joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4938c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4e3303
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004d5e69
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x5380e8]
push eax
mov ecx, edi
call fcn.004db508
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004dca45
test eax, eax
je 0x4939dc
mov ecx, dword [esp + 0x3c]
call fcn.004db535
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x5384a8]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4939a0
push edi
mov ecx, esi
call fcn.004d8b9a
mov ecx, esi
call fcn.00493b40
cmp dword [esp + 0x38], 1
jne 0x4939d5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004d8cd5
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x4963f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x496423
push esi
call fcn.004994e0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x49641c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4964a9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x496492
mov eax, dword [esi + 8]
test eax, eax
je 0x496447
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x49648e
cmp eax, 2
je 0x496492
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x49643a
cmp eax, 3
je 0x49646d
cmp eax, 1
jne 0x49643a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x49643a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x49643a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004964d0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4964b8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004964d0
add esp, 4
pop esi
ret
Function at 0x4a3148
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e373c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004d5e69
mov dword [esi], method.CTreeCtrl.virtual_0
lea edi, [esi + 0x3c]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x30]
mov dword [edi], fcn.004c0950
call fcn.004a53a0
lea ecx, [edi + 0x44]
mov byte [esp + 0x18], 1
call fcn.004a53a0
lea ecx, [edi + 0x58]
mov byte [esp + 0x18], 2
call fcn.004a53a0
lea ecx, [edi + 0x6c]
mov byte [esp + 0x18], 3
call fcn.004a53a0
mov dword [edi], 0x5ca2c4
lea ecx, [esi + 0xcc]
mov byte [esp + 0x18], 4
call fcn.004d3271
mov dword [esi + 0xd8], 0
mov dword [esi + 0xd4], 0x5ca394
mov eax, dword [0x5e89b8]
mov dword [esi + 0xdc], eax
lea ecx, [esi + 0xe0]
mov byte [esp + 0x18], 7
call fcn.004a53a0
lea ecx, [esi + 0xf4]
mov byte [esp + 0x18], 8
call fcn.004d3271
mov ecx, dword [esp + 0x10]
mov dword [esi], method.CTreeCtrl.virtual_0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4a3230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e37c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], method.CTreeCtrl.virtual_0
lea ecx, [esi + 0xf4]
mov dword [esp + 0x18], 5
call fcn.004d329a
lea ecx, [esi + 0xe0]
mov byte [esp + 0x18], 4
mov dword [ecx], 0x5ca2c0
call fcn.004a55a0
lea ecx, [esi + 0xdc]
mov byte [esp + 0x18], 3
call fcn.004d4891
lea ecx, [esi + 0xd4]
mov dword [esp + 0xc], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x18], 6
call fcn.004db55f
lea ecx, [esi + 0xcc]
mov byte [esp + 0x18], 1
call fcn.004d329a
lea edi, [esi + 0x3c]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x6c]
mov byte [esp + 0x18], 9
mov dword [ecx], 0x5ca2c0
call fcn.004a55a0
lea ecx, [edi + 0x58]
mov byte [esp + 0x18], 8
mov dword [ecx], 0x5ca2c0
call fcn.004a55a0
lea ecx, [edi + 0x44]
mov byte [esp + 0x18], 7
mov dword [ecx], 0x5ca2c0
call fcn.004a55a0
lea ecx, [edi + 0x30]
mov byte [esp + 0x18], 0
mov dword [ecx], 0x5ca2c0
call fcn.004a55a0
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.004d2ed3
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4a8750
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5e446c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4a8763
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4a87a4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x5e4514]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4a87d6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4a87da
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4a87cb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4a87f8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4a87fc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4a87ed
xor ecx, ecx
mov eax, 0x5e447c
xor ebx, ebx
mov bl, byte [ecx + 0x5e4524]
cmp byte [esp + ebx + 0x14], 0
je 0x4a8827
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x5e453c]
cmp byte [esp + ebx + 0x14], 0
je 0x4a883e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4a880e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4a8797
lea edx, [esp + 0x84]
push edx
call fcn.004a8880
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4c00a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e3ba0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004bfc50
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004bfcd0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004bfcd0
lea ecx, [esi + 0xc]
call fcn.004d481c
lea ecx, [esi + 0x10]
call fcn.004d481c
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004c1270
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004c1270
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004c1270
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004d4891
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004d4891
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4f0d84
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x61b33c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x4f0e48
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x4f0dbc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x4f0e5f
dec edx
je 0x4f0ea0
jmp 0x4f0efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x4f0efd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f0f60
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x4f0f7d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x4f108f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x4f0fb0
je 0x4f0ffc
sub ecx, 0x2b
je 0x4f0ff2
sub ecx, 4
je 0x4f0ff7
dec ecx
sub ecx, 0xa
jb 0x4f0fe1
jmp 0x4f0fff
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4f0fc2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4f0fd0
jmp 0x4f0fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4f0fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4f0fff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4f0fff
mov byte [eax], 0x3e
jmp 0x4f0fff
mov byte [eax], 0x3f
jmp 0x4f0fff
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4f0f8f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x4f104f
cmp byte [esp + 3], 0xff
jne 0x4f104f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x4f1087
cmp dl, 0xff
je 0x4f1087
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x4f0f88
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x4f111c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x62c7a0
mov eax, ebx
mov edx, 8
test al, 1
je 0x4f1138
shr eax, 1
xor eax, 0xedb88320
jmp 0x4f113a
shr eax, 1
dec edx
jne 0x4f112b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x4f1124
pop ebx
ret
Function at 0x4f1150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4f1159
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004e8a38
xor eax, eax
push ebp
push 0x4f1239
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004f111c
mov eax, dword [0x62be0c]
mov byte [eax], 0
mov dword [ebx], 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.004e6e7c
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.004e7218
call fcn.004e6ba8
test eax, eax
jne 0x4f1216
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10145]
mov ecx, 0xfff1
lea eax, [ebp - 0x154]
call fcn.004e6fcc
mov dx, word [ebp - 8]
test dx, dx
jbe 0x4f1210
lea eax, [ebp - 0x10145]
xor ecx, ecx
mov cl, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0x62c7a0]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x4f11ec
cmp dword [ebp - 8], 0
jne 0x4f11c3
lea eax, [ebp - 0x154]
call fcn.004e6fec
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1240
lea eax, [ebp - 4]
call fcn.004e8588
ret

Function at 0x4fc718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4fc738
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4fc726
pop edi
pop esi
pop ebx
ret
Function at 0x504fd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0x62ccb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + 0x621670]
mov eax, dword [esi*4 + 0x6216b0]
xor eax, dword [esp]
call fcn.00504f70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.00504fac
mov dword [ebx], eax
mov edx, dword [esi*4 + 0x621680]
mov eax, dword [esi*4 + 0x6216c0]
xor eax, dword [esp]
call fcn.00504f70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.00504fac
mov dword [ebx + 0x1000], eax
mov edx, dword [esi*4 + 0x621690]
mov eax, dword [esi*4 + 0x6216d0]
xor eax, dword [esp]
call fcn.00504f70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.00504fac
mov dword [ebx + 0x2000], eax
mov edx, dword [esi*4 + 0x6216a0]
mov eax, dword [esi*4 + 0x6216e0]
xor eax, dword [esp]
call fcn.00504f70
mov edi, eax
mov eax, edi
call fcn.00504fac
mov dword [ebx + 0x3000], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x504fe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x505138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x50516d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x505193
inc ebx
cmp ebx, 0xf
jne 0x50517d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x50514f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x50eee0
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 0x18], 0x100
mov esi, 0x6260f4
mov ebx, 0x630ce4
movzx edi, byte [esi]
mov dword [esp], edi
mov eax, edi
call fcn.0050de30
mov dword [esp + 8], eax
mov eax, edi
call fcn.0050de40
mov dword [esp + 0x10], eax
movzx edi, byte [esi + 0x100]
mov dword [esp + 4], edi
mov eax, edi
call fcn.0050de30
mov dword [esp + 0xc], eax
mov eax, edi
call fcn.0050de40
mov ebp, eax
mov dword [esp + 0x14], ebp
mov eax, edi
mov edx, dword [esp + 0xc]
shl edx, 8
or eax, edx
mov edx, ebp
shl edx, 0x10
or eax, edx
mov edx, ebp
shl edx, 0x18
or eax, edx
mov dword [ebx], eax
mov eax, dword [esp + 0x10]
mov edx, eax
mov ecx, eax
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x400], edx
mov edx, dword [esp + 0xc]
shl ebp, 8
or edx, ebp
shl edi, 0x10
or edx, edi
mov ecx, dword [esp + 0x14]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x800], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp]
shl ecx, 8
or edx, ecx
shl eax, 0x10
or edx, eax
mov eax, dword [esp + 8]
shl eax, 0x18
or edx, eax
mov dword [ebx + 0xc00], edx
add ebx, 4
inc esi
dec dword [esp + 0x18]
jne 0x50eef9
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x402b7c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004042cc
test esi, esi
jne 0x402bb2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004043bc
jmp 0x402bd0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a30
mov edi, eax
test esi, esi
je 0x402bd0
cmp dword [ebx], 0
je 0x402bd0
dec esi
jmp 0x402bb9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402ed0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4e7008], 0x8088405
inc edx
mov dword [ebx + 0x4e7008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403328
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4e7024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033c0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033a0
xor eax, eax
push ebp
push 0x403399
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033dc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033a0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4e7024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4e7024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040cc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4ea04c], 0
je 0x40412d
cmp word [0x4ea220], 0xd7b2
jne 0x4040f5
cmp dword [0x4ea228], 0
jbe 0x4040f5
mov eax, 0x4ea21c
call dword [0x4ea238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4e7070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404154
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4e7034], 0
jne 0x404149
push 0
push 0x4e7068
push 0x4e7070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004027f4
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4ea04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404248
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406484
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4064ea
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040454c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402eec
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4064d4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4064f1
lea eax, [ebp - 0x10]
call fcn.004042cc
ret

Function at 0x409318
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040479c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409331
test al, 0x10
jne 0x409335
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x409424
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.0040479c
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x409446
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40c338
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c371
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004043bc
jmp 0x40c37a
mov eax, ebx
mov edx, esi
call fcn.00404320
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c384
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c3a5
mov al, byte [esp]
jmp 0x40c3a7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret