joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x20], 1
push ebx
push esi
push edi
jne 0x4bd6b4
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jle 0x4bd7be
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
shl eax, 2
mov dword [ebp + 0x10], eax
push eax
push esi
push edi
call fcn.004dc360
add edi, dword [ebp + 0x18]
add esp, 0xc
add esi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x10]
dec ebx
jne 0x4bd696
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x14], eax
test eax, eax
jle 0x4bd7be
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [ebp + 0xc], ebx
mov edi, edi
xor ecx, ecx
test edx, edx
jle 0x4bd7ab
cmp edx, 8
jb 0x4bd77c
lea eax, [edx - 1]
lea eax, [ebx + eax*4]
lea esi, [edx - 1]
lea esi, [edi + esi*4]
cmp edi, eax
ja 0x4bd6fb
cmp esi, ebx
jae 0x4bd779
mov eax, edx
and eax, 0x80000007
jns 0x4bd709
dec eax
or eax, 0xfffffff8
inc eax
movdqa xmm2, xmmword [0x534aa0]
mov esi, edx
movdqa xmm3, xmmword [0x534b10]
sub esi, eax
mov edx, ebx
mov dword [ebp + 0x20], esi
sub edx, edi
lea eax, [edi + 0x10]
mov dword [ebp + 8], edx
mov esi, ebx
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
movdqu xmm1, xmmword [esi]
add ecx, 8
lea esi, [esi + 0x20]
lea eax, [eax + 0x20]
pand xmm1, xmm2
movdqu xmm0, xmmword [eax - 0x30]
pand xmm0, xmm3
por xmm1, xmm0
movdqu xmmword [eax - 0x30], xmm1
movdqu xmm1, xmmword [ebx + eax - 0x20]
movdqu xmm0, xmmword [eax - 0x20]
pand xmm1, xmm2
pand xmm0, xmm3
por xmm1, xmm0
movdqu xmmword [eax - 0x20], xmm1
cmp ecx, dword [ebp + 0x20]
jl 0x4bd732
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
cmp ecx, edx
jge 0x4bd7ab
mov esi, ebx
lea eax, [edi + ecx*4]
sub esi, edi
sub edx, ecx
lea esp, [esp]
mov ecx, dword [eax + esi]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
and ecx, 0xffffff
xor dword [eax - 4], ecx
dec edx
jne 0x4bd790
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
add ebx, dword [ebp + 0x1c]
add edi, dword [ebp + 0x18]
dec eax
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x14], eax
jne 0x4bd6d0
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c

Function at 0x4bf4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
cdq
and edx, 3
add eax, edx
push ebx
mov ebx, dword [ebp + 0x10]
sar eax, 2
push esi
mov esi, dword [ebp + 8]
test ebx, ebx
jle 0x4bf582
mov edx, dword [ebp + 0xc]
lea ecx, [eax*4]
mov dword [ebp + 8], ecx
push edi
lea ecx, [ecx]
xor eax, eax
test edx, edx
jle 0x4bf57c
cmp edx, 8
jb 0x4bf568
mov ecx, edx
and ecx, 0x80000007
jns 0x4bf52a
dec ecx
or ecx, 0xfffffff8
inc ecx
movdqa xmm1, xmmword [0x534aa0]
mov edi, edx
sub edi, ecx
mov ecx, esi
jmp 0x4bf540
movdqu xmm0, xmmword [ecx]
add eax, 8
lea ecx, [ecx + 0x20]
pxor xmm0, xmm1
movdqu xmmword [ecx - 0x20], xmm0
movdqu xmm0, xmmword [ecx - 0x10]
pxor xmm0, xmm1
movdqu xmmword [ecx - 0x10], xmm0
cmp eax, edi
jl 0x4bf540
mov ecx, dword [ebp + 8]
cmp eax, edx
jge 0x4bf57c
lea esp, [esp]
xor dword [esi + eax*4], 0xffffff
inc eax
cmp eax, edx
jl 0x4bf570
add esi, ecx
dec ebx
jne 0x4bf510
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4c03b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8243
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x54d000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CSpriteAnime.0
mov dword [ebp - 4], 1
mov ecx, dword [0x58dca8]
push esi
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, esi
call fcn.004c0670
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4c041e
push eax
call fcn.004d9d65
add esp, 4
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi], vtable.IAppTask.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4c2d60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f84cb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x54d000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x44]
mov dword [ebp - 4], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
movdqu xmm0, xmmword [esi + 0x18]
movdqu xmmword [edi + 0x18], xmm0
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
lea eax, [esi + 0x44]
push eax
call fcn.0042ec90
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
movzx eax, word [esi + 0x54]
mov word [edi + 0x54], ax
movzx eax, word [esi + 0x56]
mov word [edi + 0x56], ax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
movdqu xmm0, xmmword [esi + 0x5c]
movdqu xmmword [edi + 0x5c], xmm0
mov eax, dword [esi + 0x6c]
mov dword [edi + 0x6c], eax
movdqu xmm0, xmmword [esi + 0x70]
movdqu xmmword [edi + 0x70], xmm0
movq xmm0, qword [esi + 0x80]
movq qword [edi + 0x80], xmm0
mov eax, dword [esi + 0x88]
mov dword [edi + 0x88], eax
movdqu xmm0, xmmword [esi + 0x8c]
movdqu xmmword [edi + 0x8c], xmm0
movq xmm0, qword [esi + 0x9c]
movq qword [edi + 0x9c], xmm0
mov eax, dword [esi + 0xa4]
mov dword [edi + 0xa4], eax
movq xmm0, qword [esi + 0xbc]
movq qword [edi + 0xbc], xmm0
mov eax, dword [esi + 0xc4]
mov dword [edi + 0xc4], eax
movq xmm0, qword [esi + 0xa8]
movq qword [edi + 0xa8], xmm0
mov eax, dword [esi + 0xb0]
mov dword [edi + 0xb0], eax
mov eax, dword [esi + 0xb4]
mov dword [edi + 0xb4], eax
mov eax, dword [esi + 0xb8]
mov dword [edi + 0xb8], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c6ff0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push 0
push 0x1f0001
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4c701b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x4c7013
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4c7056
cmp eax, 0x80
je 0x4c7056
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
mov dword [edi + 0xe4], esi
mov eax, 1
pop edi
pop esi
pop ebp
ret 4
Function at 0x4c8a50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x4f8e48
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x54d000]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x54d000]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
lea esi, [edi + 0x54]
mov dword [esp + 0x60], 0
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x4c], esi
call dword [eax + 4]
lea ecx, [edi + 0x18]
mov byte [esp + 0x60], 1
cmp dword [ecx + 0x14], 0x10
jb 0x4c8ac3
mov ecx, dword [ecx]
cmp dword [edi + 0x44], 0x10
lea eax, [edi + 0x30]
jb 0x4c8ace
mov eax, dword [eax]
push ecx
push eax
push str.__xml_version__s__encoding__s_____n
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.004c6540
add esp, 0x14
mov dword [esp + 0x1c], 0
cmp dword [esp + 0x20], 0x10
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
mov byte [eax], 0
cmp dword [esp + 0x20], 0x10
jb 0x4c8b13
push dword [esp + 0xc]
call fcn.004d9d65
add esp, 4
mov eax, dword [edi + 0x48]
test eax, eax
je 0x4c8b29
push eax
push 0
lea eax, [esp + 0x3c]
mov ecx, edi
push eax
call fcn.004c9660
xorps xmm0, xmm0
movdqa xmmword [esp + 0x24], xmm0
mov dword [esp + 0x24], vtable.CFile.0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov byte [esp + 0x60], 2
cmp dword [edi + 0x14], 0x10
jb 0x4c8b5f
mov edi, dword [edi]
push edi
lea ecx, [esp + 0x28]
call fcn.004960c0
test eax, eax
jne 0x4c8b8d
lea eax, [esp + 0x28]
mov byte [esp + 0x60], 1
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], vtable.CFile.0
call dword [0x530444]
xor edi, edi
jmp 0x4c8be2
cmp dword [esp + 0x48], 0x10
lea ecx, [esp + 0x2c]
push 0
push ecx
push dword [esp + 0x4c]
lea eax, [esp + 0x40]
cmovae eax, dword [esp + 0x40]
push eax
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x28]
call dword [eax + 0xc]
lea eax, [esp + 0x28]
mov byte [esp + 0x60], 1
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], vtable.CFile.0
call dword [0x530444]
mov edi, 1
mov byte [esp + 0x60], 0
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 8]
cmp dword [esp + 0x48], 0x10
lea ecx, [esp + 0x34]
mov dword [esp + 0x44], 0
cmovae ecx, dword [esp + 0x34]
mov byte [ecx], 0
cmp dword [esp + 0x48], 0x10
jb 0x4c8c1a
push dword [esp + 0x34]
call fcn.004d9d65
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004d9d6a
mov esp, ebp
pop ebp
ret
Function at 0x4cb7c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f931a
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x54d000]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], 0
mov eax, dword [edi]
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
push 0x6e
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.004c66f0
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov eax, dword [edi]
cmovae ecx, dword [ebp - 0x2c]
push ecx
mov ecx, edi
call dword [eax + 0x14]
test eax, eax
jne 0x4cb877
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
mov byte [eax], 0
cmp dword [ebp - 0x18], 0x10
jb 0x4cb859
push dword [ebp - 0x2c]
call fcn.004d9d65
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d9d6a
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
push 8
lea esi, [edi + 0xdc]
push esi
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
mov ecx, dword [esi]
cmp ecx, 0xa
sbb eax, eax
inc eax
mov dword [edi + 0xd8], eax
jne 0x4cb8a4
push ecx
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
push 0x57c8f0
push 0x28
call fcn.004da558
add esp, 8
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x4cb8c7
mov ecx, eax
call fcn.004cb9b0
jmp 0x4cb8c9
xor eax, eax
mov byte [ebp - 4], 1
mov dword [edi + 0x108], eax
test eax, eax
jne 0x4cb8f2
push 0x5333b8
lea ecx, [ebp - 0x4c]
call fcn.0042ba20
push 0x549be0
lea eax, [ebp - 0x4c]
push eax
call fcn.004dd2ec
call fcn.004b8fc0
mov esi, eax
mov ecx, esi
call fcn.004b9070
call fcn.00496a60
mov ecx, eax
mov dword [edi + 0x10c], eax
call fcn.00496b00
call fcn.00496280
push dword [esi + 0x2c]
mov ecx, eax
push dword [0x58dba4]
call fcn.00496390
call fcn.004b64a0
mov ecx, eax
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 0
call dword [sym.imp.USER32.dll_WINNLSEnableIME]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0xfc], eax
lea eax, [edi + 0x104]
push eax
push 0
push edi
push 0x4cbe80
push 0
push 0
call fcn.004da838
add esp, 0x18
mov dword [edi + 0x100], eax
lea ecx, [ebp - 0x2c]
call fcn.00426b30
mov eax, 1
jmp 0x4cb85b

Function at 0x4cc230
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x54d000]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x94
lea eax, [ebp - 0x98]
mov esi, edx
push 0
push eax
call fcn.004dc9b0
add esp, 0xc
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x94]
cmp eax, 6
ja 0x4cc299
jne 0x4cc288
cmp dword [ebp - 0x90], esi
jae 0x4cc299
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d9d6a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.004d9d6a
mov esp, ebp
pop ebp
ret
Function at 0x4cc960
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x54d000]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x94
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.004dc9b0
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x9c]
cmp eax, 6
ja 0x4cca2f
jne 0x4cc9ba
cmp dword [ebp - 0x98], 2
jae 0x4cca2f
push 0x94
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.004dc9b0
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x9c]
cmp eax, 6
ja 0x4cca0e
jne 0x4cc9fd
cmp dword [ebp - 0x98], 2
jae 0x4cca0e
mov edx, 1
call fcn.004cc230
neg eax
sbb eax, eax
inc eax
jmp 0x4cca10
xor eax, eax
mov ecx, dword [0x58dc90]
push eax
push str._Screen_ChangeMode
call fcn.004c8c40
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d9d6a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004d9d6a
mov esp, ebp
pop ebp
ret
Function at 0x4d17e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x54d000]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x57c8a4], 0
push esi
mov esi, dword [ebp + 0x10]
jne 0x4d184f
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4d183f
mov eax, dword [ebp - 0x94]
cmp eax, 5
ja 0x4d1831
jne 0x4d183f
cmp dword [ebp - 0x90], 1
jb 0x4d183f
mov al, 1
mov byte [0x57c8a5], al
mov byte [0x57c8a4], al
jmp 0x4d1854
xor al, al
mov byte [0x57c8a4], 1
mov byte [0x57c8a5], al
jmp 0x4d1854
mov al, byte [0x57c8a5]
test al, al
mov eax, dword [ebp + 0x18]
je 0x4d1860
or eax, 0x100
push eax
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WINMM.dll_timeSetEvent]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d9d6a
mov esp, ebp
pop ebp
ret
Function at 0x4d2490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f982b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x54d000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 0xc]
mov dword [esi], vtable.CMemAllocator.0
mov dword [eax], vtable.CMemAllocator.1.0
push eax
mov dword [ebp - 4], 0
call fcn.004d2e20
mov ecx, esi
call fcn.004d4370
mov eax, dword [esi + 0x30]
mov dword [ebp - 4], 2
test eax, eax
je 0x4d24f1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x4d24fe
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [esi + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.004d56f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4d4e40
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x4d4e5a
mov eax, 0x80004003
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esi - 0xc]
test eax, eax
je 0x4d4e6b
lea eax, [esi + 4]
jmp 0x4d4e6d
xor eax, eax
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
push eax
movdqu xmmword [edi], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x4d4f3c
lea eax, [ecx - 1]
test dword [ebp - 8], eax
jne 0x4d4f3c
cmp dword [esi + 0x44], 1
jne 0x4d4ec1
push dword [ebp + 0x10]
mov esi, 0x8004020f
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x20]
cmp eax, dword [esi + 0x30]
jge 0x4d4ee2
push dword [ebp + 0x10]
mov esi, 0x80040210
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0xc]
mov ebx, dword [ebx + 4]
add ebx, eax
mov dword [ebp + 8], eax
mov eax, ebx
cdq
idiv ecx
test edx, edx
je 0x4d4efa
sub ecx, edx
add ebx, ecx
mov ecx, dword [ebp + 0xc]
sub ebx, dword [ebp + 8]
push dword [ebp + 0x10]
mov dword [esi + 0x34], ebx
mov dword [edi + 4], ebx
mov eax, dword [ecx]
mov dword [esi + 0x2c], eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 0x38], eax
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0x3c], eax
mov dword [edi + 0xc], eax
mov dword [esi + 0x40], 1
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
mov esi, 0x8004020e
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e857c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x54d000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004de981
mov dword [ebp - 0x14], eax
cmp dword [0x57d6c4], esi
jne 0x4e866f
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4e85fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4e874f
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4e874f
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4e874f
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x57d6c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x57d6c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x57d6cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x57d6d4], eax
test eax, eax
je 0x4e866c
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x57d6d0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4e8694
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4e8687
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4e86a9
push 4
pop eax
jmp 0x4e8751
cmp dword [ebp - 0x14], esi
je 0x4e86a9
push dword [0x57d6c4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4e868e
mov eax, dword [0x57d6d0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4e8707
cmp dword [0x57d6d4], edi
je 0x4e8707
push eax
call ebx
push dword [0x57d6d4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4e8707
test eax, eax
je 0x4e8707
call ecx
test eax, eax
je 0x4e86fc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4e86fc
test byte [ebp - 8], 1
jne 0x4e8707
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4e8737
mov eax, dword [0x57d6c8]
cmp eax, edi
je 0x4e8734
push eax
call ebx
test eax, eax
je 0x4e8734
call eax
mov esi, eax
test esi, esi
je 0x4e8734
mov eax, dword [0x57d6cc]
cmp eax, edi
je 0x4e8734
push eax
call ebx
test eax, eax
je 0x4e8734
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x57d6c4]
call ebx
test eax, eax
je 0x4e874f
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4e8751
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9d6a
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x408957
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
sub edi, eax
add edi, 0x86982967
call fcn.0040897a
xor dword [esi], edx
inc eax
add esi, 1
mov eax, eax
inc edi
cmp esi, ebx
jne fcn.00408957
ret