ebx + 8], 0x8088405
inc eax
mov dword [ebx + 8], eax
mov edx, dword [ebx + 8]
shr edx, 0x18
mov eax, dword [ebx + 0xc]
call fcn.00449e4c
mov dword [ebx + 0xc], eax
inc edi
dec esi
jne 0x4c6f10
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret