joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49af20
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x4a9d00
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x19]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [ebx + 4]
push edx
push ecx
push eax
call fcn.004a6f8a
add esp, 0x10
mov dword [esi + 8], esp
lea ebx, [esi + 0x20]
mov dword [ebx + 8], edi
mov dword [ebx + 4], edi
mov dword [ebx], edi
mov byte [ebx + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.00496030
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0xd
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.004acc2e
add esp, 0x1c
mov esp, dword [esi + 8]
lea edi, [esi + eax]
add edi, 0x20
push dword [ebp + 0x10]
push edi
push ebx
call fcn.0049a8aa
add esp, 0xc
mov dword [esi + 8], eax
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x30]
movdqu xmmword [ebx + 0x1e], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0049210a
lea eax, [esi + 0x70]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push edi
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.0049c350
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x49b05a
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x78], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.0049b940
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x49b100
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 0xa8], ebp
lea ecx, [esi + 0xb0]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x4a9d10
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x19]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x20]
push dword [ebx + 4]
push edx
push ecx
push eax
call fcn.004a6f8a
add esp, 0x10
mov dword [esi + 8], esp
lea eax, [esi + 0x20]
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [eax], xmm0
mov ebx, eax
sub esp, 0x20
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.00496030
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0x18
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.004acc2e
add esp, 0x20
mov esp, dword [esi + 8]
lea ebx, [esi + eax]
add ebx, 0x20
push dword [ebp + 0x10]
push ebx
lea eax, [esi + 0x20]
push eax
call fcn.0049a8aa
add esp, 0xc
mov dword [esi + 8], eax
lea edi, [esi + 0x40]
pcmpeqd xmm0, xmm0
movdqu xmmword [edi + 0x4a], xmm0
movdqa xmmword [edi + 0x40], xmm0
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0049210a
lea eax, [esi + 0xb0]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push edi
push ebx
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.0049c350
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x49b262
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0xb8], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xb8], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x40]
push eax
push dword [ebp + 0xc]
push edi
call fcn.0049b940
add esp, 0x1c
mov eax, dword [esi + 0xb0]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x49ed08
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004a9adc
mov edx, eax
test ebx, ebx
je 0x49ed2f
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 0x10]
je 0x49ed3a
movzx eax, word [eax]
jmp 0x49ed51
xor ecx, ecx
test dl, dl
je 0x49ed64
jmp 0x49edf8
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
mov byte [ebp - 0x10], dl
call dword [section..00cfg]
mov ecx, ebx
call edi
mov dl, byte [ebp - 0x10]
xor edi, edi
cmp ax, 0xffff
sete al
je 0x49ed5e
mov edi, ebx
mov ecx, edi
cmp dl, al
je 0x49edde
mov edi, dword [esi]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
mov dword [ebp - 0x10], ecx
je 0x49ed76
movzx edi, word [eax]
jmp 0x49ed89
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
mov edi, eax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [section..00cfg]
movzx eax, di
mov ecx, ebx
push eax
push 8
call esi
test al, al
je 0x49edd8
mov esi, dword [ebp + 8]
mov edi, dword [esi]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
mov ebx, dword [ebp - 0x10]
je 0x49edc2
add eax, 2
mov dword [edi + 0xc], eax
jmp 0x49ed15
mov eax, dword [edi]
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
jmp 0x49ed12
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004a9adc
mov ebx, eax
test edi, edi
je 0x49ee01
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
je 0x49ee07
movzx eax, word [eax]
jmp 0x49ee18
mov ecx, esi
call fcn.004a9adc
mov ebx, eax
test bl, bl
jne 0x49ee23
jmp 0x49ee29
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
cmp ax, 0xffff
sete al
xor bl, al
jne 0x49ee29
mov eax, dword [ebp + 0x10]
or byte [eax], 2
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x4ad264
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.005dc726
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x4ad2b0
push ecx
push ecx
call fcn.005ebc4a
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4ad2a3
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x4ae2a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x6852b8]
test ebx, ebx
jne 0x4ae336
push 0x24
call fcn.005dc726
add esp, 4
mov esi, eax
mov dword [eax + 4], 0
mov dword [eax], 0
push 0xc
call fcn.005dc726
add esp, 4
mov dword [esi + 8], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x10], ecx
mov dword [eax + 8], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [esi + 0xc], ecx
lea eax, [esi + 0x18]
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], 1
mov dword [0x6852b8], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x4ae340
mov edi, eax
push eax
call fcn.005f8ba4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.004ae350
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
int3
Function at 0x4ae350
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x674014]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea ebx, [ebp - 0x20]
push 3
push ecx
push eax
push ebx
call fcn.004ce5a0
add esp, 0x10
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4ae47b
mov edi, dword [ebp - 0x20]
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [ebp - 0x14], 0
push 0x800
push 0
push str.api_ms_win_downlevel_shell32_l1_1_0.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x24], eax
je 0x4ae3d0
push 0x6247f2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ae3df
mov ecx, eax
call dword [section..00cfg]
lea eax, [ebp - 0x14]
push eax
push edi
call ecx
jmp 0x4ae3db
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
jmp 0x4ae3e1
xor edi, edi
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov eax, dword [ebp - 0x14]
lea eax, [edi + eax*4]
mov ecx, ebx
push eax
push edi
call fcn.004af870
mov ecx, esi
push ebx
call fcn.004adfc0
mov dword [esi], 0
mov dword [esi + 4], 0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4ae42f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x4ae47b
mov eax, dword [ebp - 0x1c]
cmp eax, esi
jne 0x4ae456
mov eax, esi
jmp 0x4ae46f
mov eax, edi
cmp edi, esi
je 0x4ae46c
lea edi, [eax - 0xc]
cmp byte [eax - 1], 0
jns 0x4ae450
push dword [eax - 0xc]
call fcn.005dc756
add esp, 4
jmp 0x4ae450
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], esi
push eax
call fcn.005dc756
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4afbc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [0x6852c0]
xor ebx, ebx
mov ecx, 3
sub ecx, eax
je 0x4afd46
mov edi, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov eax, ebx
mov ebx, dword [ebx*8 + 0x624784]
mov dword [ebp - 0x28], eax
mov eax, dword [eax*8 + 0x624780]
mov byte [ebp - 0x11], bl
lea ecx, [ebx + ebx]
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.005df8f0
add esp, 0xc
mov word [ebp + ebx*2 - 0x1c], 0
movzx eax, byte [ebp - 0x11]
test al, al
mov ecx, dword [ebp - 0x18]
mov edx, eax
mov dword [ebp - 0x2c], ecx
cmovs edx, ecx
cmp edx, edi
jbe 0x4afc60
test al, al
js 0x4afca0
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
jmp 0x4afcb8
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
test edx, edx
je 0x4afcc6
test al, al
lea edi, [ebp - 0x1c]
cmovs edi, dword [ebp - 0x24]
xor ecx, ecx
nop word cs:[eax + eax]
movzx ebx, word [esi + ecx*2]
cmp bx, word [edi + ecx*2]
jne 0x4afc4b
inc ecx
cmp edx, ecx
jne 0x4afc80
jmp 0x4afcc6
push dword [ebp - 0x1c]
call fcn.005dc756
add esp, 4
movzx ecx, byte [0x6852c0]
xor ecx, 3
mov ebx, dword [ebp - 0x28]
inc ebx
cmp ebx, ecx
mov edi, dword [ebp - 0x20]
jb 0x4afbf0
jmp 0x4afd44
test al, al
js 0x4afccf
mov edi, dword [ebp - 0x20]
jmp 0x4afce0
push dword [ebp - 0x24]
call fcn.005dc756
add esp, 4
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
test eax, eax
je 0x4afd46
cmp eax, edi
je 0x4afd46
push 0
push 1
push 0x624798
push edi
push esi
mov ebx, eax
call fcn.004bee90
add esp, 0x14
cmp ebx, edi
ja 0x4afd5a
mov ecx, ebx
sub eax, ebx
sub edi, ebx
cmp edi, eax
cmovae edi, eax
mov eax, dword [ebp + 0xc]
cmp edi, eax
jne 0x4afd44
mov bl, 1
test eax, eax
je 0x4afd46
lea eax, [esi + ecx*2]
xor ecx, ecx
mov esi, dword [ebp + 0xc]
nop word cs:[eax + eax]
movzx edx, word [eax + ecx*2]
mov edi, dword [ebp + 8]
cmp dx, word [edi + ecx*2]
jne 0x4afd44
inc ecx
cmp esi, ecx
jne 0x4afd30
jmp 0x4afd46
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
int3

Function at 0x4b3660
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x4b36b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x4b369a
call fcn.004b63a0
push dword [esi]
call fcn.004d0370
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4b36a9
mov dword [esi], ebx
call fcn.004b63a0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
call fcn.004b3810
lea ecx, [esi + 0x10]
call fcn.0050b380
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 0
mov al, byte [ebp + 0xc]
mov byte [esi + 0x19], al
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x4b36e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.004c9d50
mov dword [esi], 0
test eax, eax
je 0x4b3742
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
inc ecx
cmp ecx, 2
jb 0x4b3728
mov dword [ebp - 0x10], eax
call fcn.004b63a0
push dword [esi]
call fcn.004d0370
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x4b373b
mov dword [esi], ebx
mov ebx, eax
call fcn.004b63a0
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.004579c0
lea ecx, [esi + 0x10]
call fcn.0050b380
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4b6460
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.004ae4a0
test al, al
je 0x4b652f
xor esi, esi
call fcn.004ae4a0
test al, al
je 0x4b6526
call fcn.004ae490
mov edi, eax
mov ecx, eax
push 0x6279a9
call fcn.004ae8f0
test al, al
jne 0x4b64b9
mov ecx, edi
push str.vmodule
call fcn.004ae8f0
test al, al
je 0x4b6526
push 0x10
call fcn.005dc726
add esp, 4
mov esi, eax
push str.vmodule
call fcn.005f8970
add esp, 4
lea edx, [ebp - 0x1c]
mov ecx, edi
push eax
push str.vmodule
push edx
call fcn.004ae950
push 0x6279a9
call fcn.005f8970
add esp, 4
lea ebx, [ebp - 0x28]
mov ecx, edi
push eax
push 0x6279a9
push ebx
call fcn.004ae950
mov ecx, esi
push 0x6852f0
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.0050c2b0
cmp byte [ebp - 0x1d], 0
js 0x4b65d9
cmp byte [ebp - 0x11], 0
js 0x4b65ee
mov dword [0x685304], esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [0x676cc0], eax
mov bl, 1
test al, 1
je 0x4b65c5
mov eax, dword [0x685300]
test eax, eax
je 0x4b656d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x685300], 0
mov ecx, dword [0x6852ec]
test ecx, ecx
jne 0x4b659c
and byte [0x676cc0], 0xfe
jmp 0x4b6577
mov ecx, dword [0x6852ec]
test ecx, ecx
jne 0x4b659c
push 0xc
call fcn.005dc726
add esp, 4
mov ecx, eax
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [0x6852ec], eax
push dword [esi + 4]
call fcn.004ab558
cmp dword [esi + 0xc], 0
jne 0x4b65be
mov eax, dword [0x6852ec]
cmp byte [eax + 0xb], 0
jns 0x4b65b7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004b6600
mov ebx, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [ebp - 0x28]
call fcn.005dc756
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x4b6526
push dword [ebp - 0x1c]
call fcn.005dc756
add esp, 4
jmp 0x4b6526
Function at 0x4b9d80
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b9990

Function at 0x4c02c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c02d0
Function at 0x4c17e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push ebx
push edi
call fcn.004c00d0
add esp, 8
test al, al
je 0x4c1812
add ebx, edi
mov ecx, esi
push ebx
push edi
call fcn.004c1e80
mov bl, 1
jmp 0x4c19d9
mov ecx, esi
push 0
push ebx
call fcn.004abdfc
cmp byte [esi + 0xb], 0
js 0x4c19ba
mov ecx, esi
test ebx, ebx
je 0x4c19c4
mov bl, 1
xor eax, eax
xor esi, esi
mov dword [ebp - 0x18], ecx
jmp 0x4c1872
mov ecx, edx
shr ecx, 0xa
add ecx, 0xffffd7c0
mov edi, dword [ebp - 0x18]
mov word [edi + eax*2], cx
mov ecx, edi
inc eax
and edx, 0x3ff
or edx, 0xdc00
mov edi, dword [ebp + 8]
mov word [ecx + eax*2], dx
inc eax
cmp esi, dword [ebp + 0xc]
jae 0x4c19b2
lea ecx, [esi + 1]
movzx edx, byte [edi + esi]
test dl, 0x80
jne 0x4c1890
mov esi, ecx
jmp 0x4c194a
mov edi, dword [ebp + 0xc]
cmp ecx, edi
jne 0x4c18a0
mov esi, edi
jmp 0x4c1945
cmp dl, 0xe0
jb 0x4c18ec
cmp dl, 0xef
ja 0x4c1915
and edx, 0xf
movzx esi, byte [edx + str._000000000000]
mov dword [ebp - 0x14], esi
mov edi, dword [ebp + 8]
movzx esi, byte [edi + ecx]
mov dword [ebp - 0x10], esi
shr esi, 5
mov edi, dword [ebp - 0x14]
bt edi, esi
jae 0x4c1943
mov esi, ebx
mov ebx, dword [ebp - 0x10]
and bl, 0x3f
mov dword [ebp - 0x10], ebx
mov ebx, esi
inc ecx
mov esi, dword [ebp + 0xc]
cmp ecx, esi
je 0x4c1945
shl edx, 6
movzx esi, byte [ebp - 0x10]
or esi, edx
jmp 0x4c18f6
cmp dl, 0xc2
jb 0x4c1943
and edx, 0x1f
mov esi, edx
mov edi, dword [ebp + 8]
movzx edx, byte [edi + ecx]
xor edx, 0x80
cmp dl, 0x3f
ja 0x4c1943
shl esi, 6
or esi, edx
inc ecx
mov edx, esi
jmp 0x4c187e
cmp dl, 0xf4
mov edi, dword [ebp + 8]
ja 0x4c1943
add edx, 0xffffff10
movzx edi, byte [edi + ecx]
mov dword [ebp - 0x14], edi
shr edi, 4
movsx edi, byte [edi + 0x624bb9]
bt edi, edx
jae 0x4c1943
add esi, 2
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x4c198e
mov esi, ecx
mov edx, 0xffffffff
cmp edx, 0xd800
setb cl
lea edi, [edx - 0xe000]
cmp edi, 0x102000
setb ch
or ch, cl
movzx ebx, bl
mov ecx, 0
cmove ebx, ecx
mov ecx, 0xfffd
cmove edx, ecx
cmp edx, 0xffff
ja 0x4c1840
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
jmp 0x4c1864
mov edi, dword [ebp + 8]
movzx ecx, byte [edi + esi]
add cl, 0x80
cmp cl, 0x3f
ja 0x4c1945
mov dword [ebp - 0x10], ecx
shl edx, 6
mov ecx, dword [ebp - 0x14]
and ecx, 0x3f
or edx, ecx
mov ecx, esi
jmp 0x4c18d9
and bl, 1
mov esi, dword [ebp + 0x10]
jmp 0x4c19c8
mov ecx, dword [esi]
test ebx, ebx
jne 0x4c1830
mov bl, 1
xor eax, eax
mov ecx, esi
push 0
push eax
call fcn.004abdfc
mov ecx, esi
call fcn.004c2020
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c3a60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x140c
call fcn.005ddb10
mov eax, dword [0x674014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x676ce0]
cmp eax, 0xffffffff
je 0x4c3bca
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x4c3bca
mov eax, ebx
and eax, 0xfffffffc
lea ecx, [ebp - 0x810]
push 0x800
push eax
push ecx
call fcn.005df8f0
add esp, 0xc
mov ecx, dword [0x676ce0]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.0051b580
add esp, 8
and ebx, 0xfffffffc
je 0x4c3ade
push ebx
call fcn.005dc78c
add esp, 4
mov eax, dword [0x685fe8]
mov ecx, dword [0x678164]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4c3beb
mov esi, dword [0x685fe4]
push esi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x4c3bdf
lea eax, [ebp - 0x1410]
push 0xc00
push 0x6853e4
push eax
call fcn.005df8f0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov al, 1
mov ecx, 0x100
jmp 0x4c3b4e
mov edx, dword [ebp - 0x1418]
lea ecx, [edx - 1]
cmp edx, 2
jb 0x4c3bba
test al, 1
je 0x4c3bba
mov dword [ebp - 0x1418], ecx
xor edi, edi
lea esi, [ebp - 0x1408]
xor eax, eax
jmp 0x4c3b7c
inc edi
add esi, 0xc
cmp edi, 0x100
je 0x4c3b40
mov ebx, dword [ebp + edi*8 - 0x810]
test ebx, ebx
je 0x4c3b70
cmp dword [esi - 8], 0
je 0x4c3b70
mov ecx, dword [ebp + edi*8 - 0x80c]
cmp ecx, dword [esi]
jne 0x4c3b70
mov ecx, dword [esi - 4]
test ecx, ecx
je 0x4c3b70
mov dword [ebp + edi*8 - 0x810], 0
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
mov al, 1
jmp 0x4c3b70
push 2
push dword [ebp - 0x1414]
call fcn.0051b580
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd6f3
add esp, 0x140c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
call fcn.004cea50
jmp 0x4c3b14
push 0x685fe8
call fcn.005dc7c7
add esp, 4
cmp dword [0x685fe8], 0xffffffff
jne 0x4c3aff
push 4
call fcn.005dc726
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.0046fdf0
mov dword [0x685fe4], esi
push 0x685fe8
call fcn.005dc83d
add esp, 4
jmp 0x4c3aff

Function at 0x4c3c30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x676ce0]
cmp eax, 0xffffffff
je 0x4c3c50
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret