joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7720
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b785c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4b7874
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.004b89bc
mov eax, dword [ebp - 4]
call fcn.004b824c
xor edx, edx
push ebp
push 0x4b783f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x4b77de
test si, si
jne 0x4b7790
mov eax, dword [ebp - 8]
call fcn.0040a410
mov esi, eax
cmp esi, 0xffff
jbe 0x4b7790
call fcn.004030cc
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x4b77de
cmp eax, 0xffffffff
jle 0x4b77bf
sub ebx, eax
jmp 0x4b77ce
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.004b88f0
test ebx, ebx
je 0x4b77de
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x4b7793
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x4b7829
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x4b788c
mov dl, 1
mov eax, dword [0x4b6d08]
call fcn.0040c658
call fcn.00403930
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x4b7829
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7846
mov eax, dword [ebp - 4]
call fcn.004b82a4
ret
Function at 0x4b79a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b7b36
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b7b4c
lea edx, [ebp - 0xc]
movzx eax, si
call fcn.00409a68
push dword [ebp - 0xc]
push 0x4b7b5c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404278
mov ecx, dword [ebp - 8]
mov dl, 8
mov eax, ebx
call fcn.004b89bc
test si, si
jne 0x4b7a41
push 2
push 0x10000
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
cmp eax, 0xffffffff
jne 0x4b7a30
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, ebx
call fcn.004b88f0
mov eax, dword [ebp - 4]
call fcn.00403f38
jmp 0x4b7a97
mov esi, eax
cmp esi, 0xffff
jbe 0x4b7a97
call fcn.004030cc
jmp 0x4b7a97
push 2
push 0x10000
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
movzx edx, si
cmp eax, edx
jge 0x4b7a97
test eax, eax
jne 0x4b7a71
mov eax, dword [ebp - 4]
call fcn.00403f38
jmp 0x4b7b1b
inc eax
jne 0x4b7a82
lea ecx, [ebp - 0x14]
mov dx, 0x2733
mov eax, ebx
call fcn.004b88f0
mov eax, dword [0x567568]
mov eax, dword [eax]
call fcn.0045184c
cmp byte [ebx + 0x10088], 0
je 0x4b7a41
cmp byte [ebx + 0x10088], 0
jne 0x4b7ae6
movzx edi, si
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004044ec
push 0
push edi
mov eax, dword [ebp - 4]
call fcn.00404388
mov edx, 1
dec edx
cmp edx, dword [eax - 4]
jb 0x4b7ac8
call fcn.004030cc
inc edx
lea eax, [eax + edx - 1]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
mov edx, dword [ebp - 4]
xchg edx, eax
call fcn.004044ec
jmp 0x4b7b1b
mov byte [ebx + 0x10088], 0
mov ecx, 0x4b7b68
mov dl, 1
mov eax, dword [0x4b6d08]
call fcn.0040c658
call fcn.00403930
cmp word [ebx + 0x10282], 0
je 0x4b7b1b
mov edx, ebx
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7b3d
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00403f5c
ret
Function at 0x4b87f8
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b88c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4b88d8
mov dl, 4
mov eax, ebx
call fcn.004b89bc
mov byte [ebx + 0x10290], 0
mov si, word [ebx + 0x10288]
cmp si, 0xffff
je 0x4b88ae
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x4b88a0
test byte [ebx + 0x20], 8
jne 0x4b885d
cmp word [ebx + 0x1004a], 0
je 0x4b885d
mov edx, ebx
mov eax, dword [ebx + 0x1004c]
call dword [ebx + 0x10048]
cmp byte [ebx + 0x10089], 0
jne 0x4b88ae
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x4b8880
call fcn.004030cc
mov word [ebx + 0x10288], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x1028c]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x4b88ae
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.004b88f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b88cb
lea eax, [ebp - 4]
call fcn.00403f38
ret

Function at 0x4b8a64
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x4b8aa0
mov dl, 8
mov eax, ebx
call fcn.004b89bc
push 2
push 1
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x4b8a92
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x4b8ab0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4b8ab7
mov eax, dword [esp + 0x10000]
mov ebx, eax
mov ecx, 0x4b8b04
mov dl, 8
mov eax, ebx
call fcn.004b89bc
push 0
push 0x10000
lea eax, [esp + 8]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.wsock32.dll_recv
add esp, 0x10004
pop ebx
ret
Function at 0x4c853c
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x4c8553
add esp, 0xfffffff0
call fcn.004034d8
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4c86d9
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00418cd0
mov dword [ebx + 0x90], 0xffffffff
xor eax, eax
mov dword [ebx + 0xe4], eax
mov byte [ebx + 0x24], 1
mov byte [ebx + 0x84], 1
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x94], 0
xor eax, eax
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x4c287c]
call fcn.00403168
mov dword [ebx + 0x74], eax
lea edx, [ebp - 8]
mov eax, dword [0x5676ac]
call fcn.0040639c
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4c0ff8]
call fcn.004c6f80
mov esi, eax
mov dword [ebx + 0x78], esi
mov byte [esi + 4], 0
mov byte [esi + 0x2c], 1
lea edx, [ebp - 0xc]
mov eax, dword [0x5675d0]
call fcn.0040639c
mov eax, dword [ebp - 0xc]
push eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4c0ff8]
call fcn.004c6f80
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x4101c0]
call fcn.00403168
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x4101c0]
call fcn.00403168
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x28], 0x80000000
mov byte [ebx + 0x64], 1
mov word [ebx + 0x38], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x4c23f4]
call fcn.004c76b4
mov dword [ebx + 0x58], eax
lea edx, [ebx + 0x70]
mov eax, dword [0x56771c]
call fcn.0040639c
lea edx, [ebx + 0x60]
mov eax, dword [0x56768c]
call fcn.0040639c
mov dl, 1
mov eax, dword [0x4101c0]
call fcn.00403168
mov dword [ebx + 0x3c], eax
xor eax, eax
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x4101c0]
call fcn.00403168
mov dword [ebx + 0x54], eax
mov al, byte [0x4c8700]
mov byte [ebx + 0x95], al
mov dword [ebx + 0x40], 0xffffffff
mov dword [ebx + 0x50], 0xffffffff
mov byte [ebx + 0xea], 1
mov byte [ebx + 0xe8], 1
mov byte [ebx + 0xeb], 0
lea eax, [ebx + 0xe0]
call fcn.00403f38
mov al, byte [0x4c8704]
mov byte [ebx + 0x9c], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c86e0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403f5c
ret

Function at 0x4db6b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4db6e8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4db6c6
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4db6d5
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4db6e4
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4dbd78
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x567568]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
test eax, eax
je 0x4dbda5
mov edx, dword [0x567568]
xor edx, edx
call fcn.0044b77c
push 0
mov eax, dword [0x567568]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x4df780
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf8
mov edi, ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.004dfd18
test al, al
jne 0x4df7ae
lea eax, [esp + 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
jmp 0x4df7bc
lea eax, [esp + 0x104]
mov edx, esi
call fcn.0040a4d4
push esp
xor bl, 1
xor eax, eax
mov al, bl
push eax
push 0x4df7ec
lea eax, [esp + 0x110]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, edi
mov eax, esp
call fcn.0040a658
add esp, 0x208
pop edi
pop esi
pop ebx
ret

Function at 0x4df85c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4df8e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040a18c
xor ebx, ebx
mov edx, dword [ebp - 0xc]
mov eax, 0x4df900
call fcn.004044a4
mov esi, eax
test esi, esi
jle 0x4df8d3
mov eax, dword [ebp - 0xc]
call fcn.004041b8
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
lea eax, [ebp - 0xc]
call fcn.00404400
mov eax, dword [ebp - 0xc]
call fcn.004041b8
mov ecx, eax
lea eax, [ebp - 5]
mov edx, dword [ebp - 0xc]
call fcn.0040a4f8
lea eax, [ebp - 5]
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df8f0
lea eax, [ebp - 0xc]
call fcn.00403f38
ret

Function at 0x4df904
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x11c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4df9ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x11c]
mov eax, ebx
call fcn.0040a078
lea eax, [ebp - 0x11c]
mov edx, 0x4dfa08
call fcn.004041c0
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
call fcn.0040a4d4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x4df9d1
xor eax, eax
push ebp
push 0x4df9ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
imul dword [ebp - 0xc]
imul dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4df9d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df9f1
lea eax, [ebp - 0x11c]
call fcn.00403f38
ret
Function at 0x4dfb40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dfcf1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0040a078
cmp dword [ebp - 0xc], 0
jne 0x4dfb90
lea eax, [ebp - 0x10]
call fcn.0040a39c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040a078
lea eax, [ebp - 0xc]
mov edx, 0x4dfd08
call fcn.004041c0
mov eax, ebx
call fcn.004e00ec
sub al, 2
jb 0x4dfbaf
je 0x4dfbc2
jmp case.default.0x4dfc17
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x4dfc17
mov edx, ebx
mov eax, 0x4dfd14
call fcn.004044a4
dec eax
jne 0x4dfc00
call fcn.004dfae4
test al, al
je 0x4dfbed
mov eax, dword [ebp - 0xc]
call fcn.004dfa0c
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x4dfc17
mov dword [ebp - 8], 0x7fffffff
mov dword [ebp - 4], 0
jmp case.default.0x4dfc17
mov eax, dword [ebp - 0xc]
call fcn.0040437c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.default.0x4dfc17
jmp dword [eax*4 + 0x4dfc1e]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x4dfc17
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x4dfc17
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp case.default.0x4dfc17
mov eax, dword [ebp - 0xc]
call fcn.004df904
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x4dfc17
mov eax, dword [ebp - 0xc]
call fcn.004dfad0
cdq
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x4dfc17
mov eax, dword [ebp - 0xc]
call fcn.004df904
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jmp case.default.0x4dfc17
mov eax, dword [ebp - 0xc]
call fcn.004dfa0c
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0xffffffff
jne 0x4dfcb7
cmp dword [ebp - 8], 0xffffffff
jb 0x4dfccc
jmp 0x4dfcb9
jl 0x4dfccc
cmp dword [ebp - 4], 0
jne 0x4dfcca
cmp dword [ebp - 8], 0x7fffffff
jbe 0x4dfcd3
jmp 0x4dfccc
jle 0x4dfcd3
mov ebx, 0x7fffffff
jmp 0x4dfcd6
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dfcf8
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403f5c
ret

Function at 0x4dfd18
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, eax
xor ebx, ebx
mov edx, esi
mov eax, 0x4dfd74
call fcn.004044a4
test eax, eax
jne 0x4dfd5e
mov edx, esi
mov eax, 0x4dfd80
call fcn.004044a4
test eax, eax
jne 0x4dfd5e
mov eax, esp
mov edx, esi
call fcn.0040a4d4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4dfd5e
test al, 0x10
je 0x4dfd5e
mov bl, 1
mov eax, ebx
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x4e0adc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, dword [eax]
movzx ecx, cx
dec ecx
test ecx, ecx
jl 0x4e0b0b
inc ecx
mov ebx, esi
xor bl, byte [edx]
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x56510c]
shr esi, 8
and esi, 0xffffff
xor ebx, esi
mov esi, ebx
inc edx
dec ecx
jne 0x4e0ae9
mov dword [eax], esi
pop esi
pop ebx
ret

Function at 0x4e24b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [eax]
sub ecx, 1
jno 0x4e24c5
call fcn.004030d4
test ecx, ecx
jl 0x4e24ea
inc ecx
mov ebx, edx
xor bl, byte [esi]
and ebx, 0xff
mov edi, dword [0x566f0c]
mov ebx, dword [edi + ebx*4]
shr edx, 8
xor ebx, edx
mov edx, ebx
add esi, 1
dec ecx
jne 0x4e24ca
mov dword [eax], edx
pop edi
pop esi
pop ebx
ret

Function at 0x4e4bb4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4e4c68
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x34], dl
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x4e4be0
call fcn.00403198
xor eax, eax
mov dword [ebx + 0x38], eax
cmp byte [ebx + 0x34], 0
je 0x4e4c52
cmp dword [ebx + 0x30], 0
je 0x4e4c52
xor eax, eax
push ebp
push 0x4e4c27
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebx + 0x30]
mov dl, 1
mov eax, dword [0x4108c0]
call fcn.00414224
mov dword [ebx + 0x38], eax
mov edx, dword [ebx + 0xc]
mov cl, 6
mov eax, ebx
call fcn.004e440c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e4c52
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4c6f
lea eax, [ebp - 4]
call fcn.00403f38
ret

Function at 0x4e7dec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4e7e92
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x30]
call fcn.004e777c
mov eax, dword [ebx + 0x30]
mov esi, dword [eax + 0x28]
test esi, esi
je 0x4e7e2e
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040a658
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x1c]
call fcn.00403f8c
jmp 0x4e7e36
lea eax, [ebx + 0x1c]
call fcn.00403f38
mov eax, dword [ebx + 0x30]
mov dx, word [eax + 0x12]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x30]
mov dx, word [eax + 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea edx, [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x14]
call fcn.00403f8c
lea eax, [ebx + 0x14]
call fcn.004e0aa8
mov byte [ebx + 8], 1
mov byte [ebx + 0x26], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7e99
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403f5c
ret
Function at 0x4ea3d4
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ea458
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebx + 0x30]
mov ecx, 0x159
mov eax, esi
mov edi, dword [eax]
call dword [edi + 4]
mov cx, 1
mov edx, 0xfffffea7
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
lea eax, [ebx + 0x1c]
lea edx, [ebx + 0x30]
mov ecx, 0x64
call fcn.00404168
lea edx, [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x14]
call fcn.00403f8c
lea eax, [ebx + 0x14]
call fcn.004e0aa8
mov byte [ebx + 8], 1
mov byte [ebx + 0x26], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ea45f
lea eax, [ebp - 4]
call fcn.00403f38
ret

Function at 0x4ebb48
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x2c]
sub eax, dword [ebx + 0x28]
cmp eax, dword [esp]
jge 0x4ebb77
mov ecx, 0xeb
mov edx, 0x4ebc98
mov eax, 0x4ebcd8
call fcn.00403e98
mov eax, dword [esp + 4]
cmp eax, dword [esp]
je 0x4ebb9e
mov eax, dword [esp]
dec eax
cmp eax, dword [esp + 4]
je 0x4ebb9e
mov ecx, 0xed
mov edx, 0x4ebc98
mov eax, 0x4ebd20
call fcn.00403e98
mov eax, dword [ebx + 0x28]
mov edx, dword [esp]
cmp edx, dword [esp + 4]
jle 0x4ebbab
inc eax
mov edx, dword [ebx + 0x18]
mov dword [esp + 8], edx
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x20]
mov esi, dword [esp + 4]
dec esi
test esi, esi
jl 0x4ebbeb
inc esi
shl edx, 5
movzx edi, byte [eax + 2]
xor edx, edi
and edx, 0x3fff
mov edi, eax
and edi, dword [ebx + 0x58]
mov ebp, dword [esp + 8]
lea ebp, [ebp + edi*4]
mov edi, dword [ecx + edx*4]
mov dword [ebp], edi
mov dword [ecx + edx*4], eax
inc eax
dec esi
jne 0x4ebbc2
mov esi, dword [esp + 8]
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x28], eax
cmp byte [ebx + 4], 0
je 0x4ebc24
mov eax, dword [esp]
add dword [ebx + 0x44], eax
mov eax, dword [esp]
add dword [ebx + 0x48], eax
cmp byte [ebx + 0x34], 0
je 0x4ebc3e
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x4ebc3e
mov eax, ebx
call fcn.004ec0a8
jmp 0x4ebc3e
mov edx, eax
sub edx, dword [ebx + 0x44]
cmp edx, dword [ebx + 0x5c]
jl 0x4ebc3e
mov byte [ebx + 4], 1
sub eax, dword [ebx + 0x5c]
sub eax, dword [ebx + 0x44]
add dword [ebx + 0x44], eax
add dword [ebx + 0x48], eax
cmp word [ebx + 0x3a], 0
je 0x4ebc76
mov eax, dword [esp]
add dword [ebx + 0x10], eax
mov esi, dword [ebx + 0x10]
test esi, 0xfff
jne 0x4ebc76
mov dword [esp + 0xc], esi
fild dword [esp + 0xc]
fmul dword [0x4ebd5c]
fild dword [ebx + 0x50]
fdivp st(1)
call fcn.00402c2c
mov edx, eax
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x4ebc85
mov eax, ebx
call fcn.004ec0a8
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4eec94
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, ecx
mov ebx, edx
mov dword [esp], eax
lea edi, [esp + 4]
mov eax, dword [esp]
cmp byte [eax + 4], 0
jne 0x4eecc3
mov ecx, 0xc4
mov edx, 0x4eed60
mov eax, 0x4eeda0
call fcn.00403e98
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [edi + 4], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov dword [edi + 8], eax
dec esi
test esi, esi
jl 0x4eed34
inc esi
mov eax, dword [edi + 8]
and eax, 0xffff
or eax, 2
mov dl, byte [ebx]
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [ebx], dl
mov edx, dword [edi]
mov al, byte [ebx]
call fcn.004e0b10
mov ebp, eax
mov dword [edi], ebp
and ebp, 0xff
add dword [edi + 4], ebp
imul ebp, dword [edi + 4], 0x8088405
inc ebp
mov dword [edi + 4], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [edi + 8]
call fcn.004e0b10
mov dword [edi + 8], eax
inc ebx
dec esi
jne 0x4eece3
mov eax, dword [esp]
mov edx, dword [edi]
mov dword [eax + 8], edx
mov eax, dword [esp]
mov edx, dword [edi + 4]
mov dword [eax + 0xc], edx
mov eax, dword [esp]
mov edx, dword [edi + 8]
mov dword [eax + 0x10], edx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4eede8
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
test esi, esi
jne 0x4eee10
mov ecx, 0xf4
mov edx, 0x4eee98
mov eax, 0x4eeed8
call fcn.00403e98
mov edx, esi
mov eax, ebx
call fcn.004eef0c
mov dword [ebp - 8], 0xc
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
and eax, 0xffff
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
shr edx, 8
xor dl, byte [edi]
mov byte [esi], dl
mov edx, dword [ebx + 8]
mov al, byte [esi]
call fcn.004e0b10
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.004e0b10
mov dword [ebx + 0x10], eax
inc esi
inc edi
dec dword [ebp - 8]
jne 0x4eee26
mov al, byte [ebp + 0xb]
cmp al, byte [ebp - 9]
sete al
mov byte [ebx + 4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4eef0c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [esp]
call fcn.004041b8
mov esi, eax
test esi, esi
jle 0x4eef7a
mov edi, 1
mov eax, dword [esp]
mov al, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.004e0b10
mov ebp, eax
mov dword [ebx + 8], ebp
and ebp, 0xff
add dword [ebx + 0xc], ebp
imul ebp, dword [ebx + 0xc], 0x8088405
inc ebp
mov dword [ebx + 0xc], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.004e0b10
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x4eef3e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret