joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4919f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x1bc
mov dword [eax], 0xfffffffe
mov dword [esp + 0x2c], eax
mov eax, dword [0x503558]
mov edx, dword [eax + 0x71900]
xor eax, eax
lea esi, [esi]
nop
bt edx, eax
jae 0x491a27
mov dword [esp + ebx*4 + 0x90], eax
add ebx, 1
add eax, 1
cmp eax, 0x20
jne 0x491a18
mov eax, dword [esp + 0x2c]
mov dword [eax], 0xffffffff
test ebx, ebx
je 0x491b78
lea eax, [ebx + 0x60]
lea esi, [esp + 0x110]
mov dword [esp + 0xc], 0x61
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._Techniques__c__c__List___Name__ESCexit__use_which_technique_
mov dword [esp + 4], 0x4e
mov dword [esp], esi
call fcn.004024f0
movzx eax, byte [0xde8308]
mov byte [esp + 0x2b], al
test al, al
jne 0x491baa
lea esi, [esi]
lea eax, [esp + 0x3f]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00411de0
mov edi, eax
test al, al
je 0x491c78
movzx edx, byte [esp + 0x3f]
lea eax, [edx - 0x20]
cmp al, 0x1f
jbe 0x491ad0
cmp dl, 0x40
je 0x491bc0
movsx edi, dl
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll_islower]
test eax, eax
jne 0x491af8
call fcn.0040e990
jmp 0x491a88
mov ecx, 0x80000401
bt ecx, eax
jae 0x491ab7
cmp byte [esp + 0x2b], 0
jne 0x491b50
call fcn.00409a70
call fcn.00491170
mov eax, edi
mov byte [esp + 0x2b], al
jmp 0x491a88
sub edi, 0x61
cmp ebx, edi
jle 0x491ac7
test edi, edi
js 0x491ac7
mov eax, 0xffffffff
mov edx, 0xffffffff
cmp byte [esp + 0x2b], 0
mov word [0x503544], ax
mov word [0x503542], dx
je 0x491b68
call fcn.00409b30
call fcn.0046f230
mov ebp, dword [esp + edi*4 + 0x90]
mov eax, dword [esp + 0x2c]
mov dword [eax], ebp
add esp, 0x1bc
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00409b30
call fcn.0046f230
mov byte [esp + 0x2b], 0
jmp 0x491a88
mov ebp, dword [esp + edi*4 + 0x90]
jmp 0x491b32
lea esi, [esp + 0x110]
mov dword [esp + 8], str.No_techniques_available___ESCexit
mov dword [esp + 4], 0x4e
mov dword [esp], esi
call fcn.004024f0
movzx eax, byte [0xde8308]
mov byte [esp + 0x2b], al
test al, al
je 0x491a88
call fcn.00409a70
call fcn.00491170
jmp 0x491a88
lea eax, [esp + 0x40]
mov dword [esp + 8], 0x4f
mov edi, 0x65
mov dword [esp + 4], eax
mov dword [esp], str.Technique_
mov dword [esp + 0x40], 0x72616c46
mov dword [esp + 0x44], 0x694d2065
mov dword [esp + 0x48], 0x6c697373
mov word [esp + 0x4c], di
call fcn.00411bd0
test al, al
je 0x491c8a
xor edi, edi
test ebx, ebx
jg 0x491c23
jmp 0x491ac7
add edi, 1
cmp ebx, edi
je 0x491ac7
mov ebp, dword [esp + edi*4 + 0x90]
mov eax, dword [ebp*4 + 0x501380]
mov dword [esp + 4], eax
lea eax, [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x491c18
mov ecx, 0xffffffff
mov ebx, 0xffffffff
cmp byte [esp + 0x2b], 0
mov word [0x503544], cx
mov word [0x503542], bx
je 0x491b32
call fcn.00409b30
call fcn.0046f230
jmp 0x491b32
mov word [0x503544], 0xffff
mov word [0x503542], 0xffff
cmp byte [esp + 0x2b], 0
jne 0x491c9e
xor eax, eax
add esp, 0x1bc
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00409b30
call fcn.0046f230
xor eax, eax
jmp 0x491c93
Function at 0x4967b0
Capabilities:
Read file on windows

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x11646e0]
test ebx, ebx
jne 0x4967ca
jmp 0x49682f
mov ebx, dword [ebx + 0x600]
test ebx, ebx
je 0x49682f
cmp word [ebx + 0x60c], 0
je 0x4967c0
movzx eax, word [ebx + 0x60e]
not eax
test al, 3
jne 0x4967c0
movzx eax, word [ebx + 0x610]
test ax, ax
je 0x496860
mov edx, dword [ebx + 0x604]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp + 0xc], edx
mov dword [esp], ebx
call sub.msvcrt.dll_fread
movzx edx, word [ebx + 0x60e]
test dl, 8
jne 0x496838
test eax, eax
jne 0x496898
or edx, 8
mov word [ebx + 0x60e], dx
mov ebx, dword [ebx + 0x600]
test ebx, ebx
jne 0x4967ca
add esp, 0x18
pop ebx
ret
movzx eax, word [ebx + 0x60c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x608]
mov dword [esp], eax
call fcn.0046b850
and word [ebx + 0x60e], 0xfffe
jmp 0x4967c0
mov dword [esp], 2
call dword [0x503f4c]
mov dword [esp + 4], str.Error:_trav__chunksize_should_not_be_0_in_do_xfers_n
mov dword [esp], eax
call fcn.00496420
mov eax, 0x100
mov word [ebx + 0x610], ax
mov eax, 0x100
jmp 0x4967ed
movzx eax, ax
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
movzx eax, word [ebx + 0x60c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x608]
mov dword [esp], eax
call fcn.0046b7d0
and word [ebx + 0x60e], 0xfffe
jmp 0x4967c0

Function at 0x4969b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x3c
push edi
push esi
push ebx
sub esp, 0x11c
lea edi, [esp + 0x20]
mov dword [esp + 0x10], 0x656d6f74
mov ebp, dword [esp + 0x134]
rep stosd dword es:[edi], eax
mov dword [esp + 4], 1
mov esi, dword [esp + 0x138]
mov dword [esp], 0x614
mov dword [esp + 0x14], 0x72656678
mov dword [esp + 0x18], 0x5858582e
mov dword [esp + 0x1c], 0x585858
call sub.msvcrt.dll_calloc
test eax, eax
je 0x496a39
mov ebx, eax
mov eax, dword [0x11646e0]
mov dword [0x11646e0], ebx
cmp byte [esi], 0x2f
mov dword [ebx + 0x600], eax
je 0x496a39
mov dword [esp + 4], 0x521753
mov dword [esp], esi
call sub.msvcrt.dll_strstr
test eax, eax
je 0x496a40
xor eax, eax
jmp 0x496aad
lea edi, [esp + 0x10]
mov dword [esp], edi
call fcn.004968f0
mov dword [ebx + 0x60e], 0x1000001
mov dword [ebx + 0x604], eax
test eax, eax
je 0x496ac0
mov eax, dword [esp + 0x130]
mov word [ebx + 0x60c], bp
mov dword [ebx + 0x608], eax
lea eax, [ebx + 0x400]
add ebx, 0x500
mov dword [esp + 8], 0xff
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_strncpy
mov dword [esp + 8], 0xff
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msvcrt.dll_strncpy
mov eax, 1
add esp, 0x11c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x11646e0]
cmp ebx, eax
jne 0x496adc
jmp 0x496b00
mov edx, dword [eax + 0x600]
cmp ebx, edx
je 0x496ae8
mov eax, edx
test eax, eax
jne 0x496ad0
xor eax, eax
jmp 0x496aad
mov edx, dword [ebx + 0x600]
mov dword [eax + 0x600], edx
mov dword [esp], ebx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x496aad
mov eax, dword [ebx + 0x600]
mov dword [esp], ebx
mov dword [0x11646e0], eax
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x496aad
Function at 0x496b20
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x28]
test dx, dx
je 0x496bc0
mov ebx, dword [0x11646e0]
mov eax, edx
test ebx, ebx
jne 0x496b5a
jmp 0x496bb0
mov ebx, dword [ebx + 0x600]
test ebx, ebx
je 0x496bb0
cmp ax, word [ebx + 0x60c]
jne 0x496b50
cmp esi, dword [ebx + 0x608]
jne 0x496b50
movzx eax, di
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.0046b6f0
test eax, eax
je 0x496bf0
mov eax, dword [ebx + 0x604]
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sub.msvcrt.dll_fwrite
cmp eax, edi
jb 0x496bf7
mov eax, 1
add esp, 0x10
pop ebx
pop esi
pop edi
ret
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], 1
mov dword [esp], 0x614
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x496bb0
mov eax, dword [0x11646e0]
mov dword [0x11646e0], ebx
mov dword [ebx + 0x600], eax
jmp 0x496b6b
mov eax, 0xffffffff
jmp 0x496ba9
mov dword [esp], 2
call dword [0x503f4c]
mov dword [esp + 4], str.Error:_fwrite_failed_in_local_file_write_n
mov dword [esp], eax
call fcn.00496420
mov eax, dword [ebx + 0x604]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
lea eax, [ebx + 0x500]
mov dword [esp], eax
call sub.msvcrt.dll__unlink
mov eax, dword [0x11646e0]
cmp eax, ebx
jne 0x496c4c
jmp 0x496c70
mov edx, dword [eax + 0x600]
cmp edx, ebx
je 0x496c5a
mov eax, edx
test eax, eax
jne 0x496c40
mov eax, 0xfffffffe
jmp 0x496ba9
mov edx, dword [ebx + 0x600]
mov dword [eax + 0x600], edx
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x496c50
mov eax, dword [ebx + 0x600]
mov dword [esp], ebx
mov dword [0x11646e0], eax
call sub.msvcrt.dll_free
jmp 0x496c50
Function at 0x496c90
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov eax, 0x101c
push edi
push esi
push ebx
call fcn.004f11c8
sub esp, eax
mov ecx, dword [esp + 0x1034]
mov edx, dword [esp + 0x1030]
test cx, cx
je 0x496e30
mov ebx, dword [0x11646e0]
mov eax, ecx
test ebx, ebx
jne 0x496cde
jmp 0x496e20
mov ebx, dword [ebx + 0x600]
test ebx, ebx
je 0x496e20
cmp ax, word [ebx + 0x60c]
jne 0x496cd0
cmp edx, dword [ebx + 0x608]
jne 0x496cd0
lea esi, [ebx + 0x400]
lea edi, [esp + 0x10]
mov edx, esi
mov eax, edi
call fcn.00496360
test al, al
je 0x496df8
mov dword [esp + 4], 0x521782
xor esi, esi
mov dword [esp], edi
call sub.msvcrt.dll_fopen
mov ebp, eax
test eax, eax
je 0x496d9d
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x604]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
jmp 0x496d68
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], edi
call sub.msvcrt.dll_fwrite
cmp eax, esi
jb 0x496e88
mov eax, dword [ebx + 0x604]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], edi
call sub.msvcrt.dll_fread
mov esi, eax
test eax, eax
jne 0x496d48
mov esi, 1
mov dword [esp], ebp
call sub.msvcrt.dll_fclose
mov eax, dword [ebx + 0x604]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
lea eax, [ebx + 0x500]
mov dword [esp], eax
call sub.msvcrt.dll__unlink
mov eax, dword [0x11646e0]
cmp eax, ebx
jne 0x496de0
jmp 0x496eac
mov edx, dword [eax + 0x600]
cmp edx, ebx
je 0x496e60
mov eax, edx
test eax, eax
jne 0x496dd0
add esp, 0x101c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0xde84b8]
mov dword [esp + 0xc], esi
mov dword [esp + 4], 0x1000
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00404e10
jmp 0x496d0a
add esp, 0x101c
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 1
mov dword [esp], 0x614
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x496e20
mov eax, dword [0x11646e0]
mov dword [0x11646e0], ebx
mov dword [ebx + 0x600], eax
jmp 0x496cef
mov edx, dword [ebx + 0x600]
mov dword [eax + 0x600], edx
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x101c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 2
xor esi, esi
call dword [0x503f4c]
mov dword [esp + 4], str.Error:_fwrite_failed_in_local_file_close_n
mov dword [esp], eax
call fcn.00496420
jmp 0x496d95
mov eax, dword [ebx + 0x600]
mov dword [esp], ebx
mov dword [0x11646e0], eax
call sub.msvcrt.dll_free
jmp 0x496de4
Function at 0x496ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov eax, 0x111c
push edi
push esi
push ebx
call fcn.004f11c8
sub esp, eax
mov edx, dword [esp + 0x1130]
lea eax, [esp + 0x10]
call fcn.00496360
test al, al
je 0x496fc5
lea eax, [esp + 0x10]
mov dword [esp + 4], 0x5217b2
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x496ff2
mov ebp, 1
lea edi, [esp + 0x110]
mov ebx, 0x80078071
lea esi, [esi]
nop
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
mov dword [esp], edi
call sub.msvcrt.dll_fread
test eax, eax
je 0x496f98
movzx ecx, bp
mov edx, edi
add eax, edi
lea esi, [esi]
nop
movzx ebp, byte [edx]
add edx, 1
add ecx, ebp
cmp edx, eax
jne 0x496f60
lea ebp, [ecx + ecx]
mov eax, ebp
mul ebx
mov eax, ecx
shr edx, 0xf
imul edx, edx, 0xfff1
sub ebp, edx
mul ebx
shl ebp, 0x10
shr edx, 0xf
imul edx, edx, 0xfff1
sub ecx, edx
or ebp, ecx
jmp 0x496f30
mov dword [esp], esi
xor ebx, ebx
call sub.msvcrt.dll_ferror
mov dword [esp], esi
test eax, eax
sete bl
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0x1134]
mov dword [eax], ebp
add esp, 0x111c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1130]
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [0xde84b8]
mov dword [esp + 8], eax
lea eax, [esp + 0x10]
mov dword [esp], eax
call fcn.00404e10
jmp 0x496ef8
xor ebp, ebp
mov ebx, 1
jmp 0x496faf

Function at 0x4972d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov eax, 0x117c
push edi
push esi
push ebx
call fcn.004f11c8
sub esp, eax
mov edx, dword [esp + 0x1190]
lea eax, [esp + 0x70]
mov ebp, dword [esp + 0x1194]
call fcn.00496360
test al, al
je 0x4973a0
lea eax, [esp + 0x70]
mov dword [esp + 4], 0x5217b2
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x4973d0
lea edi, [esp + 0x18]
lea ebx, [esp + 0x170]
mov dword [esp], edi
call fcn.004a1770
jmp 0x497348
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.004a17a0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fread
test eax, eax
jne 0x497338
mov dword [esp + 4], edi
xor ebx, ebx
mov dword [esp], ebp
call fcn.004a19e0
mov dword [esp], esi
call sub.msvcrt.dll_ferror
mov dword [esp], esi
test eax, eax
sete bl
call sub.msvcrt.dll_fclose
add esp, 0x117c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1190]
mov dword [esp + 4], 0x100
mov dword [esp + 0xc], eax
mov eax, dword [0xde84b8]
mov dword [esp + 8], eax
lea eax, [esp + 0x70]
mov dword [esp], eax
call fcn.00404e10
jmp 0x4972ff
mov dword [ebp], 0
mov ebx, 1
mov dword [ebp + 4], 0
mov eax, ebx
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0
add esp, 0x117c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a1770
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
ret

Function at 0x4a3ba0
Capabilities:
Encrypt data using speck

Disassembly:
movzx eax, byte [esp + 0x10]
movzx edx, byte [esp + 0xc]
add eax, eax
or eax, edx
movzx edx, byte [esp + 0x14]
shl edx, 2
or eax, edx
mov dword [esp + 0xc], eax
jmp fcn.00443190
Function at 0x4df590
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x48]
mov ebp, dword [esp + 0x40]
mov edi, esi
shr edi, 5
or edi, 1
cmp esi, edi
jb 0x4df6ea
mov edx, dword [esp + 0x44]
mov ecx, esi
mov ebx, esi
lea esi, [esi]
nop
mov ebp, ebx
mov eax, ebx
add edx, 1
sub ecx, edi
shl ebp, 5
shr eax, 2
add eax, ebp
movzx ebp, byte [edx - 1]
add eax, ebp
xor ebx, eax
cmp ecx, edi
jae 0x4df5c0
mov ebp, dword [esp + 0x40]
mov eax, dword [ebp + 0x2c]
mov edx, dword [ebp + 0x34]
sub eax, 1
and eax, ebx
mov edi, dword [edx + eax*4]
lea ecx, [eax*4]
mov dword [esp + 0x18], ecx
test edi, edi
je 0x4df644
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x44]
jmp 0x4df617
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4df640
cmp dword [edi + 8], esi
jne 0x4df610
lea eax, [edi + 0x14]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4df610
add esp, 0x2c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [esp + 0x1c]
lea eax, [esi + 0x15]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], ebp
call fcn.004da680
mov edx, dword [esp + 0x44]
mov dword [eax + 8], esi
mov edi, eax
lea eax, [eax + 0x14]
mov dword [eax - 4], 0
mov dword [eax - 8], 0
mov dword [eax - 0x14], ebx
mov dword [eax - 0x10], 0
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov byte [edi + esi + 0x14], 0
mov eax, dword [esp + 0x18]
add eax, dword [ebp + 0x34]
add esi, dword [ebp + 0x60]
mov edx, dword [eax]
add esi, 0x15
mov ecx, dword [ebp + 0x2c]
mov dword [ebp + 0x60], esi
mov dword [edi + 0xc], edx
mov dword [eax], edi
mov eax, dword [ebp + 0x30]
add eax, 1
mov dword [ebp + 0x30], eax
cmp ecx, eax
jae 0x4df633
cmp ecx, 0x3ffffffd
jg 0x4df633
lea eax, [ebp + 0x2c]
add ecx, ecx
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.004df440
add esp, 0x2c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, esi
jmp 0x4df5e1

Function at 0x4e70c0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
mov ebx, ecx
sub esp, 0x21c
lea ebp, [esp + 0x10]
cmp ecx, 0x200
ja 0x4e7120
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], ebp
call sub.msvcrt.dll_fread
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov esi, eax
mov dword [esp], edi
call fcn.004d3080
test esi, esi
setne al
test ebx, ebx
sete dl
add esp, 0x21c
or eax, edx
pop ebx
pop esi
movzx eax, al
pop edi
pop ebp
ret
mov dword [esp], ecx
call sub.msvcrt.dll_malloc
mov ebp, eax
test eax, eax
je 0x4e7162
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov esi, eax
mov dword [esp], edi
call fcn.004d3080
mov dword [esp], ebp
call sub.msvcrt.dll_free
jmp 0x4e7106
mov dword [esp + 4], str.not_enough_memory_to_read_a_file
mov dword [esp], edi
call fcn.004d7410
jmp 0x4e70dc
Function at 0x4e9440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov eax, dword [esp + 0x54]
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], ecx
mov eax, dword [eax]
cmp edx, eax
jae 0x4e9634
mov esi, ecx
movzx ecx, byte [ecx]
mov edi, dword [esp + 0x50]
xor ebp, ebp
add esi, 1
mov dword [esp + 0x20], esi
movzx esi, cl
sub edi, 1
mov dword [esp + 0x28], esi
mov esi, dword [esp + 0x10]
mov byte [esp + 0x17], cl
sub eax, esi
mov dword [esp + 0x18], eax
cmp cl, 0x2e
jne 0x4e94d5
add ebp, 1
cmp eax, ebp
jne 0x4e948e
lea esi, [esi]
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x54]
lea esi, [eax + 1]
mov eax, dword [esp + 0x10]
add edi, eax
jmp 0x4e94bb
lea ecx, [edi - 1]
cmp dword [esp + 0x10], edi
je 0x4e94cd
mov edi, ecx
mov dword [esp], ebp
mov ecx, esi
mov edx, edi
mov eax, ebx
call fcn.004e8fd0
test eax, eax
je 0x4e94b0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], ebx
movzx esi, byte [esi + ebp]
jmp 0x4e950c
mov eax, dword [esp + 0x1c]
movzx edx, byte [eax + 1]
mov eax, esi
call fcn.004e86e0
mov edx, eax
test edx, edx
je 0x4e95b8
mov eax, dword [esp + 0x18]
add ebp, 1
cmp ebp, eax
je 0x4e952f
mov eax, dword [esp + 0x10]
movzx esi, byte [eax + ebp]
cmp byte [esp + 0x17], 0x5b
je 0x4e9540
cmp byte [esp + 0x17], 0x25
je 0x4e94e0
mov eax, dword [esp + 0x28]
cmp esi, eax
jne 0x4e95b8
add ebp, 1
cmp dword [esp + 0x18], ebp
jne 0x4e9504
mov ebx, dword [esp + 0x2c]
jmp 0x4e9498
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 1]
cmp al, 0x5e
je 0x4e95e0
cmp dword [esp + 0x20], edi
jae 0x4e95b8
mov edx, 1
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x24], edx
jmp 0x4e9590
cmp dl, 0x2d
je 0x4e9600
cmp esi, eax
je 0x4e95a6
lea edx, [ebx + 1]
cmp edx, edi
jae 0x4e9628
movzx eax, byte [ebx + 1]
mov ecx, ebx
mov ebx, edx
movzx edx, byte [ecx + 2]
cmp al, 0x25
jne 0x4e9570
mov eax, esi
lea ebx, [ecx + 2]
call fcn.004e86e0
test eax, eax
je 0x4e957d
mov edx, dword [esp + 0x24]
test edx, edx
jne 0x4e94f9
lea esi, [esi]
mov dword [esp + 0x18], ebp
mov ebx, dword [esp + 0x2c]
jmp 0x4e9498
add ebp, 1
cmp dword [esp + 0x18], ebp
je 0x4e952f
mov eax, dword [esp + 0x10]
movzx esi, byte [eax + ebp]
lea esi, [esi]
mov eax, dword [esp + 0x1c]
lea ebx, [eax + 2]
cmp ebx, edi
jae 0x4e95c5
xor edx, edx
movzx eax, byte [eax + 2]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], edx
jmp 0x4e9590
lea edx, [ecx + 3]
cmp edx, edi
jae 0x4e9579
cmp esi, eax
jl 0x4e9617
movzx eax, byte [ecx + 3]
cmp esi, eax
jle 0x4e95a6
mov ebx, edx
lea edx, [ebx + 1]
cmp edx, edi
jb 0x4e9588
lea esi, [esi]
mov edx, dword [esp + 0x24]
xor edx, 1
jmp 0x4e94f1
mov dword [esp + 0x18], 0
jmp 0x4e9498
Function at 0x4f0370
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004fe950
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004fe950
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4f03d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x11e25ec]
test esi, esi
jle 0x4f04f0
mov eax, dword [0x11e25f0]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4f0404
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4f0487
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4f03f0
mov dword [esp], ebx
call fcn.004f0dc0
mov edi, eax
test eax, eax
je 0x4f0517
mov eax, dword [0x11e25f0]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004f0f00
mov edx, dword [0x11e25f0]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4f04f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4f0480
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4f0490
add dword [0x11e25ec], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x11e25f0]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4f0480
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004f0370
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4f040e
mov eax, dword [0x11e25f0]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004f0370
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004f0370
lea esi, [esi]
nop
Function at 0x4f0a30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x11e2608
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x11e2600]
sub esp, 4
test ebx, ebx
je 0x4f0a85
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4f0a7e
test esi, esi
je 0x4f0a7e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4f0a60
mov dword [esp], 0x11e2608
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4f0dc0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4f0de5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4f0df0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4f0de5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4f0e38
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4f0e2e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4f0e3a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4f0e20
xor eax, eax
pop ebx
pop esi
ret