joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417370
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
jne 0x41737b
xor al, al
ret
lea ecx, [eax + edi]
cmp ecx, 0x40
jbe 0x4173d7
cmp eax, 0x40
ja 0x4173c5
lea eax, [esi + 0x44]
push esi
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
push eax
mov eax, dword [esi + 0x40]
call fcn.004171e0
push ebx
lea edx, [esi + 0x44]
push edx
mov eax, edi
call fcn.004171e0
add dword [esi + 0x40], edi
mov al, 1
ret
push edi
add eax, esi
push ebx
push eax
call sub.MSVCR90.dll_memcpy
add dword [esi + 0x40], edi
add esp, 0xc
mov al, 1
ret

Function at 0x4173f0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push edi
mov edi, eax
mov eax, dword [edi + 0x40]
cmp eax, 0xffffffff
je 0x417483
cmp eax, 0x40
jbe 0x417416
push esi
push edi
lea esi, [edi + 0x44]
call fcn.00417260
mov dword [edi + 0x40], 0x14
pop esi
mov eax, dword [edi + 0x40]
mov ecx, 0x40
sub ecx, eax
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
xor dword [edi + eax*4], 0x36363636
inc eax
cmp eax, 0x10
jb 0x417430
lea eax, [edi + 0x44]
push edi
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
push eax
mov eax, 0x40
call fcn.004171e0
mov dword [edi + 0x40], 0xffffffff
test ebx, ebx
je 0x417497
mov edx, dword [esp + 8]
push edx
add edi, 0x44
push edi
mov eax, ebx
call fcn.004171e0
pop edi
ret 4

Function at 0x4174a0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
sub esp, 0x1c
mov eax, dword [0x435028]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [edi + 0x40], 0xffffffff
mov eax, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 4], eax
je 0x4174ce
push ebx
push 0
xor ebx, ebx
mov eax, edi
call fcn.004173f0
pop ebx
push esi
lea ecx, [esp + 0xc]
lea esi, [edi + 0x44]
push ecx
call fcn.00417260
xor eax, eax
mov edi, edi
xor dword [edi + eax*4], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x4174e0
push edi
push esi
mov eax, 0x40
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
call fcn.004171e0
lea edx, [esp + 0xc]
push edx
push esi
mov eax, 0x14
call fcn.004171e0
lea eax, [esp + 0xc]
push eax
call fcn.00417260
pop esi
test ebp, ebp
jbe 0x41755b
mov edx, dword [esp + 4]
push ebp
lea ecx, [esp + 0xc]
push ecx
push edx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov ecx, dword [esp + 0x1c]
pop ebp
xor ecx, esp
call fcn.00427762
add esp, 0x1c
ret 8
Function at 0x41aea0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
push edi
lea eax, [esp + 0x10]
mov ecx, 0x41
mov esi, 0x43b850
mov edi, 0x43b954
rep movsd dword es:[edi], dword [esi]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x41af7f
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x10]
push ecx
call edi
test eax, eax
je 0x41aef9
xor eax, eax
mov edi, edi
cmp esi, 0x104
jae 0x41af01
mov dl, byte [esp + eax + 0x10]
mov byte [esi + 0x43b850], dl
inc eax
inc esi
cmp eax, 8
jl 0x41aee0
cmp esi, 0x104
jb 0x41aed1
xor eax, eax
jmp 0x41af10
movzx edx, byte [eax + 0x43b954]
movzx ecx, byte [eax + 0x43b955]
not dl
xor byte [eax + 0x43b850], dl
movzx edx, byte [eax + 0x43b956]
not cl
xor byte [eax + 0x43b851], cl
movzx ecx, byte [eax + 0x43b957]
not dl
xor byte [eax + 0x43b852], dl
movzx edx, byte [eax + 0x43b958]
not cl
xor byte [eax + 0x43b853], cl
not dl
xor byte [eax + 0x43b854], dl
add eax, 5
cmp eax, 0x104
jl 0x41af10
mov edi, 0x43b850
call fcn.0041afc0
mov edi, 0x43b954
call fcn.0041afc0
pop edi
pop esi
add esp, 0x14
ret
mov edi, dword [sym.imp.MSVCR90.dll_rand_s]
lea eax, [esp + 0xc]
push eax
call edi
add esp, 4
test eax, eax
jne 0x41afab
mov cl, byte [esp + 0xc]
mov byte [esi + 0x43b850], cl
inc esi
cmp esi, 0x104
jb 0x41af85
jmp 0x41af01
push 0xd7
xor ecx, ecx
call fcn.00405910
int3

Function at 0x427762
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435028]
jne 0x42776c
repz ret
jmp fcn.00427cae

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3fff6bf7
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x192d683e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x572487]
shl eax, 2
mov dword [0x57248b], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0054ddf0
pop edx
call fcn.0054dd54
call fcn.0054de30
push 0
call fcn.0054f1a4
pop ecx
push 0x572430
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x57248f], eax
push 0
jmp fcn.00557fc8

Function at 0x4017c8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa6c
push ebx
push esi
mov bx, 2
lea eax, [ebp - 0x594]
push eax
push ebx
call sub.WSOCK32.DLL_WSAStartup
push 0x400
lea edx, [ebp - 0x404]
push edx
call sub.WSOCK32.DLL_gethostname
test eax, eax
jne 0x40184f
lea ecx, [ebp - 0x404]
push ecx
call sub.WSOCK32.DLL_gethostbyname
xor esi, esi
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov dword [ebp - 4], ecx
jmp 0x401839
cmp word [eax + 0xa], 4
jne 0x401834
xor edx, edx
mov ecx, dword [ebp - 4]
jmp 0x40182c
mov ebx, dword [eax + 0xc]
mov ebx, dword [ebx + esi*4]
mov bl, byte [ebx + edx]
inc edx
mov byte [ecx], bl
inc ecx
movsx ebx, word [eax + 0xa]
cmp edx, ebx
jl 0x40181f
inc esi
add dword [ebp - 4], 4
test eax, eax
je 0x401846
mov edx, dword [eax + 0xc]
cmp dword [edx + esi*4], 0
jne 0x401811
call sub.WSOCK32.DLL_WSACleanup
mov eax, esi
jmp 0x401856
call sub.WSOCK32.DLL_WSACleanup
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4087c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ecx, ecx
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ebx, eax
cmp esi, ecx
jle 0x4087e9
lea eax, [ecx + 0x32]
mov edi, 0x65
cdq
idiv edi
mov eax, edx
inc ecx
xor byte [ebx], al
inc ebx
cmp esi, ecx
jg 0x4087d4
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40b360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ecx, ecx
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ebx, eax
cmp esi, ecx
mov edi, dword [ebp + 0x14]
jle 0x40b388
mov eax, ecx
inc ecx
cdq
idiv dword [ebp + 0x18]
mov al, byte [edi + edx]
xor byte [ebx], al
inc ebx
cmp esi, ecx
jg 0x40b377
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40dca8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
mov eax, 0x582e14
push ebx
push esi
push edi
call fcn.0054e578
mov edx, dword [0x57ef20]
mov ecx, dword [0x57ef2b]
mov dword [ebp - 0x78], edx
mov edx, dword [0x57ef24]
mov dword [ebp - 0x74], edx
lea edi, [ebp - 0xec]
mov dx, word [0x57ef28]
mov esi, 0x57ef2f
mov word [ebp - 0x70], dx
mov dl, byte [0x57ef2a]
mov byte [ebp - 0x6e], dl
mov dword [ebp - 0x7c], ecx
mov ecx, 0x1b
lea eax, [ebp - 0x78]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push eax
call fcn.0054e278
pop ecx
mov esi, eax
xor eax, eax
lea edx, [ebp - 0x78]
cmp esi, eax
jle 0x40dd22
mov cl, 0xc8
sub cl, al
inc eax
xor byte [edx], cl
inc edx
cmp esi, eax
jg 0x40dd16
lea eax, [ebp - 0x7c]
push eax
call fcn.0054e278
pop ecx
mov esi, eax
xor eax, eax
lea edx, [ebp - 0x7c]
cmp esi, eax
jle 0x40dd43
mov cl, 0xc8
sub cl, al
inc eax
xor byte [edx], cl
inc edx
cmp esi, eax
jg 0x40dd37
lea eax, [ebp - 0xec]
push eax
call fcn.0054e278
pop ecx
mov esi, eax
xor eax, eax
invalid
xchg ebp, eax

Function at 0x431008
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push 0x74
mov eax, dword [ebp + 8]
add eax, 0x22b4
push eax
lea edx, [ebp - 0x78]
push edx
call fcn.0054e0d4
add esp, 0xc
mov eax, dword [ebp - 0x24]
sub eax, 0x3e8
xor ebx, ebx
add eax, 0x3e8
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, 0x400ffe
mov ecx, dword [edx + 0x22f8]
add ecx, eax
imul eax, ebx, 0x10524
add ecx, eax
mov eax, ecx
xor ecx, ecx
add eax, 2
xor edx, edx
xor ecx, dword [eax]
inc edx
add eax, 4
cmp edx, 0x4149
jl 0x431059
mov edx, dword [ebp - 4]
mov dword [edx], ecx
inc ebx
add dword [ebp - 4], 4
cmp ebx, 0xa
jl 0x431038
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43107c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [ebp + 8]
mov ebx, 0x400ff7
push dword [eax + 0xb0]
pop edx
mov eax, dword [ebp + 0xc]
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 4], edx
mov ecx, 0x12b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x100]
cdq
idiv ecx
mov ecx, 0x18ffe
add ebx, edx
add ecx, 2
mov eax, ecx
imul dword [ebp - 4]
add eax, 9
xor edx, edx

Function at 0x433acc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 0xc]
cmp ecx, edx
jle 0x433ae4
xor byte [eax], 0x63
inc edx
inc eax
cmp ecx, edx
jg 0x433adb
pop ebp
ret

Function at 0x433ae8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 0xc]
cmp ecx, edx
jle 0x433b00
xor byte [eax], 0x42
inc edx
inc eax
cmp ecx, edx
jg 0x433af7
pop ebp
ret

Function at 0x475c5f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor eax, eax
lea ecx, [ebp + 9]
xor dl, byte [ecx]
inc eax
inc ecx
cmp eax, 5
jl 0x475c69
xor eax, eax
lea ecx, [ebp + 0xe]
xor dl, byte [ecx]
inc eax
inc ecx
cmp eax, 0x12
jl 0x475c77
mov eax, edx
pop ebp
ret
Function at 0x4a27e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov edx, dword [ebp + 0xc]
mov ecx, eax
inc eax
shl ecx, 2
push ecx
mov cl, 0x64
pop ebx
sub cl, bl
xor byte [edx], cl
inc edx
cmp eax, 0x28
jl 0x4a27e9
pop ebx
pop ebp
ret

Function at 0x4a31a1
Capabilities:
Delete file
Get common file path

Disassembly:
sete dl
and edx, 1
lea eax, [ebp - 4]
push edx
mov edx, 2
dec dword [edi + 0x1c]
call fcn.0055c51c
pop ecx
test cl, cl
je 0x4a3309
mov eax, dword [ebx + 0x778]
push eax
lea edx, [esi + 0x1111]
push edx
lea ecx, [ebp - 0x150]
push ecx
call fcn.005518b4
add esp, 0xc
push 0x104
lea eax, [ebp - 0x13c]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea edx, [esi + 0x1114]
push edx
lea ecx, [ebp - 0x13c]
push ecx
call fcn.0054e1e8
add esp, 8
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x13c]
push edx
call fcn.0054e1e8
add esp, 8
lea ecx, [esi + 0x1121]
and dword [ecx], edx
add byte [eax], al

Function at 0x4a56d0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x587f90
push ebx
call fcn.0054e578
mov dword [ebp - 8], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.0055c248
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
mov eax, dword [ebp + 0xc]
call fcn.0055c1dc
mov ebx, eax
test bl, bl
jne 0x4a572f
push 0x80
cmp dword [ebp + 0xc], 0
je 0x4a571a
mov eax, dword [ebp + 0xc]
jmp 0x4a571f
mov eax, 0x581d8d
push eax
invalid
popal
Function at 0x4a5770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
mov eax, 0x5856bc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.0054e578
mov word [ebp - 0x30], 8
xor edx, edx
xor ecx, ecx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x154]
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0x14
mov word [ebp - 0x30], 0x20
mov dword [ebp - 8], ecx
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0x14
push 0x104
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x5818fc
lea edx, [ebp - 0x154]
push edx
call fcn.0054e1e8
add esp, 8
push 0x581909
lea ecx, [ebp - 0x154]
push ecx
call fcn.0054e1e8
add esp, 8
push 0x58190c
lea eax, [ebp - 0x154]
push eax
call fcn.0054e1e8
mov word [ebp - 0x30], 0x2c
add esp, 8
lea edx, [ebp - 0x154]
lea eax, [ebp - 0xc]
call fcn.0055c210
mov edx, eax
inc dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0055c54c
dec dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0055c51c
mov word [ebp - 0x30], 0x38
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x10]
push eax
inc dword [ebp - 0x24]
call fcn.004795ac
add esp, 8
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0055c54c
dec dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0055c51c
cmp dword [ebp - 8], 0
je 0x4a5873
mov ecx, dword [ebp - 8]
mov eax, dword [ecx - 4]
jmp 0x4a5875
xor eax, eax
cmp eax, 4
jge 0x4a58a9
dec dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0055c51c
dec dword [ebp - 0x24]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0055c51c
mov ecx, dword [ebp - 0x40]
mov dword fs:[0], ecx
jmp 0x4a5990
push 4
cmp dword [ebp - 8], 0
je 0x4a58b6
mov eax, dword [ebp - 8]
jmp 0x4a58bb
mov eax, 0x581911
push eax
lea edx, [ebp - 0x48]
push edx
call fcn.0054e0d4
xor dword [ebp - 0x48], 0x87236151
mov eax, dword [ebp - 0x48]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov dl, 1
mov eax, dword [0x535998]
call fcn.004087f0
mov dword [ebp - 0x44], eax
mov word [ebp - 0x30], 0x44
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea eax, [ebp - 0x14]
call fcn.0055c468
inc dword [ebp - 0x24]
mov edx, dword [eax]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
call dword [ecx + 0x34]
dec dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0055c51c
mov word [ebp - 0x30], 0x50
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov word [ebp - 0x30], 0x14
jmp 0x4a593e
mov ebx, dword [ebp - 0x44]
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x4a5966
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x30], 0x68
mov edx, 3
mov eax, dword [ebp - 0x1c]
Function at 0x4a5cc4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
mov eax, 0x585908
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.0054e578
mov word [ebp - 0x30], 8
xor edx, edx
xor ecx, ecx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x154]
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0x14
mov word [ebp - 0x30], 0x20
mov dword [ebp - 8], ecx
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0x14
push 0x104
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x581928
lea edx, [ebp - 0x154]
push edx
call fcn.0054e1e8
add esp, 8
push 0x581935
lea ecx, [ebp - 0x154]
push ecx
call fcn.0054e1e8
add esp, 8
push 0x581938
lea eax, [ebp - 0x154]
push eax
call fcn.0054e1e8
mov word [ebp - 0x30], 0x2c
add esp, 8
lea edx, [ebp - 0x154]
lea eax, [ebp - 0xc]
call fcn.0055c210
mov edx, eax
inc dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0055c54c
dec dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0055c51c
mov word [ebp - 0x30], 0x38
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x10]
push eax
inc dword [ebp - 0x24]
call fcn.004795ac
add esp, 8
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0055c54c
dec dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0055c51c
cmp dword [ebp - 8], 0
je 0x4a5dc7
mov ecx, dword [ebp - 8]
mov eax, dword [ecx - 4]
jmp 0x4a5dc9
xor eax, eax
cmp eax, 4
jge 0x4a5dfd
dec dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0055c51c
dec dword [ebp - 0x24]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0055c51c
mov ecx, dword [ebp - 0x40]
mov dword fs:[0], ecx
jmp 0x4a5ee4
push 4
cmp dword [ebp - 8], 0
je 0x4a5e0a
mov eax, dword [ebp - 8]
jmp 0x4a5e0f
mov eax, 0x58193d
push eax
lea edx, [ebp - 0x48]
push edx
call fcn.0054e0d4
xor dword [ebp - 0x48], 0x87236151
mov eax, dword [ebp - 0x48]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov dl, 1
mov eax, dword [0x535998]
call fcn.004087f0
mov dword [ebp - 0x44], eax
mov word [ebp - 0x30], 0x44
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea eax, [ebp - 0x14]
call fcn.0055c468
inc dword [ebp - 0x24]
mov edx, dword [eax]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
call dword [ecx + 0x34]
dec dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0055c51c
mov word [ebp - 0x30], 0x50
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov word [ebp - 0x30], 0x14
jmp 0x4a5e92
mov ebx, dword [ebp - 0x44]
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x4a5eba
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x30], 0x68
mov edx, 3
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x30], 0x5c
dec dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0055c51c
dec dword [ebp - 0x24]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0055c51c
mov ecx, dword [ebp - 0x40]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b9410
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x3c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 1
jle 0x4b944f
mov ecx, dword [ebp - 0x18]
sar ecx, 1
jns 0x4b944c
adc ecx, 0
mov dword [ebp - 0x18], ecx
xor edi, edi
mov eax, esi
jmp 0x4b945e
mov edx, dword [eax]
inc edi
add eax, 4
mov byte [edx], 0
cmp edi, dword [esi + 0x9c40]
jl 0x4b9455
mov dword [ebp - 4], ebx
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x34]
add eax, dword [ebx + 0x28]
adc edx, dword [ebx + 0x2c]
add dword [ebp - 0xc], eax
adc dword [ebp - 8], edx
mov eax, dword [ebx]
test eax, eax
je 0x4b9485
add ebx, eax
jmp 0x4b9469
cmp dword [ebp - 0x18], 1
jle 0x4b94a2
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00554cc3
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
mov edi, eax
mov eax, dword [esi + 0x9c48]
sub edi, eax
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x34]
add eax, dword [ebx + 0x28]
adc edx, dword [ebx + 0x2c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
mov eax, dword [ebx + 0x44]
push eax
push esi
call fcn.004bb2cc
add esp, 0x14
mov eax, dword [ebx]
test eax, eax
je 0x4b94e2
add ebx, eax
jmp 0x4b94b2
mov edx, dword [ebp - 0xc]
xor edi, edi
mov dword [esi + 0x9c48], edx
mov ebx, esi
mov edx, dword [ebp - 8]
mov dword [esi + 0x9c4c], edx
jmp 0x4b9519
mov eax, dword [ebx]
cmp byte [eax], 0
jne 0x4b9515
push edi
push esi
call fcn.004bb420
add esp, 8
dec edi
add ebx, 0xfffffffc
dec dword [esi + 0x9c40]
inc edi
add ebx, 4
cmp edi, dword [esi + 0x9c40]
jl 0x4b94fa
mov byte [esi + 0x9c54], 0
mov byte [esi + 0x9c64], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bae74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
mov eax, dword [sym.Project1.exe__PlayForm]
lea edx, [ebp - 0x104]
push ebx
push esi
mov ebx, dword [eax + 0x2ca8]
mov eax, 0x569e0034
push edx
push eax
push ebx
call fcn.004e04f0
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x104]
push ecx
call fcn.004e1580
add esp, 8
push 4
lea eax, [ebp - 0x104]
push eax
lea edx, [ebp - 4]
push edx
call fcn.0054e0d4
add esp, 0xc
mov eax, 0xe5d20034
lea edx, [ebp - 0x104]
push edx
push eax
push ebx
call fcn.004e04f0
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x104]
push ecx
call fcn.004e19cc
add esp, 8
mov cl, 0x63
xor eax, eax
xor esi, esi
lea edx, [ebp - 0x104]
mov ebx, eax
inc esi
add ebx, ebx
lea ebx, [ebx + ebx*4]
mov eax, ebx
mov bl, byte [edx]
xor bl, cl
inc edx
movsx ebx, bl
add ebx, 0xffffffd0
add eax, ebx
cmp esi, 5
jl 0x4baeff
sub eax, dword [ebp - 4]
test eax, eax
jle 0x4baf27
cmp eax, 7
jle 0x4baf29
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4baf30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
mov eax, dword [sym.Project1.exe__PlayForm]
lea edx, [ebp - 0x104]
push ebx
push esi
mov ebx, dword [eax + 0x2ca8]
mov eax, 0xd8d0034
push edx
push eax
push ebx
call fcn.004e04f0
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x104]
push ecx
call fcn.004e1580
add esp, 8
push 4
lea eax, [ebp - 0x104]
push eax
lea edx, [ebp - 4]
push edx
call fcn.0054e0d4
add esp, 0xc
mov eax, 0x64950037
lea edx, [ebp - 0x104]
push edx
push eax
push ebx
call fcn.004e04f0
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x104]
push ecx
call fcn.004e19cc
add esp, 8
mov cl, 0x63
xor eax, eax
xor esi, esi
lea edx, [ebp - 0x104]
mov ebx, eax
inc esi
add ebx, ebx
lea ebx, [ebx + ebx*4]
mov eax, ebx
mov bl, byte [edx]
xor bl, cl
inc edx
movsx ebx, bl
add ebx, 0xffffffd0
add eax, ebx
cmp esi, 5
jl 0x4bafbb
sub eax, dword [ebp - 4]
test eax, eax
jle 0x4bafe3
cmp eax, 7
jle 0x4bafe5
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret