joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
dec eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x10], ecx
lea eax, [ebx + eax*2]
mov dword [ebp - 0x18], eax
cmp ebx, eax
mov eax, dword [ebp + 0x10]
jae 0x4240ee
push esi
mov esi, dword [ebp + 0x14]
push edi
nop dword [eax]
test esi, esi
je 0x423f6c
cmp eax, esi
jae 0x4240e9
mov bl, byte [eax]
mov byte [ebp + 0xf], bl
test bl, bl
je 0x4240e9
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x510840]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x423f9e
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp + 0xf]
mov byte [ebp - 3], cl
cmp esi, edx
jae 0x423fb3
mov bh, byte [esi]
jmp 0x423fb5
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 2], bh
cmp esi, edx
jae 0x423fc3
mov ch, byte [esi]
jmp 0x423fc5
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 1], ch
cmp esi, edx
jae 0x423fd3
mov bl, byte [esi]
jmp 0x423fd5
xor bl, bl
movzx edx, ch
movzx ecx, cl
movzx esi, bh
movzx edi, bl
mov byte [ebp + 0xf], bl
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx*4 + 0x510860]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x510888]
shr ebx, cl
mov esi, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0xc]
cmp esi, dword [ebx*4 + 0x510874]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x51089c]
mov ebx, dword [ebp - 0x14]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x4240c6
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp + 0xf], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
jmp 0x4240cc
add eax, ebx
test esi, esi
je 0x4240e6
mov ecx, dword [ebp - 0x10]
mov word [ecx], si
add ecx, 2
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x423f60
jmp 0x4240e9
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
pop edi
pop esi
xor edx, edx
mov word [ecx], dx
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x4240fc
mov dword [edx], eax
sub ecx, ebx
sar ecx, 1
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4300f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [0x5d13e4]
cmp byte [edi + 0x59ed], 0
lea eax, [edi + 0x20]
jne 0x430236
mov ecx, dword [eax]
push ebx
test ecx, ecx
je 0x43022e
push esi
push 0x5112b4
push ecx
call fcn.004237a0
mov esi, eax
add esp, 8
test esi, esi
je 0x43022a
push esi
call fcn.004eb97f
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x430221
push 2
push 0
push esi
call fcn.004e61f3
add esp, 0xc
test eax, eax
jne 0x430221
push esi
call fcn.004eb97f
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x430221
push 0
push dword [ebp - 4]
push esi
call fcn.004e61f3
add esp, 0xc
test eax, eax
jne 0x430221
mov eax, dword [0x5d13e4]
test eax, eax
je 0x430192
inc dword [eax + 0xb0]
push dword [0x5d13ec]
push ebx
call dword [0x5cf008]
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x430221
push esi
push ebx
push 1
push eax
call fcn.004e5d68
add esp, 0x10
push esi
cmp eax, ebx
je 0x4301e7
call fcn.004e54b8
mov eax, dword [0x5d13e4]
add esp, 4
test eax, eax
je 0x4301d2
dec dword [eax + 0xb0]
push dword [0x5d13ec]
mov esi, dword [ebp - 4]
push esi
call dword [0x5cf00c]
add esp, 8
jmp 0x43022a
call fcn.004e54b8
mov esi, dword [ebp - 4]
add esp, 4
test ebx, ebx
je 0x430200
push ebx
push esi
call fcn.00425320
add esp, 8
mov eax, dword [0x5d13e4]
test eax, eax
je 0x43020f
dec dword [eax + 0xb0]
push dword [0x5d13ec]
push esi
call dword [0x5cf00c]
add esp, 8
jmp 0x43022a
push esi
call fcn.004e54b8
add esp, 4
lea eax, [edi + 0x20]
pop esi
mov byte [edi + 0x59ed], 1
pop ebx
movss xmm0, dword [edi + 0x59f0]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x430287
subss xmm0, dword [edi + 0x18]
comiss xmm1, xmm0
movss dword [edi + 0x59f0], xmm0
jb 0x430287
mov eax, dword [eax]
test eax, eax
je 0x430276
push eax
call fcn.0042c7a0
add esp, 4
mov dword [edi + 0x59f0], 0
pop edi
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x98], 1
mov dword [edi + 0x59f0], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x444950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50be70
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5cfc24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x54], ebx
jle 0x4449ad
xor edi, edi
mov eax, dword [esi + 0x5c]
mov ecx, dword [edi + eax]
test ecx, ecx
je 0x4449a4
cmp byte [edi + eax + 8], 0
je 0x4449a4
push ecx
call fcn.00425870
mov eax, dword [esi + 0x5c]
add esp, 4
mov dword [edi + eax], 0
inc ebx
add edi, 0x78
cmp ebx, dword [esi + 0x54]
jl 0x444980
xor edx, edx
cmp dword [esi + 0x3c], edx
jle 0x4449ed
mov eax, dword [esi + 0x44]
mov edi, dword [eax + edx*4]
mov eax, dword [esi + 0x5c]
mov ebx, dword [edi + 0x34]
cmp ebx, eax
jb 0x4449e7
mov ecx, dword [esi + 0x54]
shl ecx, 4
sub ecx, dword [esi + 0x54]
lea eax, [eax + ecx*8]
cmp ebx, eax
jae 0x4449e7
mov dword [edi + 0x34], 0
xor ecx, ecx
mov eax, dword [esi + 0x44]
mov eax, dword [eax + edx*4]
mov word [eax + 0x38], cx
inc edx
cmp edx, dword [esi + 0x3c]
jl 0x4449b4
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x444a12
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.00425870
add esp, 4
mov dword [esi + 0x5c], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x444a37
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.00425870
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x46c], 0xffffffff
mov dword [esi + 0x468], 0xffffffff
test eax, eax
je 0x444a5b
push eax
call fcn.00425870
add esp, 4
mov eax, dword [esi + 0x20]
test eax, eax
je 0x444a6b
push eax
call fcn.00425870
add esp, 4
xor ebx, ebx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [esi + 0x19], 0
cmp dword [esi + 0x3c], ebx
jle 0x444aee
mov eax, dword [esi + 0x44]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x444ae8
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00444c10
mov eax, dword [edi + 0x28]
mov byte [ebp - 4], 1
test eax, eax
je 0x444ab0
push eax
call fcn.00425870
add esp, 4
mov eax, dword [edi + 0x1c]
mov byte [ebp - 4], 2
test eax, eax
je 0x444ac4
push eax
call fcn.00425870
add esp, 4
mov eax, dword [edi + 8]
mov byte [ebp - 4], 3
test eax, eax
je 0x444ad8
push eax
call fcn.00425870
add esp, 4
push edi
mov dword [ebp - 4], 0xffffffff
call fcn.00425870
add esp, 4
inc ebx
cmp ebx, dword [esi + 0x3c]
jl 0x444a84
mov eax, dword [esi + 0x44]
test eax, eax
je 0x444b13
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.00425870
add esp, 4
mov dword [esi + 0x44], 0
mov byte [esi + 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x448c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x448c97
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.00425870
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x448cbc
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.00425870
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x448ce1
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.00425870
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x448d22
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.00425870
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x448d47
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.00425870
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x448d6c
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.00425870
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00444b30
Function at 0x454660
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c36b
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x5cfc24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebx + 4], 0
push 0x58
mov dword [ebp - 4], 0
mov dword [ebx + 4], 0
call fcn.004ddea2
mov dword [ebx + 4], eax
mov ecx, dword [ebp + 0x14]
lea esi, [eax + 0x18]
push 0x40
mov dword [ebp - 4], 1
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov dword [eax + 0x10], ecx
mov dword [ebp + 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ddea2
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea eax, [esi + 8]
mov byte [ebp - 4], 2
mov ecx, eax
mov dword [ebp + 8], eax
call fcn.00459740
mov dword [esi + 0x30], 3
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 4
call fcn.00459270
push 0
push 0xff
push 0xff
push 0xff
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.00451f80
push eax
push 0x80
push 0x80
lea ecx, [ebp - 0x3c]
call fcn.00459380
xor edi, edi
nop word [eax + eax]
xor esi, esi
nop dword [eax]
nop word [eax + eax]
push 0xff
push 0xff
push 0xff
push 0xff
lea ecx, [ebp - 0x18]
call fcn.00451f80
push eax
push esi
push edi
lea ecx, [ebp - 0x3c]
call fcn.00459700
inc esi
cmp esi, 2
jl 0x454770
inc edi
cmp edi, 2
jl 0x454760
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x28], xmm0
call fcn.0045a330
mov ecx, dword [ebp + 8]
push 1
call fcn.0045a560
lea ecx, [ebp - 0x3c]
call fcn.004592a0
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [ebx + 4]
mov dword [eax + 4], ecx
mov eax, dword [ebx + 4]
mov dword [eax + 8], ecx
mov eax, dword [ebx + 4]
mov byte [eax + 0xc], 0
mov eax, dword [ebx + 4]
mov byte [eax + 0xd], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4665a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
and edi, 7
je 0x4665cf
cmp eax, edi
jge 0x4665bf
push esi
call fcn.00460d20
add esp, 4
mov eax, dword [esi + 0xc]
mov ecx, edi
shr eax, cl
sub dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
xor ecx, ecx
mov edx, eax
test eax, eax
jle 0x4665fd
mov eax, dword [esi + 0xc]
push ebx
mov bl, al
nop dword [eax]
mov byte [ebp + ecx + 8], bl
sub edx, 8
shr eax, 8
inc ecx
mov dword [esi + 0xc], eax
mov bl, al
test edx, edx
jg 0x4665e0
mov dword [esi + 8], edx
pop ebx
cmp ecx, 4
jge 0x466619
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x46660a
xor dl, dl
jmp 0x46660f
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x466600
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
jne 0x46667e
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
ja 0x46667e
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x466662
push edi
push ecx
push esi
call fcn.0046a530
add esp, 0xc
test eax, eax
je 0x466688
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004e1300
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
pop ebp
ret
mov dword [0x5d17b0], str.Corrupt_PNG
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x49ca50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
movzx edx, word [eax]
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebx]
mov dword [ebp - 4], ebx
cmp ebx, eax
jb 0x49ca73
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0x14]
sub eax, ebx
cmp esi, eax
push edi
cmova esi, eax
xor edi, edi
mov dword [ebp + 0x14], esi
test esi, esi
je 0x49cac1
mov edi, dword [ebp + 0x10]
sub ebx, edi
lea ecx, [ecx]
movzx eax, byte [ebx + edi]
lea edi, [edi + 1]
mov ecx, edx
shr ecx, 8
xor ecx, eax
add eax, edx
imul eax, eax, 0x3193
mov edx, 0x58bf
mov byte [edi - 1], cl
sub edx, eax
and edx, 0xffff
dec esi
jne 0x49ca90
mov esi, dword [ebp + 0x14]
mov edi, esi
mov ebx, dword [ebp - 4]
mov eax, dword [ebp + 8]
lea ecx, [ebx + esi]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
mov word [eax], dx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b84f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bba50

Function at 0x4bc120
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ceb6
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5cfc24]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 1
call fcn.004c6c20
push 0xd
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x4bc192
push str.Failed_to_get_the_clipboard_data_in_Unicode_format.
push 0x5d4118
call fcn.00414310
push eax
call fcn.00452070
add esp, 0xc
jmp 0x4bc201
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4bc1a5
push str.Failed_to_open_the_Win32_clipboard.
jmp 0x4bc17d
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
jne 0x4bc1cd
push str.Failed_to_get_Win32_handle_for_clipboard_content.
push 0x5d4118
call fcn.00414310
push eax
call fcn.00452070
add esp, 0xc
jmp 0x4bc1fb
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
lea ecx, [ebp - 0x28]
call fcn.004c6b60
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.004c6c60
lea ecx, [ebp - 0x28]
call fcn.00414a60
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dde94
mov esp, ebp
pop ebp
ret
Function at 0x4c7f30
Capabilities:
Check for time delay via queryperformancecounter
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50dae1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5cfc24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5d42d0]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x5d3f08]
cmp eax, dword [esi + 4]
jg 0x4c8011
mov eax, dword [0x5d3f10]
cmp eax, dword [esi + 4]
jg 0x4c8058
cmp byte [0x5d3f0c], 0
je 0x4c7fc2
mov eax, dword [0x5d3f18]
cmp eax, dword [esi + 4]
jg 0x4c8093
push 0x5d3f14
lea ecx, [ebp - 0x10]
call fcn.004c7a70
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [ebp - 0x10]
call fcn.004c7a90
jmp 0x4c7fcc
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0xf4240
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.004de4d0
push dword [0x5d3f04]
push dword [0x5d3f00]
push edx
push eax
call fcn.004deb70
mov esi, dword [ebp + 8]
push edx
push eax
push esi
call fcn.004c78b0
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x5d3f08
call fcn.004dea5c
add esp, 4
cmp dword [0x5d3f08], 0xffffffff
jne 0x4c7f76
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
push 0x5d3f08
mov dword [0x5d3f00], eax
mov dword [0x5d3f04], ecx
call fcn.004dea12
add esp, 4
jmp 0x4c7f76
push 0x5d3f10
call fcn.004dea5c
add esp, 4
cmp dword [0x5d3f10], 0xffffffff
jne 0x4c7f87
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
push 0x5d3f10
setb byte [0x5d3f0c]
call fcn.004dea12
add esp, 4
jmp 0x4c7f87
push 0x5d3f18
call fcn.004dea5c
add esp, 4
cmp dword [0x5d3f18], 0xffffffff
jne 0x4c7fa1
mov ecx, 0x5d3f14
mov dword [ebp - 4], 0
call fcn.004c79b0
push 0x50e170
call fcn.004de740
push 0x5d3f18
mov dword [ebp - 4], 0xffffffff
call fcn.004dea12
add esp, 8
jmp 0x4c7fa1
Function at 0x4df299
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4df2d8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4df2d8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4df2d8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4df2d8
cmp dword [ecx + 0x74], 0xe
jbe 0x4df2d8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4eb742
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004deb40
mov eax, dword [0x5cfc24]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004f3185
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4eb784
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4eb8e0
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004deb70
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x5d4a68]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004fa268
mov ecx, dword [esi*4 + 0x5d4a68]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4eb8d9
cmp eax, dword [edi + ecx + 0x24]
jne 0x4eb8d9
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4eb8d9
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004fa268
add esp, 0x14
test edx, edx
jl 0x4eb8d9
jg 0x4eb84f
test eax, eax
jb 0x4eb8d9
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4eb8d9
jl 0x4eb869
cmp dword [ebp - 0x1008], eax
ja 0x4eb8d9
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4eb887
test ebx, ebx
je 0x4eb8c0
cmp ecx, edi
jae 0x4eb8c0
mov al, byte [ecx]
cmp al, 0xd
jne 0x4eb8a1
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4eb8ad
cmp byte [ecx + 1], 0xa
jne 0x4eb8ad
inc ecx
jmp 0x4eb8ad
movzx eax, al
movsx eax, byte [eax + 0x5cfea0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4eb887
cmp edx, ebx
jne 0x4eb887
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4eb8de
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004dde94
leave
ret

Function at 0x4f7d6b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5bb810
push 0x5bb808
push str.FlsAlloc
push 0x1e
call fcn.004f7bd8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4f7d9f
push dword [ebp + 8]
mov ecx, esi
call dword [0x50f374]
call esi
jmp 0x4f7da5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x4f7de9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5bb820
push 0x5bb818
push str.FlsGetValue
push 0x20
call fcn.004f7bd8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4f7e20
push dword [ebp + 8]
mov ecx, esi
call dword [0x50f374]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4f94a3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f9314

Function at 0x4f9706
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x5d4a68]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4f9746
cmp byte [ebx], 0xa
jne 0x4f9746
or byte [eax + edi + 0x28], 4
jmp 0x4f974b
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4f9849
mov al, byte [edx]
cmp al, 0x1a
je 0x4f982b
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4f977a
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4f979f
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4f97a9
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4f975c
jmp 0x4f9849
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f9826
cmp dword [ebp - 0xc], 0
je 0x4f9826
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x5d4a68]
test byte [eax + edi + 0x28], 0x48
je 0x4f9800
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4f97eb
mov byte [esi], dl
jmp 0x4f97fc
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x5d4a68]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4f9849
cmp byte [ebp - 1], 0xa
jne 0x4f980f
cmp esi, ebx
jne 0x4f980f
mov byte [esi], 0xa
jmp 0x4f9848
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004fa286
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4f9849
mov byte [esi], 0xd
jmp 0x4f9848
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x5d4a68]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4f9845
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4f9849
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret