joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53d690
Capabilities:
Set environment variable

Disassembly:
sub esp, 4
cmp dword [esp + 8], 0
push ebx
push esi
push edi
push ebp
je 0x53d8ce
mov edx, dword [esp + 0x18]
push 0x3d
push edx
call fcn.0053d9c0
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x53d8ce
cmp ebp, dword [esp + 0x18]
je 0x53d8ce
cmp byte [ebp + 1], 1
sbb eax, eax
mov ecx, dword [0x583a84]
neg eax
mov dword [esp + 0x10], eax
cmp dword [0x583a88], ecx
jne 0x53d6ed
push ecx
call fcn.0053d940
add esp, 4
mov dword [0x583a84], eax
cmp dword [0x583a84], 0
jne 0x53d79d
cmp dword [esp + 0x1c], 0
je 0x53d724
cmp dword [0x583a8c], 0
je 0x53d724
call fcn.0053d1b0
test eax, eax
je 0x53d79d
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [esp + 0x10], 0
je 0x53d735
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x583a84], 0
jne 0x53d769
push 4
call fcn.00532c80
add esp, 4
mov dword [0x583a84], eax
test eax, eax
jne 0x53d75e
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [0x583a84]
mov dword [eax], 0
cmp dword [0x583a8c], 0
jne 0x53d79d
push 4
call fcn.00532c80
add esp, 4
mov dword [0x583a8c], eax
test eax, eax
jne 0x53d792
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [0x583a8c]
mov dword [eax], 0
mov esi, dword [0x583a84]
sub ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
push ebp
push edx
call fcn.0053d8e0
add esp, 8
mov edi, eax
test edi, edi
jl 0x53d805
cmp dword [esi], 0
je 0x53d805
cmp dword [esp + 0x10], 0
je 0x53d7fc
lea ebx, [esi + edi*4]
mov eax, dword [ebx]
push eax
call fcn.00532d30
add esp, 4
cmp dword [ebx], 0
je 0x53d7e9
mov eax, dword [ebx + 4]
add ebx, 4
inc edi
mov dword [ebx - 4], eax
cmp dword [ebx], 0
jne 0x53d7da
shl edi, 2
push edi
push esi
call fcn.005354e0
add esp, 8
test eax, eax
je 0x53d84d
jmp 0x53d848
mov edx, dword [esp + 0x18]
mov dword [esi + edi*4], edx
jmp 0x53d84d
cmp dword [esp + 0x10], 0
jne 0x53d8c4
test edi, edi
jge 0x53d816
neg edi
lea eax, [edi*4 + 8]
push eax
push esi
call fcn.005354e0
add esp, 8
test eax, eax
jne 0x53d838
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
lea ecx, [eax + edi*4]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov dword [ecx + 4], 0
mov dword [0x583a84], eax
cmp dword [esp + 0x1c], 0
je 0x53d8ba
mov edi, dword [esp + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.00532c80
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x53d8ba
mov edi, dword [esp + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 1
sbb eax, eax
lea ecx, [ebp + ebx]
mov byte [ecx], 0
lea ecx, [ecx + 1]
and eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.00532d30
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x402d54
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x52a008], 0x8088405
inc edx
mov dword [ebx + 0x52a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4045c8
Capabilities:
Packed with generic packer

Disassembly:
test edx, edx
je 0x40462d
test ecx, ecx
je fcn.00404300
cmp edx, dword [eax]
je 0x404634
cmp ecx, dword [eax]
je 0x4045ea
push eax
push ecx
call fcn.00404300
pop edx
pop eax
jmp fcn.00404584
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
push eax
mov eax, dword [ebx - 4]
add eax, dword [esi - 4]
call fcn.00404370
mov edi, eax
mov edx, eax
mov eax, ebx
mov ecx, dword [ebx - 4]
call fcn.0040293c
mov edx, edi
mov eax, esi
mov ecx, dword [esi - 4]
add edx, dword [ebx - 4]
call fcn.0040293c
pop eax
mov edx, edi
test edi, edi
je 0x404624
dec dword [edi - 8]
call fcn.00404300
pop edi
pop esi
pop ebx
ret
mov edx, ecx
jmp fcn.00404300
mov edx, ecx
jmp fcn.00404584

Function at 0x42f650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42f67d
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x42f66e
and ecx, 3
je 0x42f695
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x42f682
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x42f6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x42f6d9
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x42f6c1
pop esi
and esi, 3
je 0x42f6fe
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x42f6df
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x42f708
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x42f734
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x42f725
and ecx, 3
je 0x42f74c
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x42f739
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x42f754
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0x42f760
pop edi
pop ebx
ret

Function at 0x43007c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov esi, eax
mov eax, esi
shr eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.0042fcd4
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4301bb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
dec edi
test edi, edi
jl 0x43012a
inc edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.0040293c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042f754
lea eax, [ebx + esi]
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
call fcn.0040293c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042f754
lea eax, [ebx + esi]
mov ebx, eax
dec edi
jne 0x4300d7
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
cmp esi, edi
jg 0x430178
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.0040293c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042f754
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov ecx, esi
call fcn.0040293c
lea eax, [ebx + esi]
mov ebx, eax
sub edi, esi
test edi, edi
jle 0x4301a2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec edi
test edi, edi
jl 0x4301a2
inc edi
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dl, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec edi
jne 0x430192
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4301c2
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0042fe70
ret
Function at 0x43e984
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov bl, dl
dec ebx
test ebx, ebx
jl 0x43e9d8
inc ebx
xor edx, edx
mov ecx, edx
shl ecx, 2
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x52a814]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x52ac14]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x52b014]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x52b414]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x43e993
pop edi
pop esi
pop ebx
ret

Function at 0x462930
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 0xc], 0
jle 0x4629f0
xor ebx, ebx
lea esi, [ebp - 0x114]
mov eax, dword [ebp + 8]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
call fcn.00405574
mov al, byte [edi + eax]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x46295a
xor edx, edx
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x4629f0
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc edx
and dl, 0xff
mov esi, edx
and esi, 0xff
mov al, byte [ebp + esi - 0x114]
mov cl, byte [ebp - 0xd]
add cl, al
and cl, 0xff
mov byte [ebp - 0xd], cl
xor ecx, ecx
mov cl, byte [ebp - 0xd]
mov cl, byte [ebp + ecx - 0x114]
mov byte [ebp + esi - 0x114], cl
xor ecx, ecx
mov cl, byte [ebp - 0xd]
mov byte [ebp + ecx - 0x114], al
add al, byte [ebp + esi - 0x114]
and al, 0xff
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx]
and eax, 0xff
xor cl, byte [ebp + eax - 0x114]
mov eax, dword [ebp - 8]
mov byte [eax + ebx], cl
inc ebx
dec dword [ebp - 0x14]
jne 0x46298c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4629fc
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp - 0xc], 0
jle 0x462ab4
xor esi, esi
lea ecx, [ebp - 0x110]
mov eax, esi
cdq
idiv edi
mov al, byte [ebx + edx]
mov byte [ecx], al
inc esi
inc ecx
cmp esi, 0x100
jne 0x462a29
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x462ab4
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
inc edx
and dl, 0xff
xor eax, eax
mov al, dl
mov al, byte [ebp + eax - 0x110]
lea ecx, [eax + ecx]
and cl, 0xff
xor ebx, ebx
mov bl, cl
mov bl, byte [ebp + ebx - 0x110]
mov edi, edx
and edi, 0xff
mov byte [ebp + edi - 0x110], bl
xor ebx, ebx
mov bl, cl
mov byte [ebp + ebx - 0x110], al
xor ebx, ebx
mov bl, dl
add al, byte [ebp + ebx - 0x110]
and al, 0xff
mov ebx, dword [ebp - 4]
mov bl, byte [ebx + esi]
and eax, 0xff
xor bl, byte [ebp + eax - 0x110]
mov eax, dword [ebp - 8]
mov byte [eax + esi], bl
inc esi
dec dword [ebp - 0x10]
jne 0x462a4f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x462ac0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov edi, ecx
mov ecx, edx
mov ebp, eax
test cl, cl
jbe 0x462b27
xor ebx, ebx
mov esi, esp
mov byte [edi + ebx], bl
xor eax, eax
mov al, cl
push eax
mov eax, ebx
pop edx
push ecx
mov ecx, edx
cdq
idiv ecx
pop ecx
mov al, byte [ebp + edx]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x462ad8
xor eax, eax
xor ebx, ebx
mov esi, esp
mov dl, byte [edi + ebx]
xor ecx, ecx
mov cl, dl
add eax, ecx
xor ecx, ecx
mov cl, byte [esi]
add eax, ecx
and eax, 0xff
mov cl, byte [edi + eax]
mov byte [edi + ebx], cl
mov byte [edi + eax], dl
inc ebx
inc esi
cmp ebx, 0x100
jne 0x462b00
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x465618
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x46561e
ret
Function at 0x4aabdc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x54e1ec]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x4aadb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a2dac
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004a3fd4
mov eax, dword [esi]
call fcn.004918ac
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x4aac4e
mov eax, dword [esi]
call fcn.004918ac
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.004918b8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x4aac72
mov eax, dword [esi]
call fcn.004918b8
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.004918a0
cmp eax, dword [ebp - 0x18]
jle 0x4aac88
mov eax, dword [esi]
call fcn.004918a0
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00491894
cmp eax, dword [ebp - 0xc]
jle 0x4aac9e
mov eax, dword [esi]
call fcn.00491894
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.004a9564
push eax
call fcn.0040799c
call fcn.00406e8c
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x4aad65
mov eax, ebx
call fcn.0040457c
cmp eax, 0x64
jge 0x4aad65
cmp dword [0x53b158], 0
je 0x4aad65
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call fcn.004079ec
cmp dword [ebp - 8], 0
je 0x4aad65
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call fcn.004079ec
cmp dword [ebp - 8], 0
je 0x4aad28
mov bl, 2
jmp 0x4aad43
lea edx, [ebp - 0x20]
mov eax, dword [0x556834]
call fcn.004ade74
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x4aad41
xor ebx, ebx
jmp 0x4aad43
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x53b260]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.004a9564
push eax
call dword [0x53b158]
mov eax, dword [0x54dff4]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call fcn.004a6c98
push 4
mov eax, dword [ebp - 4]
call fcn.004a9564
push eax
call fcn.004079e4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aadbc
call fcn.00406e8c
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x4bc5ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
jbe 0x4bc610
mov eax, 1
mov ebx, ecx
add ebx, eax
dec ebx
mov bl, byte [ebx]
mov edi, edx
add edi, eax
dec edi
xor byte [edi], bl
inc eax
dec esi
jne 0x4bc5fe
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4bc9a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0x4bc9c5
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x14]
mov eax, edi
call fcn.004bc960
mov ax, word [esi + ebp*2 + 0x16]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x18]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1a]
lea eax, [edi + 6]
call fcn.004bc960
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x1c]
lea eax, [edi + 4]
call fcn.004bc960
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x1e]
lea eax, [edi + 2]
call fcn.004bc960
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0x4bc9e1
mov dx, word [esi + 0x74]
mov eax, edi
call fcn.004bc960
mov ax, word [esi + 0x76]
add word [edi + 4], ax
mov ax, word [esi + 0x78]
add word [edi + 2], ax
mov dx, word [esi + 0x7a]
lea eax, [edi + 6]
call fcn.004bc960
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bcb30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, eax
lea edi, [esp + 4]
mov eax, dword [edx]
mov dword [edi], eax
add edx, 4
mov eax, dword [edx]
lea edx, [edi + 4]
mov dword [edx], eax
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0x4bcb55
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x7c]
mov eax, edi
call fcn.004bc960
mov ax, word [esi + ebp*2 + 0x7e]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x80]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x82]
lea eax, [edi + 6]
call fcn.004bc960
mov ax, word [edi + 4]
mov word [esp + 0xc], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x84]
lea eax, [edi + 4]
call fcn.004bc960
mov ax, word [edi + 2]
mov word [esp + 0xe], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x86]
lea eax, [edi + 2]
call fcn.004bc960
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0xc]
xor word [edi + 2], ax
mov ax, word [esp + 0xe]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0x4bcb71
mov dx, word [esi + 0xdc]
mov eax, edi
call fcn.004bc960
mov ax, word [esi + 0xde]
add word [edi + 4], ax
mov ax, word [esi + 0xe0]
add word [edi + 2], ax
mov dx, word [esi + 0xe2]
lea eax, [edi + 6]
call fcn.004bc960
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0xe], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0xe]
mov word [edi + 2], ax
mov eax, dword [edi]
mov edx, dword [esp]
mov dword [edx], eax
lea eax, [edi + 4]
mov eax, dword [eax]
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cbb50
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x4cbb81
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4cbb69
add dl, dl
jne 0x4cbb8c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4cbbdd
xor eax, eax
add dl, dl
jne 0x4cbb99
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4cbc7a
add dl, dl
jne 0x4cbba8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4cbbb3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4cbbbe
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4cbbc9
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4cbbd3
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x4cbb78
mov eax, 1
add dl, dl
jne 0x4cbbeb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4cbbf6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4cbbe2
sub eax, ebx
mov ebx, 1
jne 0x4cbc29
mov ecx, 1
add dl, dl
jne 0x4cbc0f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4cbc1a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4cbc06
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4cbb78
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4cbc40
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4cbc4b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4cbc37
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4cbb78
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4cbc9b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x4cbb78
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4cd378
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cd437
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x4cd429
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x4cd412
test esi, esi
jbe 0x4cd429
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a708
test eax, eax
jne 0x4cd404
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x4cd429
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x4cd3e1
jmp 0x4cd429
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x4cd429
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd43e
ret