joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47aa44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47aca4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x47aaa7
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0047a50c
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e988
cmp al, 1
jne 0x47aaa7
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0047a824
test al, al
je 0x47ac33
cmp dword [ebp - 8], 0
jge 0x47aac5
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0047a50c
mov eax, dword [ebp - 0x210]
call fcn.00404c54
cmp ebx, eax
jge 0x47ab0f
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0047a50c
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x6b0154]
and eax, 0xff
bt dword [edx], eax
jae 0x47ab0f
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x47ab23
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0047aa20
cmp ebx, dword [ebp - 8]
je 0x47ac25
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x47ab4f
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403c98
and eax, 0x7f
movzx eax, word [eax*2 + 0x6a4f7c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x47ac12
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403c98
and eax, 0x7f
movzx eax, word [eax*2 + 0x6a4f7c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00455814
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403c98
and eax, 0x7f
movzx eax, word [eax*2 + 0x6a4f7c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00455814
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ac19
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x47ac86
cmp dword [ebp - 8], 0
jge 0x47ac3e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0047a50c
mov eax, dword [ebp - 0x218]
call fcn.00404c54
cmp eax, dword [ebp - 8]
jg 0x47ac78
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0047a50c
mov eax, dword [ebp - 0x21c]
call fcn.00404c54
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0047aa20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47acab
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004049b0
ret
Function at 0x491328
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404e4c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
pop ebx
ret

Function at 0x493e94
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00493a48
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404e4c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x493ef2
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6afb44]
mov dl, 1
mov eax, dword [0x493940]
call fcn.0040e1b4
call fcn.0040432c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x493efc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404e4c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x493f54
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6b01a8]
mov dl, 1
mov eax, dword [0x493940]
call fcn.0040e1b4
call fcn.0040432c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00493a78
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x49fd54
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49fe2c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6c56ac], 0
jne 0x49fe10
lea eax, [ebp - 4]
mov edx, 0x49fe44
call fcn.00404a24
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404e4c
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x49fe10
mov eax, ebx
call fcn.00402838
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x49fe09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x49fdf3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x49fe54
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x49fdf3
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x6c56ac], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fe10
mov eax, dword [ebp - 0xc]
call fcn.00402858
ret
mov ebx, dword [0x6c56ac]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49fe33
lea eax, [ebp - 4]
call fcn.0040498c
ret
Function at 0x4bc7e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 8]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
lea eax, [ebx + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
mov eax, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
sub eax, dword [ebx + 8]
sbb edx, dword [ebx + 0xc]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], edx
pop ebx
ret

Function at 0x4e0efc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e10a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x11b], 0x12
test byte [ebx + 0x1c], 0x10
jne 0x4e1085
mov eax, ebx
call fcn.004ed56c
test byte [eax + 0x2ec], 8
jne 0x4e1085
push 0
mov eax, ebx
call fcn.004ed590
push eax
push 0x4514
mov eax, ebx
call fcn.004ed590
push eax
call sub.user32.dll_SendMessageA
dec eax
je 0x4e1085
cmp word [ebx + 0x1ba], 0
je 0x4e0f8e
mov byte [ebp - 1], 1
lea ecx, [ebp - 1]
mov edx, ebx
mov eax, dword [ebx + 0x1bc]
call dword [ebx + 0x1b8]
cmp byte [ebp - 1], 0
je 0x4e1085
mov eax, ebx
call fcn.004ed56c
test eax, eax
je 0x4e1085
mov al, byte [ebx + 0x50]
cmp al, 4
je 0x4e107a
mov byte [ebx + 0xa1], al
mov byte [ebx + 0x50], 4
cmp byte [ebx + 0x51], 0
jne 0x4e0fe6
mov al, byte [ebx + 0xa1]
cmp al, 2
je 0x4e0fe6
cmp al, 1
je 0x4e0fe6
cmp al, 3
je 0x4e0fe6
mov eax, ebx
call fcn.004ed56c
lea edx, [ebp - 0x14]
call fcn.0044e858
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x91]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebx + 0x64], 0
je 0x4e102e
lea edx, [ebp - 0x18]
mov eax, dword [0x6afcb4]
mov eax, dword [eax]
call fcn.0046fc48
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0xbc]
mov ecx, 0x3f
call fcn.0040a834
mov eax, dword [0x6afcb4]
mov eax, dword [eax]
call fcn.0046fa5c
push 0
mov eax, dword [0x6afcb4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
jmp 0x4e106a
mov eax, ebx
call fcn.004ed56c
test eax, eax
je 0x4e105b
mov eax, ebx
call fcn.004ed56c
lea edx, [ebp - 0x1c]
call fcn.0044eeb8
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0xbc]
mov ecx, 0x3f
call fcn.0040a834
push 0
mov eax, ebx
call fcn.004ed590
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebx + 0xa4]
push eax
push 0
call sub.shell32.dll_Shell_NotifyIconA
jmp 0x4e1081
mov eax, ebx
call fcn.004e09b4
mov byte [ebx + 0x51], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e10aa
lea eax, [ebp - 0x1c]
call fcn.0040498c
lea eax, [ebp - 0x18]
call fcn.0040498c
ret
Function at 0x4fc98c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
mov al, byte [ebx + 4]
mov word [ebp - 6], ax
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4fc9b3
add word [ebp - 6], 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4fc9c5
add word [ebp - 6], 0x4000
test byte [ebx + 0xb], 0x20
je 0x4fc9d1
add word [ebp - 6], 0x8000
mov byte [ebp - 0xd], 0
movzx edx, word [ebp - 6]
mov cl, 2
mov eax, dword [ebp - 0xc]
call fcn.004fc81c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4fca1e
xor eax, eax
push ebp
push 0x4fca17
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 4]
xor edx, edx
call fcn.004fc84c
pop ecx
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fca1e
ret
cmp byte [ebp - 0xd], 2
je 0x4fc9d1
cmp dword [ebp - 4], 0
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x509b68
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x30], 0
je 0x509d17
mov eax, dword [ebp - 4]
call fcn.00455b18
test al, al
je 0x509d17
mov eax, dword [ebp - 4]
mov byte [eax + 0x235], 1
mov eax, dword [ebp - 4]
call fcn.00455814
push eax
call sub.user32.dll_HideCaret
mov eax, dword [ebp - 4]
call fcn.00455814
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x509cf8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x509cd1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044e900
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.0044e8bc
inc eax
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x509cb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov ebx, eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00453834
mov eax, dword [ebp - 4]
cmp byte [eax + 0x20c], 1
jne 0x509c66
push 0xcc0020
push 2
push 2
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0044e900
push eax
mov eax, dword [ebp - 4]
call fcn.0044e8bc
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
jmp 0x509c92
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0044e900
push eax
mov eax, dword [ebp - 4]
call fcn.0044e8bc
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509cba
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50bd40
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x30], 0
je 0x50beef
mov eax, dword [ebp - 4]
call fcn.00455b18
test al, al
je 0x50beef
mov eax, dword [ebp - 4]
mov byte [eax + 0x221], 1
mov eax, dword [ebp - 4]
call fcn.00455814
push eax
call sub.user32.dll_HideCaret
mov eax, dword [ebp - 4]
call fcn.00455814
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x50bed0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x50bea9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0044e900
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.0044e8bc
inc eax
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x50be8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov ebx, eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00453834
mov eax, dword [ebp - 4]
cmp byte [eax + 0x20c], 1
jne 0x50be3e
push 0xcc0020
push 2
push 2
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0044e900
push eax
mov eax, dword [ebp - 4]
call fcn.0044e8bc
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
jmp 0x50be6a
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0044e900
push eax
mov eax, dword [ebp - 4]
call fcn.0044e8bc
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50be92
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5417e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41703c]
call fcn.0040563c
xor eax, eax
push ebp
push 0x541924
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6a68b4], 0
jne 0x541833
mov ecx, dword [0x6af428]
mov dl, 1
mov eax, dword [0x408938]
call fcn.0040e178
call fcn.0040432c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403230
mov eax, ebx
call fcn.00405264
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x541934
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406c40
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405274
test eax, eax
jle 0x5418cb
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x5418c4
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404c1c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404c04
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004097e4
test eax, eax
jne 0x5418c4
mov ebx, 0x15
jmp 0x5418d0
mov ebx, 0x10
jmp 0x5418d0
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x6a68b4]
call fcn.005416dc
mov eax, dword [ebp - 8]
call fcn.005416dc
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54192b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004049b0
lea eax, [ebp - 0x10]
mov edx, dword [0x41703c]
call fcn.0040570c
ret

Function at 0x542800
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x542871
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x6a68e4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x54285b
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.005427f0
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x5425f8]
call fcn.00542898
mov dword [0x6a6948], eax
mov eax, dword [ebp - 4]
call fcn.005427a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x542878
lea eax, [ebp - 8]
call fcn.00406c40
ret
Function at 0x54681c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e3c
xor eax, eax
push ebp
push 0x546890
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404c54
mov esi, eax
test esi, esi
jle 0x54686f
mov edi, 1
lea eax, [ebp - 4]
call fcn.00404ea4
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi - 1]
xor dl, bl
mov byte [eax + edi - 1], dl
inc edi
dec esi
jne 0x546856
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004049e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x546897
lea eax, [ebp - 4]
call fcn.0040498c
ret

Function at 0x546d40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x546e0f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
lea eax, [ebp - 8]
mov edx, 0x546e28
call fcn.00404a24
xor ebx, ebx
mov esi, 0x6c9fc4
mov eax, ebx
add al, 0x4d
mov edx, eax
shl eax, 5
add eax, edx
sub al, 3
mov edx, eax
imul edx, edx, 0x3b
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0054681c
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004049e0
inc ebx
add esi, 4
cmp ebx, 0x100
jne 0x546d71
mov eax, dword [ebp - 8]
call fcn.00404c54
mov edx, eax
lea ecx, [ebp - 8]
xor eax, eax
call fcn.0040503c
mov eax, dword [ebp - 8]
mov edx, 0x546ef0
call fcn.00404d98
je 0x546df4
xor ebx, ebx
mov eax, 0x6ca7c4
lea edx, [ebx + 0x309]
imul edx, edx, 0x4d
sub edx, 7
imul edx, edx, 0x1c03
xor edx, 0x21b666
mov dword [eax], edx
inc ebx
add eax, 4
cmp ebx, 0x100
jne 0x546dce
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x546e16
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004049b0
ret
Function at 0x546ef4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x547030
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
xor esi, esi
mov edi, 0x6ca3c4
mov eax, 0xff
call fcn.00403250
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
call fcn.00402cbc
mov ebx, eax
lea eax, [ebx + 0x4d]
mov edx, eax
shl eax, 5
add eax, edx
sub al, 3
mov edx, eax
imul edx, edx, 0x3b
lea ecx, [ebp - 8]
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x6c9fc4]
call fcn.0054681c
mov eax, esi
add al, 0xbc
imul eax, eax, 0x2c
sub al, 4
lea edx, [eax + eax*4]
lea edx, [edx + edx*8]
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0054681c
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004049e0
inc esi
add edi, 4
cmp esi, 0x100
jne 0x546f1e
mov eax, dword [ebp - 8]
call fcn.00404c54
mov edx, eax
lea ecx, [ebp - 8]
xor eax, eax
call fcn.0040503c
mov eax, dword [ebp - 8]
mov edx, 0x54704c
call fcn.00404d98
je 0x547012
xor esi, esi
mov edi, 0x6cabc4
mov eax, 0xff
call fcn.00403250
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
call fcn.00402cbc
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x6ca7c4]
xor edx, edx
mov dl, bl
add edx, 0x309
imul edx, edx, 0x4d
sub edx, 7
imul edx, edx, 0x1c03
xor eax, edx
lea edx, [esi + 0x378]
imul edx, edx, 0x58
sub edx, 8
imul edx, edx, 0x1ff5
xor eax, edx
mov dword [edi], eax
inc esi
add edi, 4
cmp esi, 0x100
jne 0x546fb3
xor eax, eax
dec eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547037
lea eax, [ebp - 0x10]
call fcn.0040498c
lea eax, [ebp - 8]
call fcn.0040498c
ret

Function at 0x547050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e3c
xor eax, eax
push ebp
push 0x547102
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404c54
test eax, eax
jns 0x547083
add eax, 3
sar eax, 2
mov esi, eax
dec esi
test esi, esi
jle 0x5470ae
mov ebx, 1
lea eax, [ebp - 4]
call fcn.00404ea4
mov edx, ebx
dec edx
shl edx, 2
add eax, edx
lea edx, [ebx + ebx*2]
add edx, 0xb
sub dword [eax], edx
inc ebx
dec esi
jne 0x547092
mov eax, dword [ebp - 4]
call fcn.00404c54
mov esi, eax
test esi, esi
jle 0x5470e1
mov ebx, 1
lea eax, [ebp - 4]
call fcn.00404ea4
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
imul ecx, ebx, 0x10f447
xor edx, ecx
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x5470c1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004049e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x547109
lea eax, [ebp - 4]
call fcn.0040498c
ret

Function at 0x566f90
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x566fb5
cmp dword [esp + 4], 5
jb 0x566fb5
mov al, 1
jmp 0x566fb7
xor eax, eax
add esp, 0x94
ret
Function at 0x5902c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
lea eax, [ebp - 4]
call fcn.0040561c
xor eax, eax
push ebp
push 0x59038f
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x5902fc
mov word [ebp - 6], 0xd379
jmp 0x590302
mov word [ebp - 6], 0xd399
mov eax, dword [ebp + 8]
call fcn.004050c0
mov eax, dword [ebp - 4]
call fcn.00405274
mov edi, eax
test edi, edi
jle 0x590369
mov esi, 1
mov eax, dword [ebp - 4]
mov ax, word [eax + esi*2 - 2]
mov ebx, eax
xor bx, word [ebp - 6]
imul ax, si, 0x4f
add bx, ax
add bx, 0xb5c3
xor bx, 0x983e
lea ecx, [ebp - 0x10]
movzx eax, bx
mov edx, 4
call fcn.00409e30
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405254
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.00405280
mov eax, dword [ebp + 8]
inc esi
dec edi
jne 0x59031d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x590396
lea eax, [ebp - 0x10]
call fcn.0040498c
lea eax, [ebp - 0xc]
call fcn.004050c0
lea eax, [ebp - 4]
call fcn.004050c0
ret