joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7ff8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov esi, ebx
mov eax, esi
call fcn.00492c88
test al, al
jne 0x4b806a
mov eax, esi
call fcn.00492b7c
test al, al
jne 0x4b806a
mov eax, esi
call fcn.00492e8c
test al, al
jne 0x4b806a
mov eax, esi
call fcn.00492ed8
test al, al
jne 0x4b806a
mov eax, esi
call fcn.00492e60
test al, al
jne 0x4b806a
mov eax, esi
call fcn.00492de8
test al, al
jne 0x4b806a
mov eax, esi
call fcn.00492e10
test al, al
jne 0x4b806a
mov eax, esi
call fcn.00492e38
test al, al
jne 0x4b806a
mov eax, esi
call fcn.00492eb0
test al, al
je 0x4b8112
xor eax, eax
push ebp
push 0x4b8101
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0041ffe8
test al, al
je 0x4b80f0
mov eax, dword [0x66b800]
mov byte [eax], 1
lea eax, [ebp - 4]
push eax
push 0
push ebx
push 0x4b7f80
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x77a328], eax
cmp dword [0x77a328], 0
jne 0x4b80b5
xor eax, eax
call fcn.004b7d14
jmp 0x4b80f7
push 0xfa0
mov eax, dword [0x77a328]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x4b80f7
xor edx, edx
mov eax, dword [0x77a328]
call fcn.00473994
mov eax, dword [0x77a328]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [0x77a328], eax
xor eax, eax
call fcn.004b7d14
jmp 0x4b80f7
mov eax, esi
call fcn.004b7d14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b8112
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4b8794
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b880f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.0040650c
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
test esi, esi
je 0x4b87ce
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebx]
call fcn.0040627c
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, eax
mov eax, ebx
call fcn.0040650c
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.0042102c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00405e24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8816
lea eax, [ebp - 8]
call fcn.00405dd0
ret
Function at 0x4b8828
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push 0x1000
mov eax, dword [0x66b988]
mov eax, dword [eax]
call eax
test eax, eax
je 0x4b884a
mov byte [ebp - 1], 1
jmp 0x4b8911
mov byte [ebp - 1], 0
call fcn.004b9460
test al, al
je 0x4b8911
mov eax, dword [0x66b55c]
cmp dword [eax], 0
je 0x4b8911
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x4b891c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
xor eax, eax
push ebp
push 0x4b890a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4b88a3
call fcn.004057d4
jmp 0x4b8911
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4b8950
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0x4b88ed
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_GetCurrentProcessId
push eax
mov eax, dword [0x66b55c]
mov eax, dword [eax]
call eax
test eax, eax
je 0x4b88ed
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8911
cmp dword [ebp - 8], 0
je 0x4b8909
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b92c4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x14], eax
push 0x80000001
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x80000001
mov edx, 0x7fffffff
mov eax, 0x7fffffff
call fcn.0046005c
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push 0x4b9238
call sub.user32.dll_EnumWindows
test eax, eax
je 0x4b9314
mov edi, ebx
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebx], 0x7fffffff
jne 0x4b932a
push 0
push ebx
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0046005c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4be1d4
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov byte [ebp - 1], dl
mov esi, eax
lea eax, [ebp - 2]
xor ecx, ecx
mov edx, 1
call fcn.0040d87c
lea eax, [ebp - 8]
push eax
push 0
push 0x28
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4be231
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x4be231
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4be23e
mov byte [ebp - 2], 0
jmp 0x4be3db
xor eax, eax
push ebp
push 0x4be3d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
call fcn.0040627c
push eax
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x4be278
mov byte [ebp - 2], 0
call fcn.004057d4
jmp 0x4be3db
cmp byte [ebp - 1], 0
je 0x4be351
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0xc]
call fcn.00403498
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4be34a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x4be334
mov eax, dword [ebp - 0x14]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x4be334
inc esi
xor ebx, ebx
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [edx + eax*4 + 4]
mov dword [ebp - 0x1c], ecx
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x14]
add edx, 4
mov edi, dword [edx + eax*4 + 8]
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x20]
mov ecx, 8
call fcn.0041f6e8
test al, al
je 0x4be330
test edi, 2
jne 0x4be31d
test edi, 1
je 0x4be334
mov byte [ebp - 2], 0
call fcn.004057d4
call fcn.004057d4
jmp 0x4be3db
inc ebx
dec esi
jne 0x4be2d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be351
mov eax, dword [ebp - 0x14]
call fcn.004034b4
ret
movzx eax, byte [ebp - 1]
mov eax, dword [eax*4 + 0x6635c4]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x10
call fcn.0040d87c
mov dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x10
lea eax, [ebp - 0x30]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x4be3b9
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete byte [ebp - 2]
cmp byte [ebp - 2], 0
je 0x4be3bd
cmp dword [ebp - 0x10], 0x10
jne 0x4be3bd
cmp dword [ebp - 0x40], 1
jne 0x4be3bd
test byte [ebp - 0x34], 2
sete byte [ebp - 2]
jmp 0x4be3bd
mov byte [ebp - 2], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4be3db
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4be400
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, 0x4be42c
call fcn.004be3e8
test al, al
je 0x4be41d
mov dword [ebx], 1
pop ebx
pop ebp
ret
xor eax, eax
mov dword [ebx], eax
pop ebx
pop ebp
ret

Function at 0x4be440
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
cmp dword [eax], 0
je 0x4be456
xor edx, edx
mov dword [eax], edx
mov eax, 0x4be460
call fcn.004be3f4
pop ebp
ret

Function at 0x4bf698
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4bf6b9
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4bf6a6
pop edi
pop esi
pop ebx
ret

Function at 0x4bf6f4
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
mov eax, dword [esi]
call fcn.004bf6c0
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004bf6c0
mov esi, eax
xor eax, eax
mov edx, dword [edi]
mov dword [ebp - 8], edx
mov edx, dword [edi + 4]
mov dword [ebp - 0xc], edx
mov edx, dword [edi + 8]
mov dword [ebp - 0x10], edx
mov edx, dword [edi + 0xc]
mov dword [ebp - 0x14], edx
mov edx, 0x20
add eax, 0x9e3779b9
mov ecx, esi
shl ecx, 4
mov edi, dword [ebp - 8]
xor edi, esi
add ecx, edi
mov edi, esi
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0xc]
add ebx, ecx
mov ecx, ebx
shl ecx, 4
mov edi, dword [ebp - 0x10]
xor edi, ebx
add ecx, edi
mov edi, ebx
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0x14]
add esi, ecx
dec edx
jne 0x4bf737
mov eax, ebx
call fcn.004bf6c0
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, esi
call fcn.004bf6c0
mov edx, dword [ebp - 4]
add edx, 4
mov dword [edx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bf798
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
mov eax, dword [esi]
call fcn.004bf6c0
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004bf6c0
mov esi, eax
mov eax, 0xc6ef3720
mov edx, dword [edi]
mov dword [ebp - 8], edx
mov edx, dword [edi + 4]
mov dword [ebp - 0xc], edx
mov edx, dword [edi + 8]
mov dword [ebp - 0x10], edx
mov edx, dword [edi + 0xc]
mov dword [ebp - 0x14], edx
mov edx, 0x20
mov ecx, ebx
shl ecx, 4
mov edi, dword [ebp - 0x10]
xor edi, ebx
add ecx, edi
mov edi, ebx
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0x14]
sub esi, ecx
mov ecx, esi
shl ecx, 4
mov edi, dword [ebp - 8]
xor edi, esi
add ecx, edi
mov edi, esi
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0xc]
sub ebx, ecx
sub eax, 0x9e3779b9
dec edx
jne 0x4bf7de
mov eax, ebx
call fcn.004bf6c0
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, esi
call fcn.004bf6c0
mov edx, dword [ebp - 4]
add edx, 4
mov dword [edx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c0714
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4c082c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, edi
call fcn.00405e68
cmp dword [ebp - 4], 0
je 0x4c0764
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x4c0764
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00406324
mov edi, ebx
and edi, 0x300
and ebx, 0xfffffcff
push 0
lea eax, [ebp - 0xc]
push eax
push 0
or edi, 0x20006
push edi
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x4c0811
xor eax, eax
push ebp
push 0x4c080a
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, esi
test ebx, ebx
je 0x4c07be
sub ebx, 4
mov ebx, dword [ebx]
mov eax, ebx
push eax
mov eax, esi
call fcn.0040627c
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0040627c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x4c07f3
call fcn.00451724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0816
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
call fcn.00451724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0833
lea eax, [ebp - 4]
call fcn.00405dd0
ret
Function at 0x4c2c78
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4c2e6d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x28]
mov eax, dword [0x66b7f8]
call fcn.00408588
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00439fb4
mov eax, dword [ebp - 0x24]
push eax
test ebx, ebx
setne al
pop edx
call fcn.0041c98c
mov byte [ebp - 0x11], 1
mov dl, 1
mov eax, dword [0x45f3cc]
call fcn.00404db8
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x4c2e03
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004c2738
push dword [ebp - 4]
push 0x4c2e88
push 0x4c2e94
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00406180
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, 0x3f
call fcn.004c28c0
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4c2de8
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
push dword [ebp - 4]
push 0x4c2e88
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x30]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00406180
mov bl, 1
mov eax, dword [ebp - 8]
call fcn.0040627c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4c2d93
test al, 0x10
je 0x4c2d93
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ebp - 9]
mov eax, dword [ebp - 8]
call fcn.004c2c78
mov ebx, eax
jmp 0x4c2dce
cmp dword [ebp - 0x10], 0
je 0x4c2da3
mov edx, eax
mov eax, dword [ebp - 8]
call dword [ebp - 0x10]
mov ebx, eax
test bl, bl
je 0x4c2dce
push 0x80
mov eax, dword [ebp - 8]
call fcn.0040627c
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4c2dce
mov eax, dword [ebp - 8]
call fcn.0041f5e0
mov ebx, eax
test bl, bl
jne 0x4c2ddc
mov byte [ebp - 0x11], 0
cmp byte [ebp - 9], 0
jne 0x4c2de8
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x4c2d41
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2e0a
mov ebx, dword [0x66be9c]
mov ebx, dword [ebx]
lea eax, [ebp - 0x18]
call ebx
ret
Function at 0x4c8e74
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb4
push ebx
xor ecx, ecx
mov dword [ebp - 0x448], ecx
mov dword [ebp - 0x44c], ecx
xor ecx, ecx
push ebp
push 0x4c8fa5
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x444]
call fcn.0044f0fc
call fcn.00440e8c
test al, al
je 0x4c8f17
mov eax, dword [0x66b8e4]
call fcn.00403f28
call fcn.00403690
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x444]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x444]
call fcn.0044b064
push eax
lea eax, [ebp - 0x444]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x4c8fbc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4c8f87
mov ebx, dword [0x66f7f8]
test ebx, ebx
jne 0x4c8f28
call fcn.0041f908
mov ebx, eax
push 0x40
lea eax, [ebp - 0x44]
push eax
mov eax, dword [0x66b808]
mov eax, dword [eax + 4]
push eax
mov eax, ebx
call fcn.004079f8
push eax
call sub.user32.dll_LoadStringA_1
push 0
lea eax, [ebp - 0x448]
lea edx, [ebp - 0x44]
mov ecx, 0x40
call fcn.00406040
mov eax, dword [ebp - 0x448]
push eax
lea eax, [ebp - 0x44c]
lea edx, [ebp - 0x444]
mov ecx, 0x400
call fcn.00406040
mov eax, dword [ebp - 0x44c]
mov ecx, 0x2010
pop edx
call fcn.00440b60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8fac
lea eax, [ebp - 0x44c]
mov edx, 2
call fcn.00405df4
ret
Function at 0x4de668
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x4de686
mov byte [ebp - 5], 1
jmp 0x4de75e
mov byte [ebp - 5], 0
mov esi, dword [ebp - 4]
cmp esi, 0x10000
jb 0x4de75e
cmp esi, ebx
jb 0x4de75e
mov eax, esi
sub eax, ebx
cmp eax, 0x7ffffffe
jge 0x4de75e
mov edx, esi
sub edx, ebx
inc edx
mov eax, ebx
call fcn.0041f7d4
test al, al
je 0x4de75e
xor eax, eax
push ebp
push 0x4de754
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4de73e
lea ecx, [ebp - 0x58]
xor edx, edx
mov eax, ebx
call fcn.0042af5c
cmp byte [ebp - 0x4f], 0
je 0x4de6eb
cmp ebx, dword [ebp - 0x54]
jne 0x4de6f5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4de75e
mov ebx, dword [ebp - 0x54]
mov esi, dword [ebp - 0x48]
cmp esi, 0xcc
je 0x4de734
cmp esi, 0xc2
je 0x4de734
cmp esi, 0xc3
je 0x4de734
cmp byte [ebp - 0x35], 0
je 0x4de73e
mov edi, dword [ebp - 0x48]
cmp edi, 0xe9
je 0x4de734
cmp edi, 0xe8
je 0x4de734
cmp edi, 0xff
jne 0x4de73e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4de75e
mov eax, dword [ebp - 4]
dec eax
cmp eax, ebx
ja 0x4de6d4
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4de75e
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50b918
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x50b91e
ret
Function at 0x51afd8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x6652bc
test edx, edx
jne 0x51aff7
xor eax, eax
jmp 0x51b115
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x51b014
push esi
push edx
push eax
call fcn.0051b11c
add esp, 0xc
jmp 0x51b115
push esi
push edx
push eax
call fcn.0051b3dc
add esp, 0xc
jmp 0x51b115
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x51cb60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, ecx
mov eax, dword [ebp - 8]
cmp byte [eax], 0
jne 0x51cbb3
xor edx, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, edx
mov ebx, 8
test cl, 1
je 0x51cb96
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x51cb98
shr ecx, 1
dec ebx
jne 0x51cb87
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
inc edx
add dword [ebp - 0xc], 4
cmp edx, 0x100
jne 0x51cb80
mov eax, dword [ebp - 8]
mov byte [eax], 1
mov eax, dword [ebp + 8]
dec eax
test eax, eax
jl 0x51cbde
inc eax
xor edx, edx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + edx]
xor ecx, esi
and ecx, 0xff
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + ecx*4]
shr esi, 8
xor ecx, esi
mov esi, ecx
inc edx
dec eax
jne 0x51cbbe
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x51eb50
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, dword [ebx]
movzx edx, byte [ebp - 1]
call fcn.00477b6c
mov esi, eax
mov dword [ebx], esi
mov eax, dword [ebx + 4]
and esi, 0xff
add eax, esi
imul edi, eax, 0x8088405
inc edi
mov dword [ebx + 4], edi
mov edx, edi
shr edx, 0x18
mov eax, dword [ebx + 8]
call fcn.00477b6c
mov dword [ebx + 8], eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x51ec34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
cmp dword [ebp - 8], 0
setne al
mov edx, 0x51ed34
call fcn.0041c98c
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0051ebe0
mov edi, 0xa
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, pe_nt_image_headers32
call fcn.00403a90
mov ebx, eax
lea eax, [esi + 4]
call fcn.0051eb98
mov byte [ebp - 9], al
lea eax, [esi + 4]
mov edx, ebx
call fcn.0051eb50
xor bl, byte [ebp - 9]
mov eax, dword [ebp - 0x10]
mov byte [eax], bl
inc dword [ebp - 0x10]
dec edi
jne 0x51ec6b
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0051ebe0
mov edi, 0xa
lea ebx, [ebp - 0x1c]
lea eax, [esi + 4]
call fcn.0051eb98
mov byte [ebp - 9], al
lea eax, [esi + 4]
movzx edx, byte [ebx]
call fcn.0051eb50
movzx eax, byte [ebp - 9]
xor byte [ebx], al
inc ebx
dec edi
jne 0x51ecac
movzx ebx, byte [ebp + 0xa]
lea eax, [esi + 4]
call fcn.0051eb98
mov byte [ebp - 9], al
lea eax, [esi + 4]
mov edx, ebx
call fcn.0051eb50
xor bl, byte [ebp - 9]
mov byte [ebp - 0x12], bl
movzx ebx, byte [ebp + 0xb]
lea eax, [esi + 4]
call fcn.0051eb98
mov byte [ebp - 9], al
lea eax, [esi + 4]
mov edx, ebx
call fcn.0051eb50
xor bl, byte [ebp - 9]
mov byte [ebp - 0x11], bl
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
mov byte [esi + 0x10], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4