joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474470
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x53abb8]
cmp byte [eax + 0xa5], 0
jne 0x4744e7
cmp dword [0x53abd0], 0
jne 0x4744a5
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x47442c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x53abd0], eax
cmp dword [0x53abcc], 0
jne 0x4744c0
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x53abcc], eax
cmp dword [0x53abd4], 0
jne 0x4744e7
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4743cc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x53abd4], eax
pop ecx
pop ebp
ret

Function at 0x4745b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.00474548
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4745d1
xor eax, eax
call fcn.00474580
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x4745eb
mov al, 1
call fcn.00474580
mov esp, ebp
pop ebp
ret

Function at 0x474d1c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x53abb8]
cmp dword [eax + 0x30], 0
je 0x474de6
mov eax, dword [ebp - 4]
cmp dword [eax + 0x94], 0
jne 0x474ddd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x474c9c
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
cmp dword [eax + 8], 0
je 0x474ddd
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
push 0xffffffffffffffec
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x474d97
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x474ddd
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
call fcn.0041fc88
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x474dac
mov eax, dword [ebp - 4]
inc dword [eax + 0x94]
mov esp, ebp
pop ebp
ret

Function at 0x475afc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa4], 0
je 0x475b41
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 8]
call fcn.00404e80
jmp 0x475b52
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x8c]
call fcn.00404de4
mov esp, ebp
pop ebp
ret
Function at 0x4770a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
je 0x4770f3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00457bf0
test al, al
je 0x4770f3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00457720
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4770f3
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00457720
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret

Function at 0x47abac
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, ecx
shl edx, 2
add edx, eax
mov dword [esp], edx
mov eax, dword [esp]
call fcn.0040656c
test eax, eax
je 0x47ac06
lea eax, [esp + 4]
push eax
push 0x40
push 4
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esp]
mov dword [eax], ebx
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 4
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
push 4
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop ecx
pop edx
pop ebx
ret

Function at 0x47acd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
push esp
push 0x40
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
mov edx, ebx
mov eax, edi
mov ecx, esi
call fcn.00402e54
push esp
mov eax, dword [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_VirtualProtect
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x47b2c4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp], edx
mov ebp, eax
lea edi, [esp + 0x14]
mov eax, dword [0x53abec]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x47b310
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [0x53abec]
call fcn.0041fc88
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp ebp, dword [eax]
jne 0x47b30c
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
jmp 0x47b3f6
inc esi
dec ebx
jne 0x47b2e4
mov dword [esp + 8], ebp
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
xor ebx, ebx
mov edx, edi
mov eax, dword [esp + 0xc]
call fcn.0047aec8
test al, al
jne 0x47b330
mov byte [edi], 1
xor eax, eax
mov al, byte [edi]
add ebx, eax
xor eax, eax
mov al, byte [edi]
add dword [esp + 0xc], eax
cmp ebx, 5
jb 0x47b31e
mov edx, ebx
mov eax, dword [esp + 8]
call fcn.0047b01c
mov edi, eax
add edi, 5
mov eax, edi
call fcn.00402bbc
mov esi, eax
mov eax, 0x14
call fcn.00402bbc
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [eax], ebp
mov eax, dword [esp + 0x18]
mov dword [eax + 4], esi
mov eax, dword [esp + 0x18]
mov dword [eax + 8], edi
mov eax, dword [esp + 0x18]
mov dword [eax + 0x10], ebx
mov eax, ebx
call fcn.00402bbc
mov ebp, eax
mov eax, dword [esp + 0x18]
mov dword [eax + 0xc], ebp
mov edx, ebp
mov eax, dword [esp + 8]
mov ecx, ebx
call fcn.00402e54
mov edx, dword [esp + 0x18]
mov eax, dword [0x53abec]
call fcn.0041fa88
lea eax, [esp + 0x10]
push eax
push 0x40
push edi
push esi
call sub.kernel32.dll_VirtualProtect
mov edx, esi
mov eax, dword [esp + 8]
mov ecx, ebx
call fcn.00402e54
mov ecx, ebx
mov edx, dword [esp + 8]
mov eax, esi
call fcn.0047b0e8
mov edx, dword [esp + 8]
add edx, ebx
lea eax, [ebx + esi]
call fcn.0047ad10
mov edx, dword [esp]
mov eax, dword [esp + 8]
call fcn.0047ad10
mov dword [esp + 4], esi
mov eax, dword [esp + 4]
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47b684
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
mov edx, 0x40
mov eax, ebx
call fcn.0047a4b4
test al, al
je 0x47b6d8
mov eax, ebx
cmp word [eax], 0x5a4d
jne 0x47b6d8
cmp dword [eax + 0x3c], 0
je 0x47b6d8
mov eax, dword [eax + 0x3c]
add eax, ebx
mov dword [ebp - 4], eax
mov edx, 0xf8
mov eax, dword [ebp - 4]
call fcn.0047a4b4
test al, al
je 0x47b6d3
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
je 0x47b6d8
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
pop ecx
pop ebp
ret
Function at 0x483a58
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x53ac08
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x483a7a
shr eax, 1
xor eax, 0xedb88320
jmp 0x483a7c
shr eax, 1
dec edx
jne 0x483a68
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x483a61
mov byte [0x53b008], 1
pop esi
pop ebx
ret

Function at 0x483a98
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x53b008], 0
jne 0x483aaf
call fcn.00483a58
mov eax, edi
dec eax
test eax, eax
jl 0x483ad8
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x53ac08]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x483ab9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4865f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x486625
dec al
je 0x486661
dec al
je 0x4866a5
dec al
je 0x486710
jmp 0x48679a
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x48679a
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x486635
jmp 0x48679a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48679a
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x486671
jmp 0x48679a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48679a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4866d3
xor ebp, ebp
jmp 0x4866e4
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4866ed
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4866b5
jmp 0x48679a
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48679a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x486768
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00483ae0
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x486724
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x498264
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042d7b0
cmp ebx, dword [ebp - 8]
jge 0x4982c7
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042dc28
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042dc28
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042dc68
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x49828d
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4982d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042d7b0
cmp ebx, dword [ebp - 8]
jge 0x498333
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042dc28
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042dc28
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042dc68
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4982f9
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b5e68
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x2001f
push 0
push 0x4b5f04
push 0
mov eax, dword [ebp - 4]
call fcn.00405250
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4b5edf
mov eax, dword [ebp - 0xc]
call fcn.00405050
inc eax
push eax
mov eax, dword [ebp - 0xc]
call fcn.00405250
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00405250
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp dword [ebp - 0x14], 0
je 0x4b5efc
mov ecx, dword [0x539414]
mov dl, 1
mov eax, dword [0x4b4110]
call fcn.0040eb18
call fcn.00404720
mov esp, ebp
pop ebp
ret 4

Function at 0x4b5f08
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405250
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteKeyA
pop ecx
pop ecx
pop ebp
ret
Function at 0x4b5f6c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
mov edx, dword [0x41c23c]
call fcn.004057dc
xor eax, eax
push ebp
push 0x4b60bf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x537978], 0
jne 0x4b5fc2
mov ecx, dword [0x539108]
mov dl, 1
mov eax, dword [0x408b00]
call fcn.0040eb18
call fcn.00404720
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 0x10
call fcn.004036ac
mov eax, dword [ebp - 4]
call fcn.00405640
mov dword [ebp - 0x2c], eax
mov esi, 0x4b60d0
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
call fcn.00406c5c
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
call fcn.00405650
test eax, eax
jle 0x4b605d
mov dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x50]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4b6054
lea eax, [ebp - 0x54]
mov edx, dword [ebp - 4]
call fcn.00405018
mov eax, dword [ebp - 0x54]
push eax
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x50]
mov ecx, 0x10
call fcn.00405000
mov eax, dword [ebp - 0x58]
pop edx
call fcn.00409b34
test eax, eax
jne 0x4b6054
mov dword [ebp - 0x10], 0x15
jmp 0x4b6064
mov dword [ebp - 0x10], 0x10
jmp 0x4b6064
mov dword [ebp - 0x10], 0x15
lea eax, [ebp - 0x20]
push eax
push 1
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call dword [0x537978]
call fcn.004b5dd8
mov eax, dword [ebp - 0x18]
call fcn.004b5dd8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
call fcn.00406c74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b60c6
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.00404db4
lea eax, [ebp - 0x20]
mov edx, dword [0x41c23c]
call fcn.004058ac
ret
Function at 0x4d939c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
mov eax, ebp
mov edx, dword [esp]
call fcn.00404de4
mov esi, ebx
mov eax, dword [ebp]
call fcn.00405050
test ax, ax
jbe 0x4d9407
mov word [esp + 4], ax
mov bx, 1
mov eax, ebp
call fcn.004052a8
movzx edi, bx
mov edx, dword [ebp]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec word [esp + 4]
jne 0x4d93cc
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4d9750
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.00404de4
mov eax, dword [esi]
call fcn.00405050
test ax, ax
jbe 0x4d97b0
mov word [esp], ax
mov bx, 1
mov eax, esi
call fcn.004052a8
movzx ebp, bx
mov edx, dword [esi]
mov dl, byte [edx + ebp - 1]
movzx ecx, di
shr ecx, 8
xor dl, cl
mov byte [eax + ebp - 1], dl
mov eax, dword [esi]
movzx eax, byte [eax + ebp - 1]
add di, ax
imul ax, di, 0xce6d
add ax, 0x58bf
mov edi, eax
inc ebx
dec word [esp]
jne 0x4d9778
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4dd6ac
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4dd6da
mov eax, ebx
call fcn.004de160
cmp dword [ebx + 0x40], 0
je 0x4dd6d3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4dd74b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4dd73d
cmp dword [ebx + 8], 0
je 0x4dd6fc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4dd70e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4dd73d
cmp dword [ebx + 8], 0
je 0x4dd6ef
cmp eax, 3
je 0x4dd721
dec eax
jne 0x4dd6ef
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4dd6ef
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4dd6ef
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4dd769
cmp dword [ebx + 0x14], 0xcc
je 0x4dd769
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004dd774
pop ebx
ret
Function at 0x4f312c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f31a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.004053dc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405250
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00405050
push eax
call sub.kernel32.dll_GetTempPathA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004053dc
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004f2ed4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f31a8
lea eax, [ebp - 0xc]
call fcn.00404d90
ret
Function at 0x504d60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x504dd1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00504d3c
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.004f24b0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
call fcn.004f2000
mov eax, dword [ebp - 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x504dd8
lea eax, [ebp - 0x14]
call fcn.00404d90
ret

Function at 0x50dc94
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405240
xor eax, eax
push ebp
push 0x50ddba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405050
mov ebx, eax
shl ebx, 2
mov eax, ebx
call fcn.004097fc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x50dd9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00405d50
push 0
call sub.user32.dll_OpenClipboard
call sub.user32.dll_EmptyClipboard
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x50dd6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x50dd59
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, ebx
call fcn.00402e54
mov eax, dword [ebp - 8]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50dd60
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
Function at 0x50ed48
Capabilities:
Hide graphical window

Disassembly:
push 9
mov eax, dword [0x53979c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x53979c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetForegroundWindow
mov eax, dword [0x53979c]
mov eax, dword [eax]
cmp byte [eax + 0x5b], 0
jne 0x50ed9d
mov eax, dword [0x53979c]
mov eax, dword [eax]
mov byte [eax + 0x5b], 1
mov eax, dword [0x53979c]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x50ed9d
mov edx, dword [0x53979c]
mov dl, 1
call fcn.0046dc20
ret

Function at 0x510488
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51053f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00405250
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x5104ca
call fcn.004047cc
jmp 0x510546
mov eax, ebx
call fcn.00402bbc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00405250
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x5104f3
call fcn.004047cc
jmp 0x510546
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x510550
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x510514
call fcn.004047cc
jmp 0x510546
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510546
mov eax, dword [ebp - 8]
call fcn.00402bec
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5125b4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00408304
ret