joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9a50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512b99
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push eax
push esi
mov dword [ebp - 0x34], ecx
push ecx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x2c], 0
call fcn.004239c0
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], 0x52b4b8
call fcn.00424170
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 1
push eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x4a9b25
cmp dword [ebp - 0x30], 2
jne 0x4a9b25
push 0x52b4c8
lea ecx, [ebp - 0x28]
call fcn.00403e70
mov ebx, eax
mov dword [ebp - 0x2c], 1
mov edx, dword [edi + 4]
mov byte [ebp - 4], 2
cmp word [edx], 0
jne 0x4a9afa
xor ecx, ecx
jmp 0x4a9b0f
mov ecx, edx
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a9b00
sub ecx, edi
sar ecx, 1
push ecx
push edx
push dword [ebx + 0x10]
mov ecx, ebx
push 0
call fcn.00408610
test eax, eax
jne 0x4a9b25
mov bl, 1
jmp 0x4a9b27
xor bl, bl
test byte [ebp - 0x2c], 1
mov dword [ebp - 4], 1
je 0x4a9b49
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4a9b49
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.004052a0
test bl, bl
je 0x4a9b5b
call fcn.004cc4f0
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x4a9bd0
push 0x4a9c00
call fcn.004e2927
add esp, 4
push 0
push 0x100
call dword [sym.imp.KERNEL32.DLL_SetProcessShutdownParameters]
mov dword [0x568604], 0x51a1d0
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push esi
push dword [ebp - 0x34]
call fcn.004212e0
add esp, 8
call fcn.00419ec0
test eax, eax
je 0x4a9ba7
push str.CC_INSTALLER_IS_RUNNING
call fcn.00417300
add esp, 4
call fcn.004a0eb0
test eax, eax
je 0x4a9bc5
push eax
push 0
call fcn.00417830
push str.NODRIVER
call fcn.00417300
add esp, 0xc
push esi
call fcn.0047c860
add esp, 4
xor esi, esi
lea ecx, [ebp - 0x44]
call fcn.00423aa0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a9ef0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512c3b
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x214]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x218], eax
test edi, edi
jne 0x4a9f3c
mov dword [ebp - 0x218], edi
jmp 0x4a9f84
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4a9f41
sub esi, ecx
lea eax, [ebp - 0x214]
push 0x80
push eax
sar esi, 1
lea eax, [ebp - 0x218]
inc esi
push esi
push eax
call fcn.004a4430
lea eax, [esi + esi]
push eax
push edi
push eax
push dword [ebp - 0x218]
call fcn.004a55d0
push eax
call fcn.0046a7e0
add esp, 0x24
mov dword [ebp - 4], 0
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], eax
test ebx, ebx
jne 0x4a9fa5
xor eax, eax
mov dword [ebp - 0x114], eax
jmp 0x4a9ff9
mov esi, ebx
lea ecx, [esi + 2]
nop word [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4a9fb0
sub esi, ecx
lea eax, [ebp - 0x110]
push 0x80
push eax
sar esi, 1
lea eax, [ebp - 0x114]
inc esi
push esi
push eax
call fcn.004a4430
lea eax, [esi + esi]
push eax
push ebx
push eax
push dword [ebp - 0x114]
call fcn.004a55d0
push eax
call fcn.0046a7e0
mov eax, dword [ebp - 0x114]
add esp, 0x24
push 0
push dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
lea ecx, [ebp - 0x110]
mov eax, dword [ebp - 0x114]
sete bl
cmp eax, ecx
je 0x4aa026
push eax
call fcn.004ec0b7
add esp, 4
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
cmp eax, ecx
je 0x4aa03f
push eax
call fcn.004ec0b7
add esp, 4
test bl, bl
je 0x4aa04b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x4aa04d
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret

Function at 0x4aa130
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], eax
test edi, edi
jne 0x4aa162
xor eax, eax
mov dword [ebp - 0x108], eax
jmp 0x4aa1b4
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4aa167
sub eax, edx
sar eax, 1
push esi
push 0x80
lea esi, [eax + 1]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.004a4430
lea eax, [esi + esi]
push eax
push edi
push eax
push dword [ebp - 0x108]
call fcn.004a55d0
push eax
call fcn.0046a7e0
mov eax, dword [ebp - 0x108]
add esp, 0x24
pop esi
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
lea ecx, [ebp - 0x104]
mov eax, dword [ebp - 0x108]
sete bl
cmp eax, ecx
je 0x4aa1d9
push eax
call fcn.004ec0b7
add esp, 4
pop edi
test bl, bl
pop ebx
je 0x4aa1f3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x4aa210
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00429f60

Function at 0x4acd60
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.SHELL32.dll_IsUserAnAdmin
test eax, eax
jne 0x4acd8c
call fcn.0041c240
test eax, eax
je 0x4acda4
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004acdd0
add esp, 8
mov esp, ebp
pop ebp
ret 8
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
je 0x4acdac
mov esp, ebp
pop ebp
ret 8
push 5
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov dword [ebp - 8], vtable.CnCrypt::SystemException.0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push 0x5511e0
push eax
call fcn.004e3ce5
int3

Function at 0x4adda0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.00416ae0
push dword [ebp + 8]
test eax, eax
je 0x4addc0
call fcn.004addf0
add esp, 4
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x4addba
mov dword [ebp - 8], vtable.CnCrypt::SystemException.0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push 0x5511e0
push eax
call fcn.004e3ce5
int3
Function at 0x4b12d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x4b1318
cmp dword [esi + 0x2c], 8
lea eax, [esi + 0x18]
jb 0x4b12e9
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [ebp + 8]
push eax
push dword [esi + 0x14]
push 0
call fcn.004b1550
mov eax, dword [ebp - 4]
add esp, 0x20
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4b133b
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0xc], vtable.CnCrypt::SystemException.0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push 0x5511e0
push eax
call fcn.004e3ce5
int3
Function at 0x4b4320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513f6b
mov eax, dword fs:[0]
push eax
sub esp, 0x600
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
cmp dword [esi], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x5f4], esi
mov dword [ebp - 0x5f8], ecx
mov dword [ebp - 4], 0
je 0x4b43d5
cmp dword [esi + 0x2c], 8
lea eax, [esi + 0x18]
jb 0x4b4379
mov eax, dword [eax]
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x5f0]
push edx
push edi
push dword [esi + 0xc]
push dword [esi + 8]
push ecx
push eax
push dword [esi + 0x14]
push 1
call fcn.004b1550
mov eax, dword [ebp - 0x5f0]
add esp, 0x20
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
cmp eax, edi
je 0x4b44a9
mov dword [ebp - method.CnCrypt::SystemException.virtual_0], vtable.CnCrypt::SystemException.0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x5fc], eax
lea eax, [ebp - 0x600]
push 0x5511e0
push eax
call fcn.004e3ce5
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x5f0]
push 0
push eax
push edi
push ecx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4b43fc
cmp dword [ebp - 0x5f0], edi
je 0x4b44a9
mov dword [ebp - method.CnCrypt::SystemException.virtual_0], vtable.CnCrypt::SystemException.0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x604], eax
lea eax, [ebp - 0x608]
push 0x5511e0
push eax
call fcn.004e3ce5
mov esi, dword [ebp - 0x5f4]
cmp dword [esi + 0x14], 0
je 0x4b44c7
mov eax, dword [ebp - 0x60c]
cmp dword [eax + 4], 0x13
jne 0x4b44c7
push 0
lea ecx, [ebp - 0x5ec]
call fcn.004aade0
mov ebx, dword [ebp + 0xc]
mov byte [ebp - 4], 2
cmp ebx, 0x200
jb 0x4b4498
mov edi, dword [ebp - 0x5f8]
shr ebx, 9
nop dword [eax + eax]
push edi
push dword [esi + 0xc]
lea ecx, [ebp - 0x5ec]
push dword [esi + 8]
call fcn.004b44e0
add dword [esi + 8], 0x200
adc dword [esi + 0xc], 0
add edi, 0x200
sub ebx, 1
jne 0x4b4470
lea ecx, [ebp - 0x5ec]
call fcn.004ab670
mov eax, 0x4b44a9
ret
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 8
push 0
push 0
call fcn.004e3ce5
int3
Function at 0x4b5220
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x4b5251
push eax
call fcn.00417c00
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp eax, 1
jge 0x4b526b
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
shl eax, 2
push eax
call fcn.004f1588
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [ecx], eax
test eax, eax
jne 0x4b528d
push str.ERR_OUTOFMEMORY
call fcn.00417300
add esp, 4
cmp dword [ebp - 4], 0
mov dword [ebp - 8], 0
jle 0x4b5329
mov eax, 0xfffffffc
push ebx
sub eax, esi
lea ebx, [esi + 4]
push edi
mov dword [ebp - 0xc], eax
nop dword [eax]
mov esi, dword [ebx]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4b52b5
sub esi, ecx
sar esi, 1
lea eax, [esi*2 + 2]
push eax
call fcn.004f1588
mov edi, eax
add esp, 4
test edi, edi
jne 0x4b52e7
push str.ERR_OUTOFMEMORY
call fcn.00417300
add esp, 4
test esi, esi
je 0x4b5303
mov ecx, dword [ebx]
mov edx, edi
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4b52f0
jmp 0x4b5308
xor eax, eax
mov word [edi], ax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, ebx
add ebx, 4
mov eax, dword [eax]
mov dword [ecx + eax], edi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 4]
jl 0x4b52b0
mov esi, dword [ebp - 0x10]
pop edi
pop ebx
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b5340
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
or eax, 0xffffffff
test edx, edx
je 0x4b536c
push esi
mov esi, dword [ebp + 8]
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x55bd10]
sub edx, 1
jne 0x4b5351
pop esi
not eax
pop ebp
ret

Function at 0x4b5370
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or ecx, 0xffffffff
xor edx, edx
nop word [eax + eax]
movzx eax, byte [edx + 0x55bd10]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x55bd10]
movzx eax, byte [edx + 0x55bd11]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x55bd10]
movzx eax, byte [edx + 0x55bd12]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x55bd10]
movzx eax, byte [edx + 0x55bd13]
add edx, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x55bd10]
cmp edx, 0x400
jl 0x4b5380
push ebx
not ecx
xor ebx, ebx
cmp ecx, 0x6fcf9e13
mov edx, 0x55bd10
push esi
sete bl
mov esi, 0x400
or ecx, 0xffffffff
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x55bd10]
sub esi, 1
jne 0x4b5400
xor eax, eax
not ecx
cmp ecx, 0x6fcf9e13
pop esi
sete al
and eax, ebx
pop ebx
ret
Function at 0x4b5720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
dec eax
cmp eax, 5
ja case.default.0x4b5730
jmp dword [eax*4 + 0x4b57d0]
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004d6f40
mov eax, dword [ebp + 0xc]
push eax
push eax
push dword [ebp + 0x10]
call fcn.004d8a20
add esp, 0xc
pop ebp
ret
call fcn.004b80d0
test eax, eax
je 0x4b5777
mov eax, dword [ebp + 0x10]
push dword [ebp + 0xc]
add eax, 0xf4
push eax
call fcn.0040101d
add esp, 8
pop ebp
ret
add dword [ebp + 0x10], 0xf4
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00402680
mov eax, dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push eax
push eax
call fcn.004d48c0
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004d51d0
mov eax, dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push eax
push eax
call fcn.004d6d70
add esp, 0x10
pop ebp
ret
mov byte [0], 0
pop ebp
ret

Function at 0x4b7030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
dec eax
cmp eax, 5
ja case.default.0x4b7040
jmp dword [eax*4 + 0x4b70d0]
call fcn.004b80d0
test eax, eax
je 0x4b7060
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00401545
add esp, 8
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00401a80
mov eax, dword [ebp + 0xc]
push eax
push eax
push dword [ebp + 0x10]
call fcn.004d9450
add esp, 0xc
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004d76b0
mov eax, dword [ebp + 0xc]
push 1
push dword [ebp + 0x10]
push eax
push eax
call fcn.004d48c0
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004d5620
mov eax, dword [ebp + 0xc]
push 1
push dword [ebp + 0x10]
push eax
push eax
call fcn.004d6d70
add esp, 0x10
pop ebp
ret
mov byte [0], 0
pop ebp
ret
Function at 0x4b8510
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x57c100], 0
je 0x4b8528
mov eax, 1
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp edi, eax
jbe 0x4b853f
sub edi, eax
cmp edi, 2
jae 0x4b854e
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov eax, 0x40
push 0
push 0
cmp edi, eax
mov dword [0x57c104], 0
push 0
mov dword [0x57e210], 0
cmova edi, eax
push 0
mov dword [0x57c10c], 0
call ebx
mov dword [0x57e21c], eax
test eax, eax
je 0x4b85a3
push 0
push 0
push 0
push 0
call ebx
mov dword [0x57e220], eax
test eax, eax
jne 0x4b85ab
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_CreateMutexW]
push 0
push 0
push 0
call esi
mov dword [0x57e218], eax
test eax, eax
je 0x4b867e
push 0
push 0
push 0
call esi
mov dword [0x57e214], eax
test eax, eax
je 0x4b867e
push 0x2000
push 0
push 0x57c210
call fcn.004e46b0
add esp, 0xc
xor esi, esi
push 0
push 0
push 0
push 0
mov dword [esi + 0x57c210], 0
call ebx
mov dword [esi + 0x57c218], eax
test eax, eax
je 0x4b8679
add esi, 0x40
cmp esi, 0x2000
jb 0x4b85f2
mov dword [0x57c108], 0
test edi, edi
je 0x4b8663
nop dword [eax]
push 0
push 0
push 0
push 0x4b8740
push 0
push 0
call fcn.004f1e8c
mov ecx, dword [0x57c108]
add esp, 0x18
mov dword [ecx*4 + 0x57c110], eax
test eax, eax
je 0x4b8679
inc ecx
mov dword [0x57c108], ecx
cmp ecx, edi
jb 0x4b8630
pop esi
pop ebx
mov dword [0x57c100], 1
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
call fcn.004b8690
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4b8990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
shr eax, 2
test eax, eax
je 0x4b89cb
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, dword [edi]
lea edi, [edi + 4]
mov esi, edx
mov ecx, edx
shr esi, 8
shl ecx, 8
xor esi, ecx
shl edx, 8
and esi, 0xff00ff
xor esi, edx
rol esi, 0x10
mov dword [edi - 4], esi
sub eax, 1
jne 0x4b89a2
pop edi
pop esi
pop ebp
ret
Function at 0x4b91f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x1000
push 0
push ebx
call fcn.004e46b0
add esp, 0xc
xor eax, eax
mov dword [ebp - 4], eax
test eax, eax
jne 0x4b92a9
mov ecx, dword [ebp + 8]
mov esi, 4
mov eax, dword [ecx]
mov dword [ebx + 0x180], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 0x184], eax
lea edx, [esi + 0x10]
shl edx, 4
lea ecx, [esi + 8]
add edx, ebx
shl ecx, 5
push edx
mov eax, dword [ecx + ebx]
mov dword [edx], eax
mov eax, dword [ecx + ebx + 4]
mov dword [edx + 4], eax
call fcn.004b9640
sar esi, 1
add esp, 4
test esi, esi
jg 0x4b9232
mov eax, dword [ebx + 0x110]
lea ecx, [ebx + 0x80]
mov dword [ecx], eax
mov eax, dword [ebx + 0x114]
push ecx
mov dword [ecx + 4], eax
call fcn.004b9640
add esp, 4
mov esi, 4
mov edx, esi
mov ecx, esi
shl edx, 4
add edx, ebx
shl ecx, 5
push edx
mov eax, dword [ecx + ebx]
mov dword [edx], eax
mov eax, dword [ecx + ebx + 4]
mov dword [edx + 4], eax
call fcn.004b9640
sar esi, 1
add esp, 4
test esi, esi
jg 0x4b9280
jmp 0x4b9314
cmp eax, 1
jle 0x4b9317
lea edx, [eax - 2]
mov ecx, 8
shl edx, 4
shl eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
lea edi, [ecx + eax]
add ecx, edx
add ecx, ecx
shl edi, 4
add edi, ebx
mov eax, dword [ebx + ecx*8]
mov dword [edi], eax
mov eax, dword [ebx + ecx*8 + 4]
mov ecx, eax
mov dword [edi + 4], eax
mov edx, ecx
mov esi, dword [edi]
mov eax, esi
shr eax, 0x18
shl ecx, 8
or eax, ecx
shr edx, 0x18
mov ecx, dword [ebp - 8]
mov dword [edi + 4], eax
shl esi, 8
movzx eax, word [edx*2 + 0x52c8c0]
mov edx, dword [ebp - 0xc]
xor eax, esi
sar ecx, 1
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
test ecx, ecx
jg 0x4b92c5
mov eax, dword [ebp - 4]
mov ecx, eax
mov edi, 2
shl eax, 8
shl ecx, 4
add eax, 0x10
add eax, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
nop
lea edx, [ecx + edi]
shl edx, 4
add edx, ebx
cmp edi, 1
jle 0x4b9383
mov ecx, edi
lea esi, [eax + 8]
shl ecx, 4
lea ebx, [edi - 1]
add esi, ecx
nop word [eax + eax]
mov ecx, dword [eax]
lea eax, [eax + 0x10]
xor ecx, dword [edx]
lea esi, [esi + 0x10]
mov dword [esi - 0x18], ecx
mov ecx, dword [eax - 0xc]
xor ecx, dword [edx + 4]
mov dword [esi - 0x14], ecx
mov ecx, dword [eax - 8]
xor ecx, dword [edx + 8]
mov dword [esi - 0x10], ecx
mov ecx, dword [eax - 4]
xor ecx, dword [edx + 0xc]
mov dword [esi - 0xc], ecx
sub ebx, 1
jne 0x4b9350
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add edi, edi
cmp edi, 0x10
jl 0x4b9330
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x10
jl 0x4b9211
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b93b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x2000
push 0
push ebx
call fcn.004e46b0
add esp, 0xc
xor eax, eax
mov dword [ebp - 4], eax
test eax, eax
jne 0x4b9459
mov eax, dword [ebp + 8]
mov esi, 4
movups xmm0, xmmword [eax]
movups xmmword [ebx + 0x180], xmm0
nop dword [eax + eax]
lea eax, [esi + 8]
shl eax, 5
lea ecx, [esi + 0x10]
shl ecx, 4
add ecx, ebx
push ecx
movups xmm0, xmmword [eax + ebx]
movups xmmword [ecx], xmm0
call fcn.004b9590
sar esi, 1
add esp, 4
test esi, esi
jg 0x4b93f0
movups xmm0, xmmword [ebx + 0x110]
lea eax, [ebx + 0x80]
push eax
movups xmmword [eax], xmm0
call fcn.004b9590
add esp, 4
mov esi, 4
mov eax, esi
mov ecx, esi
shl eax, 5
shl ecx, 4
add ecx, ebx
push ecx
movups xmm0, xmmword [eax + ebx]
movups xmmword [ecx], xmm0
call fcn.004b9590
sar esi, 1
add esp, 4
test esi, esi
jg 0x4b9432
jmp 0x4b94f1
cmp eax, 1
jle 0x4b94f4
lea edx, [eax - 2]
mov ecx, 8
shl edx, 4
shl eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
nop dword [eax]
add eax, ecx
shl eax, 4
add ebx, eax
lea eax, [edx + ecx]
shl eax, 4
add eax, dword [ebp + 0xc]
movups xmm0, xmmword [eax]
movups xmmword [ebx], xmm0
mov esi, dword [ebx + 8]
mov eax, esi
mov ecx, dword [ebx + 0xc]
mov edi, ecx
mov edx, dword [ebx + 4]
shr eax, 0x18
shl ecx, 8
or eax, ecx
shl esi, 8
mov ecx, dword [ebx]
mov dword [ebx + 0xc], eax
mov eax, edx
shr eax, 0x18
or eax, esi
shl edx, 8
mov dword [ebx + 8], eax
mov eax, ecx
shr eax, 0x18
or eax, edx
shr edi, 0x18
mov edx, dword [ebp - 0xc]
mov dword [ebx + 4], eax
shl ecx, 8
movzx eax, word [edi*2 + 0x52c6c0]
xor eax, ecx
mov ecx, dword [ebp - 8]
sar ecx, 1
mov dword [ebx], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
test ecx, ecx
jg 0x4b9480
mov eax, dword [ebp - 4]
mov ecx, eax
mov edi, 2
shl eax, 8
shl ecx, 4
add eax, 0x10
add eax, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
nop dword [eax]
lea esi, [ecx + edi]
shl esi, 4
add esi, ebx
cmp edi, 1
jle 0x4b9563
mov ecx, edi
lea edx, [eax + 8]
shl ecx, 4
lea ebx, [edi - 1]
add edx, ecx
nop word [eax + eax]
mov ecx, dword [eax]
lea eax, [eax + 0x10]
xor ecx, dword [esi]
lea edx, [edx + 0x10]
mov dword [edx - 0x18], ecx
mov ecx, dword [eax - 0xc]
xor ecx, dword [esi + 4]
mov dword [edx - 0x14], ecx
mov ecx, dword [eax - 8]
xor ecx, dword [esi + 8]
mov dword [edx - 0x10], ecx
mov ecx, dword [eax - 4]
xor ecx, dword [esi + 0xc]
mov dword [edx - 0xc], ecx
sub ebx, 1
jne 0x4b9530
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add edi, edi
cmp edi, 0x10
jl 0x4b9510
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x20
jl 0x4b93d1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret