joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4606e9
Capabilities:
Encode data using xor

Disassembly:
mov ecx, eax
inc eax
xor byte [edx], cl
inc edx
cmp eax, 0x14
jl fcn.004606e9
mov eax, dword [ebp + 8]
add eax, 0x2244
cmp dword [eax], 0
je 0x460705
mov edx, dword [eax]
jmp 0x46070a
mov edx, 0x57fc99
push edx
call fcn.004dbcf8
pop ecx
mov ebx, eax
mov word [ebp - 0x60], 8
mov edx, dword [ebp + 8]
lea eax, [ebp - 8]
add edx, 0x7a4
call fcn.00559dd8
push eax
inc dword [ebp - 0x54]
lea edx, [ebp - 0x98]
lea eax, [ebp - 4]
call fcn.00559dd8
inc dword [ebp - 0x54]
xor ecx, ecx
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x54]
pop edx
call fcn.0055a0e0
cmp dword [ebp - 0xc], 0
je 0x46075b
mov eax, dword [ebp - 0xc]
jmp 0x460760
mov eax, 0x57fc9a
push eax
call fcn.004dbcf8
pop ecx
mov esi, eax
dec dword [ebp - 0x54]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0055a088
dec dword [ebp - 0x54]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0055a088
dec dword [ebp - 0x54]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0055a088
cmp esi, ebx
jle 0x46079f
mov ebx, esi
mov eax, dword [0x57d8f4]
add ebx, 2
mov esi, 0x1a
mov edx, dword [eax]
call dword [edx + 0x2c]

Function at 0x4607fd
Capabilities:
Encode data using xor

Disassembly:
cmp ebx, eax
jle 0x4607c1
mov edx, ebx
mov eax, dword [0x57d8f4]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [0x57d8f4]
mov edx, dword [eax]
call dword [edx + 0x20]
cmp esi, eax
jle 0x4607db
mov edx, esi
mov eax, dword [0x57d8f4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [0x57d8f4]
mov edx, dword [eax]
call dword [edx + 0x2c]
add eax, 0xa
push eax
mov eax, dword [0x57d8f4]
mov edx, dword [eax]
call dword [edx + 0x20]
add eax, 0xa
push eax
mov eax, dword [0x57d8f4]
call fcn.005086ec
jmp 0x46087d
or al, byte [eax]
mov ecx, 0xfffffff6
mov edx, 0xfffffff6
call fcn.00504004
mov eax, dword [0x57d8f4]
call fcn.005086ec
mov edx, dword [eax + 0xc]
xor eax, eax
mov edi, dword [0x57d8f4]
mov ebx, dword [edx + 0x18]
mov dword [ebp - 0x74], eax
push 0x50
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x128]
add eax, 0xccc
push eax
push edx
call fcn.0054bcc8
add esp, 0xc
mov eax, dword [ebp - 0x104]
mov edx, dword [ebp - 0xfc]
lea ecx, [ebp - 0xd8]
push ebx
push ecx
lea ecx, [ebp - 0x74]
push 0
sub eax, 0x3e8
push ecx
push edi
sub edx, 0x3e8
push edx
push eax
call fcn.004dbd34
add esp, 0x1c
mov eax, dword [0x57d8f4]
call fcn.005086ec
mov edx, dword [eax + 0xc]
lea eax, [ebp - 0x14]
mov ebx, dword [edx + 0x18]
mov word [ebp - 0x60], 0x14
mov edx, dword [ebp + 8]
add edx, 0x7a4
call fcn.00559dd8
push eax
inc dword [ebp - 0x54]
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x10]
call fcn.00559dd8
inc dword [ebp - 0x54]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
inc dword [ebp - 0x54]
pop edx
call fcn.0055a0e0
cmp dword [ebp - 0x18], 0
je 0x4608cd
mov edi, dword [ebp - 0x18]
mov edi, 0x57fc9b
Function at 0x47c526
Capabilities:
Check os version

Disassembly:
inc edi
sbb al, 0xa1
xor al, 0xec
pop ecx
add byte [ebx - 0x5def1800], cl
or dword [eax], eax
lea eax, [ebp - 8]
mov eax, dword [eax]
xor edx, edx
ror byte [ecx + 0x558df455], cl
hlt

Function at 0x4a35b9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov edx, dword [ebp + 0xc]
mov ecx, eax
inc eax
shl ecx, 2
push ecx
mov cl, 0x64
pop ebx
sub cl, bl
xor byte [edx], cl
inc edx
cmp eax, 0x28
jl 0x4a35b9
pop ebx
pop ebp
ret

Function at 0x4a64bc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x58640c
push ebx
call fcn.0054c16c
mov dword [ebp - 8], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.00559e10
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
mov eax, dword [ebp + 0xc]
call fcn.00559dd0
mov ebx, eax
test bl, bl
jne 0x4a651b
push 0x80
cmp dword [ebp + 0xc], 0
je 0x4a6506
mov eax, dword [ebp + 0xc]
jmp 0x4a650b
mov eax, 0x57ff20
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp + 0xc]
call fcn.00559dd0
mov ebx, eax
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp + 0xc]
dec dword [ebp - 8]
call fcn.0055a088
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a655c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
mov eax, 0x583964
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.0054c16c
mov word [ebp - 0x30], 8
xor edx, edx
xor ecx, ecx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x154]
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0x14
mov word [ebp - 0x30], 0x20
mov dword [ebp - 8], ecx
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0x14
push 0x104
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x57faa2
lea edx, [ebp - 0x154]
push edx
call fcn.0054bddc
add esp, 8
push 0x57faaf
lea ecx, [ebp - 0x154]
push ecx
call fcn.0054bddc
add esp, 8
push 0x57fab2
lea eax, [ebp - 0x154]
push eax
call fcn.0054bddc
mov word [ebp - 0x30], 0x2c
add esp, 8
lea edx, [ebp - 0x154]
lea eax, [ebp - 0xc]
call fcn.00559dd8
mov edx, eax
inc dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0055a0b8
dec dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0055a088
mov word [ebp - 0x30], 0x38
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x10]
push eax
inc dword [ebp - 0x24]
call fcn.00479e3c
add esp, 8
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0055a0b8
dec dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0055a088
cmp dword [ebp - 8], 0
je 0x4a665f
mov ecx, dword [ebp - 8]
mov eax, dword [ecx - 4]
jmp 0x4a6661
xor eax, eax
cmp eax, 4
jge 0x4a6695
dec dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0055a088
dec dword [ebp - 0x24]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0055a088
mov ecx, dword [ebp - 0x40]
mov dword fs:[0], ecx
jmp 0x4a677c
push 4
cmp dword [ebp - 8], 0
je 0x4a66a2
mov eax, dword [ebp - 8]
jmp 0x4a66a7
mov eax, 0x57fab7
push eax
lea edx, [ebp - 0x48]
push edx
call fcn.0054bcc8
xor dword [ebp - 0x48], 0x87236151
mov eax, dword [ebp - 0x48]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov dl, 1
mov eax, dword [0x5348a0]
call fcn.004087f0
mov dword [ebp - 0x44], eax
mov word [ebp - 0x30], 0x44
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea eax, [ebp - 0x14]
call fcn.00559fd4
inc dword [ebp - 0x24]
mov edx, dword [eax]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
call dword [ecx + 0x34]
dec dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0055a088
mov word [ebp - 0x30], 0x50
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov word [ebp - 0x30], 0x14
jmp 0x4a672a
mov ebx, dword [ebp - 0x44]
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x4a6752
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x30], 0x68
mov edx, 3
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x30], 0x5c
dec dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0055a088
dec dword [ebp - 0x24]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0055a088
mov ecx, dword [ebp - 0x40]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a6ab0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
mov eax, 0x583bb0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.0054c16c
mov word [ebp - 0x30], 8
xor edx, edx
xor ecx, ecx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x154]
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0x14
mov word [ebp - 0x30], 0x20
mov dword [ebp - 8], ecx
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0x14
push 0x104
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x57face
lea edx, [ebp - 0x154]
push edx
call fcn.0054bddc
add esp, 8
push 0x57fadb
lea ecx, [ebp - 0x154]
push ecx
call fcn.0054bddc
add esp, 8
push 0x57fade
lea eax, [ebp - 0x154]
push eax
call fcn.0054bddc
mov word [ebp - 0x30], 0x2c
add esp, 8
lea edx, [ebp - 0x154]
lea eax, [ebp - 0xc]
call fcn.00559dd8
mov edx, eax
inc dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0055a0b8
dec dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0055a088
mov word [ebp - 0x30], 0x38
push ebx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x10]
push eax
inc dword [ebp - 0x24]
call fcn.00479e3c
add esp, 8
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.0055a0b8
dec dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0055a088
cmp dword [ebp - 8], 0
je 0x4a6bb3
mov ecx, dword [ebp - 8]
mov eax, dword [ecx - 4]
jmp 0x4a6bb5
xor eax, eax
cmp eax, 4
jge 0x4a6be9
dec dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0055a088
dec dword [ebp - 0x24]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0055a088
mov ecx, dword [ebp - 0x40]
mov dword fs:[0], ecx
jmp 0x4a6cd0
push 4
cmp dword [ebp - 8], 0
je 0x4a6bf6
mov eax, dword [ebp - 8]
jmp 0x4a6bfb
mov eax, 0x57fae3
push eax
lea edx, [ebp - 0x48]
push edx
call fcn.0054bcc8
xor dword [ebp - 0x48], 0x87236151
mov eax, dword [ebp - 0x48]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov dl, 1
mov eax, dword [0x5348a0]
call fcn.004087f0
mov dword [ebp - 0x44], eax
mov word [ebp - 0x30], 0x44
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea eax, [ebp - 0x14]
call fcn.00559fd4
inc dword [ebp - 0x24]
mov edx, dword [eax]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
call dword [ecx + 0x34]
dec dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0055a088
mov word [ebp - 0x30], 0x50
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov word [ebp - 0x30], 0x14
jmp 0x4a6c7e
mov ebx, dword [ebp - 0x44]
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x4a6ca6
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x30], 0x68
mov edx, 3
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x30], 0x5c
dec dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0055a088
dec dword [ebp - 0x24]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0055a088
mov ecx, dword [ebp - 0x40]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a87fc
Capabilities:
Encode data using xor

Disassembly:
add byte [eax - 0x1374aac1], al
add esp, 0xfffffef0
mov eax, dword [sym.Project1.exe__PlayForm]
lea edx, [ebp - 0x110]
push ebx
push esi
mov ebx, dword [eax + 0x2c9c]
mov esi, dword [ebp + 8]
push edx
mov eax, 0x12850035
push eax
push ebx
call fcn.004e0144
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x110]
push ecx
call fcn.004e11d4
add esp, 8
push 4
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 8]
push edx
call fcn.0054bcc8
add esp, 0xc
mov eax, 0x7f960035
lea edx, [ebp - 0x110]
push edx
push eax
push ebx
call fcn.004e0144
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x110]
push ecx
call fcn.004e11d4
add esp, 8
push 4
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 0xc]
push edx
call fcn.0054bcc8
add esp, 0xc
cmp dword [ebp - 8], 0x65
jl 0x4a8956
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov ecx, 0x62
cdq
idiv ecx
cmp edx, 2
jne 0x4a8956
push esi
call fcn.004bc67c
shl eax, 0x1e
pop ecx
shr eax, 0x1f
test eax, eax
ja 0x4a8956
mov eax, 0x22190035
lea edx, [ebp - 0x110]
push edx
push eax
push ebx
call fcn.004e0144
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x110]
push ecx
call fcn.004e11d4
add esp, 8
push 4
lea eax, [ebp - 0x110]
push eax
lea edx, [ebp - 4]
push edx
call fcn.0054bcc8
add esp, 0xc
mov ecx, dword [ebp - 4]
shl ecx, 6
shr ecx, 0x1f
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jbe 0x4a8956
mov eax, dword [sym.Project1.exe__PlayForm]
mov edx, dword [eax + 0x2a44]
cmp dword [edx + 0x2b8], 0
jle 0x4a8930
jmp 0x4a8956
lea edx, [ebp - 0x10]
xor eax, eax
mov ecx, edx
mov edx, ecx
lea ecx, [eax + eax*2]
shl ecx, 5
sub ecx, eax
shl ecx, 2
sub ecx, eax
shl ecx, 3
xor dword [edx], ecx
inc eax
add edx, 4
cmp eax, 0x384
jl 0x4a8939
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ba1fc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x3c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 1
jle 0x4ba23b
mov ecx, dword [ebp - 0x18]
sar ecx, 1
jns 0x4ba238
adc ecx, 0
mov dword [ebp - 0x18], ecx
xor edi, edi
mov eax, esi
jmp 0x4ba24a
mov edx, dword [eax]
inc edi
add eax, 4
mov byte [edx], 0
cmp edi, dword [esi + 0x9c40]
jl 0x4ba241
mov dword [ebp - 4], ebx
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x34]
add eax, dword [ebx + 0x28]
adc edx, dword [ebx + 0x2c]
add dword [ebp - 0xc], eax
adc dword [ebp - 8], edx
mov eax, dword [ebx]
test eax, eax
je 0x4ba271
add ebx, eax
jmp 0x4ba255
cmp dword [ebp - 0x18], 1
jle 0x4ba28e
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.005528b7
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
mov edi, eax
mov eax, dword [esi + 0x9c48]
sub edi, eax
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x34]
add eax, dword [ebx + 0x28]
adc edx, dword [ebx + 0x2c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
mov eax, dword [ebx + 0x44]
push eax
push esi
call fcn.004bcad4
add esp, 0x14
mov eax, dword [ebx]
test eax, eax
je 0x4ba2ce
add ebx, eax
jmp 0x4ba29e
mov edx, dword [ebp - 0xc]
xor edi, edi
mov dword [esi + 0x9c48], edx
mov ebx, esi
mov edx, dword [ebp - 8]
mov dword [esi + 0x9c4c], edx
jmp 0x4ba305
mov eax, dword [ebx]
cmp byte [eax], 0
jne 0x4ba301
push edi
push esi
call fcn.004bcc28
add esp, 8
dec edi
add ebx, 0xfffffffc
dec dword [esi + 0x9c40]
inc edi
add ebx, 4
cmp edi, dword [esi + 0x9c40]
jl 0x4ba2e6
mov byte [esi + 0x9c54], 0
mov byte [esi + 0x9c64], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bb394
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
mov eax, 0x58679c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.0054c16c
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x3c], edx
lea edx, [ebp - 0x158]
mov word [ebp - 0x28], 8
mov dword [ebp - 4], ecx
inc dword [ebp - 0x1c]
mov word [ebp - 0x28], 0x14
mov eax, dword [ebx + 0x778]
push eax
push 0x57ff44
push edx
call fcn.0054f4a8
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x144]
push ecx
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x57ff47
lea eax, [ebp - 0x144]
push eax
call fcn.0054bddc
add esp, 8
lea edx, [ebp - 0x158]
push edx
lea ecx, [ebp - 0x144]
push ecx
call fcn.0054bddc
add esp, 8
push 0x57ff54
lea eax, [ebp - 0x144]
push eax
call fcn.0054bddc
add esp, 8
push 0x57ff59
lea edx, [ebp - 0x144]
push edx
call fcn.0054bddc
mov word [ebp - 0x28], 0x20
add esp, 8
lea edx, [ebp - 0x144]
lea eax, [ebp - 8]
call fcn.00559dd8
mov edx, eax
inc dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.0055a0b8
dec dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0055a088
mov dl, 1
mov eax, dword [0x5348a0]
call fcn.004087f0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
call fcn.005426c0
test al, al
jne 0x4bb49b
push 0
push ebx
call fcn.0047b5fc
add esp, 8
mov word [ebp - 0x28], 0x2c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov word [ebp - 0x28], 0x38
xor edx, edx
mov dword [ebp - 0xc], edx
lea ecx, [ebp - 0xc]
inc dword [ebp - 0x1c]
mov edx, 4
mov eax, dword [ebp - 0x40]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea eax, [ebp - 0xc]
call fcn.0055a3d4
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0055a088
mov word [ebp - 0x28], 0x14
jmp 0x4bb4f8
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x4bb520
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov word [ebp - 0x28], 0x50
mov edx, 3
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x28], 0x44
mov eax, dword [ebp - 0x3c]
mov edx, 2
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x1c]
call fcn.0055a088
pop eax
mov edx, dword [ebp - 0x38]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bc67c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
mov eax, dword [sym.Project1.exe__PlayForm]
lea edx, [ebp - 0x104]
push ebx
push esi
mov ebx, dword [eax + 0x2c9c]
mov eax, 0x569e0034
push edx
push eax
push ebx
call fcn.004e0144
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x104]
push ecx
call fcn.004e11d4
add esp, 8
push 4
lea eax, [ebp - 0x104]
push eax
lea edx, [ebp - 4]
push edx
call fcn.0054bcc8
add esp, 0xc
mov eax, 0xe5d20034
lea edx, [ebp - 0x104]
push edx
push eax
push ebx
call fcn.004e0144
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x104]
push ecx
call fcn.004e1620
add esp, 8
mov cl, 0x63
xor eax, eax
xor esi, esi
lea edx, [ebp - 0x104]
mov ebx, eax
inc esi
add ebx, ebx
lea ebx, [ebx + ebx*4]
mov eax, ebx
mov bl, byte [edx]
xor bl, cl
inc edx
movsx ebx, bl
add ebx, 0xffffffd0
add eax, ebx
cmp esi, 5
jl 0x4bc707
sub eax, dword [ebp - 4]
test eax, eax
jle 0x4bc72f
cmp eax, 7
jle 0x4bc731
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bc738
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
mov eax, dword [sym.Project1.exe__PlayForm]
lea edx, [ebp - 0x104]
push ebx
push esi
mov ebx, dword [eax + 0x2c9c]
mov eax, 0xd8d0034
push edx
push eax
push ebx
call fcn.004e0144
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x104]
push ecx
call fcn.004e11d4
add esp, 8
push 4
lea eax, [ebp - 0x104]
push eax
lea edx, [ebp - 4]
push edx
call fcn.0054bcc8
add esp, 0xc
mov eax, 0x64950037
lea edx, [ebp - 0x104]
push edx
push eax
push ebx
call fcn.004e0144
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x104]
push ecx
call fcn.004e1620
add esp, 8
mov cl, 0x63
xor eax, eax
xor esi, esi
lea edx, [ebp - 0x104]
mov ebx, eax
inc esi
add ebx, ebx
lea ebx, [ebx + ebx*4]
mov eax, ebx
mov bl, byte [edx]
xor bl, cl
inc edx
movsx ebx, bl
add ebx, 0xffffffd0
add eax, ebx
cmp esi, 5
jl 0x4bc7c3
sub eax, dword [ebp - 4]
test eax, eax
jle 0x4bc7eb
cmp eax, 7
jle 0x4bc7ed
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bdaa8
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
mov edx, 0xb03d
mov eax, dword [ebp - 4]
call fcn.004d0624
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xec8b550b
push ebp
mov ebp, esp
add esp, 0xffffffd8
Function at 0x4bdb03
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
lea edx, [ebp + 0x10]
lea eax, [ebp + 0x10]
call fcn.0055aec4
inc dword [ebp - 0x28]
mov edx, dword [0x57e694]
mov word [ebp - 0x34], 8
mov dword [ebp - 0x50], edx
mov edx, dword [0x57e698]
mov dword [ebp - 0x4c], edx
xor eax, eax
mov dx, word [0x57e69c]
mov cx, word [0x57e69e]
mov word [ebp - 0x48], dx
mov word [ebp - 0x53], cx
mov cl, byte [0x57e6a0]
mov byte [ebp - 0x51], cl
mov dword [ebp - 0x58], eax
push 0
push 0
push 0
push 3
push 4
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.OLE32.DLL_CoInitializeSecurity
lea edx, [ebp - 0x58]
push edx
push 0x59a118
push 5
push 0
push 0x5992ec
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
je 0x4bdba4
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 0x10]
dec dword [ebp - 0x28]
call fcn.0055af74
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
jmp 0x4bdee2
mov word [ebp - 0x34], 0x14
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x5c], ecx
lea edx, [ebp - 0xe4]
mov word [ebp - 0x34], 0x14
mov byte [edx], 0
inc eax
inc edx
cmp eax, 0x64
jl 0x4bdbbd
xor eax, eax
lea ecx, [ebp - 0xe4]
lea edx, [ebp - 0x50]
mov bl, byte [edx]
inc edx
xor bl, 0x4d
inc eax
mov byte [ecx], bl
inc ecx
cmp eax, 0xa
jl 0x4bdbd2
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0xe4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
mov word [ebp - 0x34], 0x20
call fcn.0055ae8c
mov ebx, eax
inc dword [ebp - 0x28]
mov eax, dword [ebx]
push eax
mov edx, dword [ebp - 0x58]
push edx
mov ecx, dword [edx]
call dword [ecx + 0xc]
test eax, eax
mov edx, 2
sete al
and eax, 1
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x28]
call fcn.0055af74
pop ecx
test cl, cl
je 0x4bde93
xor eax, eax
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x60], eax
xor eax, eax
mov word [ebp - 0x34], 0x14
mov byte [ecx], 0
inc eax
inc ecx
cmp eax, 0x64
jl 0x4bdc4b
xor eax, eax
lea edx, [ebp - 0xe4]
lea ecx, [ebp - 0x53]
mov bl, byte [ecx]
inc ecx
xor bl, 0x4d
inc eax
mov byte [edx], bl
inc edx
cmp eax, 3
jl 0x4bdc60
mov word [ebp - 0x34], 0x38
lea edx, [ebp - 0xe4]
lea eax, [ebp - 8]
call fcn.0055ae8c
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x60]
mov word [ebp - 0x34], 0x2c
push ecx
push 0
push 0x10
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x5c]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x50]
test eax, eax
jne 0x4bde6e
xor edx, edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x68], 1
mov ecx, dword [ebp - 0x60]
push ecx
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
jne 0x4bde5f
jmp 0x4bde40

Function at 0x4bdeec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, 0x57e6a1
lea edi, [ebp - 0x28]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov esi, 0x28
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edx, eax
lea eax, [ebp - 0x28]
cmp esi, ecx
jle 0x4bdf25
mov bl, byte [eax]
inc eax
xor bl, 0x45
inc ecx
mov byte [edx], bl
inc edx
cmp esi, ecx
jg 0x4bdf17
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bdf2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov esi, 0x57e6c9
lea edi, [ebp - 0x44]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x43
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edx, eax
lea eax, [ebp - 0x44]
cmp esi, ecx
jle 0x4bdf68
mov bl, byte [eax]
inc eax
xor bl, 0x45
inc ecx
mov byte [edx], bl
inc edx
cmp esi, ecx
jg 0x4bdf5a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bdf70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov esi, 0x57e70c
lea edi, [ebp - 0x34]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x31
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edx, eax
lea eax, [ebp - 0x34]
cmp esi, ecx
jle 0x4bdfaa
mov bl, byte [eax]
inc eax
xor bl, 0x45
inc ecx
mov byte [edx], bl
inc edx
cmp esi, ecx
jg 0x4bdf9c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bdfb4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov esi, 0x57e73d
lea edi, [ebp - 0x34]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov esi, 0x34
xor ecx, ecx
mov eax, dword [ebp + 0xc]
mov edx, eax
lea eax, [ebp - 0x34]
cmp esi, ecx
jle 0x4bdfed
mov bl, byte [eax]
inc eax
xor bl, 0x45
inc ecx
mov byte [edx], bl
inc edx
cmp esi, ecx
jg 0x4bdfdf
pop edi
pop esi
pop ebx