joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cc770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x58]
cmp eax, dword [edi + 0x920]
jne 0x4cc7e3
mov eax, dword [edi + 0xbc]
add eax, dword [edi + 0xb8]
jne 0x4cc7e3
cmp dword [edi + 0x924], eax
jne 0x4cc7e3
cmp dword [edi + 0x928], eax
jne 0x4cc7e3
cmp dword [edi + 8], 0x8002
ja 0x4cc7be
jne 0x4cc7e3
mov eax, dword [edi + 0x10]
cmp byte [eax + 0x4000d], 0x15
je 0x4cc7e3
movzx eax, word [edi + 0x40]
push eax
push 2
push edi
mov dword [edi + 0xac], 0
call fcn.004cb460
add esp, 0xc
mov eax, 2
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
push edi
mov dword [edi + 0x6c], esi
call fcn.004c6220
mov eax, dword [edi + 0x64]
lea ecx, [esi - 2]
add esp, 4
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x4cc805
mov dword [esp + 0x38], edx
jmp 0x4cc816
push ecx
push edi
call fcn.004cd910
mov dword [esp + 0x40], eax
add esp, 8
mov eax, dword [edi + 0x64]
lea ecx, [esi*4]
mov eax, dword [ecx + eax - 4]
mov dword [esp + 0xc], ecx
test eax, eax
jne 0x4cc84c
mov ax, word [edi + 0x70]
dec esi
add ax, si
mov dword [edi + 0x7a], 0x47930044
mov ecx, edi
mov word [edi + 0x78], ax
call fcn.004e0060
mov ecx, dword [edi + 0x64]
mov dword [ecx + esi*4], eax
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 3
mov dword [esp + 0x3c], eax
mov eax, dword [edi + 0x54]
mov dword [esp + 0x48], 1
mov edx, dword [eax + 0x10]
mov eax, dword [edx + esi*8 - 0x10]
mov ecx, dword [edx + esi*8 - 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [edx + esi*8 - 8]
mov dword [esp + 0x18], eax
sbb eax, eax
neg eax
mov dword [esp + 0x14], ecx
mov ecx, dword [edx + esi*8 - 4]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x24], ecx
call fcn.004ca6c0
add eax, esi
mov byte [edi + 0x75], 1
add esp, 8
mov dword [edi + 0x6c], eax
test dword [esp + 0x3c], 0x1f000000
je 0x4cc8f2
mov eax, dword [edi + 0x64]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x48]
or ecx, 0x100000
mov dword [eax + edx - 4], ecx
mov eax, dword [edi + 0x64]
mov ecx, dword [esp + 0x3c]
mov dword [edx + eax], ecx
mov ecx, dword [edi + 0x64]
mov eax, dword [esp + 0x40]
mov dword [ecx + edx + 4], eax
mov ecx, dword [edi + 0x58]
movzx eax, word [ecx + 6]
add eax, 0xffff8002
lea eax, [ecx + eax*4]
mov dword [edi + 0x58], eax
mov eax, 2
pop edi
pop esi
mov esp, ebp
pop ebp
ret
add dword [edi + 0x58], 8
lea eax, [esi - 3]
mov dword [edi + 0x6c], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4d1d90
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
mov edx, dword [esi + 0x48]
movzx eax, word [edi + 2]
lea ecx, [edx + eax*8]
movzx eax, word [ecx]
lea eax, [edx + eax*8]
mov dword [esp + 0x18], eax
movzx eax, word [ecx + 2]
lea ebp, [eax + eax*2]
shl ebp, 3
cmp byte [edi + 6], 0
jge 0x4d1dcd
cmp byte [edi + 7], 0
jne 0x4d1dcd
mov ebx, 0x80
jmp 0x4d1de1
push 0xef
push edi
push esi
call fcn.004d73a0
mov edx, dword [esi + 0x48]
add esp, 0xc
mov ebx, eax
movzx ecx, word [edi]
movzx eax, byte [edx + ecx*8 + 6]
mov dword [esp + 0x14], eax
test al, al
jns 0x4d1e04
push 0xef
push ecx
push esi
call fcn.004d72e0
add esp, 0xc
mov dword [esp + 0x14], eax
mov ecx, dword [esi + 0x60]
btr ecx, eax
mov dword [esi + 0x60], ecx
test bl, bl
js 0x4d1e60
test ebp, ebp
je 0x4d1e3d
push ebp
cmp ebx, eax
jne 0x4d1e2b
push ebx
push 0x838100
push esi
call fcn.004d6480
add esp, 0x10
jmp 0x4d1e60
push eax
push ebx
push 0x8d0000fe
push esi
call fcn.004d67f0
add esp, 0x14
jmp 0x4d1e60
cmp ebx, eax
je 0x4d1e60
mov ecx, dword [esi + 0x40]
and al, 7
and bl, 7
sub al, 0x40
shl bl, 3
add bl, al
mov byte [ecx - 1], bl
lea eax, [ecx - 2]
mov dword [ecx - 5], 0x8b0000fe
mov dword [esi + 0x40], eax
push 5
push esi
call fcn.004d0c70
mov ecx, dword [esp + 0x20]
add esp, 8
mov ebx, dword [esi + 0x40]
mov al, byte [ecx + 4]
and al, 0x1f
cmp al, 0xe
jne 0x4d1eed
mov ecx, dword [ecx + 8]
movsx eax, cl
cmp ecx, eax
jne 0x4d1e94
lea eax, [ebx - 1]
mov dword [esi + 0x40], eax
mov byte [eax], cl
mov ecx, 0x830000fe
jmp 0x4d1ea0
mov dword [ebx - 4], ecx
mov ecx, 0x810000fe
add dword [esi + 0x40], 0xfffffffc
mov edi, dword [esp + 0x14]
lea eax, [ebp + 8]
push eax
push edi
push 7
push ecx
push esi
call fcn.004d67f0
mov ecx, dword [esi + 0x40]
add esp, 0x14
sub bl, cl
mov byte [ecx - 2], 0x75
lea eax, [ecx - 2]
mov byte [ecx - 1], bl
mov dword [esi + 0x40], eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax + 0xc]
movsx eax, dl
cmp edx, eax
jne 0x4d1edf
lea eax, [ecx - 3]
mov dword [esi + 0x40], eax
mov byte [eax], dl
jmp 0x4d1f2c
mov dword [ecx - 6], edx
mov ecx, 0x810000fe
add dword [esi + 0x40], 0xfffffffc
jmp 0x4d1f31
mov edi, dword [esp + 0x14]
cmp al, 2
jbe 0x4d1f19
push dword [ecx]
lea eax, [ebp + 8]
push eax
push edi
push 0x838107
push esi
call fcn.004d6420
mov eax, dword [esi + 0x40]
add esp, 0x14
sub bl, al
mov byte [eax - 2], 0x75
mov byte [eax - 1], bl
lea ebx, [eax - 2]
mov eax, dword [esp + 0x18]
lea ecx, [ebx - 1]
mov dword [esi + 0x40], ecx
mov al, byte [eax + 4]
and al, 0x1f
not al
mov byte [ecx], al
mov ecx, 0x830000fe
lea eax, [ebp + 0xc]
push eax
push edi
push 7
push ecx
push esi
call fcn.004d67f0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4dde60
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
dec esi
mov eax, dword [edi + 0x10]
lea esi, [eax + esi*8]
cmp esi, dword [edi + 0x14]
jae 0x4ddfaa
mov eax, dword [esi + 4]
cmp eax, 0xfffffff2
jbe 0x4ddf8c
cmp eax, 0xfffffff5
jne 0x4ddf7a
mov eax, dword [edi + 8]
mov ecx, dword [eax + 0xfc]
mov dword [esp + 0xc], ecx
mov dword [ecx + 0xc], edi
mov eax, dword [esi]
mov esi, dword [ecx]
movzx edx, word [eax + 6]
lea edi, [eax + 8]
mov eax, edx
add eax, eax
mov ecx, dword [esi + eax*8]
mov eax, ecx
and eax, 0xf0800000
cmp eax, 0x20800000
jne 0x4ddec8
mov edi, dword [edi]
movzx ecx, cx
cmovne ecx, edx
shl ecx, 4
add ecx, esi
mov edx, dword [ecx]
mov eax, edx
and eax, 0xf0000000
cmp eax, 0x80000000
jne 0x4ddefb
movzx ecx, dx
shl ecx, 4
add ecx, esi
mov edx, dword [ecx]
mov eax, edx
and eax, 0xf0000000
cmp eax, 0x80000000
je 0x4ddee3
mov eax, edx
and eax, 0xf0000000
cmp eax, 0x50000000
jne 0x4ddf13
movzx ecx, dx
shl ecx, 4
add ecx, esi
mov edx, dword [ecx]
and edx, 0xfc800000
cmp edx, 0x800000
jne 0x4ddf37
cmp dword [ecx + 4], 8
jne 0x4ddf37
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xc
mov eax, 0xc
jmp 0x4ddf4b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
test eax, eax
jne 0x4ddf4b
mov dword [edx], 0xb
mov eax, 0xb
mov edx, dword [ebp + 0xc]
shl edx, 8
push edx
push edi
lea edx, [esp + 0x18]
shl eax, 4
push edx
push ecx
mov ecx, dword [esp + 0x1c]
add eax, dword [ecx]
push eax
push ecx
call fcn.004d84b0
mov eax, dword [esp + 0x28]
add esp, 0x18
mov edx, dword [esp + 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0xfffffffb
jne 0x4ddfaa
mov ecx, dword [esi]
mov edx, esi
call fcn.004ab480
test eax, eax
je 0x4ddfaa
movsd xmm0, qword [esi]
xor edx, edx
addsd xmm0, qword [0x5924e8]
pop edi
pop esi
movsd qword [esp + 8], xmm0
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
push 3
push dword [ebp + 0xc]
push edi
call fcn.0049f4e0
int3
Function at 0x4de030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov eax, dword [ebx + 0x10]
mov esi, dword [esp + 0x24]
push edi
cmp dword [eax + 4], 0xfffffff5
jne 0x4de0a7
mov eax, dword [eax]
mov edx, dword [ebp]
movzx edi, word [eax + 6]
mov eax, edi
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
jne 0x4de086
nop word [eax + eax]
movzx eax, cx
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
je 0x4de070
mov eax, ecx
movzx ecx, cx
and eax, 0xf0000000
cmp eax, 0x20000000
push esi
cmovne ecx, edi
push ecx
push ebp
call fcn.004a3c00
add esp, 0xc
test eax, eax
jne 0x4de10d
mov eax, dword [ebx + 0x10]
lea ecx, [eax + 8]
cmp ecx, dword [ebx + 0x14]
jae 0x4de11f
cmp dword [eax + 0xc], 0xfffffff5
jne 0x4de11f
mov eax, dword [ecx]
mov edx, dword [ebp]
movzx edi, word [eax + 6]
mov eax, edi
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
jne 0x4de0ec
movzx eax, cx
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
je 0x4de0d6
mov eax, ecx
movzx ecx, cx
and eax, 0xf0000000
cmp eax, 0x20000000
push esi
cmovne ecx, edi
push ecx
push ebp
call fcn.004a3c00
add esp, 0xc
test eax, eax
je 0x4de11f
push eax
push ebx
call fcn.004a26a0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
or edx, 0xffffffff
or ebp, edx
cmp esi, 4
jne 0x4de154
mov ecx, dword [esp + 0x24]
xor edx, edx
pop edi
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
mov eax, dword [ebx + 0x14]
setne dl
add edx, 0xfffffffd
mov dword [eax - 4], edx
mov eax, dword [ebx + 8]
mov dword [eax + 0x9c], edx
lea eax, [esi - 3]
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
xor edi, edi
nop word [eax + eax]
mov ecx, dword [eax + edi*4 + 8]
mov dword [esp + 0x1c], edx
test ecx, ecx
je 0x4de1a5
mov eax, dword [ebx + 0x10]
cmp dword [eax + edi*8 + 4], 0xfffffff5
jne 0x4de1a5
mov eax, dword [esp + 0x20]
mov esi, dword [ecx]
push 0
sub ecx, dword [eax]
sar ecx, 4
push ecx
push ebx
call fcn.004a3d50
and esi, 0xf0000000
add esp, 0xc
add eax, 0x14
mov edx, edi
cmp esi, 0x50000000
cmovne edx, dword [esp + 0x1c]
jmp 0x4de1cb
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + edi*8 + 4]
cmp ecx, 0xfffffffb
mov eax, edi
cmovne eax, ebp
mov ebp, eax
cmp ecx, 0xfffffff2
ja 0x4de1c2
mov ecx, 0xd
jmp 0x4de1c4
not ecx
mov eax, dword [ecx*4 + 0x59020c]
mov dword [esp + edi*4 + 0x10], eax
inc edi
mov eax, dword [esp + 0x24]
cmp edi, 2
jl 0x4de160
mov eax, ebp
xor eax, edx
cmp eax, 1
je 0x4de21d
mov ecx, dword [esp + 0x28]
cmp ecx, 5
jne 0x4de1f2
mov eax, 0xceb
jmp 0x4de20e
cmp ecx, 8
jne 0x4de1fe
mov eax, 0xd09
jmp 0x4de20e
cmp ecx, 0xa
mov eax, 0xd2e
mov edx, 0xd5d
cmovl eax, edx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
push ebx
call fcn.0049f690
push dword [esp + edx*4 + 0x10]
push dword [esp + ebp*4 + 0x14]
push 0xccf
push ebx
call fcn.0049f690
int3
Function at 0x4e4730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, ecx
push ebp
movzx ebp, word [ebx + 0x78]
lea edx, [ebx + 0x78]
push esi
mov al, byte [ebx + 0x94]
and al, 0x1f
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x34], ebp
push edi
cmp al, 0xe
jne 0x4e4788
movzx edx, word [ebx + 0x1bc]
cmp edx, ebp
jbe 0x4e4784
movzx ecx, word [ebx + 0x1da]
cmp ecx, ebp
jbe 0x4e4784
nop
cmp ecx, edx
jb 0x4e4904
mov eax, dword [ebx + 0x10]
movzx ecx, word [eax + ecx*8 + 6]
cmp ecx, ebp
ja 0x4e4770
mov edx, dword [esp + 0x18]
movzx eax, word [ebx + 0x1dc]
cmp eax, ebp
jbe 0x4e490e
mov esi, dword [ebx + 0x10]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], 0x8000
lea eax, [esi + eax*8]
mov dword [esp + 0x34], eax
movzx eax, word [eax]
movzx ecx, word [esi + eax*8 + 2]
lea ebx, [esi + eax*8]
cmp edx, ebx
je 0x4e4904
movzx edi, word [edx + 2]
cmp byte [esi + edi*8 + 5], 0x1e
lea edx, [esi + edi*8]
jne 0x4e47d4
movzx edi, word [edx]
lea edx, [esi + edi*8]
cmp byte [esi + ecx*8 + 5], 0x1e
lea ebp, [esi + ecx*8]
jne 0x4e47e5
movzx ecx, word [ebp]
lea ebp, [esi + ecx*8]
mov eax, dword [esp + 0x14]
mov al, byte [eax + 0x7d]
mov byte [esp + 0x13], al
cmp al, 0x39
je 0x4e4802
cmp al, 0x38
je 0x4e4802
mov eax, dword [esp + 0x14]
movzx eax, word [eax + 0x78]
jmp 0x4e480e
mov eax, dword [esp + 0x14]
movzx eax, word [eax + 0x78]
movzx eax, word [esi + eax*8]
movzx eax, ax
mov dword [esp + 0x2c], eax
mov al, byte [ebx + 5]
cmp al, 0x39
je 0x4e4825
cmp al, 0x38
je 0x4e4825
movzx eax, word [ebx]
jmp 0x4e482c
movzx eax, word [ebx]
movzx eax, word [esi + eax*8]
movzx ebx, ax
cmp edi, ecx
je 0x4e48d3
cmp edi, 0x8000
jae 0x4e484b
cmp ecx, 0x8000
jb 0x4e48ed
cmp byte [esp + 0x13], 0x38
jne 0x4e48c9
xor eax, eax
mov dword [esp + 0x1c], edi
cmp byte [edx + 5], 0x29
mov dword [esp + 0x20], eax
jne 0x4e4893
movzx esi, word [edx + 2]
cmp si, word [esp + 0x24]
mov esi, dword [esp + 0x28]
jae 0x4e488f
movzx eax, word [edx]
mov dword [esp + 0x1c], eax
movzx eax, word [edx + 2]
mov edx, dword [esi + eax*8]
cmp dword [esp + 0x1c], ecx
jne 0x4e4889
test edx, edx
jne 0x4e48ed
mov eax, dword [esp + 0x20]
jmp 0x4e4895
mov edx, eax
jmp 0x4e4895
xor edx, edx
cmp byte [ebp + 5], 0x29
jne 0x4e48bd
movzx esi, word [ebp + 2]
cmp si, word [esp + 0x24]
mov esi, dword [esp + 0x28]
jae 0x4e48bd
movzx eax, word [ebp + 2]
movzx ecx, word [ebp]
mov eax, dword [esi + eax*8]
cmp edi, ecx
jne 0x4e48bd
test eax, eax
jne 0x4e48ed
cmp dword [esp + 0x1c], ecx
jne 0x4e48d3
cmp edx, eax
je 0x4e48d3
jmp 0x4e48ed
mov al, byte [ebp + 4]
xor al, byte [edx + 4]
test al, 0x1f
jne 0x4e48ed
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x4e4904
push ebx
push eax
push dword [esp + 0x1c]
call fcn.004e50b0
add esp, 0xc
test eax, eax
jne 0x4e4904
mov eax, dword [esp + 0x34]
movzx eax, word [eax + 6]
cmp eax, dword [esp + 0x38]
jbe 0x4e490e
mov edx, dword [esp + 0x18]
jmp 0x4e47a6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret
Function at 0x4e5610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
mov bx, word [esp + 0x10]
movzx eax, bx
push ebp
mov dword [esp + 8], eax
push esi
movzx eax, word [ecx + eax*2 + 0x156]
push edi
cmp eax, edx
jbe 0x4e56c1
mov edi, dword [ecx + 0x10]
nop dword [eax]
mov cl, byte [edi + eax*8 + 4]
lea ebp, [edi + eax*8]
movzx eax, word [ebp]
and cl, 0x1f
cmp eax, edx
je 0x4e56ee
test cl, cl
jne 0x4e56b0
movzx ecx, word [edi + eax*8 + 2]
movzx esi, word [edi + edx*8 + 2]
cmp bx, 0x42
je 0x4e569c
mov bl, byte [edi + ecx*8 + 4]
mov bh, byte [edi + esi*8 + 4]
mov al, bl
xor al, bh
test al, 0x1f
je 0x4e569c
and bl, 0x1f
xor ecx, ecx
cmp bl, 5
sete cl
and bh, 0x1f
xor eax, eax
cmp bh, 5
sete al
cmp ecx, eax
je 0x4e56b0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
cmp ecx, esi
je 0x4e5694
cmp ecx, 0x8000
jae 0x4e5694
cmp esi, 0x8000
jae 0x4e5694
movzx eax, word [ebp + 6]
mov bx, word [esp + 0x1c]
cmp eax, edx
ja 0x4e5640
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
movzx eax, word [ecx + eax*2 + 0x146]
cmp eax, edx
jbe 0x4e5694
mov esi, dword [ecx + 0x10]
lea ecx, [esi + eax*8]
movzx eax, word [ecx]
cmp eax, edx
je 0x4e56fb
movzx eax, word [ecx + 6]
cmp eax, edx
ja 0x4e56d4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
xor eax, eax
test cl, cl
pop esi
pop ebp
setne al
pop ebx
pop ecx
ret
test byte [ecx + 4], 0x1f
mov eax, 0
pop edi
pop esi
pop ebp
setne al
pop ebx
pop ecx
ret
Function at 0x4f2180
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
mov dword [ebp - 4], esi
mov eax, dword [esi + 0x1c]
mov dword [esi], vtable.NWebAdvisor::NAccessCaller::library_loader.0
test eax, eax
je 0x4f21a8
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x1c], 0
cmp dword [esi + 0x30], 0
je 0x4f21c0
cmp dword [esi + 0x34], 8
lea eax, [esi + 0x20]
jb 0x4f21b9
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x34]
cmp ecx, 8
jb 0x4f21f6
mov eax, dword [esi + 0x20]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x4f21ec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f224d
mov eax, edx
push ecx
push eax
call fcn.0050a4c5
add esp, 8
xor eax, eax
mov word [esi + 0x20], ax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 7
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x4f2236
mov eax, dword [esi + 4]
inc ecx
cmp ecx, 0x1000
jb 0x4f222c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f224d
mov eax, edx
push ecx
push eax
call fcn.0050a4c5
add esp, 8
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
mov byte [esi + 4], 0
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00522dda
int3

Function at 0x4f3efd
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004f3ed9
pop esi
leave
ret 8

Function at 0x4f4099
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
push 0x105
call fcn.004f3fb1
mov edi, eax
test edi, edi
jne 0x4f40c0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, esi
jmp 0x4f4109
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebx, 0xffffffff
cmp eax, ebx
je 0x4f4104
test al, 0x10
je 0x4f4104
test eax, 0x400
je 0x4f4100
push 0x2000000
push 0x80
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.004f410f
push dword [ebp - 4]
mov esi, eax
call fcn.004f3fed
test esi, esi
jne 0x4f4104
xor edx, edx
jmp 0x4f4106
mov edx, ebx
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x509f34
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.00538cbd
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x509f73
sub eax, 1
je 0x509f6e
sub eax, 1
je 0x509f6a
xor eax, eax
leave
ret
push 3
jmp 0x509f75
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret
Function at 0x50bcc1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x50bd00
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x50bd00
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x50bd00
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x50bd00
cmp dword [ecx + 0x74], 0xe
jbe 0x50bd00
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x533b8f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0050b9d0
mov eax, dword [0x5ec3c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0053dd6c
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x533bd1
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x533d2d
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0050b350
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x5f4d78]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00546531
mov ecx, dword [esi*4 + 0x5f4d78]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x533d26
cmp eax, dword [ecx + edi + 0x24]
jne 0x533d26
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x533d26
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00546531
add esp, 0x14
test edx, edx
jl 0x533d26
jg 0x533c9c
test eax, eax
jb 0x533d26
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x533d26
jl 0x533cb6
cmp dword [ebp - 0x1008], eax
ja 0x533d26
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x533cd4
test ebx, ebx
je 0x533d0d
cmp ecx, edi
jae 0x533d0d
mov al, byte [ecx]
cmp al, 0xd
jne 0x533cee
lea eax, [edi - 1]
cmp ecx, eax
jae 0x533cfa
cmp byte [ecx + 1], 0xa
jne 0x533cfa
inc ecx
jmp 0x533cfa
movzx eax, al
movsx eax, byte [eax + 0x5ec808]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x533cd4
cmp edx, ebx
jne 0x533cd4
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x533d2b
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0050a47b
leave
ret

Function at 0x53f28a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5b8f44
push 0x5b8f3c
push 0x5b6350
push 0x1f
call fcn.0053f0b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x53f2be
push dword [ebp + 8]
mov ecx, esi
call dword [0x5845b0]
call esi
jmp 0x53f2c4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x53f308
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5b8f54
push 0x5b8f4c
push 0x5b6374
push 0x21
call fcn.0053f0b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x53f33f
push dword [ebp + 8]
mov ecx, esi
call dword [0x5845b0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x53f347
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5b8f5c
push 0x5b8f54
push 0x5b6388
push 0x22
call fcn.0053f0b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x53f381
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5845b0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x53f41f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5b8dd4
push 0x5b8dcc
push str.GetTempPath2W
push 5
call fcn.0053f0b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x53f459
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5845b0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetTempPathW]