joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c02d60
Capabilities:
Reference sql statements

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push str.SELECT_user_name_FROM_SYSUSERPERMS_WHERE_user_id____SELECT_FIRST_creator_FROM_SYSTABLE_WHERE_table_name__RowGenerator__
push ecx
call fcn.04c02c80
add esp, 0xc
ret

Function at 0x4c02d80
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0x80
push 0x80
lea eax, [esp + 4]
push str.SELECT_IF_EXISTS__SELECT_1_FROM_SYS.SYSUSERPERMS_WHERE_user_name__rs_systabgroup___THEN_yes_else_no_endif
push eax
mov eax, dword [esp + 0x90]
call fcn.04c02c80
add esp, 0xc
test eax, eax
jne 0x4c02dc7
push 3
lea ecx, [esp + 4]
push 0x4c66394
push ecx
call fcn.04c592b0
add esp, 0xc
test eax, eax
jne 0x4c02dc7
add esp, 0x80
ret
mov eax, 0x64
add esp, 0x80
ret

Function at 0x4c030d0
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
cmp word [ebp + 0x460], 0
jne 0x4c03221
mov eax, dword [ebp + 0x80]
push ebx
push eax
lea ecx, [ebp + 0x84]
mov ebx, 4
push ecx
mov word [ebp + 0x460], 0x13
mov word [ebp + 0x462], bx
mov word [ebp + 0x464], 0xa
mov word [ebp + 0x466], bx
call fcn.04c1e4d0
push ebp
call fcn.04c01430
add esp, 0xc
test eax, eax
jl 0x4c03220
push esi
push edi
mov edi, 1
mov ecx, ebp
call fcn.04c011a0
mov esi, eax
mov eax, dword [esi + 4]
push eax
lea edx, [esp + 0x24]
mov ebx, 5
mov edi, 2
push esi
mov word [eax + 4], bx
mov dword [eax + 0x20], edx
mov dword [eax + 8], edi
call fcn.04c1e190
mov eax, dword [esi + 4]
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x1c]
push esi
mov word [eax + 4], bx
mov dword [eax + 0x20], ecx
mov dword [eax + 8], edi
call fcn.04c1e190
mov eax, dword [esi + 4]
add esp, 0x10
mov ecx, edi
dec ecx
mov eax, dword [eax]
jne 0x4c03184
push eax
lea edx, [esp + 0x18]
push esi
mov word [eax + 4], bx
mov dword [eax + 0x20], edx
mov dword [eax + 8], edi
call fcn.04c1e190
mov eax, dword [esi + 4]
add esp, 8
mov ecx, 3
lea esp, [esp]
dec ecx
mov eax, dword [eax]
jne 0x4c031b0
push eax
lea ecx, [esp + 0x1c]
push esi
mov word [eax + 4], bx
mov dword [eax + 0x20], ecx
mov dword [eax + 8], edi
call fcn.04c1e190
push 0xfffffffffffffffd
push str.SELECT__SELECT_width_FROM_SYS.SYSUSERTYPE_WHERE_type_name__money___SELECT_scale_FROM_SYS.SYSUSERTYPE_WHERE_type_name__money___SELECT_width_FROM_SYS.SYSUSERTYPE_WHERE_type_name__smallmoney___SELECT_scale_FROM_SYS.SYSUSERTYPE_WHERE_type_name__smallmoney__FROM_SYS.DUMMY
push esi
push ebp
call fcn.04c02470
add esp, 0x18
test eax, eax
jne 0x4c0320f
mov dx, word [esp + 0x20]
mov ax, word [esp + 0x10]
mov cx, word [esp + 0x14]
mov word [ebp + 0x460], dx
mov dx, word [esp + 0x18]
mov word [ebp + 0x462], ax
mov word [ebp + 0x464], cx
mov word [ebp + 0x466], dx
push esi
call fcn.04c1e360
push esi
call fcn.04c17330
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret
Function at 0x4c1de60
Capabilities:
Delete registry key
Delete registry value

Disassembly:
sub esp, 0x804
push esi
push edi
mov ecx, 7
mov esi, str.SOFTWAREODBCODBCINST.INI_
lea edi, [esp + 0x40c]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x40c]
mov byte [esp + eax + 0xc], cl
inc eax
test cl, cl
jne 0x4c1de80
lea edi, [esp + 0xc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4c1de95
mov eax, dword [str.ODBC_Drivers]
mov ecx, dword [0x4c6a7f4]
mov edx, dword [0x4c6a7f8]
mov dword [edi], eax
mov al, byte [0x4c6a7fc]
mov dword [edi + 4], ecx
lea ecx, [esp + 8]
push ecx
push 0xf003f
mov dword [edi + 8], edx
push 0
lea edx, [esp + 0x18]
push edx
push 0x80000002
mov byte [edi + 0xc], al
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4c1deec
pop edi
mov eax, 0x8000ffff
pop esi
add esp, 0x804
ret
mov ecx, 7
mov esi, 0x4c6a7d0
lea edi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x4c1dede
mov cl, byte [esp + eax + 0x40c]
mov byte [esp + eax + 0xc], cl
inc eax
test cl, cl
jne 0x4c1df11
lea edi, [esp + 0xc]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4c1df26
mov ecx, 7
mov esi, 0x4c6a7d0
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0xc]
push edx
push 0x80000002
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
pop edi
and eax, 0x8000ffff
pop esi
add esp, 0x804
ret
Function at 0x4c1df60
Capabilities:
Set registry value

Disassembly:
sub esp, 0x908
call sym.dbodbc8.dll__DllUnregisterServer
mov ecx, dword [0x4c81254]
push 0x103
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c1df92
mov eax, 0x8000ffff
add esp, 0x908
ret
push ebx
push ebp
push esi
push edi
mov ecx, 7
mov esi, str.SOFTWAREODBCODBCINST.INI_
lea edi, [esp + 0x518]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
jmp 0x4c1dfb0
mov cl, byte [esp + eax + 0x518]
mov byte [esp + eax + 0x118], cl
inc eax
test cl, cl
jne 0x4c1dfb0
lea edi, [esp + 0x118]
dec edi
jmp 0x4c1dfd0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4c1dfd0
mov edx, dword [str.ODBC_Drivers]
mov eax, dword [0x4c6a7f4]
mov ecx, dword [0x4c6a7f8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0
mov dword [edi], edx
mov dl, byte [0x4c6a7fc]
mov dword [edi + 4], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
mov dword [edi + 8], ecx
push 0
lea ecx, [esp + 0x134]
push ecx
push 0x80000002
mov byte [edi + 0xc], dl
call ebx
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xa
push str.Installed
push 1
push 0
push 0x4c6a7d0
push edx
call ebp
xor eax, eax
jmp 0x4c1e050
mov cl, byte [esp + eax + 0x518]
mov byte [esp + eax + 0x118], cl
inc eax
test cl, cl
jne 0x4c1e050
lea edi, [esp + 0x118]
dec edi
jmp 0x4c1e070
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4c1e070
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov ecx, 7
mov esi, 0x4c6a7d0
rep movsd dword es:[edi], dword [esi]
push 0xf003f
push 0
push 0
push 0
lea ecx, [esp + 0x134]
push ecx
push 0x80000002
movsb byte es:[edi], byte [esi]
call ebx
lea eax, [esp + 0x14]
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4c1e0b0
sub eax, ecx
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
push esi
lea edx, [esp + 0x18]
push edx
push 1
push 0
push str.Driver
push eax
call ebp
mov edx, dword [esp + 0x10]
push esi
lea ecx, [esp + 0x18]
push ecx
push 1
push 0
push str.Setup
push edx
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x908
ret
Function at 0x4c2e300
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov ecx, dword [ebp + 0x38]
mov ebx, eax
mov ax, word [ecx + 0xa]
mov word [esp + 0x10], ax
xor eax, eax
mov ax, word [ecx + 6]
cmp bx, ax
mov dword [esp + 0x14], eax
jne 0x4c2e32e
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
mov edx, dword [ecx + 0xc]
push esi
push edi
movzx edi, ax
movzx esi, bx
imul edi, edx
imul esi, edx
add edi, 0x10
add esi, 0x10
cmp bx, ax
mov dword [esp + 0x14], edx
jbe 0x4c2e3ee
mov eax, dword [ebp + 4]
mov ebp, esi
sub ebp, edi
test esi, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ebp
je 0x4c2e47f
mov eax, dword [eax + 8]
lea eax, [eax + eax*2]
cdq
sub eax, edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0xc]
sar eax, 1
add edx, ebp
cmp edx, eax
jg 0x4c2e47f
push esi
push ecx
call fcn.04c34000
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4c2e47f
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0xc]
mov ecx, dword [esp + 0x18]
add edx, ecx
mov dword [eax + 0xc], edx
mov edx, ecx
shr ecx, 2
xor eax, eax
add edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov dword [ebp + 0xc], eax
mov esi, edi
mov eax, ebp
call fcn.04c2e1a0
lea esi, [ebx - 1]
mov edx, edi
mov word [ebp + 6], bx
call fcn.04c2e080
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword [ecx + 0x38], ebp
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
mov dx, word [ecx]
cmp dx, word [ecx + 6]
jb 0x4c2e47f
mov eax, dword [ebp + 4]
mov ebp, esi
sub ebp, edi
test esi, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ebp
je 0x4c2e47f
mov eax, dword [eax + 8]
lea eax, [eax + eax*2]
cdq
sub eax, edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0xc]
sar eax, 1
add edx, ebp
cmp edx, eax
jg 0x4c2e47f
push esi
push ecx
call fcn.04c34000
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4c2e47f
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0xc]
mov ecx, dword [esp + 0x1c]
add edx, ecx
mov dword [eax + 0xc], edx
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x18]
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
mov dword [ebp + 0xc], eax
mov ecx, ebx
mov eax, ebp
call fcn.04c2e0b0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword [ecx + 0x38], ebp
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
Function at 0x4c2f660
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x4c81338]
push edi
xor edi, edi
cmp eax, edi
jne 0x4c2f698
mov dword [0x4c81338], 1
call fcn.04c37f40
push edi
mov dword [0x4c81328], edi
mov dword [0x4c8132c], edi
mov dword [0x4c81330], edi
call fcn.04c2f450
add esp, 4
pop edi
ret
push esi
call fcn.04c37f80
mov esi, eax
cmp esi, edi
jne 0x4c2f6af
push edi
call fcn.04c2f450
add esp, 4
mov esi, eax
mov eax, dword [0x4c8132c]
cmp eax, esi
jne 0x4c2f6c1
mov ecx, dword [0x4c81330]
inc ecx
jmp 0x4c2f6db
push esi
push 0x4c81328
call fcn.04c2f370
mov eax, esi
add esp, 8
mov dword [0x4c8132c], eax
mov ecx, 1
mov esi, dword [0x4c81338]
inc esi
dec ecx
mov dword [0x4c81338], esi
pop esi
mov dword [0x4c81330], ecx
jne 0x4c2f707
mov dword [0x4c8132c], edi
push 0x4c81328
mov edi, eax
call fcn.04c2f3e0
add esp, 4
pop edi
ret
Function at 0x4c354a0
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x4c81bc4]
test eax, eax
jne 0x4c35550
push esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
shr ecx, 0x1f
not ecx
and ecx, 1
movzx edx, al
movzx esi, ah
je 0x4c354d0
shr eax, 0x10
and eax, 0xffff7fff
jmp 0x4c354d2
xor eax, eax
test ecx, ecx
mov dword [0x4c81bb8], edx
mov dword [0x4c81bbc], esi
mov dword [0x4c81bc0], eax
mov dword [0x4c81bb4], ecx
je 0x4c35508
mov dword [0x4c81bb0], 6
mov dword [0x4c81bc4], 1
pop esi
mov eax, 0x4c81bb0
ret
cmp edx, 4
jne 0x4c3553b
test esi, esi
jne 0x4c3552c
mov dword [0x4c81bb0], 3
mov dword [0x4c81bc4], 1
pop esi
mov eax, 0x4c81bb0
ret
cmp esi, 0xa
mov dword [0x4c81bb0], 4
je 0x4c35545
mov dword [0x4c81bb0], 5
mov dword [0x4c81bc4], 1
pop esi
mov eax, 0x4c81bb0
ret

Function at 0x4c37b20
Capabilities:
Get hostname

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xc]
mov byte [esi], 0
push ecx
mov byte [esi + edi - 1], 0
mov dword [esp + 0x24], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x4c37b61
dec edi
push edi
lea edx, [esp + 0xc]
push edx
push esi
call fcn.04c59760
add esp, 0xc
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x4c38be0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xd0
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
mov ebx, 0x4c7fa7c
jmp 0x4c38c00
mov ecx, 0xa
mov esi, str.SoftwareSybaseAdaptive_Server_Anywhere
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4c38c16
mov ax, word [0x4c6d78c]
mov word [edi], ax
mov eax, dword [esp + 0xe4]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c38c30
lea edi, [esp + 0x18]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4c38c40
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebx]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push eax
call ebp
test eax, eax
jne 0x4c38cba
mov edx, dword [esp + 0xec]
lea ecx, [esp + 0xf0]
push ecx
mov ecx, dword [esp + 0xec]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4c38cba
mov ecx, dword [esp + 0xf4]
cmp dword [esp + 0x14], ecx
je 0x4c38cd6
add ebx, 4
cmp ebx, 0x4c7fa84
jl 0x4c38c00
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xd0
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xd0
ret
Function at 0x4c394f0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
mov eax, str.Unknown_error
je 0x4c39500
mov eax, esi
push 0
push str.SQLAnywhere_Fatal_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
test esi, esi
je 0x4c3951d
push esi
call fcn.04c5acd1
add esp, 4
push 1
call fcn.04c5d010
pop esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4c39530
Capabilities:
Encode data using xor

Disassembly:
push ecx
xor ecx, ecx
cmp edi, ecx
mov byte [esp + 3], cl
jbe 0x4c3956a
push ebx
push ebp
lea ecx, [ecx]
xor edx, edx
mov eax, ecx
mov ebp, 0xe
div ebp
mov bl, byte [ecx + esi]
mov al, byte [edx + 0x4c6dc88]
mov dl, byte [esp + 0xb]
xor al, bl
xor al, dl
mov byte [ecx + esi], al
inc ecx
cmp ecx, edi
mov byte [esp + 0xb], bl
jb 0x4c39540
pop ebp
pop ebx
pop ecx
ret
Function at 0x4c3a4f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x114
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, dword [esp + 0x124]
mov ebp, ecx
push ebx
push ebx
push esi
mov dword [ebp], 0x4c6de70
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x24], ebx
call fcn.04c37480
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp + 4], eax
je 0x4c3a55f
push eax
call fcn.04c37440
lea edx, [esp + 0x1c]
add esp, 4
mov dword [ebp + 4], 0xffffffff
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4c3a550
jmp 0x4c3a623
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push esi
call fcn.04c32e40
add esp, 0xc
call fcn.04c5a72f
mov dword [eax], ebx
cmp byte [esp + 0x18], bl
jne 0x4c3a623
cmp dword [esp + 0x128], ebx
je 0x4c3a610
lea edx, [esp + 0xc]
push edx
push 0x20019
push ebx
push str.SoftwareODBCODBC.INIODBC_File_DSN
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c3a610
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
push str.DefaultDSNDir
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4c3a5e6
push edi
lea edi, [esp + 0x1c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x4c3a5f5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
jmp 0x4c3a623
push 0x104
lea edx, [esp + 0x1c]
push edx
push esi
call fcn.04c332e0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call fcn.04c35c80
add esp, 4
mov dword [ebp + 0x10], eax
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x114
ret 0xc
Function at 0x4c418e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
push esi
push str.SQLAny_Default_MUTEX
xor esi, esi
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ebp, eax
test ebp, ebp
je 0x4c41988
push 0xffffffffffffffff
push ebp
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4c41981
push ebx
push str.SQLAny_Default
push eax
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ebx, eax
test ebx, ebx
je 0x4c41979
push edi
push esi
push esi
push esi
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x4c41971
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c41940
sub eax, edx
inc eax
push eax
call fcn.04c33f80
mov esi, eax
add esp, 4
test esi, esi
je 0x4c4196a
mov edx, esi
mov eax, edi
sub edx, edi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4c41960
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push ebp
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4c4e740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
test byte [esi + 0x18], 1
mov dword [esi], 0x4c6ecc0
jne 0x4c4e754
call fcn.04c4e6c0
push ebx
mov bx, word [esi + 0xb0]
push ebp
push edi
mov edi, dword [esi + 0xac]
lea ebp, [edi + 0xc34]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, bx
push ebp
mov dword [edi + eax*4 + 0x834], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
lea ecx, [edi + 0x14]
call fcn.04c4d8d0
mov ecx, dword [esi + 0x80]
push ecx
call fcn.04c4ec70
mov eax, dword [esi + 0x78]
add esp, 4
test eax, eax
je 0x4c4e7ac
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [esi + 0xa8]
mov edx, dword [edi + 0x20]
add edx, 0x18
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, edi
call fcn.04c4de70
mov eax, dword [esi + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xa4]
test eax, eax
pop edi
pop ebp
pop ebx
je 0x4c4e7ef
mov ecx, dword [esi + 0xb8]
mov ecx, dword [ecx + 0x10]
push eax
add ecx, 0xc
call fcn.04c49ac0
mov ecx, dword [esi + 0x8c]
test ecx, ecx
lea eax, [esi + 0x8c]
je 0x4c4e806
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, esi
pop esi
jmp fcn.04c43de0

Function at 0x4c52a60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov dword [esp], ecx
mov dword [eax + 0x10], eax
mov eax, dword [esp + 0x10]
push esi
xor esi, esi
mov dword [eax + 8], esi
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0xc], esi
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x1c]
mov ecx, dword [eax + 0x10]
push 1
call fcn.04c49690
mov ecx, eax
cmp ecx, esi
je 0x4c52b63
mov eax, dword [ecx + 0x14]
mov word [eax + 2], si
mov word [eax], si
mov edx, dword [esp + 0x14]
mov dword [edx + 0x18], ecx
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 0x1c]
add edx, 0xc4
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
lock xadd dword [edx], eax
mov dword [esp + 8], eax
xor eax, eax
mov ax, word [ecx + 0x10]
cmp ax, si
je 0x4c52aeb
mov edx, dword [ecx + 0x14]
sub ax, word [edx + 2]
sub eax, 5
jmp 0x4c52aed
xor eax, eax
mov ecx, dword [ecx + 0x14]
mov dx, word [ecx + 2]
mov esi, dword [esp + 0x14]
push 0x4c52960
movzx edx, dx
movzx eax, ax
push esi
add edx, eax
push edx
add ecx, 5
push ecx
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x4c52b6f
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x1c]
add eax, 0xc4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xffffffff
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
lock xadd dword [edx], eax
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 4]
push ecx
mov ecx, dword [edx + 0x18]
push ecx
mov esi, eax
mov ecx, 0x18fe
call fcn.04c524c0
add esp, 8
mov eax, 4
pop esi
add esp, 0xc
ret 8
xor eax, eax
pop esi
add esp, 0xc
ret 8
Function at 0x4c533a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
mov eax, dword [ebx + 0x24]
push ebp
push esi
mov dword [esp + 0xc], eax
push edi
lea ecx, [ecx]
mov ecx, dword [ebx + 0x64]
mov edx, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub edx, ecx
sub edx, esi
jne 0x4c533ce
test ecx, ecx
jne 0x4c533dd
test esi, esi
jne 0x4c533dd
mov edx, eax
jmp 0x4c5345a
cmp edx, 0xffffffff
jne 0x4c533dd
mov edx, 0xfffffffe
jmp 0x4c5345a
mov esi, dword [ebx + 0x24]
lea esi, [eax + esi - 0x106]
cmp ecx, esi
jb 0x4c5345a
mov edi, dword [ebx + 0x30]
mov ecx, eax
mov ebp, ecx
shr ecx, 2
lea esi, [edi + eax]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x68]
mov esi, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x54]
sub edi, eax
sub esi, eax
sub ecx, eax
mov dword [ebx + 0x68], edi
mov edi, dword [ebx + 0x44]
mov dword [ebx + 0x54], ecx
mov ecx, dword [ebx + 0x3c]
mov dword [ebx + 0x64], esi
lea esi, [ecx + edi*2]
movzx ecx, word [esi - 2]
sub esi, 2
cmp ecx, eax
jb 0x4c53431
sub ecx, eax
jmp 0x4c53433
xor ecx, ecx
dec edi
mov word [esi], cx
jne 0x4c53422
mov ecx, dword [ebx + 0x38]
mov edi, eax
lea esi, [ecx + eax*2]
movzx ecx, word [esi - 2]
sub esi, 2
cmp ecx, eax
jb 0x4c53450
sub ecx, eax
jmp 0x4c53452
xor ecx, ecx
dec edi
mov word [esi], cx
jne 0x4c53441
add edx, eax
mov ebp, dword [ebx]
mov ecx, dword [ebp + 4]
test ecx, ecx
je 0x4c53521
mov esi, dword [ebx + 0x64]
mov edi, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
add edi, esi
add edi, ecx
mov ecx, dword [ebp + 4]
mov esi, ecx
cmp esi, edx
mov dword [esp + 0xc], esi
jbe 0x4c53487
mov dword [esp + 0xc], edx
mov esi, edx
test esi, esi
jne 0x4c5348f
xor ecx, ecx
jmp 0x4c534dd
mov edx, dword [ebp + 0x1c]
sub ecx, esi
mov dword [ebp + 4], ecx
mov ecx, dword [edx + 0x18]
test ecx, ecx
jne 0x4c534b6
mov eax, dword [ebp]
mov ecx, dword [ebp + 0x30]
push esi
push eax
push ecx
call fcn.04c550a0
mov dword [ebp + 0x30], eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, esi
mov esi, dword [ebp]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xc]
mov esi, dword [ebp]
mov edx, dword [ebp + 8]
add esi, ecx
add edx, ecx
mov dword [ebp], esi
mov dword [ebp + 8], edx
mov edx, dword [ebx + 0x6c]
add edx, ecx
mov edi, edx
cmp edi, 3
mov dword [ebx + 0x6c], edx
jb 0x4c5350c
mov ecx, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
lea esi, [ecx + edx]
movzx edx, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], edx
shl edx, cl
movzx ecx, byte [esi + 1]
xor edx, ecx
and edx, dword [ebx + 0x4c]
mov dword [ebx + 0x40], edx
cmp edi, 0x106
jae 0x4c53521
mov edx, dword [ebx]
mov ecx, dword [edx + 4]
test ecx, ecx
jne 0x4c533b0
pop edi
pop esi
pop ebp
add esp, 8
ret