joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0d78
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd50
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x4a0e8f
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor ecx, ecx
push ebp
push 0x4a0e72
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x290]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x290]
mov edx, ebx
call fcn.0040c318
lea eax, [ebp - 0x290]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4a0e61
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4a0e58
mov ebx, dword [edx]
test ebx, ebx
je 0x4a0e4f
push esi
xor eax, eax
mov al, byte [ebx]
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 0x2ac], 0
xor eax, eax
mov al, byte [ebx + 1]
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 0x2a4], 0
xor eax, eax
mov al, byte [ebx + 2]
mov dword [ebp - 0x2a0], eax
mov byte [ebp - 0x29c], 0
xor eax, eax
mov al, byte [ebx + 3]
mov dword [ebp - 0x298], eax
mov byte [ebp - 0x294], 0
lea edx, [ebp - 0x2b0]
mov ecx, 3
mov eax, 0x4a0ea8
call fcn.0040c95c
jmp 0x4a0e68
mov eax, esi
call fcn.00404bb4
jmp 0x4a0e68
mov eax, esi
call fcn.00404bb4
jmp 0x4a0e68
mov eax, esi
call fcn.00404bb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a0e7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0e96
call sub.wsock32.dll_WSACleanup
ret

Function at 0x4a0f28
Capabilities:
Resolve dns

Disassembly:
push ebx
push ecx
mov ebx, edx
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00405074
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4a0f57
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4a0f57
mov eax, dword [edx]
mov edx, esp
mov ecx, 4
call fcn.00402d4c
mov eax, dword [esp]
pop edx
pop ebx
ret

Function at 0x4a166c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov edx, ebx
mov ecx, 8
test dl, 1
je 0x4a1685
shr edx, 1
xor edx, 0xedb88320
jmp 0x4a1687
shr edx, 1
dec ecx
jne 0x4a1676
mov dword [eax + ebx*4 + 0xc], edx
inc ebx
cmp ebx, 0x100
jne 0x4a166f
pop ebx
ret
Function at 0x4adaa8
Capabilities:
Get system information on windows

Disassembly:
push ebx
add esp, 0xfffffe68
xor ebx, ebx
push 0
push 0x20
lea eax, [esp + 0x150]
push eax
push 3
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x4adbd4
push 0
push 0x138
lea eax, [esp + 0x18]
push eax
push 2
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x4adbd4
push 0
push 0x2c
lea eax, [esp + 0x170]
push eax
push 0
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x4adbd4
cmp dword [0x4e8ecc], 0
jne 0x4adb12
cmp dword [0x4e8ec8], 0
je 0x4adba6
cmp byte [esp + 0x190], 0
je 0x4adba6
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, dword [0x4e8ec8]
sbb edx, dword [0x4e8ecc]
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp + 0x150]
mov edx, dword [esp + 0x154]
sub eax, dword [0x4e8ed0]
sbb edx, dword [0x4e8ed4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], 0
jne 0x4adb6f
cmp dword [esp + 8], 0
je 0x4adba6
fild qword [esp]
fild qword [esp + 8]
fdivp st(1)
fmul dword [0x4adbe0]
xor eax, eax
mov al, byte [esp + 0x190]
mov dword [esp + 0x194], eax
fild dword [esp + 0x194]
fdivp st(1)
fsubr dword [0x4adbe0]
call fcn.00402f94
mov ebx, eax
mov eax, dword [esp + 0x10]
mov dword [0x4e8ec8], eax
mov eax, dword [esp + 0x14]
mov dword [0x4e8ecc], eax
mov eax, dword [esp + 0x150]
mov dword [0x4e8ed0], eax
mov eax, dword [esp + 0x154]
mov dword [0x4e8ed4], eax
mov eax, ebx
add esp, 0x198
pop ebx
ret

Function at 0x4ae6ec
Capabilities:
Get disk information

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
xor ebx, ebx
push pe_nt_image_headers32
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push pe_nt_image_headers32
lea eax, [esp + 0x24]
push eax
push esi
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4ae72b
mov ebx, dword [esp]
mov eax, ebx
add esp, 0x20c
pop esi
pop ebx
ret
Function at 0x4b4f2c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov dword [esp], edx
mov ebx, eax
lea edx, [esp + 0x20]
mov eax, dword [esp]
mov ecx, 0x10
call fcn.00402d4c
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
dec eax
test eax, eax
jl 0x4b5088
inc eax
mov dword [esp + 0x1c], eax
lea eax, [ebx + 8]
mov ebx, eax
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
mov edi, edx
mov edx, esi
mov esi, edi
mov edi, ecx
mov ecx, eax
mov eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
xor edx, dword [esp + 0x14]
xor ecx, edx
mov dword [esp + 4], ecx
xor esi, dword [esp + 0x18]
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
add ebx, 8
dec dword [esp + 0x1c]
jne 0x4b4f7e
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov edx, dword [esp]
lea eax, [esp + 0x20]
mov ecx, 0x10
call fcn.00402d4c
add esp, 0x30
pop edi
pop esi
pop ebx
ret
Function at 0x4b50c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dl, byte [ebp + 8]
mov byte [eax], dl
mov edx, ebx
mov eax, 0x10
call fcn.004b4e38
mov edx, eax
mov eax, 4
call fcn.004b4e40
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], 0x4e1070
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx]
mov ecx, esi
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov esi, 8
mov edi, ecx
shl edi, 0xb
xor edx, edi
add dword [ebp - 0xc], edx
add ecx, ebx
mov edi, ebx
shr edi, 2
xor ecx, edi
add dword [ebp - 0x10], ecx
add ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
shl edi, 8
xor ebx, edi
add dword [ebp - 0x14], ebx
mov edi, dword [ebp - 0x10]
add dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
shr edi, 0x10
xor dword [ebp - 0xc], edi
mov edi, dword [ebp - 0xc]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
shl edi, 0xa
xor dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
add dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x18]
add dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
shr edi, 4
xor dword [ebp - 0x14], edi
add edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
shl edi, 8
xor dword [ebp - 0x18], edi
add ecx, dword [ebp - 0x18]
add dword [ebp - 0x1c], edx
mov edi, edx
shr edi, 9
xor dword [ebp - 0x1c], edi
add ebx, dword [ebp - 0x1c]
add edx, ecx
dec esi
jne 0x4b5140
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
add eax, 0x20
add dword [ebp - 0x24], 4
dec dword [ebp - 0x20]
jne 0x4b510e
cmp byte [ebp + 8], 0
jne 0x4b526f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x4b5244
inc eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 4]
add edx, 8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
dec ecx
sub ecx, dword [ebp - 0x20]
mov ebx, dword [edx]
mov dword [ebp + ecx*8 - 0xa4], ebx
mov ebx, dword [edx + 4]
mov dword [ebp + ecx*8 - 0xa0], ebx
inc dword [ebp - 0x20]
add edx, 8
dec eax
jne 0x4b521e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x4b526f
inc eax
lea edx, [ebp - 0xa4]
mov ebx, dword [ebp - 4]
add ebx, 8
mov ecx, dword [edx]
mov dword [ebx], ecx
mov ecx, dword [edx + 4]
mov dword [ebx + 4], ecx
add ebx, 8
add edx, 8
dec eax
jne 0x4b525c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b5278
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov esi, eax
lea edi, [esp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebp, edx
mov edx, ebp
mov eax, 0x4e1080
mov ecx, 0x48
call fcn.00402d4c
lea edx, [ebp + 0x48]
mov eax, 0x4e10c8
mov ecx, 0x1000
call fcn.00402d4c
xor edi, edi
mov esi, 0x12
mov dword [esp + 8], ebp
xor edx, edx
mov eax, 4
shl edx, 8
xor ecx, ecx
mov cl, byte [esp + edi + 0xc]
or edx, ecx
inc edi
cmp edi, 0x10
jl 0x4b52d3
xor edi, edi
dec eax
jne 0x4b52c0
mov eax, dword [esp + 8]
xor dword [eax], edx
add dword [esp + 8], 4
dec esi
jne 0x4b52b9
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.004b5354
mov eax, dword [esp]
mov dword [ebp + esi*4], eax
mov eax, dword [esp + 4]
mov dword [ebp + esi*4 + 4], eax
add esi, 2
cmp esi, 0x11
jle 0x4b52f1
mov edi, 4
mov ebx, ebp
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.004b5354
mov eax, dword [esp]
mov dword [ebx + esi*4 + 0x48], eax
mov eax, dword [esp + 4]
mov dword [ebx + esi*4 + 0x4c], eax
add esi, 2
cmp esi, 0xff
jle 0x4b531c
add ebx, 0x400
dec edi
jne 0x4b531a
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b5354
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov byte [esp], cl
mov esi, edx
mov ebx, eax
lea edi, [esp + 1]
mov edx, edi
mov eax, esi
mov ecx, 8
call fcn.00402d4c
cmp byte [esp], 0
je 0x4b5407
mov eax, dword [ebx]
xor dword [esi], eax
mov eax, 1
xor edx, edx
mov dl, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
xor edx, edx
mov dl, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 + 4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
add eax, 2
cmp eax, 0x10
jle 0x4b5386
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
jmp 0x4b548c
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
mov eax, 0x10
xor edx, edx
mov dl, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
xor edx, edx
mov dl, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
xor ecx, ecx
mov cl, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
xor ecx, ecx
mov cl, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
xor ecx, ecx
mov cl, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 - 4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
sub eax, 2
cmp eax, 1
jge 0x4b5412
mov eax, dword [ebx]
xor dword [esi], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x4b5534
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffee8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x118
call fcn.00402d4c
xor eax, eax
mov dword [esp], eax
mov esi, 0x4e0f70
lea edi, [esp + 4]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], 0x55555555
mov dword [esp + 0x10c], 0x55555555
mov dword [esp + 0x110], 0x55555555
mov dword [esp + 0x114], 0x55555555
mov edx, ebx
mov eax, esp
mov ecx, 0x118
call fcn.00402d4c
add esp, 0x118
pop edi
pop esi
pop ebx
ret
Function at 0x4b55b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee0
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
lea edx, [esp + 8]
mov eax, dword [esp]
mov ecx, 0x118
call fcn.00402d4c
dec edi
test edi, edi
jl 0x4b56cf
inc edi
mov dword [esp + 4], edi
mov esi, ebx
mov al, byte [esi]
mov edx, dword [esp + 8]
xor byte [esp + edx + 0xc], al
inc dword [esp + 8]
cmp dword [esp + 8], 0x100
jne 0x4b5600
xor edx, edx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x10c]
xor byte [esp + edx + 0x110], al
inc dword [esp + 0x10c]
cmp dword [esp + 0x10c], 8
jne 0x4b56c4
mov edx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
mov edi, 4
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 7
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 0xd
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shr ebp, 0x11
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 9
xor eax, ebp
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 3
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 7
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, eax
shr ebp, 0xf
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 0xb
xor eax, ebp
dec edi
jne 0x4b5644
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], eax
xor eax, eax
mov dword [esp + 0x10c], eax
inc esi
dec dword [esp + 4]
jne 0x4b55e2
mov edx, dword [esp]
lea eax, [esp + 8]
mov ecx, 0x118
call fcn.00402d4c
add esp, 0x120
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b57d4
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
push ecx
shr ecx, 2
je 0x4b57ee
cld
mov eax, dword [edi]
xor dword [esi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x4b57e1
pop ecx
and ecx, 3
je 0x4b57fd
mov al, byte [edi]
xor byte [esi], al
inc esi
inc edi
dec ecx
jne 0x4b57f4
pop edi
pop esi
ret
Function at 0x4b6044
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff88
mov dword [esp + 4], edx
mov dword [esp], eax
lea eax, [esp + 0x39]
xor ecx, ecx
mov edx, 0x3f
call fcn.00403540
lea edx, [esp + 0xc]
mov ecx, 0x2d
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4b61c9
mov edi, 1
xor esi, esi
jmp 0x4b6109
mov al, byte [esp + edi + 0xb]
xor edx, edx
mov dl, al
shr edx, 2
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4e20d0]
mov byte [esp + esi + 0x39], dl
mov edx, eax
shl edx, 4
xor eax, eax
mov al, byte [esp + edi + 0xc]
shr eax, 4
or dl, al
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x4e20d0]
mov byte [esp + esi + 0x3a], al
mov dl, byte [esp + edi + 0xc]
shl edx, 2
mov al, byte [esp + edi + 0xd]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4e20d0]
mov byte [esp + esi + 0x3b], dl
mov edx, eax
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x4e20d0]
mov byte [esp + esi + 0x3c], al
add edi, 3
add esi, 4
mov eax, dword [esp + 8]
sub eax, 2
cmp edi, eax
jle 0x4b608a
cmp edi, dword [esp + 8]
jg 0x4b61af
mov al, byte [esp + edi + 0xb]
xor edx, edx
mov dl, al
shr edx, 2
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4e20d0]
mov byte [esp + esi + 0x39], dl
cmp edi, dword [esp + 8]
jne 0x4b6166
mov edx, eax
shl edx, 4
and dl, 0x30
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x4e20d0]
mov byte [esp + esi + 0x3a], al
mov byte [esp + esi + 0x3b], 0x3d
jmp 0x4b61a7
mov edx, eax
shl edx, 4
and dl, 0x30
xor eax, eax
mov al, byte [esp + edi + 0xc]
shr eax, 4
and al, 0xf
or dl, al
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x4e20d0]
mov byte [esp + esi + 0x3a], al
mov dl, byte [esp + edi + 0xc]
shl edx, 2
and dl, 0x3c
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x4e20d0]
mov byte [esp + esi + 0x3b], al
mov byte [esp + esi + 0x3c], 0x3d
add esi, 4
lea edx, [esp + 0x39]
mov ecx, esi
mov eax, dword [esp + 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [esp + 8], 0x2d
jge 0x4b6061
add esp, 0x78
pop edi
pop esi
pop ebx
ret
Function at 0x4b7c78
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b7d1c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x20]
test al, al
jne 0x4b7cd1
mov ecx, esi
mov dl, 1
mov eax, dword [0x4b7ba0]
call fcn.004b8058
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x1c], edx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 8]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x10]
lea ecx, [ebp - 8]
mov eax, dword [ebx + 4]
mov edx, esi
mov esi, dword [eax]
call dword [esi + 0x18]
test al, al
je 0x4b7cf4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004b7edc
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 8]
cmp eax, 0x493e0
jbe 0x4b7d12
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 8], eax
mov eax, ebx
call fcn.004b7d8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b7d26
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4b9084
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x78]
cmp eax, 0xbb8
jb 0x4b915b
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x78], eax
mov eax, ebx
call fcn.004b8e38
mov word [ebx + 0x41], ax
mov eax, dword [ebx + 0x43]
mov ecx, 3
cdq
idiv ecx
mov dword [ebx + 0x43], eax
mov eax, dword [ebx + 0x47]
mov ecx, 3
cdq
idiv ecx
mov dword [ebx + 0x47], eax
mov eax, dword [ebx + 0x4b]
mov ecx, 3
cdq
idiv ecx
mov dword [ebx + 0x4b], eax
mov eax, dword [ebx + 0x4f]
mov ecx, 3
cdq
idiv ecx
mov dword [ebx + 0x4f], eax
mov eax, dword [ebx + 0x53]
mov ecx, 3
cdq
idiv ecx
mov dword [ebx + 0x53], eax
mov eax, dword [ebx + 0x57]
mov ecx, 3
cdq
idiv ecx
mov ecx, eax
mov dword [ebx + 0x57], ecx
mov eax, ecx
mov ecx, 3
cdq
idiv ecx
mov dword [ebx + 0x57], eax
mov eax, dword [ebx + 0x5b]
mov ecx, 3
cdq
idiv ecx
mov dword [ebx + 0x5b], eax
mov eax, dword [ebx + 0x7c]
mov dword [ebx + 0x63], eax
xor eax, eax
mov dword [ebx + 0x6b], eax
xor eax, eax
mov dword [ebx + 0x6f], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x73], eax
lea eax, [ebx + 0x41]
push eax
push 0x36
mov cx, 0x4653
mov edx, 0x100007f
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
call dword [esi + 0x24]
lea eax, [ebx + 0x41]
mov edx, 0x36
call fcn.00407dd4
pop esi
pop ebx
ret
Function at 0x4cd9ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4cda90
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x20]
test al, al
jne 0x4cda45
mov ecx, esi
mov dl, 1
mov eax, dword [0x4cd914]
call fcn.004cddc4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x1c], edx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 8]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x10]
lea ecx, [ebp - 8]
mov eax, dword [ebx + 4]
mov edx, esi
mov esi, dword [eax]
call dword [esi + 0x18]
test al, al
je 0x4cda68
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004cdc50
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 8]
cmp eax, 0x493e0
jbe 0x4cda86
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 8], eax
mov eax, ebx
call fcn.004cdb00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cda9a
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8