joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0320
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4c03c3
test eax, eax
jbe 0x4c03c3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4c03c3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x4c036e
xor esi, esi
jmp 0x4c0374
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x4c039f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004c2650
add esi, eax
push esi
mov ebx, esi
call fcn.004c2650
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x4c0380
pop ebp
test edi, edi
pop edi
jne 0x4c03c3
test ebx, ebx
je 0x4c03c3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0053b860
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x4c0505
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4c061d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4c061d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00550c40
mov esi, eax
test esi, esi
je 0x4c061d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4c061d
mov ecx, esi
call fcn.004c0470
cmp edi, eax
jge 0x4c061d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4c05a3
mov dword [esp + 0x34], 1
jmp 0x4c05fe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4c061d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004be1d0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x4ce6c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x408
push ebx
push ebp
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
xor esi, esi
push eax
push 0x400
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [esp + 0x420]
lea edi, [esp + 0x18]
push ecx
or ecx, 0xffffffff
xor eax, eax
push 0xb277cc
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + ecx + 0x20]
push edx
call fcn.0053d116
mov ebp, dword [esp + 0x428]
mov al, byte [esp + 0x1f]
lea edi, [esp + 0x24]
or ecx, 0xffffffff
mov byte [ebp], al
xor eax, eax
add esp, 0xc
mov dword [ebp + 4], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 8], esi
mov ebx, ecx
mov dword [ebp + 0xc], esi
cmp ebx, 0xfffffffd
jbe 0x4ce74e
call fcn.0054b2d3
mov ecx, dword [ebp + 4]
cmp ecx, esi
je 0x4ce780
mov al, byte [ecx - 1]
test al, al
je 0x4ce780
cmp al, 0xff
je 0x4ce780
cmp ebx, esi
jne 0x4ce7b1
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebp
call fcn.004d01b0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x408
ret 8
cmp ebx, esi
jne 0x4ce79c
push 1
mov ecx, ebp
call fcn.004d01b0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x408
ret 8
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x4ce7a8
cmp eax, ebx
jae 0x4ce7b9
push 1
mov ecx, ebp
call fcn.004d01b0
push ebx
mov ecx, ebp
call fcn.004cf420
mov edi, dword [ebp + 4]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov dword [ebp + 8], ebx
pop edi
pop esi
mov byte [eax + ebx], 0
mov eax, ebp
pop ebp
pop ebx
add esp, 0x408
ret 8
Function at 0x4ceb80
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x55e238
push eax
mov dword fs:[0], esp
sub esp, 0x10
xor al, al
push ebx
push ebp
push esi
mov esi, ecx
mov cl, byte [esi + 0xc]
test cl, cl
je 0x4ceca4
mov ecx, dword [esi + 4]
xor ebp, ebp
sub ecx, ebp
je 0x4cecb6
dec ecx
je 0x4cebfc
dec ecx
jne 0x4ceca4
mov eax, dword [esi + 8]
cmp eax, ebp
je 0x4ceccb
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, 1
jne 0x4ceccb
mov dword [esi + 8], ebp
mov eax, dword [esi + 0x18]
cmp eax, ebp
je 0x4cebf5
mov eax, dword [0x9e8b20]
lea ecx, [esi + 0x10]
push eax
push ebp
call fcn.004cf100
mov bl, 1
jmp 0x4cec97
mov edx, dword [0x9e8b20]
mov cl, byte [esi + 0x10]
push edi
lea edi, [esi + 0x10]
push edx
mov byte [esp + 0x14], cl
push ebp
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call fcn.004cef00
mov eax, dword [esi + 8]
mov dword [esp + 0x28], ebp
cmp eax, ebp
je 0x4cec85
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp eax, 1
jne 0x4cec85
mov dword [esi + 8], ebp
mov eax, dword [esi + 0x18]
cmp eax, ebp
je 0x4cec54
mov eax, dword [0x9e8b20]
mov ecx, edi
push eax
push ebp
call fcn.004cf100
mov eax, dword [esp + 0x14]
mov bl, 1
cmp eax, ebp
jne 0x4cec63
mov eax, 0x9e8b1c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x14]
pop edi
cmp ecx, ebp
je 0x4cec93
mov al, byte [ecx - 1]
test al, al
je 0x4cec89
cmp al, 0xff
je 0x4cec89
dec al
mov byte [ecx - 1], al
jmp 0x4cec93
xor bl, bl
jmp 0x4cec6a
dec ecx
push ecx
call fcn.0054ef7f
add esp, 4
test bl, bl
je 0x4ceca2
mov dword [esi + 4], 0xffffffff
mov byte [esi + 0xc], 0
mov al, bl
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov eax, dword [esi]
cmp eax, ebp
je 0x4ceccb
push eax
call fcn.004cfc60
add esp, 4
mov dword [esi], ebp
mov bl, 1
jmp 0x4cec97
mov ecx, dword [esp + 0x1c]
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4cf5b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push ebp
push esi
push edi
xor edi, edi
push 0xb277ec
push str.E2EE_IDR_DLL
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x4cf5ff
call fcn.005587d0
mov edi, dword [eax + 0xc]
test edi, edi
jne 0x4cf5e4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
push 0xb277ec
push str.E2EE_IDR_DLL
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x4cf5ff
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
jne 0x4cf615
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4cf629
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
jne 0x4cf642
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
mov edi, dword [esp + 0x18]
push edi
push ebx
push ebp
call fcn.004cfd60
add esp, 0xc
test al, al
jne 0x4cf6e1
mov eax, dword [edi + 8]
cmp eax, ebx
jb 0x4cf6e9
mov esi, dword [0x9e8b28]
jae 0x4cf671
call fcn.0054b4f2
mov ecx, edi
call fcn.004cf8f0
mov eax, dword [edi + 8]
mov ecx, eax
sub ecx, ebx
cmp ecx, esi
jae 0x4cf685
mov esi, ecx
test esi, esi
jbe 0x4cf6c3
mov ecx, dword [edi + 4]
sub eax, esi
sub eax, ebx
push eax
lea eax, [ecx + esi]
add eax, ebx
add ecx, ebx
push eax
push ecx
call fcn.0053b260
mov ebp, dword [edi + 8]
add esp, 0xc
sub ebp, esi
mov ecx, edi
push 0
push ebp
call fcn.004cf7d0
test al, al
je 0x4cf6bf
mov ecx, dword [edi + 4]
mov dword [edi + 8], ebp
mov byte [ecx + ebp], 0
mov ebp, dword [esp + 0x10]
mov edi, dword [edi + 4]
test edi, edi
jne 0x4cf6cf
mov edi, 0x9e8b24
mov ecx, ebx
mov esi, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret
mov edx, ebx
push 0
sub edx, eax
mov ecx, edi
push edx
call fcn.004cf700
jmp 0x4cf6c3
Function at 0x4d6c90
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + 0xb27ac4]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0xb27a54]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4d6ca3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4d6ce4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0xb27afc]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4d6d16
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4d6d1a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4d6d0b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4d6d38
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4d6d3c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4d6d2d
xor ecx, ecx
mov eax, 0xb27a64
xor ebx, ebx
mov bl, byte [ecx + 0xb27b0c]
cmp byte [esp + ebx + 0x14], 0
je 0x4d6d67
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0xb27b24]
cmp byte [esp + ebx + 0x14], 0
je 0x4d6d7e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, 0xb27ac4
jl 0x4d6d4e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4d6cd7
lea edx, [esp + 0x84]
push edx
call fcn.004d6dc0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4df0f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x55e640
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.004df4c0
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0
call fcn.004df4c0
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x3c], 1
call fcn.004df530
lea ecx, [esp + 0x10]
call fcn.00487330
cmp eax, 1
jae 0x4df198
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
push 0
call ebx
mov edi, eax
test edi, edi
je 0x4df203
lea ecx, [edi + 1]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4df203
push esi
push edi
call ebx
push esi
lea ecx, [esp + 0x14]
call fcn.004df530
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x10]
call fcn.00487330
cmp eax, 1
jb 0x4df203
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.004def90
test eax, eax
je 0x4df203
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.004df270
mov edi, dword [esp + 0x44]
xor esi, esi
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x24]
call fcn.004df590
push edi
lea ecx, [esp + 0x24]
call fcn.004df5b0
push esi
lea ecx, [esp + 0x24]
call fcn.004df650
push str..tmp
lea ecx, [esp + 0x24]
call fcn.004df5b0
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
call fcn.004def70
test eax, eax
je 0x4df239
inc esi
cmp esi, 0x7a0a1f00
jb 0x4df1ba
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.004df4e0
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.004df4e0
xor eax, eax
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x20]
push eax
call fcn.004df590
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.004df4e0
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.004df4e0
mov eax, 1
jmp 0x4df224
Function at 0x4df9c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x55e6f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.004df4c0
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x28], 0
call fcn.004df530
push 0
mov ecx, esi
call fcn.004df940
mov ebx, dword [esp + 0x2c]
cmp ebx, 1
jb 0x4dfaf8
lea ecx, [esp + 0xc]
call fcn.00487330
cmp eax, 1
jae 0x4dfa47
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004df4e0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
mov eax, dword [esp + 0x34]
lea edi, [esi + 0xc]
test eax, eax
jne 0x4dfa94
push 0
lea ecx, [esp + 0x10]
call fcn.00487320
push eax
push edi
mov ecx, 0xb65d1c
call fcn.004df0f0
test eax, eax
jne 0x4dfa9c
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004df4e0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
push eax
mov ecx, edi
call fcn.004df530
push edi
mov ecx, 0xb65d1c
call fcn.004df050
push 0
push 2
push 2
push 0
push 3
push 0xc0000000
mov ecx, edi
call fcn.00487310
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x4dfaf8
push 0
push ebx
push 0
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x4dfaf8
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 8], eax
jne 0x4dfb28
push 1
mov ecx, esi
call fcn.004df940
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.004df4e0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
lea ecx, [esp + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esp + 0x24], 0xffffffff
call fcn.004df4e0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc

Function at 0x4e0460
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x110]
call fcn.004df530
pop edi
add esp, 0x104
ret 4
Function at 0x4eb970
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x4eb9a3
push esi
call fcn.004f08b0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4eb99c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4eba29
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4eba12
mov eax, dword [esi + 8]
test eax, eax
je 0x4eb9c7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4eba0e
cmp eax, 2
je 0x4eba12
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4eb9ba
cmp eax, 3
je 0x4eb9ed
cmp eax, 1
jne 0x4eb9ba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4eb9ba
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4eb9ba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004eba60
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4eba49
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.004eba60
add esp, 4
pop esi
ret

Function at 0x51c480
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x51c48b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x51c58e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0xab55e8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0xab55e8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0xab55e8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0xab55e8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0xab55e8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0xab55e8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0xab55e8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0xab55e8]
xor eax, edx
inc ecx
dec edi
jne 0x51c4a6
pop edi
test esi, esi
je 0x51c5b0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0xab55e8]
xor eax, edx
inc ecx
dec esi
jne 0x51c592
pop esi
pop ebx
not eax
ret
Function at 0x53d413
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x53d433
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0053c49a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x53d456
test byte [esp + 8], 2
je 0x53d456
call fcn.0053c50d
mov dword [eax], 0xd
call fcn.0053c516
mov dword [eax], 5
jmp 0x53d42f
xor eax, eax
ret

Function at 0x5515e3
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x55161b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0054f670
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0054f648
jmp 0x551627
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x552cd9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x552d1b
call fcn.005587d0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x552d1b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x552d12
xor eax, eax
jmp 0x552d23
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00552d29
pop edi
pop esi
pop ebx
ret 4

Function at 0x558d00
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x558d2e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x558d4c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00558c66
jmp 0x558d4c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x558d4c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00558c66
test edi, edi
mov eax, edi
jne 0x558d36
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x415e13
Capabilities:
Encode data using xor

Disassembly:
push ds
lcall 0xac, 0x972200bf
and al, 0x99

Function at 0x41a070
Capabilities:
Encode data using xor

Disassembly:
shl dword [edi + 0x7db54cb4], 1
inc esp
xchg esi, eax
fistp word [ebp - 0x53a9ea98]
jb 0x41a0fb
outsb dx, byte [esi]
adc byte [ebp + 0x7fe8ee68], dh
mov al, 0xd8
cmp byte [edx - 0x5d59c37f], 0x82
mov byte [0xfc8d1882], al
jl 0x41a076
adc eax, 0xbaaefe52
pop es
frstor dword [edi]
add cl, byte [eax]
test eax, 0xf56c4fac
sub ecx, edx
pop edi
cmp eax, 0xc2a56c58
mov ch, 0x6a
jl 0x41a0d3
push es
mov dword [ecx], ebp
aam 0x28
pop eax
mov al, 0xb8
fadd qword [esp + eax*4 + 0x6e]
cmp esp, dword [ecx + 0x57]
sub eax, 0xb6338fcf
insb byte es:[edi], dx
shr dword [edx + 0x57e52531], 0x15
lodsb al, byte [esi]
iretd
stosb byte es:[edi], al
xor dword [0xac1557e5], esp
push ebp
xchg esi, eax
push esi
loopne 0x41a0c2
out dx, al
sti
cmp bl, ah
jg 0x41a0c8
sub esi, ebp
jnp 0x41a13d
invalid
mov al, byte [0xb2f29f9e]
dec ebp
mov edi, 0x4256c1a8
int 0xe8
mov ah, 0x74
adc byte [ecx - 0x5c11acbc], bh
pushal
inc ebp
dec eax
movsb byte es:[edi], byte [esi]
inc ebx
xlatb
hlt
push edx
stc
push ecx
pushal
jns 0x41a1b9
sub ch, byte [eax + 0x27]
cmp eax, 0xd68cb23a
sbb byte [ebx + 0x3f84fbfb], 0xdb
clc
lodsd eax, dword [esi]
push ds
mov cl, 0x9b
xchg byte [edi + 0x5f48d7da], bh
jbe 0x41a196
push ebp
push esi
scasd eax, dword es:[edi]
ficomp word [ebp + 0x1963cb64]
invalid
ret 0xd1b
inc ecx
loope 0x41a17c
insd dword es:[edi], dx
movsb byte es:[edi], byte [esi]
fisub word [ebp + 0x182dd138]
cwde
inc ebx
je 0x41a1f3
insd dword es:[edi], dx
dec esi
add dl, byte [eax - 0x5a5a79da]
scasd eax, dword es:[edi]
out 0xca, al
inc edi
pop es
inc ebx
fisub word [eax + 0x2bc31670]
arpl word [ecx + 0x28], dx
retf
sub esp, dword [ebx + 0x51]
sub bl, cl
sub ecx, dword [ecx]
out dx, eax
invalid

Function at 0x41ad42
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
pop ebp
das
mul bh
inc ebx
mov dh, 0xb
adc al, byte [esi]
mov ebx, 0xdd80b639
insd dword es:[edi], dx
popal
cwde
invalid
add dword [ebp + 0xe], ecx
cmp edx, dword [edi - 0x52]
adc eax, 0x2c7ba400
jge 0x41adab
or al, 0x1f
pushfd
wait
dec eax
add al, 0x91
jo 0x41ad03
sbb eax, dword [ebx - 1]
wait
iretd
or byte [ebx + 0x45], ch
adc eax, 0xa9e2ceb9
aas
ljmp 0xc2e7

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx