joyce8/EMBER2024-capa huggingface dataset:
Function at 0x553034
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x553261
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 8]
mov edx, dword [esi]
call fcn.004044cc
mov eax, dword [edi + 0x2f8]
add eax, 0x60
mov edx, dword [ebp - 4]
call fcn.00404488
cmp dword [ebp - 8], 0
je 0x5530c0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
je 0x55309a
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, 0x55327c
call fcn.00404740
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408b20
mov ecx, dword [ebp - 0x14]
mov edx, dword [0x5872d0]
mov edx, dword [edx]
mov eax, dword [edi + 0x2f8]
add eax, 0x78
call fcn.00404740
jmp 0x5530e1
mov edx, dword [0x5872d0]
mov edx, dword [edx]
mov eax, dword [edi + 0x2f8]
call fcn.00438198
mov eax, dword [edi + 0x2f8]
add eax, 0x78
call fcn.00404434
mov eax, dword [edi + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
je 0x553246
lea edx, [ebp - 0xc]
mov eax, dword [edi + 0x2f8]
call fcn.00438130
lea ecx, [ebp - 8]
mov eax, dword [0x5872d0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
call fcn.00527958
cmp dword [ebp - 8], 0
jne 0x55323a
push 0x24
mov ecx, 0x553280
mov edx, 0x55328c
mov eax, dword [0x5870e8]
mov eax, dword [eax]
call fcn.004a2174
cmp eax, 6
jne 0x553246
lea edx, [ebp - 8]
mov ecx, 0x5532d4
mov eax, edi
call fcn.0055353c
test al, al
je 0x553246
mov eax, dword [ebp - 8]
mov edx, 0x55327c
call fcn.00404840
jne 0x55316d
lea eax, [ebp - 8]
call fcn.00404434
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00409798
cmp dword [ebp - 0x10], 0
je 0x553196
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0x5c
je 0x553196
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, 0x55327c
call fcn.00404740
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004046fc
mov edx, dword [0x5872d0]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
call fcn.00404740
mov eax, dword [ebp - 0x18]
call fcn.00409374
test al, al
je 0x5531fc
push 0x24
push 0x553308
push dword [ebp - 0x10]
push 0x553314
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004047b4
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
mov edx, eax
mov ecx, 0x553334
mov eax, dword [0x5870e8]
mov eax, dword [eax]
call fcn.004a2174
cmp eax, 6
jne 0x553246
push 0
mov edx, dword [0x5872d0]
mov edx, dword [edx]
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 8]
call fcn.00404740
mov eax, dword [ebp - 0x20]
call fcn.004048f4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004048f4
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x553246
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00404488
mov bl, 1
jmp 0x553246
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00404488
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x553268
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00404458
ret
Function at 0x579fcc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x579fd4
push ebx
push esi
push edi
mov esi, dword [0x586f80]
xor eax, eax
push ebp
push 0x57a1d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x1c]
mov edx, 0x400
call fcn.00404a80
push 0x400
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [ebp - 0x1c]
call fcn.004048f4
mov edx, eax
mov eax, esi
call fcn.0040462c
mov eax, dword [esi]
call fcn.004046f4
mov edx, dword [esi]
cmp byte [edx + eax - 1], 0x5c
jne 0x57a04c
mov eax, dword [esi]
call fcn.004046f4
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00404994
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [esi]
lea eax, [ebp - 0x20]
mov ecx, 0x57a1f4
call fcn.00404740
mov eax, dword [ebp - 0x20]
call fcn.00409374
test al, al
jne 0x57a10d
xor eax, eax
push ebp
push 0x57a0e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41a6d4]
call fcn.004035d0
mov dword [ebp - 8], eax
call fcn.0040adc4
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x28]
call fcn.0040a770
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x57a208
call fcn.00404740
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [esi]
lea eax, [ebp - 0x2c]
mov ecx, 0x57a1f4
call fcn.00404740
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, dword [ebp - 8]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57a104
mov byte [ebp - 1], 1
jmp 0x57a1b6
xor eax, eax
push ebp
push 0x57a172
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41a6d4]
call fcn.004035d0
mov dword [ebp - 8], eax
mov edx, dword [esi]
lea eax, [ebp - 0x30]
mov ecx, 0x57a1f4
call fcn.00404740
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea ecx, [ebp - 0xc]
mov edx, 0x57a214
mov eax, dword [ebp - 8]
call fcn.0041e560
mov eax, dword [ebp - 0xc]
call fcn.0040a7d0
fstp qword [ebp - 0x18]
wait
mov eax, dword [ebp - 8]
call fcn.00403600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57a18b
call fcn.0040adc4
fld qword [ebp - 0x18]
fadd dword [0x57a218]
fcompp
fnstsw ax
sahf
jbe 0x57a1ad
call fcn.0040adc4
fcomp qword [ebp - 0x18]
fnstsw ax
sahf
ja 0x57a1b1
xor eax, eax
jmp 0x57a1b3
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57a1e0
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00404458
lea eax, [ebp - 0xc]
call fcn.00404434
ret

Function at 0x57e708
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push 5
push 0
push 0
push 0x57e72c
push 0x57e754
mov eax, ebx
call fcn.004875c8
push eax
call sub.shell32.dll_ShellExecuteA
pop ebx
ret
Function at 0x403a58
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x55e008], 0x8088405
inc edx
mov dword [ebx + 0x55e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x42ca98
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42ca9e
ret

Function at 0x43c3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43c561
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405924
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x43c578
call fcn.00405580
mov eax, ebx
call fcn.0042a924
mov edi, eax
dec edi
test edi, edi
jl 0x43c468
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0042a8f8
mov edx, dword [0x451764]
call fcn.00404590
test al, al
je 0x43c464
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0042a8f8
lea edx, [ebp - 0x14]
call fcn.0045b390
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405924
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004055f4
inc esi
dec edi
jne 0x43c416
mov al, byte [0x43c57c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x43c588
mov eax, dword [ebp - 0xc]
call fcn.004130d8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004052fc
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0045b390
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x43c578
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0045b390
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x43c578
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x43c578
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x43c594
call fcn.0040e3f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c568
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00405288
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405288
lea eax, [ebp - 0x14]
call fcn.00405264
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405288
ret
Function at 0x4631e4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x5669ec]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x4633bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045b3c0
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0045c5e8
mov eax, dword [esi]
call fcn.00479408
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x463256
mov eax, dword [esi]
call fcn.00479408
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.00479414
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x46327a
mov eax, dword [esi]
call fcn.00479414
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.004793fc
cmp eax, dword [ebp - 0x18]
jle 0x463290
mov eax, dword [esi]
call fcn.004793fc
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.004793f0
cmp eax, dword [ebp - 0xc]
jle 0x4632a6
mov eax, dword [esi]
call fcn.004793f0
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.00461bb0
push eax
call fcn.00408b7c
call fcn.0040800c
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x46336d
mov eax, ebx
call fcn.00405534
cmp eax, 0x64
jge 0x46336d
cmp dword [0x55f5e4], 0
je 0x46336d
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call fcn.00408bd4
cmp dword [ebp - 8], 0
je 0x46336d
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call fcn.00408bd4
cmp dword [ebp - 8], 0
je 0x463330
mov bl, 2
jmp 0x46334b
lea edx, [ebp - 0x20]
mov eax, dword [0x569d7c]
call fcn.0046647c
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x463349
xor ebx, ebx
jmp 0x46334b
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x55f6ec]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.00461bb0
push eax
call dword [0x55f5e4]
mov eax, dword [0x5666c8]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call fcn.0045f2ac
push 4
mov eax, dword [ebp - 4]
call fcn.00461bb0
push eax
call fcn.00408bcc
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4633c4
call fcn.0040800c
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x4a2d3c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x56b8d4
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4a2d5e
shr eax, 1
xor eax, 0xedb88320
jmp 0x4a2d60
shr eax, 1
dec edx
jne 0x4a2d4c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4a2d45
mov byte [0x56bcd4], 1
pop esi
pop ebx
ret

Function at 0x4a2d7c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x56bcd4], 0
jne 0x4a2d93
call fcn.004a2d3c
mov eax, edi
dec eax
test eax, eax
jl 0x4a2dbc
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x56b8d4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4a2d9d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4a5c38
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4a5c69
dec al
je 0x4a5ca5
dec al
je 0x4a5ce9
dec al
je 0x4a5d54
jmp 0x4a5dde
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4a5dde
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a5c79
jmp 0x4a5dde
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a5dde
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a5cb5
jmp 0x4a5dde
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a5dde
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4a5d17
xor ebp, ebp
jmp 0x4a5d28
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4a5d31
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a5cf9
jmp 0x4a5dde
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a5dde
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4a5dac
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004a2dc4
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a5d68
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ac7d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4ac7fe
mov eax, ebx
call fcn.004ad284
cmp dword [ebx + 0x40], 0
je 0x4ac7f7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4ac86f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4ac861
cmp dword [ebx + 8], 0
je 0x4ac820
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4ac832
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4ac861
cmp dword [ebx + 8], 0
je 0x4ac813
cmp eax, 3
je 0x4ac845
dec eax
jne 0x4ac813
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4ac813
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4ac813
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4ac88d
cmp dword [ebx + 0x14], 0xcc
je 0x4ac88d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004ac898
pop ebx
ret
Function at 0x4ca4f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov dl, 1
mov eax, dword [0x42c808]
call fcn.004330dc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ca6cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x54]
cmp dword [eax + 8], 0
jle 0x4ca6aa
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004345e8
mov eax, dword [ebp - 8]
call fcn.004336ac
mov eax, dword [eax + 0x14]
mov edx, esi
call fcn.0042dfc8
cmp byte [ebp + 8], 0
je 0x4ca592
xor edx, edx
mov eax, ebx
call fcn.004c9480
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.004c9480
mov edx, dword [eax]
call dword [edx + 0x20]
mov esi, eax
mov eax, ebx
call fcn.004c93b0
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x4ca5ce
xor edx, edx
mov eax, ebx
call fcn.004c9480
mov edx, dword [eax]
call dword [edx + 0x2c]
mov esi, eax
mov eax, ebx
call fcn.004c93b0
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.004c9480
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.0041fac8
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
call fcn.004336ac
pop edx
call fcn.0042e674
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.004c93b0
dec eax
test eax, eax
jl 0x4ca682
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004c9354
push 0
lea eax, [ebp - 0x20]
push eax
mov edx, esi
mov eax, ebx
call fcn.004c94ac
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x20]
imul esi
xor edx, edx
mov dl, byte [ebp + 8]
imul edx
push eax
mov edx, esi
mov eax, ebx
call fcn.004c94ac
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
imul esi
mov dl, byte [ebp + 8]
xor dl, 1
and edx, 0x7f
imul edx
xor ecx, ecx
pop edx
call fcn.0041faa0
mov eax, dword [ebp - 8]
call fcn.004336ac
mov edx, eax
lea ecx, [ebp - 0x20]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
inc esi
dec dword [ebp - 0x10]
jne 0x4ca618
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004c9354
cmp byte [ebp + 0xc], 0
je 0x4ca6aa
movzx eax, word [ebx + 0x58]
mov edx, 0x10
call fcn.004359f0
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.004c8b44
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca6d2
mov eax, dword [ebp - 8]
call fcn.004043f8
ret
Function at 0x4ea860
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4ea9e2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004eac54
mov eax, ebx
call fcn.0042daf4
dec al
je 0x4ea8a4
dec al
je 0x4ea8aa
jmp 0x4ea8b0
mov byte [ebp - 0x77], 2
jmp 0x4ea8b4
mov byte [ebp - 0x77], 1
jmp 0x4ea8b4
mov byte [ebp - 0x77], 0
mov eax, dword [ebp - 0x8c]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0x8c], eax
mov eax, ebx
call fcn.0042da80
shl eax, 2
lea eax, [eax + eax*4]
mov dword [ebp - 0x84], eax
mov edi, dword [ebx + 0x18]
cmp edi, 0xff000008
je 0x4ea901
cmp edi, 0x20000000
jne 0x4ea90d
mov dword [ebp - 0x88], 0x40000000
jmp 0x4ea917
mov eax, edi
call fcn.0042d318
mov dword [ebp - 0x7c], eax
mov eax, ebx
call fcn.0042dabc
test al, 1
je 0x4ea929
or dword [ebp - 0x88], 1
mov eax, ebx
call fcn.0042dabc
test al, 2
je 0x4ea93b
or dword [ebp - 0x88], 2
mov eax, ebx
call fcn.0042dabc
test al, 4
je 0x4ea94d
or dword [ebp - 0x88], 4
mov eax, ebx
call fcn.0042dabc
test al, 8
je 0x4ea95f
or dword [ebp - 0x88], 8
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.0042da0c
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x76]
mov ecx, 0x20
call fcn.0040d9fc
or dword [ebp - 0x8c], 0x8000000
mov eax, ebx
call fcn.0042db24
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x3c]
push eax
push 0x3c
mov eax, ebx
call fcn.0042d810
push eax
call fcn.004083a4
test eax, eax
je 0x4ea9bc
or dword [ebp - 0x8c], 0x400000
mov ax, word [ebp - 0x2c]
mov word [ebp - 0x56], ax
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.004eac80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea9e9
lea eax, [ebp - 0x94]
call fcn.00405264
ret
Function at 0x50a014
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, 0x564d9c
mov esi, eax
cmp ecx, 1
jb 0x50a11d
test edx, edx
jne 0x50a031
xor esi, esi
jmp 0x50a11d
xor eax, 0xffffffff
cmp ecx, 8
jb 0x50a0f9
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ecx, 8
cmp ecx, 8
jae 0x50a03d
test ecx, ecx
je 0x50a118
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ecx
test ecx, ecx
jne 0x50a0fd
mov esi, eax
xor esi, 0xffffffff
mov eax, esi
pop esi
pop ebx
ret