joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409f70
Capabilities:
Check for software breakpoints

Disassembly:
in eax, dx
lodsb al, byte [esi]
cmp al, 0xa3
movsb byte es:[edi], byte [esi]
jae 0x409ff3
mov dh, 0x97
xor dword [ecx + 0x49], ecx
push di
lodsb al, byte [esi]
invalid
xor byte [edx - 0x65f6b9b5], 0x74
xchg byte [ebp + 0x61d2001b], ah
bnd jge 0x40a082
mov ch, 0x76
mov ebp, 0xf0566f21
cmp al, al
hlt
mov ah, 0x31
dec ebx
or al, 0x3c
fcos
dec ecx
xchg edi, eax

Function at 0x40a090
Capabilities:
Encode data using xor

Disassembly:
add bl, cl
scasd eax, dword es:[edi]
call 0x4cca50ae
xchg edx, eax
dec ebx
mov eax, dword [esi]
or dword [ebx + 0x3855228b], edi
mov esp, dword [edx]
push ebp
cmp byte [edi], dl
cli
dec dword [0x65672f82]
cld
sub byte [edi], 0x67
cld
xchg dword [esi - 0x6d10c50f], ebx
ror byte [eax], 1
or byte [0x71a09f24], bh
fcmove st(0), st(3)
arpl bp, ax
enter 0xffffffffffff9be8, 0x13
wait
adc eax, ebx
wait
adc eax, ebx
xor byte [ecx + 0x16], dl
cmp eax, 0x6a68e48c
and ecx, dword [ebx - 0x19]
out 0x7b, eax
mov eax, 0xabdabf50
cmpsd dword [esi], dword es:[edi]
mov word [ebx - 0x5d], es
test dword [ebx - 0x4ba9ec84], ecx
xor dword [ebx + 0xc], ecx
cmp al, 0xd9
dec dword [ecx - 0x69]
fnsave dword [edi]
xchg byte [esi + 0x42aaaa60], ch
stosb byte es:[edi], al
stosb byte es:[edi], al
inc edx
adc dword [edi - 0x4078f21d], esp
cmc
pop ss
add eax, dword [ebx]
je 0x40a036
adc dl, bl
in eax, 8
mov byte [eax + edx*4 + 0x59c8ab9a], dh
cmp al, 0x76
imul dh
xchg edx, eax
dec esi
xor byte [esi - 0x4b], dl
mov word [edx + 0x759df90b], es
cmp ecx, ebx
and byte [eax + 0x18], 1
js 0x40a04c
xor ecx, esp
mov esi, 0xc7fd3fb2
sub bh, byte [ecx - 0x53]
xchg esi, eax
jmp 0xded440b3

Function at 0x40a8d0
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
les ebp, [ebp - 0x2d5f504f]
mov cl, 0xaf
mov al, byte [0x4f207d2]
push ds
dec edx
mov cl, 0x88
sub eax, 0xf0848b48
and byte es:[eax + 0x19], cl
dec ecx
in al, 0xf6
xor dword [si + 0x3d], eax
sub dword [esi - 5], eax
outsb dx, byte [esi]
outsb dx, byte [esi]
cwde
sahf
pop edx
fucomi st(4)
mov word [ecx - 0x2a], fs
sbb al, 0
sbb ecx, dword [ebp - 0xa075a7b]
lea eax, [ebp + 0x4cf5f8a5]
jnp 0x40a8b9
int3

Function at 0x40f198
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xchg esp, eax
jge 0x40f199
and edi, dword [eax + 0x348d4ee6]
leave
invalid
Function at 0x4270ac
Capabilities:
Execute syscall

Disassembly:
je 0x427082
pushal
rcr byte [ebp + 0x2714152d], 0xe7
daa
out 0xff, eax
and dword [eax], 0x2f
aaa

Function at 0x429ec8
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pop ebx
inc esi
pushal
inc edx
enter 0xffffffffffff8544, 0x42
call dword [ecx - 0x5b]
sub ebp, dword [edi - 0x12]
jbe 0x429ebc
mov bl, 0x81
salc
push ebx
xor byte [esi + edi], dl
invalid
push edx
sbb eax, dword [edi + ebp*8 - 0x3b08e706]
inc esi
into
pop eax
lea edi, [esi - 0x4c]
jle 0x429e7e
jle 0x429e7e
out dx, eax
ja 0x429f21
and byte [edx - 0x6bb26289], dh
sbb eax, 0xe67a391f
adc byte [ebx], bh
xchg byte [ebp - 0x10600e84], ah
push esp
mov dl, cl
mov cl, 0x56
xchg esp, eax
mov esi, 0x16c9150e
jge 0x429ee7
cli
push cs
adc eax, 0xfa7d16c9
cli
push es
mov dl, byte [esi + 0x6d8eb074]
fidiv word [ecx + 0x7517a5d1]
int1
shl dword [ebp - 0x200e8ae9], 1
out dx, al
pop ss
jne 0x429f17
fucompi st(6)
mov dl, 0xd4
stosb byte es:[edi], al
xor dl, byte [ecx + 0x69]
inc ebx
mov eax, 0xa4ba30f
lodsb al, byte [esi]
daa
push ebx
lodsd eax, dword [esi]
push es
mov eax, 0xd984549b
salc
arpl word [ecx + edx*4 + 0x32], di
test byte [ebx + 0x25253545], ch
adc ah, 0x46
daa
clc
adc byte [0xc828ea2b], 7
pop ebx
sub al, 0x70
add byte [eax + 0x1f], dl
enter 0x62d, 0xffffffffffffff8f
xor edi, edx
cmp eax, 0x6172ba7d
sti
push eax
adc dl, byte [esi + 0x74]
mov edx, 0x5bbe7543
int1
pop edx
dec ebp
xchg edx, eax
jno 0x429f23
push 0xc1b7aa56
push ebx
ljmp 0xd3a6

Function at 0x42bd84
Capabilities:
Encode data using xor

Disassembly:
jae 0x42bde6
invalid
psubd mm5, qword [edx - 0x2e]
xchg ebx, eax
js 0x42be5e
arpl word [ebx], cx
div dword [esi + ecx*8 + 0x1ef4835e]
push ds
jb 0x42bdf5
imul ecx, dword [ebp - 0x7d], 0xffffffa4
ret
jp 0x42bed8
fucomp st(2)
loope 0x42be7e
jbe 0x42be9d
cmc
push es
invalid
pop ebp
mov ah, byte [edi - 0x76]
dec ebx
frstor dword [ebx + 0x6e4d6873]
xchg ecx, eax
xor al, ah
ljmp 0xf38f
xchg edx, eax
hlt
xchg esp, eax
and dword [edi - 0x40], edx
adc al, bh
jmp 0xfe3617bd

Function at 0x432690
Capabilities:
Encode data using xor

Disassembly:
pop ecx
push edx
test eax, 0x81679143
leave
inc edi
mov edx, 0xf3f58615
dec ecx
adc eax, 0x49f3f586
mov ebx, 0x978f1ca8
nop
lds eax, [eax - 0x2f]
add eax, 0x38088efc
xor eax, 0xb8fedc18
imul esi, dword [ebx], 0x3a6a6e15
mov edx, 0x821f555c
in eax, dx
mov cl, 0xfc
push cs
push ebp
jl 0x43269a
ja 0x432745
popal
int 0x55
Function at 0x434118
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xeb3b46ab
push edi
push cs
shr dword [ecx], cl
jno 0x43414f
loopne 0x43417e
pop ebx
cmp al, 0x8e
rol dword [ebx], 1
ljmp 0xcb0
ret
test al, 0x84
dec ecx
mov esi, 0x84c8128a
xor al, 0x19
xchg ecx, eax
pop esi
nop
retf
mov esi, 0x260351e4
and esi, ebx
xchg esi, eax
dec ebp
and ah, bl
sbb al, 0x1c
cmpsb byte [esi], byte es:[edi]
jno 0x434160
mov byte [0xf63c17ef], al
cmpsd dword [esi], dword es:[edi]
ror dword [ecx - 0x25], 1
sahf
sub eax, 0x53342d93
xor al, 0x53
mov ebx, 0x987f2272
xor ch, 0x79
cdq
and byte [ecx], bl
or al, 0xae
cmc
aas
cmp eax, 0xfc6717
scasd eax, dword es:[edi]
scasb al, byte es:[edi]
push ecx
xor edx, dword [eax + 0x11a13af2]
loopne 0x43419c
or dword [0x89d1729], edi
pushfd
in eax, 0xfa
imul eax, ebx, 0xeebca1b
out 0x4e, al
hlt

Function at 0x43ab34
Capabilities:
Check for vm using instruction vpcext

Disassembly:
dec esi
stosd dword es:[edi], eax
pushal
setnp byte [ebx + 0x497f7ac6]
arpl word [ebx + 0x54], di
cmp eax, 0x42b8d0a5
mov eax, 0xbe823742
call 0x80ee8283
aaa
cmp byte [esi - 0x5528a218], 0x80
xor al, 0x33
xchg edi, eax
bound esi, qword [ebp + 0x6a6699c4]
mov al, 0x7a
ljmp 0xbb08
xor ebx, dword [edi + 8]
invalid
cdq
push 0xffffffffffffffb0
jp 0x43ab1c
mov bl, 0xf9
xor ebx, dword [edi + 8]
mov ebx, 0xeabd0f7d
imul ebx, dword [ecx], 0xe796235d
or edi, dword [ebx]
jne 0x43ab80
das
out dx, al
jne 0x43ab4e
push ds
les esp, [edi - 0x32]
ja 0x43ab96
loopne 0x43ab0c
add ebp, dword gs:[edx + 0x5ddcfafe]
xchg edi, eax
xor al, byte [edi + 0x72]
jo 0x43abab
invalid
push ebx
jg 0x43ab2c
inc ecx
js 0x43ab1e
clc
sub eax, esp
outsd dx, dword [esi]
mov esp, dword [edi + 0x71]
out 0x8a, eax
invalid
Function at 0x455408
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4e9b34]
cmp byte [eax + 0xc], 0
je 0x455575
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45556e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4eec9c], 0
jne 0x45545c
push 0x45557c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x455584
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4eec9c], eax
cmp dword [0x4e46e0], 0
jne 0x455557
push 0x455594
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4e46e0], eax
cmp dword [0x4e46e0], 0
je 0x455557
push 0x4555a0
mov eax, dword [0x4e46e0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4eeca0], eax
push 0x4555b0
mov eax, dword [0x4e46e0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4eeca4], eax
push 0x4555c4
mov eax, dword [0x4e46e0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4eeca8], eax
push 0x4555dc
mov eax, dword [0x4e46e0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4eecac], eax
push 0x4555f4
mov eax, dword [0x4e46e0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4eecb0], eax
push 0x455608
mov eax, dword [0x4e46e0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4eecb4], eax
push 0x455620
mov eax, dword [0x4e46e0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4eecb8], eax
push 0x455638
mov eax, dword [0x4e46e0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4eecbc], eax
push 0x455654
mov eax, dword [0x4e46e0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4eecc0], eax
push 0x455660
mov eax, dword [0x4e46e0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4eecc4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455575
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x4632a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46344f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x463430
mov dl, 1
mov eax, dword [0x417c24]
call fcn.00403cd0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404c40
lea eax, [ebp - 0x114]
push eax
push 0x40
call int.004077c4
dec eax
test eax, eax
jl 0x46341f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00455764
test al, al
je 0x463412
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x463460
lea eax, [ebp - 0x254]
call fcn.0040a83c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x463412
xor eax, eax
push ebp
push 0x46340b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x463498
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4633f4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404eb0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4633f4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404eb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463412
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x463315
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041c364
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463456
lea eax, [ebp - 0x260]
call fcn.00404c40
ret
Function at 0x463412
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46344f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x463430
mov dl, 1
mov eax, dword [0x417c24]
call fcn.00403cd0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404c40
lea eax, [ebp - 0x114]
push eax
push 0x40
call int.004077c4
dec eax
test eax, eax
jl 0x46341f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00455764
test al, al
je 0x463412
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x463460
lea eax, [ebp - 0x254]
call fcn.0040a83c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x463412
xor eax, eax
push ebp
push 0x46340b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x463498
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4633f4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404eb0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4633f4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404eb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463412
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x463315
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041c364
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463456
lea eax, [ebp - 0x260]
call fcn.00404c40
ret
Function at 0x49b840
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x49b8f6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.004050d0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x49b8e0
lea eax, [ebp - 4]
mov edx, edi
call fcn.00405360
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.004050d0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x49b8e0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x49b908
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x49b8e0
cmp dword [ebp - 0xc], 0x34
jne 0x49b8e0
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b8fd
lea eax, [ebp - 4]
call fcn.00404c40
ret

Function at 0x49eef8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x49ef5c
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404eb0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.0040970c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ef63
lea eax, [ebp - 0xc]
call fcn.00404c40
ret

Function at 0x49f83c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x49f851
add esp, 0xfffffff0
call fcn.00404024
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.00403cd0
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.00404c94
mov eax, esi
call fcn.004050d0
push eax
movzx eax, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexA
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x49f8a5
mov ecx, dword [0x4e995c]
mov dl, 1
mov eax, dword [0x49f624]
call fcn.00499038
call fcn.00404574
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x49f8cc
call fcn.0040407c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4a0460
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a0534
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404cd8
lea eax, [ebp - 4]
call fcn.00405128
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4a051e
mov eax, ebx
call fcn.00402ea8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a0517
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4a0501
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4a0544
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4a0501
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a051e
mov eax, dword [ebp - 0x10]
call fcn.00402ec4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a053b
lea eax, [ebp - 4]
call fcn.00404c40
ret
Function at 0x4c6510
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x4e8cac
mov ecx, dword [esp]
lea edx, [esp + 0xc]
movzx ebx, byte [edi]
movzx ebx, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x4c652f
mov esi, 1
mov edx, 0x4e8db4
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
add ecx, ecx
add ecx, ecx
movzx ebx, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
movzx ebx, byte [esp + eax + 0x11]
add edi, ebx
movzx ebx, byte [esp + eax + 0xd]
add ebx, ebx
add ebx, ebx
add ebx, ebx
movzx ebp, byte [esp + eax + 0xe]
add ebp, ebp
add ebp, ebp
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x4c65a8
dec ebx
je 0x4c65ca
dec ebx
je 0x4c65ec
dec ebx
je 0x4c660d
jmp 0x4c6627
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 8
movzx ebx, bl
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4c6627
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 4
movzx ebx, bl
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4c6627
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 2
movzx ebx, bl
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4c6627
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
movzx ebx, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x4c6598
inc esi
add edx, 0x40
cmp esi, 9
jne 0x4c654b
mov esi, 0x20
mov eax, 0x4e8cdc
mov edx, dword [esp + 4]
movzx ecx, byte [eax]
movzx ecx, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x4c664c
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4c6688
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
movzx eax, dl
movzx ebx, byte [eax + 0x4e8d63]
test bl, bl
jbe 0x4c66b9
lea eax, [esi + 0x3e0]
call fcn.004c6664
lea eax, [esi + 0x3fc]
call fcn.004c6664
dec bl
jne 0x4c669f
mov cl, 0x30
mov edi, 0x4e8d34
mov eax, dword [esp]
movzx edx, byte [edi]
cmp dl, 0x1c
ja 0x4c66da
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x4c66e7
movzx edx, dl
movzx edx, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x4c66c3
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4c66f4
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.004c64a8
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x4c6710
mov bl, 0x1c
mov esi, str.91__
lea edi, [ebp - 0x41]
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
call fcn.004c64a8
mov byte [edi], al
movzx edx, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.004c64a8
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x4c672c
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.004c6688
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x4c6756
mov bl, 1
mov eax, 0x4e8c2c
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x4c678f
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x4c679c
movzx ecx, byte [eax]
movzx ecx, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x4c677b
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x4c67c6
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.004c6510
jmp 0x4c67ed
movzx eax, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.004c6510
mov bl, 0x20
lea eax, [ebp - 0xa1]
movzx edx, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x4c67f5
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x4c67ae
mov bl, 0x40
mov esi, 0x4e8c6c
lea eax, [ebp - 0x3e1]
movzx edx, byte [esi]
cmp dl, 0x20
ja 0x4c685b
movzx edx, dl
movzx edx, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x4c6868
movzx edx, dl
movzx edx, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x4c6844
mov bl, 1
lea esi, [ebp - 0x3e1]
movzx ecx, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.004c64d0
inc ebx
inc esi
cmp bl, 0x41
jne 0x4c6876
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c76ac
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
movzx edx, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
movzx eax, byte [esi + 1]
movzx ecx, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
movzx edx, byte [esi + 2]
movzx ecx, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
movzx eax, byte [esi + 3]
movzx ecx, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
movzx edx, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
movzx eax, byte [esi + 4]
add eax, eax
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
movzx eax, byte [esi + 5]
add eax, eax
add eax, eax
and al, 0xff
movzx edx, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
movzx eax, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
movzx ebx, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x4c775d
movzx edx, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x4c7758
mov eax, ebp
mov edx, 8
call fcn.00405360
push 1
mov eax, ebp
call fcn.00405130
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.004c66f4
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret