joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494a40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x11c
mov eax, dword [0x52ec00]
mov edx, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 0x10], eax
test edx, edx
je 0x494b5f
push 0x105
lea ebx, [ebp - 0x118]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x494a82
cmp eax, 0x105
jae 0x494a82
inc eax
jmp 0x494a89
mov byte [ebp - 0x118], 0
test eax, eax
jne 0x494a94
xor eax, eax
jmp 0x494b3e
movsx esi, byte [ebp - 0x118]
cmp esi, 0x54
je 0x494b39
cmp esi, 0x59
je 0x494b39
cmp esi, 0x74
je 0x494b39
cmp esi, 0x79
je 0x494b39
test esi, esi
je 0x494a8d
mov eax, esi
and eax, 0xff
lea edi, [ebp - 0x117]
push eax
call fcn.004de1f0
add esp, 4
test eax, eax
je 0x494af1
movsx esi, byte [edi]
inc edi
mov eax, esi
and eax, 0xff
push eax
call fcn.004de1f0
add esp, 4
test eax, eax
jne 0x494ad9
test esi, esi
jne 0x494a8d
xor esi, esi
lea eax, [ebp - 0x11c]
mov dword [eax], esi
mov esi, 0x506d00
mov dword [eax - 0xc], esi
mov dword [eax - 8], eax
call fcn.00485da0
mov ecx, eax
lea eax, [ebp - 0x124]
push eax
xor edx, edx
push edx
push esi
push 0xffffffffffffffff
push ebx
push dword [ecx + 4]
push dword [ecx]
call fcn.004dd3cc
add esp, 0x1c
cmp dword [ebp - 0x11c], 0
je 0x494a8d
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0
xor ecx, ebp
cmp ecx, dword [0x52ec00]
jne 0x494b5a
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
call fcn.004cba1b
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0
xor ecx, ebp
cmp ecx, dword [0x52ec00]
jne 0x494b5a
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x497f50
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0x54]
mov ebx, dword [esi + 0x50]
test edx, edx
je 0x497f6a
sub ebx, edx
jmp 0x497f6f
mov edx, dword [esi + 0x4c]
sub ebx, edx
lea edx, [ebx + 4]
cmp edx, dword [esi + 0x10c]
ja 0x4983ef
movzx edx, word [esi + 0x18a]
test edx, edx
jg 0x4981a4
movsx edx, byte [esi + 0x18c]
cmp edx, 8
ja 0x49813a
movzx eax, word [edx*2 + 0x5071c0]
add eax, 0x497fac
jmp eax
push 0x37f
push str.for_put.c
push 2
push 8
call fcn.0047e600
add esp, 0x10
mov edx, dword [esi + 0x54]
test edx, edx
je 0x4983cd
mov eax, esi
mov ecx, ebx
call fcn.004984ac
and byte [esi + 0x1a4], 0xbf
cmp eax, 0xffffffff
je 0x4983b4
test byte [esi + 0x1a5], 8
je 0x4981c1
push dword [esi + 0x104]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x49839e
xor eax, eax
and byte [esi + 0x1a5], 0xf7
test eax, eax
jne 0x49847e
jmp 0x4981c1
mov edx, dword [esi + 0x54]
test edx, edx
je 0x4983de
mov eax, esi
mov ecx, ebx
call fcn.004984ac
cmp eax, 0xffffffff
je 0x4983b4
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x108], eax
mov eax, 0x26
jmp 0x498193
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x108], eax
mov eax, 0x26
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, esi
mov ecx, ebx
mov edx, dword [esi + 0x4c]
call fcn.004984ac
jmp 0x498164
mov eax, esi
mov ecx, ebx
mov edx, dword [esi + 0x4c]
call fcn.004984ac
jmp 0x4981b8
push 0x200
push 4
push esi
call fcn.00494530
add esp, 0xc
test eax, eax
je 0x497f7e
cmp ebx, dword [esi + 0x10c]
ja 0x49841c
cmp byte [esi + 0x18c], 1
je 0x497f7e
mov edx, dword [esi + 0x20]
test edx, edx
je 0x498486
test byte [edx + 0x44], 2
je 0x498453
mov ecx, 0x42
mov dword [edx + 0x38], ecx
mov edx, dword [esi + 0x20]
mov dword [edx + 0x3c], ecx
mov edx, dword [esi + 0x7c]
test edx, edx
je 0x498446
xor ecx, ecx
mov dword [edx + 4], ecx
mov dword [esi + 0x7c], ecx
mov eax, 0x42
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
movzx ecx, byte [esi + 0x1ae]
mov edx, 0x42
and ecx, 0x10
movzx ebx, byte [esi + 0x1a4]
push edx
shr ecx, 1
and ebx, 7
push edx
or ebx, ecx
push ebx
push 0xffffffffffffffff
push esi
call fcn.00486b00
add esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
mov eax, 0x42
push eax
push eax
push 1
call fcn.0047d070
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x4984a0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x4ab7a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x10c
mov edx, dword [0x220508c]
or edx, dword [0x2205090]
or edx, dword [0x2205084]
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 8], eax
or edx, dword [0x2205088]
jne 0x4ab9ba
push 0x104
lea edi, [ebp - 0x10c]
push edi
push str.FORT_BLOCKSIZE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, eax
test edx, edx
je 0x4ab805
cmp edx, 0x104
jae 0x4ab7fc
inc edx
je 0x4ab80e
jmp 0x4ab81a
mov byte [ebp - 0x10c], 0
jmp 0x4ab81a
mov byte [ebp - 0x10c], 0
jne 0x4ab81a
mov dword [0x220508c], 0xffffffff
jmp 0x4ab85a
dec edx
lea eax, [ebp - 0x110]
push eax
push 2
push edx
push edi
call fcn.004a0280
add esp, 0x10
test eax, eax
jne 0x4ab83f
mov eax, dword [ebp - 0x110]
cmp eax, 0x7fffc000
jbe 0x4ab84b
mov dword [0x220508c], 0xfffffffe
jmp 0x4ab85a
add eax, 0x1ff
and eax, 0xfffffe00
mov dword [0x220508c], eax
push 0x104
push edi
push str.FORT_BUFFERCOUNT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, eax
test edx, edx
je 0x4ab887
cmp edx, 0x104
jae 0x4ab87e
inc edx
je 0x4ab890
jmp 0x4ab89c
mov byte [ebp - 0x10c], 0
jmp 0x4ab89c
mov byte [ebp - 0x10c], 0
jne 0x4ab89c
mov dword [0x2205090], 0xffffffff
jmp 0x4ab8d0
dec edx
lea eax, [ebp - 0x110]
push eax
push 2
push edx
push edi
call fcn.004a0280
add esp, 0x10
test eax, eax
jne 0x4ab8bf
mov eax, dword [ebp - 0x110]
cmp eax, 0x7f
jbe 0x4ab8cb
mov dword [0x2205090], 0xfffffffe
jmp 0x4ab8d0
mov dword [0x2205090], eax
push 0x104
push edi
push str.FORT_FMT_RECL
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, eax
test edx, edx
je 0x4ab8fd
cmp edx, 0x104
jae 0x4ab8f4
inc edx
je 0x4ab906
jmp 0x4ab912
mov byte [ebp - 0x10c], 0
jmp 0x4ab912
mov byte [ebp - 0x10c], 0
jne 0x4ab912
mov dword [0x2205084], 0xffffffff
jmp 0x4ab945
dec edx
lea eax, [ebp - 0x110]
push eax
push 2
push edx
push edi
call fcn.004a0280
add esp, 0x10
test eax, eax
jne 0x4ab93b
mov eax, dword [ebp - 0x110]
test eax, eax
jl 0x4ab93b
mov dword [0x2205084], eax
jmp 0x4ab945
mov dword [0x2205084], 0xfffffffe
push 0x104
push edi
push str.FORT_UFMT_RECL
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edx, eax
test edx, edx
je 0x4ab972
cmp edx, 0x104
jae 0x4ab969
inc edx
je 0x4ab97b
jmp 0x4ab987
mov byte [ebp - 0x10c], 0
jmp 0x4ab987
mov byte [ebp - 0x10c], 0
jne 0x4ab987
mov dword [0x2205088], 0xffffffff
jmp 0x4ab9ba
dec edx
lea eax, [ebp - 0x110]
push eax
push 2
push edx
push edi
call fcn.004a0280
add esp, 0x10
test eax, eax
jne 0x4ab9b0
mov eax, dword [ebp - 0x110]
test eax, eax
jl 0x4ab9b0
mov dword [0x2205088], eax
jmp 0x4ab9ba
mov dword [0x2205088], 0xfffffffe
mov ecx, dword [ebp - 8]
mov dword [ebp - 8], 0
xor ecx, ebp
cmp ecx, dword [0x52ec00]
jne 0x4ab9d4
lea esp, [ebp - 4]
pop edi
pop ebp
ret
call fcn.004cba1b
lea esi, [esi]
Function at 0x4c64d0
Capabilities:
Inspect section memory permissions

Disassembly:
push edi
sub esp, 0xc
xor eax, eax
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.004c6554
push 6
push 0x2206458
call fcn.004c7180
add esp, 8
cmp eax, 1
je 0x4c6535
test eax, eax
jl 0x4c650c
add esp, 0xc
pop edi
ret
xor ebx, ebx
push ebx
push ebx
push 1
call fcn.004c93a0
push 0
push 0x3a
push 1
call fcn.004c93a0
push ebx
push ebx
push 1
call fcn.004c93a0
add esp, 0x24
push 1
call fcn.004d81e6
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 0
add esp, 0xc
pop edi
jmp fcn.004c9660
Function at 0x4cc015
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4cc054
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4cc054
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4cc054
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4cc054
cmp dword [ecx + 0x74], 0xe
jbe 0x4cc054
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4e1af4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x515ed8
push 0x515ed0
push str.FlsAlloc
push 0x1e
call fcn.004e1935
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4e1b28
push dword [ebp + 8]
mov ecx, esi
call dword [0x4f41b8]
call esi
jmp 0x4e1b2e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4e1b72
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x515ee8
push 0x515ee0
push str.FlsGetValue
push 0x20
call fcn.004e1935
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4e1ba9
push dword [ebp + 8]
mov ecx, esi
call dword [0x4f41b8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4e25ab
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e252d

Function at 0x4e539f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x22070a0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4e53df
cmp byte [ebx], 0xa
jne 0x4e53df
or byte [eax + edi + 0x28], 4
jmp 0x4e53e4
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4e54e2
mov al, byte [edx]
cmp al, 0x1a
je 0x4e54c4
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4e5413
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4e5438
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4e5442
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4e53f5
jmp 0x4e54e2
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e54bf
cmp dword [ebp - 0xc], 0
je 0x4e54bf
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x22070a0]
test byte [eax + edi + 0x28], 0x48
je 0x4e5499
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4e5484
mov byte [esi], dl
jmp 0x4e5495
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x22070a0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4e54e2
cmp byte [ebp - 1], 0xa
jne 0x4e54a8
cmp esi, ebx
jne 0x4e54a8
mov byte [esi], 0xa
jmp 0x4e54e1
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004e5198
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4e54e2
mov byte [esi], 0xd
jmp 0x4e54e1
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x22070a0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4e54de
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4e54e2
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4e54eb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x22070a0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4e552e
cmp word [esi], dx
jne 0x4e552e
or byte [edi + eax + 0x28], 4
jmp 0x4e5533
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4e5686
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4e5666
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4e5575
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4e55ab
cmp eax, edx
jae 0x4e55b7
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4e554d
jmp 0x4e5686
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e5662
cmp dword [ebp - 0x14], 0
je 0x4e5662
mov eax, dword [ebx*4 + 0x22070a0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4e563a
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4e5603
mov word [esi], cx
jmp 0x4e5636
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x22070a0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x22070a0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x22070a0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4e5686
pop ebx
cmp word [ebp - 4], bx
jne 0x4e564b
cmp esi, dword [ebp + 0xc]
jne 0x4e564b
mov word [esi], bx
jmp 0x4e5683
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004e5198
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4e5686
push 0xd
jmp 0x4e567f
mov ecx, dword [ebx*4 + 0x22070a0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4e567d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4e5686
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4e6ddf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4e6e7c
push ebx
push esi
call fcn.004e6da8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004e4ef8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4e6e29
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4e6e7b
push edi
push eax
call fcn.004e1006
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4e6e49
call fcn.004e177a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4e6e7a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004e4ef8
add esp, 0x20
test eax, eax
jne 0x4e6e68
push edi
call fcn.004e177a
jmp 0x4e6e70
push ebx
call fcn.004e177a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4eb8d5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004eb851
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4eba4d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4eba4d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4eb9fc
jg 0x4eb92e
test eax, eax
je 0x4eb9f2
push 1
push 0x1000
call fcn.004e171d
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4eb954
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4eb9e9
push 0x8000
push ebx
call fcn.004dff9a
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4eb980
jg 0x4eb97b
cmp ecx, 0x1000
jb 0x4eb980
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004debf1
add esp, 0x10
cmp eax, 0xffffffff
je 0x4eb9c5
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4eb97b
jl 0x4eb9ac
test ecx, ecx
jne 0x4eb96d
push dword [ebp - 0xc]
push ebx
call fcn.004dff9a
push esi
call fcn.004e177a
add esp, 0xc
xor edi, edi
jmp 0x4eba5e
cmp byte [edi + 0x24], 0
je 0x4eb9dc
cmp dword [edi + 0x20], 5
jne 0x4eb9dc
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4eb9e7
mov edi, dword [edi + 0x18]
jmp 0x4eb9e9
xor edi, edi
push esi
call fcn.004e177a
pop ecx
jmp 0x4eba5e
test ecx, ecx
jg 0x4eb9be
jl 0x4eb9fc
test eax, eax
jae 0x4eb9be
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004e5198
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4eba1f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4eb9be
jmp 0x4eba56
push ebx
call fcn.004ddd7d
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4eb9be
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4eba5e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4eba5b
mov edi, dword [edi + 0x18]
jmp 0x4eba5e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004e5198
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4ed150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4ed17d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ed17d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4ed623
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x58], edi
test edi, edi
jle 0x4ed6b8
push esi
mov esi, dword [ebx + 4]
mov ecx, esi
shr ecx, 0xb
and ecx, 7
push 3
add ecx, ecx
pop edx
shl edx, cl
mov eax, edx
not eax
and eax, dword [ebx + 8]
or eax, edx
mov dword [ebx + 8], eax
lea eax, [esi + 0x800]
xor eax, esi
and eax, 0x3800
xor eax, esi
mov dword [ebx + 4], eax
sub edi, 1
jne 0x4ed645
imul edi, dword [ebp - 0x58], 0xa
lea esi, [ebx + 0x1c]
lea eax, [ebp - 0x54]
push edi
push esi
push eax
call fcn.004cd870
imul eax, dword [ebp - 0x58], 0xa
push 0x50
pop ecx
sub ecx, eax
lea eax, [ebx + 0x1c]
push ecx
add eax, edi
push eax
push esi
call fcn.004cd870
push edi
lea eax, [ebp - 0x54]
sub ebx, edi
push eax
add ebx, 0x6c
push ebx
call fcn.004cd870
add esp, 0x24
pop esi
jmp 0x4ed6f7
jns 0x4ed6f7
mov ecx, dword [ebx + 4]
shr ecx, 0xb
dec ecx
shl ecx, 0xb
xor ecx, dword [ebx + 4]
and ecx, 0x3800
xor ecx, dword [ebx + 4]
mov dword [ebx + 4], ecx
shr ecx, 0xb
push 3
and ecx, 7
pop eax
add ecx, ecx
shl eax, cl
not eax
and dword [ebx + 8], eax
lea eax, [ebx + 0x1c]
push 0x46
push eax
lea eax, [ebx + 0x26]
push eax
call fcn.004cd870
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004cba1b
leave
ret
Function at 0x100be473
Capabilities:
Get number of processors

Disassembly:
jmp 0x100b2794
call fcn.100b277f
salc
arpl word [ebp - 0x79], cx
loop 0x100b278a
adc eax, 0x24748b56
add al, 0x8d
mov dh, 0xd4
adc byte [edx], al
add byte [ecx + 0x5e042474], cl
push edx
mov dword [esp], ebp
push esp
pop ebp
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 0x80
xchg dword [esp], ebp
pop esp
sub esp, 4
mov dword [esp], ebx
push edi
mov dword [esp], esi
push 0x188b
mov dword [esp], edi
jmp 0x100d83b3
push ebx
mov ebx, 8
add ebx, ebp
mov eax, dword [ebx]
pop ebx
sub esp, 4
mov dword [esp], eax
jmp 0x100d11dd
jmp 0x100bd476
push 0
push 0x41797261
push 0x7262694c
push 0x64616f4c
lea ecx, [ebp - 0x2c]
sub esp, 4
mov dword [esp], ecx
jmp 0x100cc856
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x1983f]
mov dword [esp + 4], ecx
pop ecx
jmp 0x100d4e32
jmp 0x100cc86d
call fcn.100cc858
adc byte [eax - 0x77], dl
loopne 0x100cc87c
add al, 0
add byte [eax], al
add eax, 4
xchg dword [esp], eax
pop esp
rol byte [edi + eax*4], 4
and al, 0x5c
push eax
pop dword [ebp - 4]
push ecx
mov ecx, 0xc
add ecx, ebp
mov eax, dword [ecx]
pop ecx
push esi
mov dword [esp], eax
push dword [ebp - 4]
sub dword [esp], 0x3f8325ed
pop ecx
add ecx, 0x3f8325ed
push esi
mov dword [esp], ecx
push eax
mov eax, 8
add eax, ebp
mov edx, dword [eax]
pop eax
push eax
mov eax, 0x64
add edx, eax
pop eax
push ebx
mov dword [esp], edx
jmp 0x100b277d
jmp 0x100d11f4
call fcn.100d11df
or eax, dword [ebp + 0x68]
mov byte [eax], 0
jmp 0x100b2bce
push esi
mov esi, 0x6114390f
xor esi, 0x61143917
mov eax, esi
pop esi
mov eax, dword fs:[eax]
push eax
pop dword [ebp - 4]
push dword [ebp - 4]
pop eax
push dword [eax + 0x30]
sub dword [esp], 0x63f80c4b
pop ecx
add ecx, 0x63f80c4b
push eax
mov eax, 0xfffffff8
add eax, ebp
mov dword [eax], ecx
pop eax
push dword [ebp - 8]
pop edx
push ecx
mov ecx, 8
add ecx, edx
mov eax, dword [ecx]
pop ecx
push edx
mov edx, 0xffffffec
add edx, ebp
mov dword [edx], eax
pop edx
push ebx
mov ebx, 0
mov dword [ebp - 0x10], ebx
pop ebx
cmp dword [ebp - 0x10], 0
je 0x100b3698
jmp 0x100b4265

Function at 0x100dd6f2
Capabilities:
Access peb ldr_data

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax - 0x4e23]
mov dword [esp + 4], eax
pop eax
jmp 0x100cca70

Function at 0x103e0913
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x103e0971
jmp 0x103e0930
push ebx
mov ebx, 0x1000
sub ecx, ebx
pop ebx
push esi
mov esi, 0x42603735
add esi, 0x62b848ad
not esi
xor esi, 0xa3b2af6
xor esi, 0x5731f4a
shr esi, 4
xor esi, 0x55aeb5a
sub eax, esi
pop esi
test dword [ecx], eax
cmp eax, 0x1000
jae 0x103e0930
jmp 0x103e0971
sub ecx, 0x42861a21
sub ecx, eax
add ecx, 0x42861a21
push esp
pop eax
test dword [ecx], eax
mov esp, ecx
push dword [eax]
pop ecx
push dword [eax + 4]
xor dword [esp], 0x1d9f7243
pop eax
xor eax, 0x1d9f7243
push ecx
mov dword [esp], eax
ret
Function at 0x401520
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, eax
cmp edi, 3
jl 0x4015b4
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx*4]
sub eax, edx
neg eax
add edi, eax
push ebx
lea ebx, [ebx]
movzx eax, byte [ecx]
shr eax, 2
movzx eax, byte [eax + 0x536d50]
mov byte [esi], al
movzx eax, byte [ecx]
movzx ebx, byte [ecx + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + 0x536d50]
mov byte [esi + 1], al
movzx eax, byte [ecx + 1]
movzx ebx, byte [ecx + 2]
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + 0x536d50]
mov byte [esi + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + 0x536d50]
mov byte [esi + 3], al
add ecx, 3
add esi, 4
dec edx
jne 0x401550
pop ebx
test edi, edi
jle 0x401628
movzx edx, byte [ecx]
shr edx, 2
mov al, byte [edx + 0x536d50]
mov byte [esi], al
mov al, 0x3d
cmp edi, 1
jle 0x40160d
movzx edx, byte [ecx]
movzx edi, byte [ecx + 1]
and edx, 3
shl edx, 4
shr edi, 4
or edx, edi
movzx edx, byte [edx + 0x536d50]
mov byte [esi + 1], dl
movzx ecx, byte [ecx + 1]
and ecx, 0xf
movzx edx, byte [ecx*4 + 0x536d50]
mov byte [esi + 3], al
mov byte [esi + 2], dl
add esi, 4
mov eax, esi
sub eax, dword [ebp + 8]
pop edi
mov byte [esi], 0
pop esi
pop ebp
ret
movzx ecx, byte [ecx]
and ecx, 3
shl ecx, 4
mov dl, byte [ecx + 0x536d50]
mov byte [esi + 1], dl
mov byte [esi + 2], al
mov byte [esi + 3], al
add esi, 4
mov eax, esi
sub eax, dword [ebp + 8]
pop edi
mov byte [esi], 0
pop esi
pop ebp
ret