joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463a3c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x463aa6
mov eax, ebx
call fcn.00465ea4
test al, al
jne 0x463aa6
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404ce8
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x463a93
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x463ab3
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404c4c
jmp 0x463ab3
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404c4c
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x464fa4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x465012
mov eax, esi
call fcn.0044d1c8
test al, al
je 0x465012
mov eax, dword [ebx + 0x84]
call fcn.0044ce28
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x465012
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x465006
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044ce28
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00444c60
jmp 0x465012
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00464de0
pop esi
pop ebx
ret

Function at 0x466870
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4668cc
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x46689b
call fcn.0040ee7c
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004030d8
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4668cc
call fcn.0040ee7c
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x466e84
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x407e18]
call fcn.0040590c
xor eax, eax
push ebp
push 0x467025
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4979a0], 0
jne 0x466edf
mov ecx, dword [0x499650]
mov dl, 1
mov eax, dword [0x40841c]
call fcn.0040d8c0
call fcn.00404550
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403594
mov eax, ebx
call fcn.004055b8
mov dword [ebp - 0x24], eax
mov esi, 0x467034
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.004068a4
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004055c8
test eax, eax
jle 0x466fc8
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x466fb4
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404e68
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x466f5a
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00404e9c
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x466f70
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404e9c
mov eax, dword [ebp - 0x54]
call fcn.004050a4
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404e68
mov eax, dword [ebp - 0x58]
call fcn.004050a4
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x466fb6
xor eax, eax
test al, al
je 0x466fc1
mov ebx, 0x15
jmp 0x466fcd
mov ebx, 0x10
jmp 0x466fcd
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4979a0]
call fcn.00466d04
mov eax, dword [ebp - 4]
call fcn.00466d04
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004068bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46702c
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404c1c
lea eax, [ebp - 0xc]
mov edx, dword [0x407e18]
call fcn.004059dc
ret

Function at 0x46b0a0
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x499b44]
cmp dword [eax], 2
je 0x46b0be
mov ecx, 0x314
mov edx, 0x46b0f0
mov eax, 0x46b164
call fcn.00404b24
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x46b040
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x49f0b8], eax
cmp dword [0x49f0b8], 0
jne 0x46b0e5
call fcn.0040ee7c
ret
Function at 0x46b36c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x4996c4]
cmp byte [eax], 0
jne 0x46b39a
mov ecx, 0xb5
mov edx, 0x46b3e8
mov eax, 0x46b45c
call fcn.00404b24
mov eax, ebx
call fcn.004053f4
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x46b3d8
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040558c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46b470
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x4996c4]
cmp byte [eax], 0
jne 0x46b493
mov ecx, 0xc3
mov edx, 0x46b4d4
mov eax, 0x46b548
call fcn.00404b24
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x46b4c6
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x46b4c6
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x46b4c6
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x46c07c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46c20e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 8]
mov dword [edx + 0xbc], eax
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
test esi, esi
jne 0x46c0bd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x46c0da
mov edi, dword [esi + 0x6c]
test edi, edi
je 0x46c0d0
mov eax, edi
call fcn.00439034
mov dword [ebp - 4], eax
jmp 0x46c0da
mov eax, esi
call fcn.00439034
mov dword [ebp - 4], eax
mov eax, dword [0x4996c4]
cmp byte [eax], 0
je 0x46c1f3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x64], 0
je 0x46c1f3
test ebx, ebx
je 0x46c1f3
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x1c]
and ax, word [0x46c21c]
movzx edx, word [0x46c220]
cmp dx, ax
jne 0x46c1f3
mov eax, dword [ebp - 8]
cmp byte [eax + 0x3e], 0
je 0x46c1f3
push ebp
call fcn.0046be70
pop ecx
test al, al
je 0x46c1f3
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0046bc84
mov eax, dword [ebp - 8]
call fcn.0043bb80
test eax, eax
jne 0x46c1a1
mov eax, dword [ebp - 8]
cmp word [eax + 0x60], 0
je 0x46c1a1
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
test esi, esi
je 0x46c17a
cmp dword [esi + 0x64], 0
jne 0x46c17a
mov eax, dword [esi + 4]
mov edx, dword [0x43794c]
call fcn.00403e68
test al, al
jne 0x46c1a1
push dword [ebp - 0xc]
push 0x46c228
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x60]
call fcn.0046b55c
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405634
push ebp
lea eax, [ebp - 0x14]
call fcn.0046becc
pop ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.0040567c
je 0x46c1f3
push ebp
mov eax, dword [ebp - 0xc]
call fcn.0046bfec
pop ecx
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
cmp esi, dword [ebx + 0x34]
je 0x46c1d3
cmp dword [esi + 0x6c], 0
je 0x46c1f3
mov eax, ebx
mov edx, dword [0x43794c]
call fcn.00403e68
test al, al
je 0x46c1f3
cmp dword [ebx + 0x38], 0
je 0x46c1f3
mov eax, dword [ebx + 0x38]
push eax
call sub.user32.dll_DrawMenuBar
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c215
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040540c
ret
Function at 0x46fe20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
jmp 0x46fe4d
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x46fecc
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0046ee98
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x46fe9a
mov cx, word [esp]
sub cx, si
jmp 0x46fe9c
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x46fe83
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x46fec2
mov cx, word [esp]
sub cx, si
jmp 0x46fec4
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x46feab
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x46ff29
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.0046fb1c
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x46ff14
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x46ff29
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x46fe2a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4752bc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x49f0e4
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4752de
shr eax, 1
xor eax, 0xedb88320
jmp 0x4752e0
shr eax, 1
dec edx
jne 0x4752cc
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4752c5
mov byte [0x49f4e4], 1
pop esi
pop ebx
ret

Function at 0x4752fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x49f4e4], 0
jne 0x475313
call fcn.004752bc
mov eax, edi
dec eax
test eax, eax
jl 0x47533b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x49f0e4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x47531d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x477744
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x45d]
movzx ecx, dl
cmp ecx, 6
ja case.0x4777de.0
jmp dword [ecx*4 + 0x477777]
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x4777a9
sub dl, 8
je 0x4777b8
jmp case.0x4777de.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4774d4
jmp case.0x4777de.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x477520
jmp case.0x4777de.0
movzx ecx, byte [eax + 0x45c]
cmp ecx, 0x10
ja case.0x4777de.0
movzx ecx, byte [ecx + 0x4777e5]
jmp dword [ecx*4 + 0x4777f6]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x477570
jmp case.0x4777de.0
cmp dl, 3
jne 0x477823
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4775c4
jmp case.0x4777de.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x477580
jmp case.0x4777de.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x477608
jmp case.0x4777de.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x47784e
sub dl, 8
je 0x47785a
jmp case.0x4777de.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x477624
jmp case.0x4777de.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x477688
jmp case.0x4777de.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x477879
sub dl, 8
je 0x477885
jmp case.0x4777de.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4776f0
jmp case.0x4777de.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x477718
mov esi, dword [eax + 0x448]
mov edx, dword [ebx + 0x1c]
dec edx
imul esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0xc], esi
mov eax, dword [eax + 0x450]
mov dword [ebp - 8], eax
mov esi, edx
test esi, esi
jb 0x477915
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00476af0
test eax, eax
je 0x477915
mov eax, ebx
call fcn.00477920
mov eax, dword [ebp - 8]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x448]
sub dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4778b5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x477920
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x477951
dec al
je 0x47798c
dec al
je 0x4779d1
dec al
je 0x477a3a
jmp 0x477ac4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x477ac4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x477961
jmp 0x477ac4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x477ac4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x47799c
jmp 0x477ac4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x477ac4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x477a00
xor ebp, ebp
jmp 0x477a10
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x477a19
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4779e1
jmp 0x477ac4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x477ac4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x477a93
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00475344
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x477a4e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47cc9c
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403594
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x47ce94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x47cfb0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00404bf8
test edi, edi
jne 0x47ced6
mov eax, dword [ebp - 0x10]
call fcn.00404bf8
jmp 0x47cf88
mov bl, 1
lea eax, [ebp - 0xc]
push eax
movzx edx, bl
mov ecx, 3
mov eax, edi
call fcn.0040510c
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00409bf4
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.00404de0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.00404ee0
add bl, 3
mov eax, edi
call fcn.00404ed4
movzx edx, bl
cmp eax, edx
jge 0x47ced8
lea eax, [ebp - 4]
call fcn.00404bf8
mov eax, dword [ebp - 8]
test eax, eax
je 0x47cf2f
sub eax, 4
mov eax, dword [eax]
test al, al
jbe 0x47cf7d
mov byte [ebp - 0x11], al
mov bl, 1
lea eax, [ebp - 0x1c]
movzx edx, bl
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + edx - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
call fcn.00404de0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00404ee0
movzx eax, bl
mov edx, dword [ebp - 8]
movzx eax, byte [edx + eax - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec byte [ebp - 0x11]
jne 0x47cf38
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404c4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cfb7
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404c1c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c1c
ret

Function at 0x486fb0
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
add esp, 0x190
ret

Function at 0x48894c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405094
xor eax, eax
push ebp
push 0x4889c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4889d8
call fcn.004051f0
test eax, eax
jne 0x48898a
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4889e4
call fcn.00404f2c
push 1
push 0x4889ec
mov eax, dword [ebp - 4]
call fcn.004050a4
push eax
push 0x4889f0
push 0x488a00
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4889cc
lea eax, [ebp - 4]
call fcn.00404bf8
ret
Function at 0x4023b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.00404200
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x808], ecx
mov edx, dword [ebp - 0x808]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x400
lea ecx, [ebp - 0x804]
push ecx
call fcn.00402820
mov dword [ebp - 0x808], 0
push 0x4156ec
push 0x400
lea edx, [ebp - 0x804]
push edx
call fcn.004027c0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004035f6
mov esp, ebp
pop ebp
ret

Function at 0x402440
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push str.WmGpLaunch
mov eax, dword [ebp + 8]
push eax
call fcn.00402670
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x402490
push str.WmGpLaunch
mov edx, dword [ebp + 8]
push edx
push 0x4157bc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00402c70
add esp, 0x14
mov al, 1
jmp 0x4025c5
push 0x208
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.00404200
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.00404200
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str._s.
lea edx, [ebp - 0x20c]
push edx
call fcn.00402160
add esp, 0xc
push 0x250
push 0
lea eax, [ebp - 0x664]
push eax
call fcn.00404200
add esp, 0xc
lea ecx, [ebp - 0x664]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 0xffffffff
je 0x402593
mov eax, dword [ebp - 0x664]
and eax, 0x10
je 0x402567
lea ecx, [ebp - 0x638]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00402670
add esp, 8
movzx eax, al
test eax, eax
je 0x402567
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x638]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_s
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00402c70
add esp, 0x14
mov al, 1
jmp 0x4025c5
lea eax, [ebp - 0x664]
push eax
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40258e
mov edx, dword [ebp - 0x668]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x402593
jmp 0x402504
push 0x415854
mov eax, dword [ebp + 8]
push eax
call fcn.00402670
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4025c3
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00406f56
add esp, 0xc
mov al, 1
jmp 0x4025c5
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004035f6
mov esp, ebp
pop ebp
ret
Function at 0x402670
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x40269d
mov eax, 2
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
movzx eax, word [edx + ecx]
cmp eax, 0x2e
jne 0x4026a4
xor al, al
jmp 0x4027ac
push 0x208
push 0
lea ecx, [ebp - 0x28c]
push ecx
call fcn.00404200
add esp, 0xc
mov edx, 2
imul eax, edx, 0
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax]
test edx, edx
jne 0x4026e7
mov eax, dword [ebp + 8]
push eax
push str._sConfigConfig.ini
lea ecx, [ebp - 0x28c]
push ecx
call fcn.00402160
add esp, 0xc
jmp 0x402703
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_sConfigConfig.ini
lea ecx, [ebp - 0x28c]
push ecx
call fcn.00402160
add esp, 0x10
mov dword [ebp - 0x290], 0xffffffff
push 0x80
push 0
lea edx, [ebp - 0x84]
push edx
call fcn.00404200
add esp, 0xc
lea eax, [ebp - 0x28c]
push eax
push 0x40
lea ecx, [ebp - 0x84]
push ecx
push 0x415778
push str.Patcher
push 0x41578c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x28c]
push edx
push 0xffffffffffffffff
push str.GameID
push str.GENERAL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x290], eax
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x84]
test edx, edx
je 0x402784
cmp dword [ebp - 0x290], 0xffffffff
jne 0x402788
xor al, al
jmp 0x4027ac
mov eax, dword [ebp - 0x290]
push eax
lea ecx, [ebp - 0x28c]
push ecx
lea edx, [ebp - 0x84]
push edx
push str._WmglLauncher__Find_Patcher___s__in_dir__s___gid___d
call fcn.004023b0
add esp, 0x10
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004035f6
mov esp, ebp
pop ebp
ret