joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fdcc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x45fe04]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45fde5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45fdf4
or bl, 4
test esi, 0x20000000
je 0x45fdff
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4664ac
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4664be
add esp, 0xfffffff0
call fcn.00403448
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00420590
mov eax, dword [0x482768]
mov dword [eax + 4], ebx
mov dword [eax], 0x466850
mov eax, dword [0x482774]
mov dword [eax + 4], ebx
mov dword [eax], 0x46685c
mov eax, ebx
call fcn.00466868
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x415950]
call fcn.004030cc
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x415950]
call fcn.004030cc
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x415950]
call fcn.004030cc
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x415950]
call fcn.004030cc
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x415950]
call fcn.004030cc
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x462c84
push eax
push 0
push 0
mov eax, dword [0x4828c8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x421fc4]
call fcn.00423408
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x421fc4]
call fcn.00423408
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x421fc4]
call fcn.00423408
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00466c88
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x466b64
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x466b64
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x466b64
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4665fb
call fcn.004034a0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x466948
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x466af3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x466ad4
mov dl, 1
mov eax, dword [0x415fb4]
call fcn.004030cc
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403e74
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x466ac3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004543d0
test al, al
je 0x466ab6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x466b04
lea eax, [ebp - 0x254]
call fcn.00408b20
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x466ab6
xor eax, eax
push ebp
push 0x466aaf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x466b3c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x466a98
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040e4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x466a98
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004040e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466ab6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4669b9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041a590
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466afa
lea eax, [ebp - 0x260]
call fcn.00403e74
ret

Function at 0x467428
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x483bc0]
cmp byte [eax + 0xa5], 0
jne 0x467499
cmp dword [0x483bd8], 0
jne 0x46745a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4673e4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x483bd8], eax
cmp dword [0x483bd4], 0
jne 0x467475
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x483bd4], eax
cmp dword [0x483bdc], 0
jne 0x467499
push esp
push 0
push 0
push 0x467388
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x483bdc], eax
pop edx
ret
Function at 0x467590
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4675a7
add esp, 0xfffffff0
call fcn.00403448
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00420590
mov eax, dword [0x4828b4]
cmp word [eax + 2], 0
jne 0x4675cf
mov eax, dword [0x4828b4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00468c68
mov eax, dword [0x48296c]
cmp word [eax + 2], 0
jne 0x4675e9
mov eax, dword [0x48296c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00468e60
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415950]
call fcn.004030cc
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415950]
call fcn.004030cc
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x422774]
call fcn.004285a8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x467770
mov eax, dword [0x4827cc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00428978
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x469400
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4827cc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c264
test eax, eax
je 0x4676de
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408500
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c28c
test eax, eax
je 0x4676f2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004040e4
mov eax, dword [0x4826c0]
cmp byte [eax], 0
jne 0x467726
mov eax, ebx
call fcn.00467898
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004695dc
mov eax, ebx
call fcn.00469fa0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x467766
call fcn.004034a0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x467b18
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x483bc0]
cmp dword [eax + 0x30], 0
je 0x467bc2
cmp dword [ebx + 0x94], 0
jne 0x467bbc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x467aa8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x467bbc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x467b82
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x467bbc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004181a0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x467b91
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x468724
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x468759
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f64
jmp 0x468766
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403ec8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4697b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4697f9
mov eax, esi
call fcn.0044f954
test al, al
je 0x4697f9
mov eax, dword [ebx + 0x84]
call fcn.0044f650
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4697f9
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044f650
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x46ba6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
xor edx, edx
xor ecx, ecx
push ebx
push esi
push edi
mov esi, 0x47effc
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x4c
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 0xd], 0x4d
mov byte [ebp - 0xc], 0x48
mov byte [ebp - 0xb], 0x31
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
call fcn.0046b95d
test eax, eax
jne 0x46bc2d
mov eax, 0x753c
jmp 0x46bc59
add al, 0x30
mov byte [ebp - 0xb], al
push 0x1388
push dword [0x47eff8]
call fcn.0046b143
add esp, 8
sub eax, 1
jb 0x46bb12
sub eax, 0x7f
je 0x46bc1f
sub eax, 0x82
je 0x46bc18
jmp 0x46bc26
push 0
push 0x80
push 3
push 0
push 7
push 0xc0000000
lea edx, [ebp - 0x14]
push edx
call fcn.0046a4c2
add esp, 0x1c
mov edi, eax
cmp edi, 0xffffffff
je 0x46bbe0
push 0
lea eax, [ebp - 4]
push eax
push 0x120
push dword [ebp + 0x10]
push 0x130
push dword [ebp + 0xc]
push 0x860021b4
push edi
call fcn.0046a54b
add esp, 0x20
mov ebx, eax
test ebx, ebx
je 0x46bbc6
call fcn.0046a904
cmp eax, 0x57
jne 0x46bb8c
push edi
call fcn.0046a817
pop ecx
push dword [0x47eff8]
call fcn.0046b013
pop ecx
mov eax, 0x753c
jmp 0x46bc59
push edi
call fcn.0046a817
pop ecx
push dword [0x47eff8]
call fcn.0046b013
pop ecx
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004714aa
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x46bbba
mov eax, ebx
jmp 0x46bc59
xor edx, edx
mov dl, byte [esi]
mov dword [ebp + edx*4 - 0x24], ebx
inc byte [esi]
jmp 0x46bc2d
push edi
call fcn.0046a817
pop ecx
push dword [0x47eff8]
call fcn.0046b013
pop ecx
mov eax, 0x753c
jmp 0x46bc59
call fcn.0046a904
push dword [0x47eff8]
mov ebx, eax
call fcn.0046b013
pop ecx
cmp ebx, 2
jne 0x46bbfc
inc byte [esi]
jmp 0x46bc2d
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x46bc59
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x46bc59
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x46bc59
mov eax, 0x4f1a
jmp 0x46bc59
mov eax, 0x4f1b
jmp 0x46bc59
mov eax, 0x4f1b
jmp 0x46bc59
mov eax, 0x4f1b
jmp 0x46bc59
mov al, byte [esi]
cmp al, 4
jb 0x46badc
cmp byte [esi], 3
jbe 0x46bc3f
mov byte [esi], 1
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x46bc59
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x46bc59
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x46bc59
mov eax, 0x4f1a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e256
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov eax, esi
xor dword [eax], 0x41dfac36
inc ebx
add eax, 4
cmp ebx, 4
jb 0x46e266
mov edx, edi
mov eax, dword [esi + 0x10]
shl edx, 3
add dword [esi + 0x10], edx
shr eax, 3
mov ecx, dword [esi + 0x10]
and eax, 0x3f
cmp ecx, edx
jae 0x46e290
inc dword [esi + 0x14]
mov edx, edi
mov ebx, 0x40
shr edx, 0x1d
sub ebx, eax
add dword [esi + 0x14], edx
cmp ebx, edi
ja 0x46e2e1
push ebx
add eax, esi
push dword [ebp + 0xc]
add eax, 0x18
push eax
call fcn.0046eee3
add esp, 0xc
lea eax, [esi + 0x18]
push eax
push esi
call fcn.0046e379
add esp, 8
jmp 0x46e2d6
mov edx, dword [ebp + 0xc]
add edx, ebx
push edx
push esi
call fcn.0046e379
add esp, 8
add ebx, 0x40
lea ecx, [ebx + 0x3f]
cmp edi, ecx
ja 0x46e2c4
xor eax, eax
jmp 0x46e2e3
xor ebx, ebx
sub edi, ebx
add esi, eax
push edi
mov edx, dword [ebp + 0xc]
add edx, ebx
add esi, 0x18
push edx
push esi
call fcn.0046eee3
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x46ef26
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov byte [eax], 0x52
mov edx, dword [ebp + 0xc]
mov byte [edx + 1], 0x43
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 2], 0x36
mov eax, dword [ebp + 0xc]
mov byte [eax + 3], 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 4], 0xb8
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 4
mov eax, dword [ebp + 0xc]
mov edx, dword [0x47f108]
mov dword [eax + 8], edx
mov ecx, dword [ebp + 0xc]
xor dword [ecx + 8], 0x339effab
mov ebx, 1
mov eax, dword [ebp + 0xc]
add eax, 8
mov edx, dword [eax]
inc ebx
mov dword [eax + 4], edx
mov ecx, dword [0x47f10c]
xor ecx, 0x339effab
add dword [eax + 4], ecx
add eax, 4
cmp ebx, 0x2b
jle 0x46ef82
xor eax, eax
mov edi, eax
mov esi, eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov ebx, eax
cmp dword [ebp - 8], 0x2c
jle 0x46efb7
mov eax, dword [ebp - 8]
jmp 0x46efbc
mov eax, 0x2c
lea edx, [eax + eax*2]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jg 0x46f036
push 3
mov eax, dword [ebp + 0xc]
add esi, dword [eax + ebx*4 + 8]
add esi, edi
push esi
call fcn.0046f299
mov edx, dword [ebp + 0xc]
mov esi, eax
add esp, 8
mov dword [edx + ebx*4 + 8], eax
lea edx, [edi + esi]
push edx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov edx, dword [ecx + eax*4]
add edx, esi
add edi, edx
push edi
call fcn.0046f299
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov edi, eax
add esp, 8
mov dword [ecx + edx*4], eax
lea eax, [ebx + 1]
cdq
mov ecx, 0x2c
idiv ecx
mov eax, dword [ebp - 0xc]
mov ebx, edx
inc eax
cdq
idiv dword [ebp - 8]
mov dword [ebp - 0xc], edx
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jle 0x46efd1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46f16a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0x10], 0xf
je 0x46f183
mov eax, 1
jmp 0x46f292
cmp dword [ebp + 0x10], 0
je 0x46f290
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx]
add dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
add dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
add dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebp - 0xc], edx
add dword [ebp + 0xc], 4
sub dword [ebp + 0x10], 0x10
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 8]
sub edi, dword [ecx + 0xb4]
sub ebx, dword [eax + 0xb0]
mov dword [ebp - 0x10], 0x14
mov edx, dword [ebp + 8]
lea ecx, [edx + 0xac]
mov dword [ebp - 0x14], ecx
mov eax, ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edi
mov edi, esi
mov esi, eax
push 5
mov eax, dword [ebp - 0xc]
add eax, eax
inc eax
imul dword [ebp - 0xc]
push eax
call fcn.0046f299
mov edx, esi
add esp, 8
add edx, edx
mov dword [ebp - 8], eax
inc edx
push 5
imul edx, esi
push edx
call fcn.0046f299
add esp, 8
mov dword [ebp - 4], eax
push dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
sub edi, dword [ecx]
push edi
call fcn.0046f2bc
add esp, 8
xor eax, dword [ebp - 8]
mov edi, eax
push dword [ebp - 8]
mov eax, dword [ebp - 0x14]
sub ebx, dword [eax - 4]
push ebx
call fcn.0046f2bc
xor eax, dword [ebp - 4]
dec dword [ebp - 0x10]
add dword [ebp - 0x14], 0xfffffff8
add esp, 8
mov ebx, eax
cmp dword [ebp - 0x10], 0
jg 0x46f1dd
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0xc]
sub dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
sub esi, dword [eax + 8]
mov dword [edx], ebx
add dword [ebp + 0x14], 4
mov ecx, dword [ebp + 0x14]
mov dword [ecx], esi
add dword [ebp + 0x14], 4
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
add dword [ebp + 0x14], 4
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [edx], ecx
add dword [ebp + 0x14], 4
cmp dword [ebp + 0x10], 0
jne 0x46f18d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473d6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb4
mov byte [esp], 0x4f
mov byte [esp + 2], 0x4c
mov byte [esp + 4], 0x44
mov byte [esp + 6], 0x47
mov byte [esp + 8], 0x45
mov byte [esp + 0xa], 0x45
mov byte [esp + 1], 0x4c
mov byte [esp + 3], 0x59
mov byte [esp + 5], 0x42
mov byte [esp + 7], 0x2e
mov byte [esp + 9], 0x58
mov byte [esp + 0xb], 0
mov byte [esp + 0xc], 0x44
mov byte [esp + 0xe], 0x50
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x12], 0x53
mov byte [esp + 0x14], 0x45
mov byte [esp + 0x16], 0x45
mov byte [esp + 0xd], 0x45
mov byte [esp + 0xf], 0x45
mov byte [esp + 0x11], 0x44
mov byte [esp + 0x13], 0x2e
mov byte [esp + 0x15], 0x58
mov byte [esp + 0x17], 0
mov byte [esp + 0x18], 0x57
mov byte [esp + 0x1a], 0x32
mov byte [esp + 0x1c], 0x41
mov byte [esp + 0x1e], 0x4d
mov byte [esp + 0x20], 0x45
mov byte [esp + 0x22], 0x45
mov byte [esp + 0x19], 0x33
mov byte [esp + 0x1b], 0x44
mov byte [esp + 0x1d], 0x53
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x21], 0x58
mov byte [esp + 0x23], 0
push 0
push 2
call fcn.0046aa8a
add esp, 8
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x473e43
xor eax, eax
jmp 0x473f5b
mov dword [esp + 0x24], 0x128
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.0046ab38
add esp, 8
test eax, eax
jne 0x473e6b
push ebx
call fcn.0046a817
pop ecx
xor eax, eax
jmp 0x473f5b
call fcn.0046a97a
cmp eax, dword [esp + 0x2c]
jne 0x473e7a
mov esi, dword [esp + 0x3c]
lea eax, [esp + 0x24]
push eax
push ebx
call fcn.0046abbe
add esp, 8
test eax, eax
jne 0x473e6b
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.0046ab38
add esp, 8
test eax, eax
jne 0x473eac
push ebx
call fcn.0046a817
pop ecx
xor eax, eax
jmp 0x473f5b
cmp esi, dword [esp + 0x2c]
jne 0x473f39
lea edx, [esp + 0x48]
push edx
call fcn.0046a1c9
pop ecx
lea ecx, [esp + 0x48]
push ecx
call fcn.0046a1a6
pop ecx
push esp
call fcn.0046a1c9
pop ecx
lea eax, [esp + 0xc]
push eax
call fcn.0046a1c9
pop ecx
lea edx, [esp + 0x18]
push edx
call fcn.0046a1c9
pop ecx
push 0xc
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x50]
push eax
call fcn.0046a15d
add esp, 0xc
mov edi, eax
push 0xc
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x50]
push edx
call fcn.0046a15d
add esp, 0xc
mov ebp, eax
push 0xd
lea eax, [esp + 0x1c]
push eax
lea edx, [esp + 0x50]
push edx
call fcn.0046a15d
add esp, 0xc
test edi, edi
je 0x473f35
test ebp, ebp
je 0x473f35
test eax, eax
jne 0x473f39
xor eax, eax
jmp 0x473f5b
lea edx, [esp + 0x24]
push edx
push ebx
call fcn.0046abbe
add esp, 8
test eax, eax
jne 0x473eac
push ebx
call fcn.0046a817
pop ecx
mov eax, 1
add esp, 0x14c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47408b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push es
mov ax, 0x101f
mov es, eax
xor eax, eax
mov esi, eax
mov ecx, 0x8000
xor al, byte es:[esi]
inc esi
loop 0x4740a0
pop es
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x4740b4
mov byte [ebp - 1], 0x55
mov al, byte [ebp - 1]
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop esi
pop ecx
pop ebp
ret
Function at 0x47ab32
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff18
push ebx
push esi
cmp dword [ebp + 0xc], 0x40
jle 0x47ab8b
lea eax, [ebp - 0xe8]
push eax
call fcn.0046e22b
pop ecx
lea edx, [ebp - 0xe8]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
call fcn.0046e256
add esp, 0xc
lea ecx, [ebp - 0xe8]
push ecx
lea eax, [ebp - 0x90]
push eax
call fcn.0046e2ff
add esp, 8
lea edx, [ebp - 0x90]
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], 0x10
xor eax, eax
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x80]
xor ebx, ebx
mov byte [edx], bl
mov byte [ecx], bl
inc eax
inc ecx
inc edx
cmp eax, 0x40
jl 0x47ab93
xor eax, eax
lea esi, [ebp - 0x40]
lea ecx, [ebp - 0x80]
mov edx, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jge 0x47abc0
mov bl, byte [edx]
mov byte [ecx], bl
mov byte [esi], bl
inc eax
inc esi
inc ecx
inc edx
cmp eax, dword [ebp + 0xc]
jl 0x47abb1
xor eax, eax
lea ecx, [ebp - 0x80]
lea edx, [ebp - 0x40]
jmp 0x47abcb
xor byte [edx], 0x36
xor byte [ecx], 0x5c
inc eax
inc ecx
inc edx
cmp eax, 0x40
jl 0x47abc8
lea eax, [ebp - 0xe8]
push eax
call fcn.0046e22b
pop ecx
push 0x40
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0xe8]
push ecx
call fcn.0046e256
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov ecx, edx
lea edx, [ebp - 0xe8]
xor eax, eax
jmp 0x47ac0b
mov ebx, dword [edx]
mov dword [ecx], ebx
inc eax
add ecx, 4
add edx, 4
cmp eax, 4
jl 0x47ac08
lea eax, [ebp - 0xe8]
push eax
call fcn.0046e22b
pop ecx
push 0x40
lea edx, [ebp - 0x80]
push edx
lea ecx, [ebp - 0xe8]
push ecx
call fcn.0046e256
mov edx, dword [ebp + 0x10]
add esp, 0xc
xor eax, eax
lea ecx, [edx + 0x10]
lea edx, [ebp - 0xe8]
jmp 0x47ac4e
mov ebx, dword [edx]
mov dword [ecx], ebx
inc eax
add ecx, 4
add edx, 4
cmp eax, 4
jl 0x47ac4b
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000b080
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
cmp dword [edx + 0x14], 8
mov edi, dword [edx + 0x10]
jb 0x1000b093
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add edi, edi
je 0x1000b0b1
mov edi, edi
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x1000b0a0
push 0x1f31d
and esi, 0x7fffffff
push esi
call fcn.100b67b5
imul ecx, eax, 0xb14
add esp, 8
imul edx, edx, 0x41a7
sub edx, ecx
lea eax, [edx + 0x7fffffff]
js 0x1000b0dd
mov eax, edx
pop edi
pop esi
pop ebp
ret 4