joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d555
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x47c748]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0045d4ea
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004368b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x45d5a4
cmp dword [ebp - 0x1c], 5
jb 0x45d5bc
jmp 0x45d5b8
cmp dword [ebp - 0x10], 1
jne 0x45d5bc
cmp dword [ebp - 0x1c], 4
ja 0x45d5b8
jne 0x45d5bc
cmp dword [ebp - 0x18], 0
jbe 0x45d5bc
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x46b10c
call fcn.0045d3be
test eax, eax
jge 0x45d5dd
mov byte [0x481bd0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00432456
add ebp, 0x78
leave
ret
Function at 0x403bc0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x524008], 0x8088405
inc edx
mov dword [ebx + 0x524008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x429eb4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x429eba
ret

Function at 0x4391e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x439395
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405b48
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4393ac
call fcn.004057a4
mov eax, ebx
call fcn.00427d50
mov edi, eax
dec edi
test edi, edi
jl 0x43929c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00427d24
mov edx, dword [0x4438ac]
call fcn.004047d0
test al, al
je 0x439298
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00427d24
lea edx, [ebp - 0x14]
call fcn.0044c2d4
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405b48
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405818
inc esi
dec edi
jne 0x43924a
mov al, byte [0x4393b0]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x4393bc
mov eax, dword [ebp - 0xc]
call fcn.004117ac
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00405520
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0044c2d4
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x4393ac
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0044c2d4
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x4393ac
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x4393ac
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x4393c8
call fcn.0040d788
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43939c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004054ac
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004054ac
lea eax, [ebp - 0x14]
call fcn.00405488
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004054ac
ret
Function at 0x471184
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4711b2
mov eax, ebx
call fcn.00471c38
cmp dword [ebx + 0x40], 0
je 0x4711ab
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x471223
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x471215
cmp dword [ebx + 8], 0
je 0x4711d4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4711e6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x471215
cmp dword [ebx + 8], 0
je 0x4711c7
cmp eax, 3
je 0x4711f9
dec eax
jne 0x4711c7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4711c7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4711c7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x471241
cmp dword [ebx + 0x14], 0xcc
je 0x471241
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047124c
pop ebx
ret
Function at 0x49d168
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x550ce4
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x49d18a
shr eax, 1
xor eax, 0xedb88320
jmp 0x49d18c
shr eax, 1
dec edx
jne 0x49d178
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x49d171
mov byte [0x5510e4], 1
pop esi
pop ebx
ret

Function at 0x49d1a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5510e4], 0
jne 0x49d1bf
call fcn.0049d168
mov eax, edi
dec eax
test eax, eax
jl 0x49d1e8
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x550ce4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x49d1c9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x49fd34
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x49fd65
dec al
je 0x49fda1
dec al
je 0x49fde5
dec al
je 0x49fe50
jmp 0x49feda
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x49feda
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49fd75
jmp 0x49feda
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49feda
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49fdb1
jmp 0x49feda
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49feda
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x49fe13
xor ebp, ebp
jmp 0x49fe24
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x49fe2d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x49fdf5
jmp 0x49feda
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49feda
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x49fea8
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0049d1f0
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x49fe64
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a5448
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov dl, 1
mov eax, dword [0x429c24]
call fcn.0043068c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a561b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x54]
cmp dword [eax + 8], 0
jle 0x4a55fa
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00431b98
mov eax, dword [ebp - 8]
call fcn.00430c5c
mov eax, dword [eax + 0x14]
mov edx, esi
call fcn.0042b3e4
cmp byte [ebp + 8], 0
je 0x4a54e2
xor edx, edx
mov eax, ebx
call fcn.004a43d0
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.004a43d0
mov edx, dword [eax]
call dword [edx + 0x20]
mov esi, eax
mov eax, ebx
call fcn.004a4300
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x4a551e
xor edx, edx
mov eax, ebx
call fcn.004a43d0
mov edx, dword [eax]
call dword [edx + 0x2c]
mov esi, eax
mov eax, ebx
call fcn.004a4300
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.004a43d0
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.0041dd08
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
call fcn.00430c5c
pop edx
call fcn.0042ba90
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.004a4300
dec eax
test eax, eax
jl 0x4a55d2
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004a42a4
push 0
lea eax, [ebp - 0x20]
push eax
mov edx, esi
mov eax, ebx
call fcn.004a43fc
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x20]
imul esi
xor edx, edx
mov dl, byte [ebp + 8]
imul edx
push eax
mov edx, esi
mov eax, ebx
call fcn.004a43fc
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
imul esi
mov dl, byte [ebp + 8]
xor dl, 1
and edx, 0x7f
imul edx
xor ecx, ecx
pop edx
call fcn.0041dce0
mov eax, dword [ebp - 8]
call fcn.00430c5c
mov edx, eax
lea ecx, [ebp - 0x20]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
inc esi
dec dword [ebp - 0x10]
jne 0x4a5568
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004a42a4
cmp byte [ebp + 0xc], 0
je 0x4a55fa
movzx eax, word [ebx + 0x58]
mov edx, 0x10
call fcn.00432fa0
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.004a3a94
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5622
mov eax, dword [ebp - 8]
call fcn.00404638
ret
Function at 0x4b54cc
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b564e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004b58c0
mov eax, ebx
call fcn.0042af10
dec al
je 0x4b5510
dec al
je 0x4b5516
jmp 0x4b551c
mov byte [ebp - 0x77], 2
jmp 0x4b5520
mov byte [ebp - 0x77], 1
jmp 0x4b5520
mov byte [ebp - 0x77], 0
mov eax, dword [ebp - 0x8c]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0x8c], eax
mov eax, ebx
call fcn.0042ae9c
shl eax, 2
lea eax, [eax + eax*4]
mov dword [ebp - 0x84], eax
mov edi, dword [ebx + 0x18]
cmp edi, 0xff000008
je 0x4b556d
cmp edi, 0x20000000
jne 0x4b5579
mov dword [ebp - 0x88], 0x40000000
jmp 0x4b5583
mov eax, edi
call fcn.0042a734
mov dword [ebp - 0x7c], eax
mov eax, ebx
call fcn.0042aed8
test al, 1
je 0x4b5595
or dword [ebp - 0x88], 1
mov eax, ebx
call fcn.0042aed8
test al, 2
je 0x4b55a7
or dword [ebp - 0x88], 2
mov eax, ebx
call fcn.0042aed8
test al, 4
je 0x4b55b9
or dword [ebp - 0x88], 4
mov eax, ebx
call fcn.0042aed8
test al, 8
je 0x4b55cb
or dword [ebp - 0x88], 8
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.0042ae28
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x76]
mov ecx, 0x20
call fcn.0040d12c
or dword [ebp - 0x8c], 0x8000000
mov eax, ebx
call fcn.0042af40
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x3c]
push eax
push 0x3c
mov eax, ebx
call fcn.0042ac2c
push eax
call fcn.0040810c
test eax, eax
je 0x4b5628
or dword [ebp - 0x8c], 0x400000
mov ax, word [ebp - 0x2c]
mov word [ebp - 0x56], ax
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004b58ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5655
lea eax, [ebp - 0x94]
call fcn.00405488
ret
Function at 0x4cf524
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, 0x52a61c
mov esi, eax
cmp ecx, 1
jb 0x4cf62d
test edx, edx
jne 0x4cf541
xor esi, esi
jmp 0x4cf62d
xor eax, 0xffffffff
cmp ecx, 8
jb 0x4cf609
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ecx, 8
cmp ecx, 8
jae 0x4cf54d
test ecx, ecx
je 0x4cf628
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ecx
test ecx, ecx
jne 0x4cf60d
mov esi, eax
xor esi, 0xffffffff
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4d3694
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov ebx, eax
mov eax, dword [ebx + 0x60]
mov esi, eax
lea edi, [esp + 4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, dword [esp + 0x14]
test edx, edx
jns 0x4d36bb
call fcn.00404574
xor ecx, ecx
mov eax, dword [ebx + 0x78]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4d3704
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4d36fc
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [0x4d2ce0]
call fcn.004064d8
inc edi
dec esi
jne 0x4d36e3
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x44]
movzx esi, word [esp + 0xc]
test esi, esi
jle 0x4d3781
mov edx, dword [0x4d2ce0]
mov eax, 0x3c
call fcn.004064c4
mov dword [esp], eax
mov edx, dword [esp]
mov ecx, 0x2e
mov eax, dword [ebx + 0x78]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [esp]
movzx ecx, word [eax + 0x1c]
mov eax, dword [esp]
lea edx, [eax + 0x30]
mov eax, dword [ebx + 0x78]
call fcn.004cf23c
mov eax, dword [esp]
movzx edx, word [eax + 0x1e]
mov cx, 1
mov eax, dword [ebx + 0x78]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [esp]
movzx ecx, word [eax + 0x20]
mov eax, dword [esp]
lea edx, [eax + 0x34]
mov eax, dword [ebx + 0x78]
call fcn.004cf23c
mov eax, dword [esp]
mov edx, dword [eax + 0x30]
mov ecx, dword [esp]
mov eax, dword [ebx + 0x30]
mov edi, dword [eax]
call dword [edi + 0x3c]
dec esi
jne 0x4d370d
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x14]
movzx edx, word [esp + 0xc]
cmp eax, edx
sete al
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x4046f0
Capabilities:
Get geographical location
Get keyboard layout
Hide graphical window
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x5c]
mov eax, dword [0x500034]
xor eax, esp
mov dword [esp + 0x40], eax
call fcn.0043ba40
mov dword [0x500be8], edi
mov dword [0x500be4], esi
call fcn.00434da0
call fcn.0041f810
call fcn.00424450
call fcn.0041d6e0
call fcn.0043cdf0
cmp dword [0x503304], 4
jb 0x404748
jne 0x404758
cmp dword [0x50330c], 2
je 0x404758
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [section..data], eax
call fcn.0040b280
push str.user32.dll
call fcn.0043baa0
add esp, 4
mov esi, eax
push str.winmm.dll
call fcn.0043baa0
add esp, 4
invalid

Function at 0x405f20
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
sub esp, 0x20
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x500034]
xor ecx, esp
mov dword [esp + 0x1c], ecx
cmp byte [eax], 0x26
jne 0x405fc2
add eax, 1
mov ecx, esp
lea edx, [esp + 4]
push ecx
push edx
push 0x4de18d
push eax
call fcn.00405ff0
add esp, 0x10
cmp eax, 2
jne 0x405fc2
push dword [esp]
push 0
push 0
push 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test eax, eax
je 0x405fbb
mov eax, dword [esp + 0x30]
mov ecx, dword [esp]
mov dword [esp + 8], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
push ecx
push eax
call fcn.00438490
add esp, 8
test al, al
je 0x405fd7
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
setne bl
jmp 0x405fc4
xor ebx, ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0049e340
mov eax, ebx
add esp, 0x20
pop esi
pop ebx
ret
push str.Serialised_configuration_data_was_invalid
call fcn.00405390
int3

Function at 0x406150
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
cmp dword [esp + 0x14], 2
jne 0x4061fd
mov ebp, dword [esp + 0x1c]
lea eax, [ebp + 1]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x4061fd
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4061fd
mov edi, eax
mov bl, byte [esp + 0x20]
push ebp
push dword [esp + 0x1c]
push eax
call fcn.004a0b20
add esp, 0xc
mov byte [edi + ebp], 0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test bl, bl
jne 0x4061bf
push 0
push 1
push 0x8002
push dword [0x500004]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x500004]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x406202
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
test bl, bl
jne 0x4061fd
push 0
push 0
push 0x8002
push dword [0x500004]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test bl, bl
je 0x4061e8
jmp 0x4061fd
Function at 0x49ebc7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49ec06
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x49ec06
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49ec06
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x49ec06
cmp dword [ecx + 0x74], 0xe
jbe 0x49ec06
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4b2920
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b294d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b294d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4b2d21
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4da968
push 0x4da960
push str.FlsAlloc
push 0x1e
call fcn.004b33b4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b2d55
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x4b2d5b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4b2d9f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4da978
push 0x4da970
push str.FlsGetValue
push 0x20
call fcn.004b33b4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b2dd6
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4b7f30
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pushal
pushfd
inc eax
call fcn.00406360
mov esi, 0x349278b8
xor edi, esi
neg edx
mov ecx, 0x38bf521
shr esi, 0x1e
xor eax, ebx
sub edx, esp
inc esi
mov eax, eax
xor edx, esp
not eax

Function at 0x4b7f59
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov edi, edx
mov ebx, esi
test eax, esp
jo 0x4b7ee9
mov ecx, esi
rol eax, 1
mov esi, eax
rol eax, 0x17
shr eax, 0x1d
neg esi
rol esi, 0xd
shr esi, 0xa
or esi, dword [0x50048c]
shl esi, 5
call fcn.0049e695
inc dword [ecx - 0x53dc6d16]
add al, 0x8b
sal bh, cl
salc
ror edx, 0x14
add ecx, esi
dec edi
sub ecx, edx
inc esi
sub esi, eax
xor ebx, eax
not eax
xchg esi, esi
xor esi, eax
shr eax, 0x13
xor ebx, 0x1ad573d2
dec eax
mov ecx, 0xbc37ff
mov esp, 0x1fc0f700
test eax, 0xacec21f
jo 0x4b7fae
call fcn.0041fdff
inc eax
shr eax, 0xc
add dword [0x50415f], edi
inc edi
shl esi, 3
call fcn.00406360
xor dword [0x5044b2], ecx
sub edi, dword [0x50095a]
rol ebx, 0x17
neg eax
loop 0x4b7fb0
rol eax, 0xe
xor ecx, esp
and edx, 0x2dc30f60
inc eax
mov ecx, dword [0x500954]
rol esi, 8
not edx
mov ecx, 0x694ed8
add dword [0x504464], edx
rol esi, 0xe
shr esi, 0x1c
neg esi
inc edx
xor dword [0x5045fd], 0x7481cc4
call fcn.0049e695
rol edi, 0x1a
mov ebx, dword [0x500444]
shr eax, 0x15
loop 0x4b7fff
mov esi, 0x150ff0a2
sub eax, eax
and esi, edi
Function at 0x4b8034
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xchg eax, edx
and esi, edi
call fcn.0049e695
shl esi, 0xe
xor edi, ebx
mov ecx, dword [0x5007b3]
mov ecx, 0xe591ee
inc eax
mov dword [0x504292], 0x1bf49776
rol eax, 0x15
neg esi
dec eax
rol edx, 0xa
inc eax
call fcn.0049e695
mov dword [0x5040e7], esi
shr esi, 6
loop 0x4b804d
inc esi
xor edi, esi
neg esi
dec esi
mov ebx, eax
add esi, eax
or ebx, dword [0x500a08]
add edi, ebx