joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a511e
Capabilities:
Get system information on windows

Disassembly:
push 0x28
mov eax, 0x50544f
call fcn.004d2f7d
mov ebx, dword [ebp + 8]
push ebx
mov ecx, ebx
call fcn.004a5eed
xor edi, edi
lea esi, [ebx + 0x2c]
mov dword [ebp - 4], edi
call fcn.00408740
mov byte [ebp - 4], 1
lea esi, [ebx + 0x44]
push 4
mov dword [ebp - 0x10], esi
call fcn.004cb80b
pop ecx
cmp eax, edi
je 0x4a515c
mov dword [eax], esi
jmp 0x4a515e
xor eax, eax
mov dword [esi], eax
mov byte [ebp - 4], 2
call fcn.004a9be7
lea ecx, [esi + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x15], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov dword [esi + 0x1c], edi
lea esi, [ebx + 0x64]
mov dword [esi], vtable.ATL::CThreadPool_class_CECHttpDownloader::CDownloadWorker__class_ATL::CRTThreadTraits__class_ATL::Win32WaitTraits_.0
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
xor eax, eax
mov dword [esi + 0x10], edi
push 6
lea edi, [esi + 0x14]
pop ecx
rep stosd dword es:[edi], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0x8ca0
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov edi, 0x4a54be
mov byte [ebp - 4], 4
mov dword [ebx + 0xa8], eax
mov dword [ebp - 0x10], 0x547
cmp eax, edi
je 0x4a51e0
lea eax, [ebp - 0x10]
push eax
add ebx, 8
call fcn.004a606b
mov ebx, dword [ebp + 8]
mov dword [eax], edi
xor eax, eax
mov dword [ebp - 0x10], 0x548
cmp eax, edi
je 0x4a51fe
lea eax, [ebp - 0x10]
push eax
add ebx, 8
call fcn.004a606b
mov ebx, dword [ebp + 8]
mov dword [eax], edi
and dword [ebp - 0x34], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp dword [ebp - 0x20], 0
jne 0x4a5223
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
add eax, 2
push eax
push ebx
call fcn.004a58bd
mov eax, ebx
call fcn.004d3057
ret 4

Function at 0x4a5978
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, eax
cmp dword [edi + 0x40], 0
je 0x4a5a12
lea eax, [edi + 0x14]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [edi + 0x30]
xor eax, eax
call fcn.004a5b8b
mov esi, dword [edi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a59e2
mov eax, esi
lea ecx, [edi + 4]
call fcn.004a5b37
mov eax, dword [eax]
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 8], 0x103
jne 0x4a59dd
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 4]
call ebx
dec esi
jns 0x4a59af
push dword [edi + 0x40]
call ebx
push dword [ebp - 0x10]
and dword [edi + 0x40], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [edi + 0x14]
push eax
mov byte [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [edi + 0x3c]
call ebx
lea ecx, [ebp - 0x10]
call fcn.00404ea0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a5b8b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
push esi
mov esi, eax
cmp dword [edi + 0x40], ebx
jne 0x4a5ba7
mov eax, 0x80004005
pop esi
pop ebx
leave
ret 4
lea eax, [edi + 0x14]
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0xc]
mov byte [ebp - 0x18], 1
cmp esi, eax
jne 0x4a5bcb
lea ecx, [ebp - 0x1c]
call fcn.00404ea0
xor eax, eax
jmp 0x4a5ba1
mov dword [ebp - 0xc], ebx
jge 0x4a5cc5
sub eax, esi
cmp eax, ebx
mov dword [ebp - 0x10], eax
jle 0x4a5c9f
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
lea ebx, [edi + 0x38]
push ebx
call esi
push 0xffffffffffffffff
push 0
push 0
push dword [edi + 0x40]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push dword [ebp + 8]
mov eax, dword [edi + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4a5c3b
push 0
push ebx
call esi
test eax, eax
je 0x4a5c3f
lea ecx, [ebp - 0x1c]
call fcn.00404ea0
mov eax, 0x102
call fcn.00406d40
jmp 0x4a5ba1
test eax, eax
jne 0x4a5ca8
lea esi, [edi + 4]
mov ecx, dword [esi + 8]
xor ebx, ebx
test ecx, ecx
jle 0x4a5c5c
mov edx, dword [edi + 0x10]
mov eax, dword [esi]
cmp dword [eax], edx
je 0x4a5ca3
inc ebx
add eax, 4
cmp ebx, ecx
jl 0x4a5c50
or dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
je 0x4a5c90
mov ecx, esi
call fcn.004a5b37
mov ebx, dword [eax]
push 0xea60
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4a5cbe
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 8]
call fcn.004a5dc9
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jl 0x4a5be1
xor esi, esi
jmp 0x4a5caf
mov dword [ebp - 8], ebx
jmp 0x4a5c60
call fcn.00405ec0
mov esi, eax
lea ecx, [ebp - 0x1c]
call fcn.00404ea0
mov eax, esi
jmp 0x4a5ba1
mov esi, 0x80004005
jmp 0x4a5caf
sub esi, eax
cmp esi, ebx
mov dword [ebp - 0x14], esi
jle 0x4a5c9f
push dword [edi + 0x3c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [edi + 0x2c]
lea ecx, [ebp - 8]
push ecx
push 0
push edi
push 0x4a5e67
push eax
push 0
call fcn.004cd307
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x4a5ca8
push dword [ebp + 8]
mov eax, dword [edi + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4a5d3c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea esi, [edi + 4]
mov dword [ebp - 0x10], ebx
call fcn.004a5d67
test eax, eax
je 0x4a5d21
xor ebx, ebx
test ebx, ebx
je 0x4a5d2c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x4a5cce
jmp 0x4a5c9f
cmp eax, 0x102
jne 0x4a5d54
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x80070102
jmp 0x4a5caf
call fcn.00405ec0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a5caf
Function at 0x4a6520
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x78
mov eax, dword [0x5466b0]
xor eax, esp
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x80]
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
push edi
xor edi, edi
push eax
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.004bf470
add esp, 4
lea esi, [esp + 0x18]
lea ecx, [esp + 0x74]
call fcn.004bf520
mov dword [esp + 0x14], edi
lea ecx, [edi + 0x10]
lea eax, [ebp + 0x13]
lea esi, [esp + 0x83]
lea esp, [esp]
movzx dx, byte [eax]
movzx bx, byte [esi]
add dx, bx
add di, dx
mov word [esp + 0x14], di
mov dl, byte [esp + 0x14]
mov byte [eax], dl
add ecx, 0xffff
shr di, 8
dec esi
dec eax
test cx, cx
ja 0x4a65a0
mov eax, dword [ebp]
mov ecx, dword [esp + 0x94]
cmp eax, ecx
jae 0x4a65f4
mov dword [ebp], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.004cb38b
add esp, 0x78
ret
sub eax, ecx
mov ecx, dword [esp + 0x84]
pop edi
pop esi
mov dword [ebp], eax
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004cb38b
add esp, 0x78
ret

Function at 0x4a6620
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x70
mov eax, dword [0x5466b0]
xor eax, esp
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x74]
push ebx
push ebp
mov ebx, ecx
cmp dword [ebx], 0
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
mov ebp, 1
je 0x4a6662
mov eax, 0x408
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.004cb38b
add esp, 0x70
ret
mov eax, dword [ebx + 0x14]
cmp eax, 1
jae 0x4a6718
mov ecx, 0xfffffffd
sub ecx, ebx
mov dword [esp + 0x1c], ecx
lea esp, [esp]
mov ecx, ebx
sub ecx, eax
add ecx, 0x28
mov edi, eax
test eax, eax
je 0x4a669e
mov esi, dword [esp + 0x14]
sub esi, ecx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
sub edi, 1
jne 0x4a6693
add dword [esp + 0x14], eax
sub ebp, eax
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
lea eax, [ebx + 4]
push eax
mov eax, 0x10
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
call fcn.004bf470
add esp, 4
lea esi, [esp + 0x20]
lea ecx, [ebx + 0x18]
call fcn.004bf520
mov eax, 0x10
lea ecx, [ebx + 0x13]
mov dl, byte [ecx]
mov bl, dl
inc bl
mov byte [ecx], bl
test dl, dl
jne 0x4a670c
mov edx, dword [esp + 0x1c]
dec ecx
add edx, ecx
jne 0x4a66f7
mov ebx, dword [esp + 0x18]
cmp ebp, eax
ja 0x4a6680
mov ecx, ebx
sub ecx, eax
add ecx, 0x28
mov edi, ebp
test ebp, ebp
je 0x4a673b
mov esi, dword [esp + 0x14]
sub esi, ecx
jmp 0x4a6730
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
sub edi, 1
jne 0x4a6730
mov ecx, dword [esp + 0x7c]
pop edi
sub eax, ebp
pop esi
mov dword [ebx + 0x14], eax
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004cb38b
add esp, 0x70
ret
Function at 0x4a6c30
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi]
mov edx, ecx
xor edx, eax
shr ecx, 8
and edx, 0xff
mov edx, dword [edi + edx*4]
xor edx, ecx
movzx ecx, dl
add ecx, dword [esi + 4]
mov dword [esi], edx
mov edx, dword [esi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 4], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [edi + ecx*4]
mov dword [esi + 8], edx
ret
Function at 0x4a964a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x9c]
mov eax, dword [eax]
add ebx, 0x84
mov dword [esp + 0x14], eax
mov eax, dword [ebx]
push esi
push edi
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebx]
lea edi, [esp + 0x10]
lea esi, [esp + 0x18]
mov dword [esp + 0x10], eax
call fcn.0047c948
test al, al
jne 0x4a96b0
call fcn.004a1ded
mov eax, dword [eax + 4]
cmp dword [eax + 8], 0xa
je 0x4a96a5
push 0
mov ecx, eax
call fcn.004adf72
lea esi, [esp + 0x18]
call fcn.004a6394
jmp 0x4a9670
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
and dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
mov eax, dword [ebx]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebx]
lea edi, [esp + 0x20]
lea esi, [esp + 0x18]
mov dword [esp + 0x20], eax
call fcn.0047c948
test al, al
jne 0x4a97e8
call fcn.004a1ded
mov esi, dword [eax + 4]
cmp dword [esi + 8], 0xa
je 0x4a977c
mov eax, dword [esi + 0x10]
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
jne 0x4a971b
push 0xffffffffffffffff
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4a9735
cmp eax, 0x102
jne 0x4a9735
push 0xffffffffffffffff
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
add dword [esp + 0x10], 0x3e8
lea esi, [esp + 0x18]
call fcn.004a1ded
mov eax, dword [eax + 4]
test eax, eax
je 0x4a974d
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
lea esi, [esp + 0x18]
call fcn.004a1ded
push dword [esp + 0x1c]
and dword [eax + 4], 0
push dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
push ebx
call fcn.004811d8
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
jmp 0x4a9785
lea esi, [esp + 0x18]
call fcn.004a6394
cmp dword [esp + 0x10], 0xbb8
jb 0x4a96c4
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov ecx, dword [ebx]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebx]
lea edi, [esp + 0x20]
lea esi, [esp + 0x18]
mov dword [esp + 0x20], eax
call fcn.0047c948
test al, al
jne 0x4a97e8
call fcn.004a1ded
mov eax, dword [eax + 4]
test eax, eax
je 0x4a97dd
cmp dword [eax + 8], 0xa
je 0x4a97dd
push 0xffffffffffffffff
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea esi, [esp + 0x18]
call fcn.004a6394
jmp 0x4a97a2
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a9cef
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
call fcn.004a9ca7
add esp, 0xc
push dword [eax]
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
lea ecx, [ebp + 0xc]
mov dword [esi + 0x10], eax
call fcn.004087f0
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x4a9d58
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x14], eax
cmp eax, edi
je 0x4a9d58
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov ecx, dword [eax + 8]
add eax, 0xc
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov eax, esi
pop edi
pop ebp
ret 8

Function at 0x4aa3c3
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
jmp 0x4aa3da
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea esi, [ebp - 0x10]
call fcn.004a9c65
pop ecx
pop ecx
push dword [ebp - 8]
lea eax, [edi + 0xc]
push eax
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x4aa414
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4aa427
xor ebx, ebx
lea ecx, [ebp - 8]
call fcn.004087f0
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x4aa3d8
jmp 0x4aa42f
lea ecx, [ebp - 8]
call fcn.004087f0
test ebx, ebx
je 0x4aa48f
lea eax, [edi + 0xc]
push eax
push 0
push 0
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x4aa48f
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
push edi
push dword [ebp + 0xc]
lea eax, [esi + 0xc]
mov dword [esi + 4], ebx
push eax
mov dword [esi + 8], edi
call fcn.004d5790
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.004a9c19
cmp byte [ebp + 0x14], 0
push eax
push dword [ebp + 8]
je 0x4aa489
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4aa48f
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x4ac931
Capabilities:
Check if file exists

Disassembly:
push 0x40
mov eax, 0x5053f6
call fcn.004d2fe8
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
call fcn.00408850
and dword [ebp - 4], 0
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test edi, edi
je 0x4ac978
push edi
call esi
test eax, eax
je 0x4ac978
mov edx, edi
lea edi, [ebp - 0x3c]
call fcn.004085a0
jmp 0x4ac9d5
lea eax, [ebp - 0x40]
push str.SoftMgrGameChrome.exe
push eax
call fcn.0045b262
pop ecx
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [eax]
mov edi, dword [ebp - 0x3c]
lea eax, [ecx - 0x10]
add edi, 0xfffffff0
cmp eax, edi
je 0x4ac9c9
cmp dword [edi + 0xc], 0
jl 0x4ac9bd
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x4ac9bd
call fcn.00408780
mov ebx, eax
mov eax, edi
call fcn.00408830
add ebx, 0x10
mov dword [ebp - 0x3c], ebx
jmp 0x4ac9c9
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [ebp - 0x3c]
call fcn.00408500
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.004087f0
mov edi, dword [ebp - 0x3c]
test edi, edi
je 0x4ac9fd
push edi
call esi
test eax, eax
je 0x4ac9fd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0045afbc
pop ecx
test eax, eax
jne 0x4aca28
call fcn.0045a980
test eax, eax
jne 0x4aca28
push str.GameChrome.exe_not_signed
call fcn.00401f50
mov edx, str.ChromeCtrl
mov ecx, eax
call fcn.00401fd0
pop ecx
xor esi, esi
lea ecx, [ebp - 0x3c]
call fcn.004087f0
mov eax, esi
call fcn.004d306b
ret 0x10
mov eax, dword [0x51f880]
mov esi, str.ptype
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x51f888
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.trans
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], eax
mov eax, dword [0x51f884]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x14], eax
movsd dword es:[edi], dword [esi]
call fcn.00408850
mov eax, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x44]
mov byte [ebp - 4], 2
push dword [eax]
movzx eax, byte [ebp + 0x14]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x48]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 4]
lea eax, [ebp - 0x20]
push eax
push dword [esi + 8]
lea eax, [ebp - 0x2c]
push eax
push str.__s:_d___s:_d___s:_d___s:_d__s
lea edi, [ebp - 0x40]
call fcn.00404c10
add esp, 0x28
mov eax, edi
push eax
lea eax, [ebp - 0x3c]
push eax
mov eax, esi
call fcn.004acab7
mov ecx, edi
mov esi, eax
call fcn.004087f0
jmp 0x4aca16
Function at 0x4acab7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x54cfe0
push 0x14
mov edi, eax
call fcn.004cba2a
mov esi, eax
xor eax, eax
pop ecx
pop ecx
cmp esi, eax
je 0x4acaef
lea ecx, [esi + 0xc]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
call fcn.00408850
lea ecx, [esi + 0x10]
call fcn.00408850
jmp 0x4acaf1
xor esi, esi
mov eax, dword [edi + 4]
mov dword [esi], eax
lea eax, [edi + 0x8c]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov dword [esi + 4], ecx
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edi, [esi + 0xc]
mov ebx, dword [edi]
lea eax, [ecx - 0x10]
sub ebx, 0x10
cmp eax, ebx
je 0x4acb50
cmp dword [ebx + 0xc], 0
jl 0x4acb45
mov edx, dword [eax]
cmp edx, dword [ebx]
jne 0x4acb45
call fcn.00408780
mov dword [ebp + 8], eax
mov eax, ebx
call fcn.00408830
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
jmp 0x4acb50
mov ebx, dword [ecx - 0xc]
push ecx
mov eax, edi
call fcn.00408500
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
lea edi, [esi + 0x10]
mov ebx, dword [edi]
lea eax, [ecx - 0x10]
sub ebx, 0x10
cmp eax, ebx
je 0x4acb94
cmp dword [ebx + 0xc], 0
jl 0x4acb89
mov edx, dword [eax]
cmp edx, dword [ebx]
jne 0x4acb89
call fcn.00408780
mov dword [ebp + 8], eax
mov eax, ebx
call fcn.00408830
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
jmp 0x4acb94
mov ebx, dword [ecx - 0xc]
push ecx
mov eax, edi
call fcn.00408500
xor eax, eax
push eax
push eax
push esi
push 0x4acbb9
push eax
push eax
call fcn.004cd307
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
pop ebp
ret 8

Function at 0x4b10b0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, eax
call fcn.004afdb0
mov eax, dword [edi + 0x40]
xor ebx, ebx
push eax
mov dword [edi + 0x30], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
call fcn.004cc1ec
push 2
push ebx
push ebp
mov dword [edi + 0x40], ebx
call fcn.004cf3a0
push ebp
call fcn.004cf5c2
push ebx
push ebx
push ebp
mov esi, eax
call fcn.004cf3a0
add esp, 0x20
cmp esi, ebx
je 0x4b1164
lea ecx, [esi + 1]
push ecx
call fcn.004ca0f2
push ebp
push esi
push 1
push eax
mov dword [edi + 0x40], eax
call fcn.004cf8d0
add esp, 0x14
cmp eax, esi
je 0x4b1128
mov eax, 5
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x30], eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov edx, dword [edi + 0x40]
mov byte [esi + edx], bl
mov eax, dword [edi + 0x40]
call fcn.004af310
mov byte [edi + 0x2c], bl
cmp byte [eax], 0xef
jne 0x4b1151
cmp byte [eax + 1], 0xbb
jne 0x4b1151
cmp byte [eax + 2], 0xbf
jne 0x4b1151
mov byte [edi + 0x2c], 1
add eax, 3
cmp eax, ebx
je 0x4b116e
cmp byte [eax], bl
je 0x4b116e
mov edx, dword [edi]
push ebx
push eax
mov eax, dword [edx + 0x3c]
mov ecx, edi
call eax
mov eax, dword [edi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov eax, 0xf
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x30], eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4b11f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f3cfb
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x5466b0]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
push edi
mov eax, dword [0x5466b0]
xor eax, esp
push eax
lea eax, [esp + 0x11c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x12c]
mov edi, ecx
lea ecx, [esp + 0xc]
push eax
push ecx
mov cl, byte [esp + 0x138]
call fcn.004b13f0
lea ecx, [esp + 0xc]
mov dword [esp + 0x124], 0
call fcn.004b1350
mov edi, dword [edi + 0x30]
lea esi, [esp + 0xc]
call fcn.00482b66
mov eax, edi
mov ecx, dword [esp + 0x11c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004cb38b
add esp, 0x11c
ret 8

Function at 0x4b2cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x2c]
push edi
lea esp, [esp]
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea edx, [ecx + ebp - 0x106]
mov dword [esp + 0xc], edi
cmp eax, edx
jb 0x4b2d60
mov eax, dword [esi + 0x38]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call fcn.004d5790
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebp
sub dword [esi + 0x6c], ebp
add esp, 0xc
sub dword [esi + 0x5c], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x4b2d2f
sub eax, ebp
jmp 0x4b2d31
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x4b2d20
mov ecx, dword [esi + 0x40]
mov edx, ebp
lea ecx, [ecx + ebp*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x4b2d50
sub eax, ebp
jmp 0x4b2d52
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x4b2d41
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x4b2e1a
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [esp + 0xc]
mov ebx, eax
mov dword [esp + 0x10], edx
cmp ebx, ecx
jbe 0x4b2d88
mov ebx, ecx
test ebx, ebx
je 0x4b2ddc
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4b2daa
mov edx, dword [edi]
mov ecx, dword [edi + 0x30]
mov eax, ebx
call fcn.004c3660
jmp 0x4b2dc3
cmp eax, 2
jne 0x4b2dca
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
test ecx, ecx
jne 0x4b2dbc
xor eax, eax
jmp 0x4b2dc7
mov edx, ebx
call fcn.004c0700
mov edx, dword [esp + 0x10]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.004d5790
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x4b2e06
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x4b2e1a
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x4b2ce0
pop edi
pop ebp
pop ebx
add esp, 8
ret