joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4514a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
dec esi
mov eax, dword [edi + 0x10]
lea esi, [eax + esi*8]
cmp esi, dword [edi + 0x14]
jae 0x4515ea
mov eax, dword [esi + 4]
cmp eax, 0xfffffff2
jbe 0x4515cc
cmp eax, 0xfffffff5
jne 0x4515ba
mov eax, dword [edi + 8]
mov ecx, dword [eax + 0xfc]
mov dword [esp + 0xc], ecx
mov dword [ecx + 0xc], edi
mov eax, dword [esi]
mov esi, dword [ecx]
movzx edx, word [eax + 6]
lea edi, [eax + 8]
mov eax, edx
add eax, eax
mov ecx, dword [esi + eax*8]
mov eax, ecx
and eax, 0xf0800000
cmp eax, 0x20800000
jne 0x451508
mov edi, dword [edi]
movzx ecx, cx
cmovne ecx, edx
shl ecx, 4
add ecx, esi
mov edx, dword [ecx]
mov eax, edx
and eax, 0xf0000000
cmp eax, 0x80000000
jne 0x45153b
movzx ecx, dx
shl ecx, 4
add ecx, esi
mov edx, dword [ecx]
mov eax, edx
and eax, 0xf0000000
cmp eax, 0x80000000
je 0x451523
mov eax, edx
and eax, 0xf0000000
cmp eax, 0x50000000
jne 0x451553
movzx ecx, dx
shl ecx, 4
add ecx, esi
mov edx, dword [ecx]
and edx, 0xfc800000
cmp edx, 0x800000
jne 0x451577
cmp dword [ecx + 4], 8
jne 0x451577
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xc
mov eax, 0xc
jmp 0x45158b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
test eax, eax
jne 0x45158b
mov dword [edx], 0xb
mov eax, 0xb
mov edx, dword [ebp + 0xc]
shl edx, 8
push edx
push edi
lea edx, [esp + 0x18]
shl eax, 4
push edx
push ecx
mov ecx, dword [esp + 0x1c]
add eax, dword [ecx]
push eax
push ecx
call fcn.0044eb20
mov eax, dword [esp + 0x28]
add esp, 0x18
mov edx, dword [esp + 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0xfffffffb
jne 0x4515ea
mov ecx, dword [esi]
mov edx, esi
call fcn.0041a750
test eax, eax
je 0x4515ea
movsd xmm0, qword [esi]
xor edx, edx
addsd xmm0, qword [0x4d9f98]
pop edi
pop esi
movsd qword [esp + 8], xmm0
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
push 3
push dword [ebp + 0xc]
push edi
call fcn.00409530
int3
Function at 0x451670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov eax, dword [ebx + 0x10]
push edi
mov edi, dword [esp + 0x2c]
cmp dword [eax + 4], 0xfffffff5
jne 0x4516e7
mov eax, dword [eax]
mov edx, dword [ebp]
movzx esi, word [eax + 6]
mov eax, esi
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
jne 0x4516c6
nop word [eax + eax]
movzx eax, cx
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
je 0x4516b0
mov eax, ecx
movzx ecx, cx
and eax, 0xf0000000
cmp eax, 0x20000000
push edi
cmovne ecx, esi
push ecx
push ebp
call fcn.00414140
add esp, 0xc
test eax, eax
jne 0x45174d
mov eax, dword [ebx + 0x10]
lea ecx, [eax + 8]
cmp ecx, dword [ebx + 0x14]
jae 0x45175f
cmp dword [eax + 0xc], 0xfffffff5
jne 0x45175f
mov eax, dword [ecx]
mov edx, dword [ebp]
movzx esi, word [eax + 6]
mov eax, esi
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
jne 0x45172c
movzx eax, cx
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
je 0x451716
mov eax, ecx
movzx ecx, cx
and eax, 0xf0000000
cmp eax, 0x20000000
push edi
cmovne ecx, esi
push ecx
push ebp
call fcn.00414140
add esp, 0xc
test eax, eax
je 0x45175f
push eax
push ebx
call fcn.00412800
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
or ebp, 0xffffffff
or esi, ebp
mov dword [esp + 0x20], esi
cmp edi, 4
jne 0x451798
mov ecx, dword [esp + 0x28]
xor edx, edx
pop edi
pop esi
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
mov eax, dword [ebx + 0x14]
setne dl
add edx, 0xfffffffd
mov dword [eax - 4], edx
mov eax, dword [ebx + 8]
mov dword [eax + 0x9c], edx
lea eax, [ebp + 2]
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x28]
xor edi, edi
nop
mov ecx, dword [eax + edi*4 + 8]
lea edx, [edi*8]
mov dword [esp + 0x10], ebp
test ecx, ecx
je 0x4517f0
mov eax, dword [ebx + 0x10]
cmp dword [eax + edx + 4], 0xfffffff5
jne 0x4517f0
mov eax, dword [esp + 0x24]
mov esi, dword [ecx]
push 0
sub ecx, dword [eax]
sar ecx, 4
push ecx
push ebx
call fcn.004142a0
and esi, 0xf0000000
add esp, 0xc
add eax, 0x14
mov ebp, edi
cmp esi, 0x50000000
mov esi, dword [esp + 0x20]
cmovne ebp, dword [esp + 0x10]
jmp 0x45181a
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + edx + 4]
cmp ecx, 0xfffffffb
mov eax, edi
cmovne eax, esi
mov esi, eax
mov dword [esp + 0x20], esi
cmp ecx, 0xfffffff2
ja 0x451811
mov ecx, 0xd
jmp 0x451813
not ecx
mov eax, dword [ecx*4 + 0x4d7ec8]
mov dword [esp + edi*4 + 0x14], eax
inc edi
mov eax, dword [esp + 0x28]
cmp edi, 2
jl 0x4517a0
mov eax, esi
xor eax, ebp
cmp eax, 1
je 0x451870
mov ecx, dword [esp + 0x2c]
cmp ecx, 5
jne 0x451845
mov eax, 0xceb
jmp 0x451861
cmp ecx, 8
jne 0x451851
mov eax, 0xd09
jmp 0x451861
cmp ecx, 0xa
mov eax, 0xd2e
mov edx, 0xd5d
cmovl eax, edx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
push ebx
call fcn.004096f0
push dword [esp + ebp*4 + 0x14]
push dword [esp + esi*4 + 0x18]
push 0xccf
push ebx
call fcn.004096f0
int3
Function at 0x45c6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x28
push ebx
mov ebx, ecx
push ebp
movzx ebp, word [ebx + 0x78]
lea edx, [ebx + 0x78]
push esi
mov al, byte [ebx + 0x94]
and al, 0x1f
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x30], ebp
push edi
cmp al, 0xe
jne 0x45c727
movzx edx, word [ebx + 0x1bc]
cmp edx, ebp
jbe 0x45c724
movzx ecx, word [ebx + 0x1da]
cmp ecx, ebp
jbe 0x45c724
nop
cmp ecx, edx
jb 0x45c8a3
mov eax, dword [ebx + 0x10]
movzx ecx, word [eax + ecx*8 + 6]
cmp ecx, ebp
ja 0x45c710
lea edx, [ebx + 0x78]
movzx eax, word [ebx + 0x1dc]
cmp eax, ebp
jbe 0x45c8ad
mov esi, dword [ebx + 0x10]
mov dword [esp + 0x18], 0x8000
lea eax, [esi + eax*8]
mov dword [esp + 0x30], eax
movzx eax, word [eax]
movzx ecx, word [esi + eax*8 + 2]
lea ebx, [esi + eax*8]
cmp edx, ebx
je 0x45c8a3
movzx edi, word [edx + 2]
cmp byte [esi + edi*8 + 5], 0x1e
lea edx, [esi + edi*8]
jne 0x45c76f
movzx edi, word [edx]
lea edx, [esi + edi*8]
cmp byte [esi + ecx*8 + 5], 0x1e
lea ebp, [esi + ecx*8]
jne 0x45c780
movzx ecx, word [ebp]
lea ebp, [esi + ecx*8]
mov eax, dword [esp + 0x14]
mov al, byte [eax + 5]
mov byte [esp + 0x13], al
cmp al, 0x39
je 0x45c79c
cmp al, 0x38
je 0x45c79c
mov eax, dword [esp + 0x14]
movzx eax, word [eax]
jmp 0x45c7a7
mov eax, dword [esp + 0x14]
movzx eax, word [eax]
movzx eax, word [esi + eax*8]
movzx eax, ax
mov dword [esp + 0x24], eax
mov al, byte [ebx + 5]
cmp al, 0x39
je 0x45c7be
cmp al, 0x38
je 0x45c7be
movzx eax, word [ebx]
jmp 0x45c7c5
movzx eax, word [ebx]
movzx eax, word [esi + eax*8]
movzx eax, ax
mov dword [esp + 0x20], eax
cmp edi, ecx
jne 0x45c7e3
mov edx, dword [esp + 0x24]
cmp edx, eax
je 0x45c8a3
mov ecx, eax
jmp 0x45c879
cmp edi, 0x8000
jae 0x45c7f7
cmp ecx, 0x8000
jb 0x45c88c
cmp byte [esp + 0x13], 0x38
jne 0x45c863
xor eax, eax
mov dword [esp + 0x2c], edi
xor ebx, ebx
mov dword [esp + 0x1c], eax
cmp byte [edx + 5], 0x29
jne 0x45c835
movzx eax, word [edx + 2]
cmp ax, word [esp + 0x18]
jae 0x45c82f
movzx edx, word [edx]
mov eax, dword [esi + eax*8]
mov dword [esp + 0x1c], eax
cmp edx, ecx
jne 0x45c837
test eax, eax
jne 0x45c88c
jmp 0x45c837
mov edx, dword [esp + 0x2c]
jmp 0x45c837
mov edx, edi
cmp byte [ebp + 5], 0x29
jne 0x45c857
movzx eax, word [ebp + 2]
cmp ax, word [esp + 0x18]
jae 0x45c857
movzx ecx, word [ebp]
mov ebx, dword [esi + eax*8]
cmp edi, ecx
jne 0x45c857
test ebx, ebx
jne 0x45c88c
cmp edx, ecx
jne 0x45c86d
cmp dword [esp + 0x1c], ebx
je 0x45c86d
jmp 0x45c88c
mov al, byte [ebp + 4]
xor al, byte [edx + 4]
test al, 0x1f
jne 0x45c88c
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
cmp edx, ecx
je 0x45c8a3
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
call fcn.0045d0d0
add esp, 0xc
test eax, eax
jne 0x45c8a3
mov eax, dword [esp + 0x30]
movzx eax, word [eax + 6]
cmp eax, dword [esp + 0x34]
jbe 0x45c8ad
mov edx, dword [esp + 0x14]
jmp 0x45c741
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x45d770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
movzx eax, word [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov dword [esp + 8], eax
lea ebp, [ecx + 0x10]
movzx eax, word [ecx + eax*2 + 0x156]
push esi
push edi
cmp eax, edx
jbe 0x45d7f3
mov edi, dword [ebp]
nop dword [eax + eax]
mov cl, byte [edi + eax*8 + 4]
lea ebx, [edi + eax*8]
movzx eax, word [ebx]
and cl, 0x1f
cmp eax, edx
je 0x45d820
test cl, cl
jne 0x45d7e7
cmp word [esp + 0x1c], 0x42
movzx ecx, word [edi + eax*8 + 2]
movzx esi, word [edi + edx*8 + 2]
je 0x45d7d3
mov al, byte [edi + esi*8 + 4]
xor al, byte [edi + ecx*8 + 4]
test al, 0x1f
jne 0x45d7e7
cmp ecx, esi
je 0x45d818
cmp ecx, 0x8000
jae 0x45d818
cmp esi, 0x8000
jae 0x45d818
movzx eax, word [ebx + 6]
cmp eax, edx
ja 0x45d7a0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
movzx eax, word [ecx + eax*2 + 0x146]
cmp eax, edx
jbe 0x45d818
mov esi, dword [ebp]
lea ecx, [esi + eax*8]
movzx eax, word [ecx]
cmp eax, edx
je 0x45d82d
movzx eax, word [ecx + 6]
cmp eax, edx
ja 0x45d806
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
xor eax, eax
test cl, cl
pop esi
pop ebp
setne al
pop ebx
pop ecx
ret
test byte [ecx + 4], 0x1f
mov eax, 0
pop edi
pop esi
pop ebp
setne al
pop ebx
pop ecx
ret
Function at 0x45ea40
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
mov esi, edx
mov dword [esp + 0x18], esi
mov eax, dword [ebx + 0x620]
add eax, 0x8000
cmp dword [ebx + 8], eax
jb 0x45ebf8
cmp dword [ebx + 0xb8], 0
push ebp
je 0x45ebdd
mov ebp, dword [ebx + 0x54]
mov dword [esp + 0x10], ebp
mov ebp, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [esp + 0xc], ecx
test cl, 3
jne 0x45ebdd
mov eax, dword [ecx]
and eax, 0xff
cmp eax, 0x41
je 0x45ebdd
cmp eax, 0x43
je 0x45ebdd
cmp eax, 0x49
je 0x45ebdd
cmp eax, 0x3f
je 0x45ebdd
mov eax, dword [ebx + 0x5c]
movzx eax, byte [eax + 6]
sub eax, 0x13
je 0x45ebdd
sub eax, 0x78
je 0x45ebdd
sub eax, 6
je 0x45ebdd
movzx eax, byte [ecx - 3]
lea edx, [ebp + 8]
mov esi, dword [ebx + 0x6c]
mov ecx, ebp
mov dword [esp + 0x18], esi
lea eax, [eax*8 + 0x10]
sub ecx, eax
movzx eax, word [ebx + 6]
mov dword [esp + 0x14], ecx
cmp eax, dword [ebx + 0x61c]
jae 0x45ec00
push edi
lea esi, [esi*8 + 8]
push esi
lea edi, [ebp - 8]
push edi
push edx
call fcn.0046bff0
mov ecx, dword [esp + 0x20]
lea eax, [ebp + 8]
sub eax, dword [esp + 0x24]
add eax, 2
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [ebp + 4], 0
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [ebp], 0x40422e
mov dword [ebp - 4], 0xffffffff
add dword [ecx + 0x10], 0x10
add dword [ecx + 0x14], 0x10
lea eax, [eax*4 + 4]
mov ecx, dword [ebx + 0x64]
push eax
lea eax, [ecx - 4]
push eax
lea eax, [ecx + 4]
push eax
call fcn.0046bff0
push 0x40422e
push 0x19
push ebx
call fcn.00452560
mov ecx, dword [ebx + 0x64]
or eax, 0x20000
push ebx
mov dword [ecx], eax
call fcn.00452670
mov ecx, dword [ebx + 0x64]
push 0
push 8
push ebx
mov dword [ecx - 4], eax
add dword [ebx + 0x64], 8
add dword [ebx + 0x70], 2
inc dword [ebx + 0xb8]
mov word [ebx + 0x144], ax
call fcn.0043ed20
push esi
lea eax, [ebp + 8]
push eax
push edi
call fcn.0046bff0
mov eax, dword [esp + 0x50]
add esp, 0x40
mov dword [ebp - 4], eax
mov eax, dword [esp + 0x14]
pop edi
pop ebp
add dword [eax + 0x10], 0xfffffff0
add dword [eax + 0x14], 0xfffffff0
mov eax, dword [esp + 0x18]
pop esi
pop ebx
mov dword [eax + 4], 0xffffffff
add esp, 0x14
ret
push 0
push 7
push ebx
call fcn.0043ed20
add esp, 0xc
mov dword [esi + 4], 0xffffffff
pop ebp
pop esi
pop ebx
add esp, 0x14
ret
push 1
push ebx
call fcn.00414d20
push 4
push ebx
call fcn.00414ce0
int3
Function at 0x46ae35
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x46ae74
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46ae74
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46ae74
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x46ae74
cmp dword [ecx + 0x74], 0xe
jbe 0x46ae74
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x47807a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4780b9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4780b9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4780b9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4780b9
cmp dword [ecx + 0x74], 0xe
jbe 0x4780b9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x47caf5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004d24e0
mov eax, dword [0x4f11c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00476874
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x47cb37
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x47cc93
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0046a550
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4f2ce8]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.004b903f
mov ecx, dword [esi*4 + 0x4f2ce8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x47cc8c
cmp eax, dword [ecx + edi + 0x24]
jne 0x47cc8c
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47cc8c
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004b903f
add esp, 0x14
test edx, edx
jl 0x47cc8c
jg 0x47cc02
test eax, eax
jb 0x47cc8c
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x47cc8c
jl 0x47cc1c
cmp dword [ebp - 0x1008], eax
ja 0x47cc8c
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x47cc3a
test ebx, ebx
je 0x47cc73
cmp ecx, edi
jae 0x47cc73
mov al, byte [ecx]
cmp al, 0xd
jne 0x47cc54
lea eax, [edi - 1]
cmp ecx, eax
jae 0x47cc60
cmp byte [ecx + 1], 0xa
jne 0x47cc60
inc ecx
jmp 0x47cc60
movzx eax, al
movsx eax, byte [eax + 0x4f13f0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x47cc3a
cmp edx, ebx
jne 0x47cc3a
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x47cc91
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004698d9
leave
ret
Function at 0x4aed9b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4deca0
push 0x4dec98
push str.FlsAlloc
push 0x1f
call fcn.004aea69
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4aedcf
push dword [ebp + 8]
mov ecx, esi
call dword [0x4d61a4]
call esi
jmp 0x4aedd5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4aee19
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4decb0
push 0x4deca8
push str.FlsGetValue
push 0x21
call fcn.004aea69
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4aee50
push dword [ebp + 8]
mov ecx, esi
call dword [0x4d61a4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4aee58
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4decb8
push 0x4decb0
push str.FlsSetValue
push 0x22
call fcn.004aea69
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4aee92
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4d61a4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x4aefa3
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.GetTempPath2W
push 0x4de9bc
push str.GetTempPath2W
push 5
call fcn.004aea69
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4aefdd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4d61a4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetTempPathW]
Function at 0x4b383c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4f2ce8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4b387c
cmp byte [ebx], 0xa
jne 0x4b387c
or byte [edi + eax + 0x28], 4
jmp 0x4b3881
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x4b3980
mov dl, byte [eax]
cmp dl, 0x1a
je 0x4b3963
inc eax
cmp dl, 0xd
je 0x4b38ad
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x4b38d3
cmp eax, ecx
jae 0x4b38e1
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x4b3895
jmp 0x4b3980
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b395e
cmp dword [ebp - 0x10], 0
je 0x4b395e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4f2ce8]
test byte [eax + edi + 0x28], 0x48
je 0x4b3938
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4b3923
mov byte [esi], dl
jmp 0x4b3934
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4f2ce8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4b3980
cmp byte [ebp - 1], 0xa
jne 0x4b3947
cmp esi, ebx
jne 0x4b3947
mov byte [esi], 0xa
jmp 0x4b397f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004b905d
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4b3980
mov byte [esi], 0xd
jmp 0x4b397f
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4f2ce8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4b397d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4b3980
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4b3989
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4f2ce8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4b39cf
cmp word [ebx], dx
jne 0x4b39cf
or byte [eax + edi + 0x28], 4
jmp 0x4b39d4
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x4b3b37
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x4b3b17
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4b3a15
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4b3a4b
cmp eax, edx
jae 0x4b3a59
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x4b39f0
jmp 0x4b3b37
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b3b12
cmp dword [ebp - 0x18], 0
je 0x4b3b12
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4f2ce8]
test byte [eax + edi + 0x28], 0x48
je 0x4b3ae8
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x4b3aac
mov word [esi], cx
jmp 0x4b3ae3
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4f2ce8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4f2ce8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4f2ce8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x4b3b37
pop eax
cmp word [ebp - 4], ax
jne 0x4b3af8
cmp esi, ebx
jne 0x4b3af8
mov word [esi], ax
jmp 0x4b3b34
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004b905d
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4b3b37
push 0xd
pop eax
jmp 0x4b3af3
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4f2ce8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x4b3b31
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x4b3b37
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4c19d7
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c18ab
Function at 0x4c2214
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4f11c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4c225f
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004c25b0
test al, al
jne 0x4c2259
sub edx, 2
cmp edx, edi
jne 0x4c223f
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4c2281
lea eax, [edi + 2]
cmp edx, eax
je 0x4c2281
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004c1edb
add esp, 0x10
jmp 0x4c237b
push esi
lea ecx, [ebp - 0x255]
call fcn.004c25b0
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c22c4
push dword [ebp - 0x25c]
jmp 0x4c2271
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4c2301
cmp word [ebp - 0x226], 0
je 0x4c2322
cmp word [ebp - 0x226], ax
jne 0x4c2301
cmp word [ebp - 0x224], 0
je 0x4c2322
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004c1edb
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4c236e
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4c22db
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4c2356
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4c237b
push 0x4c19fa
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004cd890
add esp, 0x10
jmp 0x4c234b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004698d9
leave
ret