joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469900
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x469af7
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x46995f
lea edx, [ebp - 0x28]
mov eax, dword [0x581e6c]
call fcn.0040765c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0041f6d4
mov eax, dword [ebp - 0x24]
mov ecx, 0x9e8
mov edx, 0x469b10
call fcn.00404f58
mov byte [ebp - 0x11], 1
mov dl, 1
mov eax, dword [0x4393b8]
call fcn.00403fdc
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x469a8d
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00469350
push dword [ebp - 4]
push 0x469b38
push 0x469b44
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.004053cc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, 0x3f
call fcn.004694fc
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x469a77
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
push dword [ebp - 4]
push 0x469b38
lea ecx, [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x30]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004053cc
mov bl, 1
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x469a22
test al, 0x10
je 0x469a22
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ebp - 9]
mov eax, dword [ebp - 8]
call fcn.00469900
mov ebx, eax
jmp 0x469a5d
cmp dword [ebp - 0x10], 0
je 0x469a32
mov edx, eax
mov eax, dword [ebp - 8]
call dword [ebp - 0x10]
mov ebx, eax
test bl, bl
je 0x469a5d
push 0x80
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x469a5d
mov eax, dword [ebp - 8]
call fcn.00428e40
mov ebx, eax
test bl, bl
jne 0x469a6b
mov byte [ebp - 0x11], 0
cmp byte [ebp - 9], 0
jne 0x469a77
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x4699d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469a94
lea eax, [ebp - 0x18]
call fcn.0042e580
ret
Function at 0x469c58
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x469c60
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x469db8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040502c
lea eax, [ebp - 4]
call fcn.00469be0
cmp dword [ebp - 4], 0
jne 0x469ca5
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004035a4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call fcn.00428f74
test esi, esi
jne 0x469d4c
lea eax, [ebp - 0x18]
push eax
call fcn.00427bac
lea edx, [ebp - 8]
lea eax, [ebp - 0x18]
call fcn.0045c12c
movzx eax, byte [0x469dc8]
push eax
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
mov edx, 0x469dd4
mov eax, dword [ebp - 8]
call fcn.0044663c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
call fcn.004050c4
movzx eax, byte [0x469dd8]
push eax
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
mov edx, 0x469de4
mov eax, dword [ebp - 8]
call fcn.0044663c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
call fcn.004050c4
movzx eax, byte [0x469dd8]
push eax
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov edx, 0x469df0
mov eax, dword [ebp - 8]
call fcn.0044663c
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 8]
call fcn.004050c4
push dword [ebp - 4]
push dword [ebp - 8]
push 0x469dfc
mov eax, ebx
mov edx, 3
call fcn.004053cc
jmp 0x469d90
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00405794
mov eax, dword [ebp - 8]
call fcn.0040550c
push eax
push 0
mov eax, esi
call fcn.0040550c
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
je 0x469d90
lea eax, [ebp - 8]
call fcn.004681b4
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00405080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469dbf
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00405050
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405050
ret
Function at 0x46ae0c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov edi, edx
test edi, edi
jbe 0x46af84
mov ebx, eax
mov eax, edi
mov esi, 3
xor edx, edx
div esi
mov esi, eax
test esi, esi
jns 0x46ae31
call fcn.00403edc
test esi, esi
jle 0x46aec5
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
movzx edx, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ae60
call fcn.00403edc
movzx edx, byte [edx + 0x57c34c]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ae7b
call fcn.00403edc
movzx edx, byte [edx + 0x57c34c]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46ae97
call fcn.00403edc
movzx edx, byte [edx + 0x57c34c]
mov byte [ecx + 2], dl
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46aeae
call fcn.00403edc
movzx eax, byte [eax + 0x57c34c]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec esi
jne 0x46ae39
mov eax, edi
mov esi, 3
xor edx, edx
div esi
dec edx
je 0x46aedb
dec edx
je 0x46af20
jmp 0x46af84
movzx eax, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46aef3
call fcn.00403edc
movzx edx, byte [edx + 0x57c34c]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46af0c
call fcn.00403edc
movzx eax, byte [eax + 0x57c34c]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x46af84
movzx eax, byte [ebx]
shl eax, 0x10
movzx edx, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46af41
call fcn.00403edc
movzx edx, byte [edx + 0x57c34c]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
cmp edx, 0x3f
jbe 0x46af5c
call fcn.00403edc
movzx edx, byte [edx + 0x57c34c]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
cmp eax, 0x3f
jbe 0x46af76
call fcn.00403edc
movzx eax, byte [eax + 0x57c34c]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
pop edi
pop esi
pop ebx
ret
Function at 0x46fe68
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x46fe71
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47009c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040502c
mov eax, edi
call fcn.0040502c
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, ebx
call fcn.004461f4
test al, al
je 0x470079
lea eax, [ebp - 0xc]
push eax
mov eax, ebx
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x470079
mov eax, esi
call fcn.0040309c
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x470072
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
push esi
push 0
mov eax, ebx
call fcn.0040550c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x47005c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4700ac
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46ffa6
push 0x4700d0
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov edx, 4
call fcn.00428798
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 2]
mov edx, 4
call fcn.00428798
push dword [ebp - 0x24]
push 0x4700ec
lea eax, [ebp - 4]
mov edx, 4
call fcn.004053cc
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.0040550c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x46ffa6
cmp dword [ebp - 0x10], 1
jbe 0x46ffa6
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.00429320
mov ecx, eax
mov eax, dword [ebp - 8]
mov edx, ebx
call fcn.0040511c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x470100
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x47005c
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
call fcn.004087dc
mov ebx, eax
mov eax, dword [ebp - 0x1c]
movzx esi, word [eax + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
call fcn.004087dc
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0xc]
mov word [ebp - 0x14], ax
lea edx, [ebp - 0x28]
movzx eax, bx
call fcn.00428684
push dword [ebp - 0x28]
push 0x47010c
lea edx, [ebp - 0x2c]
movzx eax, si
call fcn.00428684
push dword [ebp - 0x2c]
push 0x47010c
lea edx, [ebp - 0x30]
movzx eax, word [ebp - 0x12]
call fcn.00428684
push dword [ebp - 0x30]
push 0x47010c
lea edx, [ebp - 0x34]
movzx eax, word [ebp - 0x14]
call fcn.00428684
push dword [ebp - 0x34]
mov eax, edi
mov edx, 7
call fcn.004053cc
mov eax, dword [edi]
mov edx, 0x470118
call fcn.00405458
jne 0x47005c
mov eax, edi
call fcn.0040502c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470079
mov eax, dword [ebp - 0x18]
call fcn.004030b8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4700a3
lea eax, [ebp - 0x34]
mov edx, 6
call fcn.00405050
lea eax, [ebp - 4]
call fcn.0040502c
ret
Function at 0x4702f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [edi], eax
mov eax, ebx
call fcn.0046fdc0
test al, al
je 0x47034d
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x47034d
push esi
push ebx
call sub.kernel32.dll_SizeofResource
mov dword [edi], eax
push esi
push ebx
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x47034d
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x492364
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x49236a
ret
Function at 0x4a165c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x57deb0
test edx, edx
jne 0x4a167b
xor eax, eax
jmp 0x4a1799
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4a1698
push esi
push edx
push eax
call fcn.004a17a0
add esp, 0xc
jmp 0x4a1799
push esi
push edx
push eax
call fcn.004a1a60
add esp, 0xc
jmp 0x4a1799
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4a2c54
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, ecx
mov edx, dword [ebp - 8]
cmp byte [edx], 0
jne 0x4a2ca7
xor esi, esi
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov ecx, esi
mov ebx, 8
test cl, 1
je 0x4a2c8a
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x4a2c8c
shr ecx, 1
dec ebx
jne 0x4a2c7b
mov edx, dword [ebp - 0xc]
mov dword [edx], ecx
inc esi
add dword [ebp - 0xc], 4
cmp esi, 0x100
jne 0x4a2c74
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov edx, dword [ebp + 8]
dec edx
test edx, edx
jl 0x4a2cec
inc edx
xor esi, esi
cmp esi, 0x7ffffffe
jbe 0x4a2cbf
call fcn.00403edc
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + esi]
xor ecx, eax
and ecx, 0xff
cmp ecx, 0xff
jbe 0x4a2cdb
call fcn.00403edc
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + ecx*4]
shr eax, 8
xor ecx, eax
mov eax, ecx
inc esi
dec edx
jne 0x4a2cb2
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4a97c8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
test ebx, ebx
je 0x4a98d7
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 8], eax
call fcn.00447104
mov byte [ebp - 9], al
xor eax, eax
call fcn.00447170
xor eax, eax
push ebp
push 0x4a98d0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.004a7fe8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a98b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004a9bc0
dec eax
test eax, eax
jl 0x4a989c
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004aac18
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 8]
je 0x4a9894
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004aac18
call fcn.004aa8f8
cmp al, 1
je 0x4a9894
xor eax, eax
push ebp
push 0x4a988a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.004aac18
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a9894
inc dword [ebp - 4]
dec dword [ebp - 0x14]
jne 0x4a9835
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a98b9
lea eax, [ebp - 0x10]
call fcn.0040f894
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a9938
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
test esi, esi
je 0x4a9b2b
test edi, edi
je 0x4a99cf
call fcn.004a7488
xor eax, eax
push ebp
push 0x4a99c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004a9bc0
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4a99b5
mov edx, ebx
mov eax, esi
call fcn.004a9bd0
cmp edi, dword [eax + 4]
jne 0x4a99af
lea eax, [ebp - 8]
push eax
mov edx, ebx
mov eax, esi
call fcn.004a9bd0
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetExitCodeThread
test eax, eax
je 0x4a99a4
cmp dword [ebp - 8], 0x103
je 0x4a99af
mov edx, ebx
mov eax, esi
call fcn.004a971c
jmp 0x4a99b5
dec ebx
cmp ebx, 0xffffffff
jne 0x4a9973
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9b2b
call fcn.004a74a0
ret
call sub.kernel32.dll_GetCurrentThreadId_1
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount
mov edx, dword [esi + 0xc]
cmp eax, edx
jbe 0x4a99fb
sub eax, edx
cmp eax, 0x3e8
jae 0x4a99fb
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004a9938
jmp 0x4a9b2b
call sub.kernel32.dll_GetTickCount
mov dword [esi + 0xc], eax
xor eax, eax
call fcn.004a7fe8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a9b24
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
call fcn.004aac10
mov edi, eax
dec edi
test edi, edi
jl 0x4a9a9b
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aac18
mov byte [eax + 0x58], 0
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aac18
cmp dword [eax + 0xc], 0
je 0x4a9a97
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aac18
mov eax, dword [eax + 4]
cmp eax, dword [ebp - 4]
je 0x4a9a97
lea eax, [ebp - 8]
push eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aac18
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetExitCodeThread
test eax, eax
je 0x4a9a85
cmp dword [ebp - 8], 0x103
je 0x4a9a97
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004aac18
mov byte [eax + 0x58], 1
mov byte [ebp - 0xd], 1
inc ebx
dec edi
jne 0x4a9a31
cmp byte [ebp - 0xd], 0
jne 0x4a9aab
call fcn.00404a30
jmp 0x4a9b2b
call fcn.004a7488
xor eax, eax
push ebp
push 0x4a9b07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004a9bc0
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x4a9af4
mov edx, ebx
mov eax, esi
call fcn.004a9bd0
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0xc]
call fcn.004a98e0
test al, al
je 0x4a9aee
mov edx, ebx
mov eax, esi
call fcn.004a971c
dec ebx
cmp ebx, 0xffffffff
jne 0x4a9acd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9b0e
call fcn.004a74a0
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af220
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, edi
call fcn.004b0cf0
mov esi, ebx
test esi, esi
jne 0x4af25e
push 0x4af38c
push 0x4af398
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x4af25e
mov edx, dword [ebp - 4]
push edx
call eax
mov esi, eax
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 8
call fcn.004038b8
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x4af380
xor eax, eax
push ebp
push 0x4af379
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
je 0x4af298
mov ebx, dword [ebp + 8]
jmp 0x4af2a7
lea edx, [ebp - 8]
mov eax, 0xcc
call fcn.0040f8b0
mov ebx, eax
xor eax, eax
push ebp
push 0x4af35b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
jne 0x4af2c1
mov dword [ebx], 0x10007
cmp dword [ebp + 8], 0
jne 0x4af2d5
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetThreadContext
test eax, eax
je 0x4af33f
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x90]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetThreadSelectorEntry
test eax, eax
je 0x4af33f
cmp dword [ebp + 0x1c], 0
je 0x4af2fb
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
jmp 0x4af304
mov eax, dword [ebx + 0xb8]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004af1c4
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
movzx eax, byte [ebp + 0x18]
push eax
push esi
push 1
movzx eax, byte [ebp + 0x14]
push eax
movzx eax, byte [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push ebx
mov ecx, dword [ebx + 0xb4]
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.004af120
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af362
cmp dword [ebp + 8], 0
jne 0x4af35a
mov eax, dword [ebp - 8]
call fcn.004030b8
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4b0fa8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
push edi
mov byte [ebp - 0x7d], cl
mov edi, edx
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x78]
mov edx, dword [0x4740b4]
call fcn.00405c60
xor eax, eax
push ebp
push 0x4b102e
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x4b1012
mov eax, edi
call fcn.004b1278
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4b1012
inc ebx
xor esi, esi
lea ecx, [ebp - 0x78]
mov edx, esi
mov eax, edi
call fcn.004b12f0
movzx eax, byte [ebp - 0x7d]
xor al, 1
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1f], 0
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x7c]
call fcn.004b1088
inc esi
dec ebx
jne 0x4b0fea
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1035
lea eax, [ebp - 0x78]
mov edx, dword [0x4740b4]
call fcn.00405d30
ret
Function at 0x4bbbb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4bbbd1
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4bbbbe
pop edi
pop esi
pop ebx
ret

Function at 0x4bbc0c
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004bbbd8
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004bbbd8
mov esi, eax
xor eax, eax
mov edx, dword [0x68785c]
mov dword [ebp - 8], edx
mov edx, dword [0x687860]
mov dword [ebp - 0xc], edx
mov edx, dword [0x687864]
mov dword [ebp - 0x10], edx
mov edx, dword [0x687868]
mov dword [ebp - 0x14], edx
mov edx, 0x20
add eax, 0x9e3779b9
mov ecx, esi
shl ecx, 4
mov edi, dword [ebp - 8]
xor edi, esi
add ecx, edi
mov edi, esi
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0xc]
add ebx, ecx
mov ecx, ebx
shl ecx, 4
mov edi, dword [ebp - 0x10]
xor edi, ebx
add ecx, edi
mov edi, ebx
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0x14]
add esi, ecx
dec edx
jne 0x4bbc5a
mov eax, ebx
call fcn.004bbbd8
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, esi
call fcn.004bbbd8
mov edx, dword [ebp - 4]
add edx, 4
mov dword [edx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bbcb8
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [esi]
call fcn.004bbbd8
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.004bbbd8
mov esi, eax
mov eax, 0xc6ef3720
mov edx, dword [0x68785c]
mov dword [ebp - 8], edx
mov edx, dword [0x687860]
mov dword [ebp - 0xc], edx
mov edx, dword [0x687864]
mov dword [ebp - 0x10], edx
mov edx, dword [0x687868]
mov dword [ebp - 0x14], edx
mov edx, 0x20
mov ecx, ebx
shl ecx, 4
mov edi, dword [ebp - 0x10]
xor edi, ebx
add ecx, edi
mov edi, ebx
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0x14]
sub esi, ecx
mov ecx, esi
shl ecx, 4
mov edi, dword [ebp - 8]
xor edi, esi
add ecx, edi
mov edi, esi
shr edi, 5
xor edi, eax
add ecx, edi
add ecx, dword [ebp - 0xc]
sub ebx, ecx
sub eax, 0x9e3779b9
dec edx
jne 0x4bbd09
mov eax, ebx
call fcn.004bbbd8
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, esi
call fcn.004bbbd8
mov edx, dword [ebp - 4]
add edx, 4
mov dword [edx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c7b84
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebx + 4], 0x12345678
mov dword [ebx + 8], 0x23456789
mov dword [ebx + 0xc], 0x34567890
mov eax, dword [ebp - 4]
call fcn.00405308
mov esi, eax
test esi, esi
jle 0x4c7bf6
mov edi, 1
mov eax, dword [ebp - 4]
movzx edx, byte [eax + edi - 1]
mov eax, dword [ebx + 4]
call fcn.0044a0d4
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
and eax, 0xff
add dword [ebx + 8], eax
imul eax, dword [ebx + 8], 0x8088405
inc eax
mov dword [ebx + 8], eax
mov edx, dword [ebx + 8]
shr edx, 0x18
mov eax, dword [ebx + 0xc]
call fcn.0044a0d4
mov dword [ebx + 0xc], eax
inc edi
dec esi
jne 0x4c7bb8
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret