joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486474
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4dcc14]
cmp dword [eax + 0x30], 0
je 0x48651e
cmp dword [ebx + 0x94], 0
jne 0x486518
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x486404
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x486518
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4864de
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x486518
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041e0c4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4864ed
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x487080
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4870b5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404d9c
jmp 0x4870c2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404d00
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x487fb8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x487ff9
mov eax, esi
call fcn.0046eae0
test al, al
je 0x487ff9
mov eax, dword [ebx + 0x84]
call fcn.0046e880
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x487ff9
push 0
mov eax, dword [ebx + 0x84]
call fcn.0046e880
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x48aa3c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48aac1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x26]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403368
mov dword [ebp - 0x26], ebx
mov dword [ebp - 0x22], 3
lea eax, [ebp - 8]
mov ecx, 0x48aad8
mov edx, esi
call fcn.00404fd4
mov eax, dword [ebp - 8]
call fcn.00405188
mov dword [ebp - 0x1e], eax
mov al, byte [ebp - 1]
call fcn.0048aa14
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48aac8
lea eax, [ebp - 8]
call fcn.00404cac
ret
Function at 0x48ae38
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x48aff0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
mov dl, 1
mov eax, dword [0x41c178]
call fcn.00403e44
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x48af86
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0048ac10
lea eax, [ebp - 0x24]
mov ecx, 0x48b008
mov edx, dword [ebp - 0x14]
call fcn.00404fd4
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov edx, 0x3f
call fcn.0048ac78
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x48af70
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
push dword [ebp - 0x14]
push 0x48b018
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x28]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405048
mov bl, 1
mov eax, dword [ebp - 0x18]
call fcn.00405188
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x48af1b
test al, 0x10
je 0x48af1b
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 1]
mov eax, dword [ebp - 0x18]
call fcn.0048ae38
mov ebx, eax
jmp 0x48af56
cmp dword [ebp - 8], 0
je 0x48af2b
mov edx, eax
mov eax, dword [ebp - 0x18]
call dword [ebp - 8]
mov ebx, eax
test bl, bl
je 0x48af56
push 0x80
mov eax, dword [ebp - 0x18]
call fcn.00405188
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x48af56
mov eax, dword [ebp - 0x18]
call fcn.00409e7c
mov ebx, eax
test bl, bl
jne 0x48af64
mov byte [ebp - 9], 0
cmp byte [ebp - 1], 0
jne 0x48af70
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x48aeca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48af8d
lea eax, [ebp - 0x10]
call fcn.0040f648
ret
Function at 0x48b04c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48b0f3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405188
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x48b0dd
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00405314
mov eax, dword [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405188
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x48b0dd
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x48b104
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x48b0dd
cmp dword [ebp - 8], 0x34
jne 0x48b0dd
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b0fa
lea eax, [ebp - 0x10]
call fcn.00404cac
ret

Function at 0x48b2fc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48b465
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.00403368
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x4c47bc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4c47c0], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4c47c4], eax
mov eax, dword [0x4dbd14]
cmp dword [eax], 2
sete byte [0x4c472c]
push 0x48b470
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.0048b01c
cmp byte [0x4c472c], 0
jne 0x48b388
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0048b04c
test al, al
je 0x48b388
mov eax, dword [ebp - 0x4c]
mov dword [0x4dd1b8], eax
jmp 0x48b38f
xor eax, eax
mov dword [0x4dd1b8], eax
call fcn.0048b198
and eax, 0x7f
cmp eax, 0xb
ja case.0x48b3a0.0
jmp dword [eax*4 + 0x48b3a7]
mov byte [0x4c4718], 1
jmp case.0x48b3a0.0
mov byte [0x4c471c], 1
jmp case.0x48b3a0.0
mov byte [0x4c4720], 1
jmp case.0x48b3a0.0
mov byte [0x4c4724], 1
jmp case.0x48b3a0.0
mov byte [0x4c4728], 1
jmp case.0x48b3a0.0
mov byte [0x4c4730], 1
mov byte [0x4c4734], 1
jmp case.0x48b3a0.0
mov byte [0x4c4730], 1
mov byte [0x4c4738], 1
jmp case.0x48b3a0.0
mov byte [0x4c4730], 1
mov byte [0x4c473c], 1
jmp case.0x48b3a0.0
mov byte [0x4c4740], 1
jmp case.0x48b3a0.0
mov byte [0x4c4744], 1
jmp case.0x48b3a0.0
mov byte [0x4c4748], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b46c
lea eax, [ebp - 4]
call fcn.00404cac
ret
Function at 0x4915f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405178
xor eax, eax
push ebp
push 0x491688
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00491bc4
test al, al
jne 0x491637
lea eax, [ebp - 0x20c]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
jmp 0x491645
lea eax, [ebp - 0x20c]
mov edx, dword [ebp - 4]
call fcn.0040a3cc
lea eax, [ebp - 0x108]
push eax
xor bl, 1
xor eax, eax
mov al, bl
push eax
push 0x491698
lea eax, [ebp - 0x20c]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, esi
lea eax, [ebp - 0x108]
call fcn.0040a53c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49168f
lea eax, [ebp - 4]
call fcn.00404cac
ret

Function at 0x491708
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x491795
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040a168
xor ebx, ebx
mov edx, dword [ebp - 0xc]
mov eax, 0x4917ac
call fcn.004052cc
mov esi, eax
test esi, esi
jle 0x49177f
mov eax, dword [ebp - 0xc]
call fcn.00404f88
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
lea eax, [ebp - 0xc]
call fcn.00405228
mov eax, dword [ebp - 0xc]
call fcn.00404f88
mov ecx, eax
lea eax, [ebp - 5]
mov edx, dword [ebp - 0xc]
call fcn.0040a3f0
lea eax, [ebp - 5]
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49179c
lea eax, [ebp - 0xc]
call fcn.00404cac
ret

Function at 0x4917b0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x11c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x491896
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x11c]
mov eax, ebx
call fcn.0040a054
lea eax, [ebp - 0x11c]
mov edx, 0x4918b4
call fcn.00404f90
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
call fcn.0040a3cc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x49187d
xor eax, eax
push ebp
push 0x491859
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
imul dword [ebp - 0xc]
imul dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49187d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49189d
lea eax, [ebp - 0x11c]
call fcn.00404cac
ret
Function at 0x4919ec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x491b9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040a054
cmp dword [ebp - 0xc], 0
jne 0x491a3c
lea eax, [ebp - 0x10]
call fcn.0040a30c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040a054
lea eax, [ebp - 0xc]
mov edx, 0x491bb4
call fcn.00404f90
mov eax, ebx
call fcn.00492090
sub al, 2
jb 0x491a5b
je 0x491a6e
jmp case.default.0x491ac3
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x491ac3
mov edx, ebx
mov eax, 0x491bc0
call fcn.004052cc
dec eax
jne 0x491aac
call fcn.00491990
test al, al
je 0x491a99
mov eax, dword [ebp - 0xc]
call fcn.004918b8
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x491ac3
mov dword [ebp - 8], 0x7fffffff
mov dword [ebp - 4], 0
jmp case.default.0x491ac3
mov eax, dword [ebp - 0xc]
call fcn.00405188
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.default.0x491ac3
jmp dword [eax*4 + 0x491aca]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x491ac3
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x491ac3
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x491ac3
mov eax, dword [ebp - 0xc]
call fcn.004917b0
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x491ac3
mov eax, dword [ebp - 0xc]
call fcn.0049197c
cdq
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x491ac3
mov eax, dword [ebp - 0xc]
call fcn.004917b0
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x491ac3
mov eax, dword [ebp - 0xc]
call fcn.004918b8
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0xffffffff
jne 0x491b63
cmp dword [ebp - 8], 0xffffffff
jb 0x491b78
jmp 0x491b65
jl 0x491b78
cmp dword [ebp - 4], 0
jne 0x491b76
cmp dword [ebp - 8], 0x7fffffff
jbe 0x491b7f
jmp 0x491b78
jle 0x491b7f
mov ebx, 0x7fffffff
jmp 0x491b82
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491ba4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404cd0
ret

Function at 0x491bc4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, eax
xor ebx, ebx
mov edx, esi
mov eax, 0x491c20
call fcn.004052cc
test eax, eax
jne 0x491c0a
mov edx, esi
mov eax, 0x491c2c
call fcn.004052cc
test eax, eax
jne 0x491c0a
mov eax, esp
mov edx, esi
call fcn.0040a3cc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x491c0a
test al, 0x10
je 0x491c0a
mov bl, 1
mov eax, ebx
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x492ae0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, dword [eax]
movzx ecx, cx
dec ecx
test ecx, ecx
jl 0x492b0f
inc ecx
mov ebx, esi
xor bl, byte [edx]
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4c4c58]
shr esi, 8
and esi, 0xffffff
xor ebx, esi
mov esi, ebx
inc edx
dec ecx
jne 0x492aed
mov dword [eax], esi
pop esi
pop ebx
ret

Function at 0x493a44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [eax]
sub ecx, 1
jno 0x493a55
call fcn.00403db4
test ecx, ecx
jl 0x493a7a
inc ecx
mov ebx, edx
xor bl, byte [esi]
and ebx, 0xff
mov edi, dword [0x4db6d8]
mov ebx, dword [edi + ebx*4]
shr edx, 8
xor ebx, edx
mov edx, ebx
add esi, 1
dec ecx
jne 0x493a5a
mov dword [eax], edx
pop edi
pop esi
pop ebx
ret

Function at 0x493f28
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x2c]
sub eax, dword [ebx + 0x28]
cmp eax, dword [esp]
jge 0x493f57
mov ecx, 0xeb
mov edx, 0x494078
mov eax, 0x4940d4
call fcn.00404c8c
mov eax, dword [esp + 4]
cmp eax, dword [esp]
je 0x493f7e
mov eax, dword [esp]
dec eax
cmp eax, dword [esp + 4]
je 0x493f7e
mov ecx, 0xed
mov edx, 0x494078
mov eax, 0x49411c
call fcn.00404c8c
mov eax, dword [ebx + 0x28]
mov edx, dword [esp]
cmp edx, dword [esp + 4]
jle 0x493f8b
inc eax
mov edx, dword [ebx + 0x18]
mov dword [esp + 8], edx
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x20]
mov esi, dword [esp + 4]
dec esi
test esi, esi
jl 0x493fcb
inc esi
shl edx, 5
movzx edi, byte [eax + 2]
xor edx, edi
and edx, 0x3fff
mov edi, eax
and edi, dword [ebx + 0x58]
mov ebp, dword [esp + 8]
lea ebp, [ebp + edi*4]
mov edi, dword [ecx + edx*4]
mov dword [ebp], edi
mov dword [ecx + edx*4], eax
inc eax
dec esi
jne 0x493fa2
mov esi, dword [esp + 8]
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x28], eax
cmp byte [ebx + 4], 0
je 0x494004
mov eax, dword [esp]
add dword [ebx + 0x44], eax
mov eax, dword [esp]
add dword [ebx + 0x48], eax
cmp byte [ebx + 0x34], 0
je 0x49401e
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x49401e
mov eax, ebx
call fcn.004944a4
jmp 0x49401e
mov edx, eax
sub edx, dword [ebx + 0x44]
cmp edx, dword [ebx + 0x5c]
jl 0x49401e
mov byte [ebx + 4], 1
sub eax, dword [ebx + 0x5c]
sub eax, dword [ebx + 0x44]
add dword [ebx + 0x44], eax
add dword [ebx + 0x48], eax
cmp word [ebx + 0x3a], 0
je 0x494056
mov eax, dword [esp]
add dword [ebx + 0x10], eax
mov esi, dword [ebx + 0x10]
test esi, 0xfff
jne 0x494056
mov dword [esp + 0xc], esi
fild dword [esp + 0xc]
fmul dword [0x494158]
fild dword [ebx + 0x50]
fdivp st(1)
call fcn.00402ce8
mov edx, eax
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x494065
mov eax, ebx
call fcn.004944a4
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x495040
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, ecx
mov ebx, edx
mov dword [esp], eax
lea edi, [esp + 4]
mov eax, dword [esp]
cmp byte [eax + 4], 0
jne 0x49506f
mov ecx, 0xc5
mov edx, 0x49510c
mov eax, 0x495168
call fcn.00404c8c
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [edi + 4], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov dword [edi + 8], eax
dec esi
test esi, esi
jl 0x4950e0
inc esi
mov eax, dword [edi + 8]
and eax, 0xffff
or eax, 2
mov dl, byte [ebx]
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [ebx], dl
mov edx, dword [edi]
mov al, byte [ebx]
call fcn.00492b14
mov ebp, eax
mov dword [edi], ebp
and ebp, 0xff
add dword [edi + 4], ebp
imul ebp, dword [edi + 4], 0x8088405
inc ebp
mov dword [edi + 4], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [edi + 8]
call fcn.00492b14
mov dword [edi + 8], eax
inc ebx
dec esi
jne 0x49508f
mov eax, dword [esp]
mov edx, dword [edi]
mov dword [eax + 8], edx
mov eax, dword [esp]
mov edx, dword [edi + 4]
mov dword [eax + 0xc], edx
mov eax, dword [esp]
mov edx, dword [edi + 8]
mov dword [eax + 0x10], edx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4951b0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
test esi, esi
jne 0x4951d8
mov ecx, 0xf5
mov edx, 0x495260
mov eax, 0x4952bc
call fcn.00404c8c
mov edx, esi
mov eax, ebx
call fcn.004952f0
mov dword [ebp - 8], 0xc
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
and eax, 0xffff
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
shr edx, 8
xor dl, byte [edi]
mov byte [esi], dl
mov edx, dword [ebx + 8]
mov al, byte [esi]
call fcn.00492b14
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00492b14
mov dword [ebx + 0x10], eax
inc esi
inc edi
dec dword [ebp - 8]
jne 0x4951ee
mov al, byte [ebp + 0xb]
cmp al, byte [ebp - 9]
sete al
mov byte [ebx + 4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4952f0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [esp]
call fcn.00404f88
mov esi, eax
test esi, esi
jle 0x49535e
mov edi, 1
mov eax, dword [esp]
mov al, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.00492b14
mov ebp, eax
mov dword [ebx + 8], ebp
and ebp, 0xff
add dword [ebx + 0xc], ebp
imul ebp, dword [ebx + 0xc], 0x8088405
inc ebp
mov dword [ebx + 0xc], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00492b14
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x495322
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x495630
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
cmp dword [ebp - 8], 0
jne 0x49565b
mov ecx, 0x189
mov edx, 0x495820
mov eax, 0x49587c
call fcn.00404c8c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00495a1c
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov eax, pe_nt_image_headers32
call fcn.00403388
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
mov al, byte [ebp - 9]
call fcn.00492b14
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00492b14
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x49566f
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00495a1c
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov al, byte [edi]
mov edx, dword [ebx + 8]
call fcn.00492b14
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00492b14
mov dword [ebx + 0x10], eax
mov eax, esi
xor byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x4956ea
mov al, byte [ebp + 0xa]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
mov al, byte [ebp - 9]
call fcn.00492b14
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00492b14
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x12], al
mov al, byte [ebp + 0xb]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
mov al, byte [ebp - 9]
call fcn.00492b14
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00492b14
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x11], al
mov byte [ebx + 4], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4