joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bdc60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x533688
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebx + 4], edi
je 0x4bdd43
sub esp, 0x18
mov ecx, esp
push 4
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], 7
push str.C17E
mov word [ecx], ax
call fcn.00413520
lea eax, [ebp - 0x28]
push eax
call fcn.004c4350
add esp, 0x1c
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], edi
jb 0x4bdcd5
mov eax, dword [eax]
push eax
push 0
call fcn.004c0880
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4bdcfb
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004bd350
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x4bdd41
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4bdd3a
mov eax, dword [ebx + 4]
test eax, eax
je 0x4bdd33
mov ecx, dword [ebp - 0x2c]
mov edi, 1
mov eax, dword [eax + 4]
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 4
Function at 0x4bdd70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x533688
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x2c], eax
xor eax, eax
cmp dword [ebx + 4], edi
je 0x4bde53
sub esp, 0x18
mov ecx, esp
push 4
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], 7
push str.7C2C
mov word [ecx], ax
call fcn.00413520
lea eax, [ebp - 0x28]
push eax
call fcn.004c4350
add esp, 0x1c
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], edi
jb 0x4bdde5
mov eax, dword [eax]
push eax
push 0
call fcn.004c0880
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4bde0b
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004bd350
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x4bde51
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4bde4a
mov eax, dword [ebx + 4]
test eax, eax
je 0x4bde43
mov ecx, dword [ebp - 0x2c]
mov edi, 1
mov eax, dword [eax + 8]
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 4
Function at 0x4bde80
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5336b8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [esi + 4], edi
je 0x4be005
sub esp, 0x18
mov ecx, esp
push 4
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], 7
push str.145C
mov word [ecx], ax
call fcn.00413520
lea eax, [ebp - 0x28]
push eax
call fcn.004c4350
add esp, 0x1c
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], edi
jb 0x4bdefb
mov eax, dword [eax]
push eax
push 0
call fcn.004c0880
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4bdf28
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004bd350
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test ebx, ebx
je 0x4be003
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4bdffc
mov esi, dword [esi + 4]
test esi, esi
je 0x4bdffc
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x4bdfa3
lea ecx, [esi + 0x1c]
test ecx, ecx
je 0x4bdfa3
lea eax, [esi + 0x10001c]
test eax, eax
je 0x4bdfa3
mov edi, dword [ebp + 0xc]
lea eax, [edi - 0xb]
cmp eax, 0xffff4
ja 0x4bdfa3
push edi
push edx
push ecx
mov dword [esi + 0x18], edi
call fcn.004d8ee0
lea eax, [esi + 0x10001c]
push eax
lea eax, [esi + 0x1c]
push edi
push eax
call fcn.004bf370
add esp, 0x18
mov edx, dword [ebp - 0x30]
test edx, edx
je 0x4bdff0
lea ecx, [esi + 0x100030]
test ecx, ecx
je 0x4bdff0
lea eax, [esi + 0x200030]
test eax, eax
je 0x4bdff0
mov edi, dword [ebp + 0x14]
lea eax, [edi - 0xb]
cmp eax, 0xffff4
ja 0x4bdff0
push edi
push edx
push ecx
mov dword [esi + 0x10002c], edi
call fcn.004d8ee0
lea eax, [esi + 0x200030]
push eax
lea eax, [esi + 0x100030]
push edi
push eax
call fcn.004bf370
add esp, 0x18
push ebx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4be030
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5336e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
xor eax, eax
cmp dword [ebx + 4], edi
je 0x4be10b
sub esp, 0x18
mov ecx, esp
push 4
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], 7
push str.B39A
mov word [ecx], ax
call fcn.00413520
lea eax, [ebp - 0x28]
push eax
call fcn.004c4350
add esp, 0x1c
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], edi
jb 0x4be09f
mov eax, dword [eax]
push eax
push 0
call fcn.004c0880
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4be0c5
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004bd350
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x4be109
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4be102
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x4be0fb
mov eax, dword [ebp + 8]
mov edi, 1
mov dword [ecx + 0xc], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 4

Function at 0x4be130
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5336e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
xor eax, eax
cmp dword [ebx + 4], edi
je 0x4be20b
sub esp, 0x18
mov ecx, esp
push 4
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], 7
push str.BA41
mov word [ecx], ax
call fcn.00413520
lea eax, [ebp - 0x28]
push eax
call fcn.004c4350
add esp, 0x1c
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], edi
jb 0x4be19f
mov eax, dword [eax]
push eax
push 0
call fcn.004c0880
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4be1c5
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004bd350
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x4be209
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4be202
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x4be1fb
mov eax, dword [ebp + 8]
mov edi, 1
mov dword [ecx + 0x14], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 4
Function at 0x4be230
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5336e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
xor eax, eax
cmp dword [ebx + 4], edi
je 0x4be30b
sub esp, 0x18
mov ecx, esp
push 4
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], 7
push str.5D84
mov word [ecx], ax
call fcn.00413520
lea eax, [ebp - 0x28]
push eax
call fcn.004c4350
add esp, 0x1c
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], edi
jb 0x4be29f
mov eax, dword [eax]
push eax
push 0
call fcn.004c0880
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4be2c5
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004bd350
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x4be309
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4be302
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x4be2fb
mov eax, dword [ebp + 8]
mov edi, 1
mov dword [ecx + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 4

Function at 0x4be330
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5336e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
xor eax, eax
cmp dword [ebx + 4], edi
je 0x4be40b
sub esp, 0x18
mov ecx, esp
push 4
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], 7
push str.C17E
mov word [ecx], ax
call fcn.00413520
lea eax, [ebp - 0x28]
push eax
call fcn.004c4350
add esp, 0x1c
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], edi
jb 0x4be39f
mov eax, dword [eax]
push eax
push 0
call fcn.004c0880
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4be3c5
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004bd350
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x4be409
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4be402
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x4be3fb
mov eax, dword [ebp + 8]
mov edi, 1
mov dword [ecx + 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 4
Function at 0x4be430
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5336e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
xor eax, eax
cmp dword [ebx + 4], edi
je 0x4be50b
sub esp, 0x18
mov ecx, esp
push 4
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], 7
push str.7C2C
mov word [ecx], ax
call fcn.00413520
lea eax, [ebp - 0x28]
push eax
call fcn.004c4350
add esp, 0x1c
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], edi
jb 0x4be49f
mov eax, dword [eax]
push eax
push 0
call fcn.004c0880
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4be4c5
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004bd350
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x4be509
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4be502
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x4be4fb
mov eax, dword [ebp + 8]
mov edi, 1
mov dword [ecx + 8], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret 4
Function at 0x4bf030
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x4bf190
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4bf190
cmp dword [ebp + 0x14], 0
je 0x4bf190
push ebx
mov ebx, dword [ebp + 0xc]
lea ecx, [ebx + 2]
test ecx, ecx
js 0x4bf188
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x40000000
jge 0x4bf188
mov ecx, edi
cmp ebx, 2
jle 0x4bf111
lea edx, [ebx - 3]
mov eax, 0xaaaaaaab
mul edx
mov edi, edx
shr edi, 1
inc edi
lea eax, [edi*4]
sub eax, edi
neg eax
add ebx, eax
nop dword [eax]
nop dword [eax + eax]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + 0x5471b8]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
add edx, edx
movzx eax, byte [eax + edx*8 + 0x5471b8]
mov byte [ecx + 1], al
movzx edx, byte [esi + 1]
movzx eax, byte [esi + 2]
and edx, 0xf
shr eax, 6
movzx eax, byte [eax + edx*4 + 0x5471b8]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
add esi, 3
and eax, 0x3f
movzx eax, byte [eax + 0x5471b8]
mov byte [ecx + 3], al
add ecx, 4
sub edi, 1
jne 0x4bf0b0
mov edi, dword [ebp + 0x10]
test ebx, ebx
je 0x4bf175
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + 0x5471b8]
mov byte [ecx], al
cmp ebx, 1
jle 0x4bf15a
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
add edx, edx
movzx eax, byte [eax + edx*8 + 0x5471b8]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
and eax, 0xf
movzx eax, byte [eax*4 + 0x5471b8]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
jmp 0x4bf172
movzx eax, byte [esi]
and eax, 3
shl eax, 4
mov al, byte [eax + 0x5471b8]
mov byte [ecx + 1], al
mov word [ecx + 2], 0x3d3d
add ecx, 4
mov edx, dword [ebp + 0x14]
mov eax, ecx
sub eax, edi
pop ebx
pop edi
mov dword [edx], eax
xor eax, eax
mov byte [ecx], 0
pop esi
pop ebp
ret
pop ebx
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x4bf370
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x48], 0
push eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
call fcn.004bfef0
push 0x10
lea eax, [ebp - 0x5c]
push eax
push esi
call fcn.004bf2c0
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop esi
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret
Function at 0x4bf3e0
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
mov dword [ebp - 0x64], ecx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4bf4d7
push esi
push 0xa000
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
call fcn.004d72c0
add esp, 4
mov dword [ebp - 0x60], 0
mov esi, eax
lea eax, [ebp - 0x60]
push 0
push eax
push 0xa000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4bf4b7
nop dword [eax]
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x4bf4b5
push eax
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.004bfef0
add esp, 0xc
mov dword [ebp - 0x60], 0
lea eax, [ebp - 0x60]
push 0
push eax
push 0xa000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4bf480
jmp 0x4bf4b7
mov bl, 1
push esi
call fcn.004d71b8
push dword [ebp + 0x10]
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x64]
call fcn.004bf2c0
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret

Function at 0x4bf610
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x58], 0
push eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x5c], 0
push eax
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
call fcn.004bfef0
push 0x10
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004bf2c0
add esp, 0x18
xor edi, edi
xor esi, esi
nop word [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push str._02x
lea eax, [ebx + edi*2]
push 3
push eax
call fcn.00412070
inc esi
add esp, 0x10
add edi, eax
cmp esi, 0x10
jl 0x4bf680
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret
Function at 0x4bf6c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x58], 0
push eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x5c], 0
push eax
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
call fcn.004bfef0
push 0x10
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004bf2c0
add esp, 0x18
xor edi, edi
xor esi, esi
nop word [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push 0x546258
lea eax, [ebx + edi]
push 3
push eax
call fcn.0042cf60
inc esi
add esp, 0x10
add edi, eax
cmp esi, 0x10
jl 0x4bf730
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret

Function at 0x4bf770
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x48], 0
push eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
call fcn.004bfef0
push dword [ebp + 0x14]
lea eax, [ebp - 0x5c]
push eax
push esi
call fcn.004bf2c0
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop esi
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret
Function at 0x4bffa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x533780
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x26
lea eax, [ebp - 0x48]
mov dword [ebp - 0x4c], 0
push eax
push 0x3f
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x48], 0xd4aec58c
mov dword [ebp - 0x44], 0xd4b5c5b9
mov dword [ebp - 0x40], 0xd4a0c5a8
mov dword [ebp - 0x3c], 0xd4a4c5ad
mov dword [ebp - 0x38], 0xd492c583
mov dword [ebp - 0x34], 0xd4a6c5b0
mov dword [ebp - 0x30], 0xd4b4c5b0
mov dword [ebp - 0x2c], 0xd4afc596
mov dword [ebp - 0x28], 0xd4b4c5af
mov word [ebp - 0x24], 0xc5ab
call fcn.004c00d0
push 0xe
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
push 0x14
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x20], 0xa9f99ad8
mov dword [ebp - 0x1c], 0xa9e39ac0
mov dword [ebp - 0x18], 0xa9df9ac7
mov word [ebp - 0x14], 0x9af0
call fcn.004c00d0
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 1
call fcn.004c02f0
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x7c]
call fcn.004c02f0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x4c], 3
lea ecx, [ebp - 0x68]
sete bl
call fcn.004c0120
lea ecx, [ebp - 0x7c]
call fcn.004c0120
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret

Function at 0x4c07b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
test eax, eax
jne 0x4c07da
pop edi
mov esp, ebp
pop ebp
ret
push esi
push eax
call fcn.004e1b5b
add esp, 4
mov esi, eax
push esi
push dword [ebp - 4]
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4c085f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x597154
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4c085f
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
movzx eax, word [edx + 0xa]
mov word [ecx], ax
movzx eax, word [edx + 8]
mov word [ecx + 2], ax
movzx eax, word [edx + 0xe]
mov word [ecx + 4], ax
movzx eax, word [edx + 0xc]
mov word [ecx + 6], ax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4c085a
movzx eax, word [edx + 0x12]
mov word [ecx], ax
movzx eax, word [edx + 0x10]
mov word [ecx + 2], ax
movzx eax, word [edx + 0x16]
mov word [ecx + 4], ax
movzx eax, word [edx + 0x14]
mov word [ecx + 6], ax
mov edi, 1
test esi, esi
je 0x4c086c
push esi
call fcn.004e1b56
add esp, 4
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret