joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47668b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov eax, dword [0x54108c]
mov edi, ecx
test eax, eax
je 0x47680f
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x4766c2
cmp dword [eax + 4], 0
mov esi, eax
je 0x4766c2
add esi, 4
jmp 0x476805
mov eax, dword [0x54108c]
test eax, eax
je 0x47681e
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x476803
mov esi, eax
test eax, eax
jne 0x476725
mov al, byte [0x5c91e8]
mov ecx, 8
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x47688b
mov dword [eax], 0x54108c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x54108c]
test eax, eax
je 0x47682d
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x476739
mov ebx, dword [edi]
mov dword [edi], 0
test ebx, ebx
jne 0x4767f1
lea ecx, [esp + 0x3c]
xorps xmm0, xmm0
movups xmmword [ecx + 0x10], xmm0
movups xmmword [ecx], xmm0
call fcn.004786f9
test eax, eax
jne 0x47683c
movups xmm0, xmmword [esp + 0x3c]
movups xmm1, xmmword [esp + 0x4c]
mov ecx, 0x158
mov edx, 8
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm1
mov al, byte [0x5c91e8]
call fcn.0041aa20
test eax, eax
je 0x47687f
mov ebx, eax
xor eax, eax
xor edi, edi
inc eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov eax, ebx
add eax, 8
push 0x100
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
movaps xmm0, xmmword [esp + 0x10]
movaps xmm1, xmmword [esp]
mov dword [ebx + 0x108], 0x40
mov eax, 0x10000
movups xmmword [ebx + 0x110], xmm0
movups xmmword [ebx + 0x120], xmm1
xorps xmm1, xmm1
movups xmmword [ebx + 0x130], xmm1
mov dword [ebx + 0x144], edi
mov dword [ebx + 0x140], eax
mov dword [ebx + 0x14c], edi
mov dword [ebx + 0x148], eax
mov dword [ebx + 0x150], edi
add esi, 4
mov ecx, dword [esi]
mov dword [esi], ebx
test ecx, ecx
je 0x476805
call fcn.00475223
jmp 0x476805
xor esi, esi
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x54108c
call fcn.004832d0
jmp 0x4766a7
mov ecx, 0x54108c
call fcn.004832d0
jmp 0x4766d0
mov ecx, 0x54108c
call fcn.004832d0
jmp 0x47671e
xor edx, edx
lea ecx, [esp + 0x2c]
lea esi, [esp + 0x34]
mov dword [ecx], eax
mov dword [esi], ecx
mov dword [ecx + 4], 0x568c00
lea ecx, [esp + 0x3c]
inc edx
mov dword [esi + 4], 0x4786b0
mov dword [ecx], 0x568b6c
mov dword [ecx + 4], edx
mov dword [ecx + 0x10], 0
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov edx, 0x568a90
call fcn.00444350
ud2
mov ecx, 8
mov edx, 0x158
jmp 0x476895
mov ecx, 4
mov edx, 8
call fcn.0041b1c0
ud2
Function at 0x4786f9
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, ecx
push 2
push 0x20
push ecx
push 0
call sub.bcrypt.dll_BCryptGenRandom
xor edi, edi
cmp eax, 0xc0000000
jb 0x478746
mov esi, eax
push 0x20
push ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x478746
mov al, byte [0x5c91e8]
mov ecx, 4
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x47874d
mov edi, eax
add esi, 0x80000000
mov dword [eax], esi
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 4
call fcn.0041b1c0
ud2
Function at 0x4797ba
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x18], ecx
mov edi, 0x98badcfe
mov ebx, 0x10325476
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
shrd eax, esi, cl
shr esi, cl
test cl, 0x20
lea ecx, [ecx + 1]
cmove esi, eax
mov eax, 0
mov edx, esi
and edx, 1
bt esi, 0
mov esi, 0xefcdab89
adc eax, 0xffffffff
dec edx
xor ebx, esi
and edx, esi
mov esi, 0x67452301
xor ebx, edx
mov edx, edi
and eax, esi
xor edi, esi
xor edi, eax
shld edi, ebx, 1
shld ebx, edx, 1
cmp ecx, 0x40
jne 0x4797dd
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
xor ecx, edi
xor edx, ebx
mov dword [eax], edx
mov dword [eax + 4], ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4798fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
mov edi, ecx
call dword [ebp + 8]
mov ecx, eax
xor edx, esi
xor eax, eax
mov esi, 0x10
xor ecx, edi
mov edi, edx
shr edx, 4
shld edi, ecx, 0x1c
and ecx, 0xf
xor eax, ecx
dec esi
mov ecx, edi
jne 0x479913
pop esi
pop edi
pop ebp
ret

Function at 0x479a89
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 8
mov esi, ecx
push 0x20
push edx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x479aa5
mov byte [esi + 0x10], 5
jmp 0x479ad3
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x10]
xor ebx, ebx
mov byte [ecx], bl
mov dword [ecx + 4], eax
call fcn.00479a03
mov dword [esi], str.couldnt_generate_random_bytes
mov dword [esi + 4], 0x1e
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x5691bc
mov byte [esi + 0x10], bl
add esp, 8
pop esi
pop ebx
pop ebp
ret
Function at 0x482320
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x482337
test eax, eax
jne 0x482498
mov edi, dword [0x5c9140]
test edi, edi
je 0x482498
mov dword [ebp - 0x10], 0
jmp 0x482357
mov edi, dword [edi + 8]
test edi, edi
je 0x482386
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4824d7
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x482350
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x482350
test byte [ebp - 0x10], 1
je 0x482498
mov edi, dword [0x5c9140]
test edi, edi
je 0x482498
mov dword [ebp - 0x10], 0
jmp 0x4823b7
mov edi, dword [edi + 8]
test edi, edi
je 0x4823e6
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4824d7
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x4823b0
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x4823b0
test byte [ebp - 0x10], 1
je 0x482498
mov edi, dword [0x5c9140]
test edi, edi
je 0x482498
mov dword [ebp - 0x10], 0
jmp 0x482417
mov edi, dword [edi + 8]
test edi, edi
je 0x482446
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4824d7
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x482410
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x482410
test byte [ebp - 0x10], 1
je 0x482498
mov edi, dword [0x5c9140]
test edi, edi
je 0x482498
mov dword [ebp - 0x10], 0
jmp 0x482467
mov edi, dword [edi + 8]
test edi, edi
je 0x482492
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4824d7
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x482460
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x482460
test byte [ebp - 0x10], 1
jne 0x4824a2
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, dword [0x5c9140]
jmp 0x4824ad
mov edi, dword [edi + 8]
test edi, edi
je 0x482498
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4824d7
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x4824aa
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
jmp 0x4824aa
mov edx, 0x2b
mov ecx, str.called__Option::unwrap____on_a__None__value_home_vi_.cargo_registry_src_index.crates.io_6f17d22bba15001f_url_1.7.2_src_lib.rsURL_has_no_host
push 0x56c5fc
call fcn.00445340
add esp, 4
ud2
Function at 0x482f90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x5410d8]
test eax, eax
je 0x483054
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x482fbe
cmp dword [eax + 4], 0
mov edi, eax
je 0x482fbe
add edi, 8
jmp 0x48304e
mov eax, dword [0x5410d8]
test eax, eax
je 0x483063
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x48304c
mov esi, eax
test eax, eax
jne 0x48301b
movzx eax, byte [0x5c91e8]
mov ecx, 0x10
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x48307e
mov dword [eax], 0x5410d8
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5410d8]
test eax, eax
je 0x483072
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
mov ecx, dword [esi + 0xc]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
je 0x48304e
test ecx, ecx
je 0x48304e
lock dec dword [ecx]
jne 0x48304e
call fcn.004830a0
jmp 0x48304e
xor edi, edi
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov ecx, 0x5410d8
call fcn.004832d0
jmp 0x482fa3
mov ecx, 0x5410d8
call fcn.004832d0
jmp 0x482fcc
mov ecx, 0x5410d8
call fcn.004832d0
jmp 0x483014
mov ecx, 4
mov edx, 0x10
call fcn.0041b1c0
ud2

Function at 0x4832d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x483339
lea ebx, [esi + 0xc]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push ebx
call sub.kernel32.dll_InitOnceBeginInitialize
cmp eax, 1
mov dword [ebp - 0x10], eax
jne 0x483373
cmp dword [ebp - 0x14], 0
je 0x48335a
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x483395
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x5c9140]
nop
mov dword [esi + 8], eax
lock cmpxchg dword [0x5c9140], esi
jne 0x483320
push 0
push 0
push ebx
call sub.kernel32.dll_InitOnceComplete
jmp 0x483369
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x4833d1
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x48335e
mov edi, dword [ebp - 0x10]
jmp 0x483369
mov edi, dword [esi]
jmp 0x483368
mov edi, eax
push dword [ebp - 0x10]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x10]
mov edx, 0x56c578
push 0x56c5d8
push eax
call fcn.00483410
add esp, 8
ud2
push 0
push 4
push ebx
call sub.kernel32.dll_InitOnceComplete
lea ecx, [ebp - 0x2c]
mov edx, 0x56c5c8
mov dword [ebp - 0x2c], 0x56c590
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], str.failed_to_write_whole_buffer
mov dword [ebp - 0x20], 0
call fcn.00444350
ud2
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x56c590
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], str.failed_to_write_whole_buffer
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.00483470
ud2
Function at 0x483940
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x5410e8]
test eax, eax
je 0x4839c5
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x483961
cmp byte [eax + 4], 0
mov esi, eax
jne 0x4839b9
mov eax, dword [0x5410e8]
test eax, eax
je 0x4839d4
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x4839be
mov esi, eax
test eax, eax
jne 0x4839b3
movzx eax, byte [0x5c91e8]
mov ecx, 8
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x4839ec
mov dword [eax], 0x5410e8
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x5410e8]
test eax, eax
je 0x4839e0
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
mov word [esi + 4], 1
add esi, 5
jmp 0x4839c0
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0x5410e8
call fcn.004832d0
jmp 0x48394e
mov ecx, 0x5410e8
call fcn.004832d0
jmp 0x48396b
mov ecx, 0x5410e8
call fcn.004832d0
jmp 0x4839ac
mov ecx, 4
mov edx, 8
call fcn.0041b1c0
ud2

Function at 0x4846c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x103
lea edx, [ebp - 0x14]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x48470f
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x14]
cmp eax, 0x103
je 0x484731
test eax, eax
js 0x48471d
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov al, 4
jmp 0x484728
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0xc]
mov dword [ebp - 0x3c], 0x56bdfc
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x30], 0
push eax
push ecx
push edx
call fcn.00482790
add esp, 0xc
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
call fcn.00482890
mov ecx, 7
int 0x29
ud2
Function at 0x484d50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x5410c8]
test eax, eax
je 0x484de9
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x484d78
cmp dword [eax + 4], 0
je 0x484d78
add eax, 8
jmp 0x484de6
mov eax, dword [0x5410c8]
test eax, eax
je 0x484df8
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x484de4
mov esi, eax
test eax, eax
jne 0x484dcd
movzx eax, byte [0x5c91e8]
mov ecx, 0x10
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x484e13
mov dword [eax], 0x5410c8
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5410c8]
test eax, eax
je 0x484e07
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
jmp 0x484de6
xor eax, eax
pop esi
pop ebp
ret
mov ecx, 0x5410c8
call fcn.004832d0
jmp 0x484d62
mov ecx, 0x5410c8
call fcn.004832d0
jmp 0x484d82
mov ecx, 0x5410c8
call fcn.004832d0
jmp 0x484dc6
mov ecx, 4
mov edx, 0x10
call fcn.0041b1c0
ud2
Function at 0x487a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
movzx ebx, byte [edx + 0x1c]
mov dword [ebp - 0x20], ecx
xor eax, eax
mov ecx, 0
mov edi, edx
call 0x487aae
pop esi
cmp bl, 1
setne dl
sbb ecx, ecx
or cl, dl
cmp cl, 0xff
movzx edx, cl
je 0x487ac5
test edx, edx
jne 0x487ae8
mov byte [ebp - 0x14], bl
movzx ebx, byte [edi + 0x1e]
cmp cl, 0xff
mov dword [ebp - 0x18], ebx
je 0x487ad8
test edx, edx
jne 0x487ae2
mov ecx, edi
call fcn.004879a0
movzx eax, al
movzx ebx, byte [ebp - 0x14]
jmp 0x487aef
mov dword [ebp - 0x18], 0
xor ecx, ecx
test bl, bl
jne 0x487b49
xor ecx, ecx
cmp byte [edi + 8], 6
lea edx, [edi + 8]
cmove edx, ecx
je 0x487b49
movzx ebx, byte [edx]
mov ecx, 6
add esi, dword [ebx*4 + 0x487c58]
jmp esi
add eax, ecx
movzx ecx, byte [ebp - 0x18]
mov edx, dword [edi + 4]
mov dword [ebp - 0x1c], ecx
add ecx, eax
cmp edx, ecx
jb 0x487c41
mov esi, edi
mov edi, dword [edi]
cmp edx, ecx
mov ebx, edi
lea ebx, [edi + ecx]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
jne 0x487b80
movzx eax, byte [esi + 8]
mov byte [ebp - 0xd], al
mov ebx, dword [ebp - 0x14]
xor eax, eax
jmp 0x487bf2
movzx ebx, byte [esi + 8]
cmp bl, 3
mov byte [ebp - 0xd], bl
jae 0x487bab
add eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
sub eax, edx
lea esi, [edx + esi - 1]
nop dword [eax + eax]
cmp byte [esi], 0x5c
je 0x487bde
dec esi
inc eax
jne 0x487ba0
jmp 0x487b79
add eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
sub eax, edx
lea edi, [edx + esi - 1]
nop word [eax + eax]
movzx esi, byte [edi]
cmp esi, 0x2f
je 0x487bdb
cmp esi, 0x5c
je 0x487bdb
dec edi
inc eax
jne 0x487bc0
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
xor eax, eax
jmp 0x487bf2
mov edx, dword [ebp - 0x1c]
not eax
lea ecx, [ecx + eax + 1]
cmp edx, ecx
jb 0x487c48
mov ebx, dword [ebp - 0x18]
mov eax, 1
add ebx, ecx
sub edx, ecx
je 0x487c16
mov cl, 9
cmp edx, 2
je 0x487c1a
cmp edx, 1
jne 0x487c29
cmp byte [ebx], 0x2e
jne 0x487c29
xor ecx, ecx
cmp byte [ebp - 0xd], 3
setae cl
lea ecx, [ecx + ecx*2 + 7]
jmp 0x487c29
mov cl, 0xa
jmp 0x487c29
cmp byte [ebx], 0x2e
jne 0x487c29
cmp byte [ebx + 1], 0x2e
sete cl
xor cl, 9
mov esi, dword [ebp - 0x20]
add eax, edx
mov dword [esi], eax
mov byte [esi + 4], cl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x56b1fc
jmp 0x487c4d
push 0x56b20c
call fcn.00444cf0
add esp, 4
ud2
Function at 0x487e50
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
movaps xmm0, xmmword [0x542380]
mov eax, dword [ebp + 8]
mov ebx, ecx
mov dword [esp + 0x34], 0
mov word [esp + 0x38], 0
mov dword [esp + 0x18], 0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x30], 0
mov byte [esp + 0x34], 1
lea esi, [esp + 0x18]
lea ecx, [esp + 0x10]
push esi
push eax
call fcn.004a2f60
add esp, 8
cmp byte [esp + 0x10], 4
jne 0x487eb0
mov esi, dword [esp + 0x14]
jmp 0x487f0e
movzx eax, byte [esp + 0x10]
mov esi, dword [esp + 0x14]
cmp eax, 4
je 0x487f0e
cmp eax, 3
jne 0x487f03
mov edi, dword [esi + 4]
mov dword [esp + 4], ebx
mov ebx, dword [esi]
mov eax, dword [edi]
push ebx
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x487ef1
cmp dword [edi + 8], 9
jb 0x487ee3
mov ebx, dword [ebx - 4]
push ebx
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
push esi
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
mov ebx, dword [esp + 4]
mov dword [ebx], 0
jmp 0x488048
lea edi, [esp + 0x18]
mov edx, esi
mov ecx, edi
call fcn.004a3170
mov eax, dword [esp + 0x18]
xor eax, 2
or eax, dword [esp + 0x1c]
jne 0x487f80
cmp byte [esp + 0x20], 3
jne 0x487fc1
mov eax, dword [esp + 0x24]
mov dword [esp + 4], ebx
mov ebx, dword [eax + 4]
mov edi, dword [eax]
mov dword [esp + 8], eax
mov eax, dword [ebx]
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x487f69
cmp dword [ebx + 8], 9
jb 0x487f5b
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
push dword [esp + 8]
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
mov ebx, dword [esp + 4]
jmp 0x487fc1
cmp dword [esp + 0x54], 0
jne 0x487fc1
mov eax, dword [esp + 0x50]
test esi, esi
mov dword [esp + 8], eax
je 0x487fc9
mov dword [esp + 0x18], 0
call sub.kernel32.dll_GetCurrentProcess
push 2
push 0
push 0
push edi
push eax
push esi
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x488037
mov eax, dword [esp + 0x18]
mov dword [esp + 4], ebx
jmp 0x487fcf
mov dword [ebx], 0
jmp 0x488042
mov dword [esp + 4], ebx
xor eax, eax
push 0
push 0
push 0
push 2
push 0
mov dword [esp + 0x20], eax
push eax
call sub.kernel32.dll_CreateFileMappingA
test eax, eax
je 0x488022
mov edi, eax
push dword [esp + 8]
push 0
push 0
push 4
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
push edi
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x488022
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], edx
mov dword [eax], 1
jmp 0x488042
mov eax, dword [esp + 4]
mov dword [eax], 0
push dword [esp + 0xc]
call sub.kernel32.dll_CloseHandle
jmp 0x488042
call sub.kernel32.dll_GetLastError
mov dword [ebx], 0
push esi
call sub.kernel32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x488e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x4a0
call fcn.00488e14
Function at 0x49c450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov dword [esp], ecx
mov eax, dword [edx + 4]
mov ecx, dword [edx + 8]
mov ebx, dword [edx]
mov esi, edx
mov dword [esp + 0x3c], eax
call fcn.00457f30
mov ecx, dword [esp + 0x3c]
mov edi, eax
mov eax, ebx
test edx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
je 0x49c55a
mov ebx, edx
nop dword [eax + eax]
dec ebx
add edi, 0x10
cmp ebx, 0xffffffff
je 0x49c56e
lea eax, [edi - 0x10]
lea ecx, [esp + 0x20]
lea esi, [esp + 0x40]
lea edx, [esp + 0xc]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, dword [esp + 0x1c]
movsd qword [esp + 0x48], xmm1
movsd qword [esp + 0x40], xmm0
mov eax, dword [eax + 0xc]
push esi
push dword [eax + 0x20]
call fcn.00497da0
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, eax
xor edx, 0x2e
or edx, ecx
je 0x49c59a
lea esi, [esp + 0x32]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
mov esi, dword [esi]
mov dword [esp + 4], esi
lea esi, [esp + 0x32]
movzx esi, word [esi + 4]
mov word [esp + 8], si
movzx esi, word [esp + 0x30]
cmp si, word [ebp + 8]
mov esi, dword [esp + 0x2c]
jne 0x49c4a0
movzx edi, word [esp + 8]
mov ebx, dword [esp]
mov word [ebx + 0x16], di
mov edi, dword [esp + 4]
mov dword [ebx + 0x12], edi
mov dword [ebx + 4], ecx
movzx ecx, word [ebp + 8]
mov dword [ebx], eax
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], esi
mov word [ebx + 0x10], cx
jmp 0x49c5db
cmp dword [esi + 0x14], 0
jne 0x49c588
sub eax, dword [esi]
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], eax
jmp 0x49c588
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x14], 0
jne 0x49c588
mov ecx, dword [esp + 0xc]
sub ecx, dword [eax]
mov dword [eax + 0x14], 1
mov dword [eax + 0x18], ecx
mov eax, dword [esp]
mov dword [eax + 4], 0
mov dword [eax], 0x2e
jmp 0x49c5db
lea edx, [esp + 0x32]
mov ecx, dword [esp]
mov edi, dword [esp + 0x2c]
mov esi, dword [edx]
movzx eax, word [edx + 4]
movzx edx, word [esp + 0x30]
mov dword [esp + 4], esi
mov dword [ecx + 0x12], esi
mov esi, dword [esp + 0x28]
mov word [ecx + 0x16], ax
mov word [esp + 8], ax
mov dword [ecx + 0xc], edi
mov dword [ecx + 8], esi
mov word [ecx + 0x10], dx
mov dword [ecx + 4], 0
mov dword [ecx], 0x2f
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret