joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c2e70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
push esi
call fcn.0054e38b
add esp, 8
test eax, eax
jne 0x4c2f96
mov ecx, esi
call fcn.004c2b50
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4c2f8d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4c2f8d
cmp dword [ebp - 4], 0
lea edx, [edi + 0x20]
lea ecx, [ebp - 0x1c]
jne 0x4c2f37
call fcn.004c2c70
cmp dword [ebp - 0xc], 0
jne 0x4c2f0c
cmp dword [ebp - 8], 0
jne 0x4c2f0c
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
jmp 0x4c2f17
lea edx, [edi + 0x18]
lea ecx, [ebp - 0xc]
call fcn.004c2c70
cmp dword [ebp - 0x14], 0
jne 0x4c2f23
cmp dword [ebp - 0x10], 0
je 0x4c2f6d
lea edx, [edi + 0x28]
lea ecx, [ebp - 0x14]
call fcn.004c2c70
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004c2d50
cmp dword [ebp - 0xc], 0
jne 0x4c2f56
cmp dword [ebp - 8], 0
jne 0x4c2f56
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
jmp 0x4c2f61
lea edx, [edi + 0x18]
lea ecx, [ebp - 0xc]
call fcn.004c2d50
cmp dword [ebp - 0x14], 0
jne 0x4c2f82
cmp dword [ebp - 0x10], 0
jne 0x4c2f82
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [edi + 0x2c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [edi + 0x28]
lea ecx, [ebp - 0x14]
call fcn.004c2d50
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4c2ff0
test bl, 0x10
je 0x4c2ff0
push 0x30
push 0
push edi
call fcn.0053f2b0
add esp, 0xc
mov ecx, 0x210000
call fcn.004c2420
shl ebx, 7
not ebx
mov dword [edi + 0x20], eax
and ebx, 0x80
mov dword [edi + 0x28], eax
or ebx, 0x4100
mov dword [edi + 0x18], eax
mov dword [edi + 0x24], edx
xor eax, eax
mov dword [edi + 0x2c], edx
mov dword [edi + 0x1c], edx
mov word [edi + 6], bx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c3860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5e7cdc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test eax, eax
jne 0x4c389e
push dword [ebp + 0xc]
push esi
push dword [0x609ce0]
call fcn.005510cc
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x4c397b
test edi, edi
jne 0x4c3953
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
cmp eax, 1
mov eax, dword [ebp + 0xc]
jne 0x4c38ed
shr eax, 1
push eax
lea ebx, [esi + eax]
push ebx
push dword [0x609ce0]
call fcn.005510cc
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x4c397b
test edi, edi
je 0x4c397b
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov byte [esi], al
inc esi
cmp al, 0xa
jne 0x4c38e4
mov word [esi - 1], 0xa0d
inc esi
inc edi
sub ecx, 1
jne 0x4c38d0
sub esi, edi
jmp 0x4c3953
dec eax
mov ebx, esi
push eax
push esi
push dword [0x609ce0]
call fcn.005510cc
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x4c397b
test edi, edi
je 0x4c397b
mov byte [edi + esi], 0xa
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov edx, esi
mov byte [esi], al
inc esi
cmp al, 0xd
jne 0x4c3927
cmp byte [ebx], 0xa
jne 0x4c3927
mov esi, edx
dec edi
mov eax, esi
sub ecx, 1
jne 0x4c3911
test edi, edi
jne 0x4c394a
push 1
push esi
push dword [0x609ce0]
call fcn.005510cc
add esp, 0xc
mov edi, 1
jmp 0x4c3953
sub esi, edi
cmp byte [eax - 1], 0x1a
jne 0x4c3953
dec edi
mov ecx, dword [0x6098d8]
mov edx, esi
push edi
call fcn.004bc540
mov dword [0x6098d8], eax
add esp, 4
mov eax, dword [0x609ce8]
add eax, edi
mov dword [0x609ce8], eax
cmp eax, edi
jb 0x4c3981
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov edx, str.file_exceeds_Zips_4GB_uncompressed_size_limit
mov ecx, 6
call fcn.004be9e0
int3
Function at 0x4c3f40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x5e7ce8], 1
push ebx
push esi
push edi
mov esi, ecx
jne 0x4c4020
mov dword [0x5e7ce8], 2
test esi, esi
je 0x4c3f7e
mov al, byte [esi]
cmp al, 0x80
jae 0x4c3f7e
cmp byte [esi + 1], 0x3a
jne 0x4c3f7e
movzx eax, al
movzx ebx, byte [eax + 0x6547e0]
jmp 0x4c3f80
xor ebx, ebx
mov ecx, 0x210000
mov dword [0x609cf0], 0x28
mov dword [0x609cf4], 0x210000
call fcn.004c2420
push 0
push 0
mov dword [0x609cf8], eax
xor ecx, ecx
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x5c3a78
push eax
lea eax, [ebp - 0xc]
mov dword [0x609cfc], edx
push eax
push 0
push 0xd
test ebx, ebx
mov byte [ebp - 4], bl
lea eax, [ebp - 4]
push 0x6098c4
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4c3ff8
push 0
mov ecx, 0x6098c4
mov dword [0x5e7cc0], 0x6098c4
call fcn.004c1e40
add esp, 4
jmp 0x4c4002
mov dword [0x5e7cc0], 0
test esi, esi
je 0x4c4017
cmp byte [esi], 0x80
jae 0x4c4020
cmp byte [esi + 1], 0x3a
jne 0x4c4020
cmp byte [esi + 2], 0
jne 0x4c4020
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x5cd3d8
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4c4047
test dl, dl
je 0x4c4043
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4c4047
add eax, 2
add ecx, 2
test dl, dl
jne 0x4c4027
xor eax, eax
jmp 0x4c404c
sbb eax, eax
or eax, 1
mov ecx, esi
test eax, eax
jne 0x4c4062
push eax
call fcn.004c1e40
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c4065
sub ecx, edx
lea eax, [ecx + 2]
push eax
call fcn.0054cef5
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4c408a
lea eax, [ebx + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4c4090
mov al, byte [ebx]
mov esi, ebx
test al, al
je 0x4c40c3
cmp al, 0x5c
jne 0x4c40ac
mov byte [esi], 0x2f
call fcn.0055277b
push eax
push esi
call fcn.0055272f
add esi, eax
add esp, 8
mov al, byte [esi]
test al, al
jne 0x4c40a5
mov edx, 0x3a
mov ecx, ebx
call fcn.004c2ad0
mov edi, eax
test edi, edi
je 0x4c411a
mov cl, byte [edi + 1]
inc edi
mov esi, edi
test cl, cl
je 0x4c40fd
nop
cmp cl, 0x3a
je 0x4c4110
call fcn.0055277b
push eax
push esi
call fcn.0055272f
mov cl, byte [esi + eax]
add esi, eax
add esp, 8
test cl, cl
jne 0x4c40e0
cmp edi, ebx
jbe 0x4c411c
cmp byte [edi], 0
jne 0x4c411c
mov eax, 0x2e
mov word [edi], ax
jmp 0x4c411c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, ebx
mov edx, edi
mov ecx, ebx
call fcn.004c3c10
push ebx
mov esi, eax
call fcn.005417da
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c6a20
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
push 0x50
call fcn.005533a4
push edi
push 0x4b
call fcn.005533a4
push edi
push 3
call fcn.005533a4
push edi
push 4
call fcn.005533a4
movsx eax, byte [esi + 2]
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 3]
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0x2c]
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0x2d]
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 6]
add esp, 0x40
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 7]
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 8]
push edi
push eax
call fcn.005533a4
mov eax, dword [esi + 8]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0xa]
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0xb]
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0xc]
push edi
push eax
call fcn.005533a4
mov eax, dword [esi + 0xc]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0xe]
add esp, 0x40
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0xf]
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0x10]
push edi
push eax
call fcn.005533a4
mov eax, dword [esi + 0x10]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0x12]
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0x13]
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0x14]
push edi
push eax
call fcn.005533a4
mov eax, dword [esi + 0x14]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0x16]
add esp, 0x40
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0x17]
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0x18]
push edi
push eax
call fcn.005533a4
mov eax, dword [esi + 0x18]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.005533a4
movsx eax, byte [esi + 0x1c]
push edi
push eax
call fcn.005533a4
mov eax, dword [esi + 0x1c]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.005533a4
push edi
push dword [esi + 0x18]
push 1
push dword [esi + 0x48]
call fcn.005561a2
add esp, 0x40
cmp eax, dword [esi + 0x18]
jne 0x4c6bc1
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4c6bbc
push edi
push eax
push 1
push dword [esi + 0x3c]
call fcn.005561a2
add esp, 0x10
cmp eax, dword [esi + 0x1c]
jne 0x4c6bc1
pop edi
xor eax, eax
pop esi
ret
pop edi
mov eax, 0xa
pop esi
ret
Function at 0x4c6f30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5e7d00]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, ecx
push edi
mov dword [ebp - 0xc], eax
mov eax, dword [0x6548e0]
push esi
push 0x50
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
call fcn.005533a4
push esi
push 0x4b
call fcn.005533a4
push esi
push 5
call fcn.005533a4
push esi
push 6
call fcn.005533a4
push esi
push 0
call fcn.005533a4
push esi
push 0
call fcn.005533a4
push esi
push 0
call fcn.005533a4
push esi
push 0
call fcn.005533a4
add esp, 0x40
movsx edi, bl
push esi
push edi
call fcn.005533a4
shr ebx, 8
movsx esi, bl
mov ebx, dword [ebp + 0x14]
push ebx
push esi
call fcn.005533a4
push ebx
push edi
call fcn.005533a4
mov edi, ebx
push edi
push esi
call fcn.005533a4
mov ebx, dword [ebp - 4]
movsx eax, bl
push edi
push eax
call fcn.005533a4
mov eax, ebx
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.005533a4
mov eax, ebx
shr eax, 0x10
movsx eax, al
push edi
push eax
call fcn.005533a4
shr ebx, 0x18
movsx eax, bl
push edi
push eax
call fcn.005533a4
mov ebx, dword [ebp + 8]
add esp, 0x40
movsx eax, bl
push edi
push eax
call fcn.005533a4
push edi
mov eax, ebx
shr eax, 8
movsx eax, al
push eax
call fcn.005533a4
mov eax, ebx
shr eax, 0x10
movsx eax, al
push edi
push eax
call fcn.005533a4
shr ebx, 0x18
movsx eax, bl
push edi
push eax
call fcn.005533a4
mov ebx, dword [ebp - 8]
movsx eax, bl
push edi
push eax
call fcn.005533a4
mov eax, ebx
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.005533a4
add esp, 0x30
test ebx, ebx
je 0x4c7073
push edi
push ebx
push 1
push dword [ebp - 0xc]
call fcn.005561a2
add esp, 0x10
cmp eax, ebx
je 0x4c7073
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c7ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x609d0c]
xor edx, edx
push esi
mov esi, dword [0x624644]
xor ecx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov dword [0x6546a4], 2
push edi
test ebx, ebx
je 0x4c7cb7
mov edi, dword [0x609d08]
cmp ebx, 3
jb 0x4c7b5b
movzx eax, byte [esi + 0x634682]
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
mov dword [0x609d08], edi
movzx ecx, word [edi*2 + 0x624660]
mov edx, ecx
mov word [eax*2 + 0x6446a0], cx
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov word [edi*2 + 0x624660], si
test edx, edx
je 0x4c7b8a
mov eax, esi
sub eax, edx
cmp eax, 0x7efa
ja 0x4c7b8a
mov eax, dword [0x62464c]
mov ecx, edx
cmp eax, ebx
cmova eax, ebx
mov dword [0x62464c], eax
call fcn.004c7820
mov ecx, eax
cmp ecx, ebx
cmova ecx, ebx
mov dword [ebp - 4], ecx
cmp ecx, 3
jb 0x4c7c2f
lea edx, [ecx - 3]
mov ecx, esi
sub ecx, dword [0x624650]
call fcn.004c9140
mov edx, dword [ebp - 4]
mov ecx, eax
sub ebx, edx
mov dword [ebp - 0xc], ecx
mov dword [0x609d0c], ebx
cmp edx, dword [0x609d00]
ja 0x4c7c09
cmp ebx, 3
jb 0x4c7c09
dec edx
movzx eax, byte [esi + 0x634683]
inc esi
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
movzx ecx, word [edi*2 + 0x624660]
mov dword [ebp - 8], ecx
mov word [eax*2 + 0x6446a0], cx
mov word [edi*2 + 0x624660], si
sub edx, 1
jne 0x4c7bc1
mov ecx, dword [ebp - 0xc]
mov dword [0x609d08], edi
mov dword [ebp - 4], edx
jmp 0x4c7c46
add esi, edx
mov dword [ebp - 4], 0
mov edx, esi
movzx edi, byte [edx + 0x634680]
movzx eax, byte [edx + 0x634681]
shl edi, 5
xor edi, eax
mov dword [0x609d08], edi
jmp 0x4c7c49
movzx edx, byte [esi + 0x634680]
xor ecx, ecx
call fcn.004c9140
dec ebx
mov ecx, eax
mov dword [0x609d0c], ebx
inc esi
mov edx, esi
mov dword [0x624644], esi
test ecx, ecx
je 0x4c7c8a
mov eax, dword [0x6546a0]
test eax, eax
js 0x4c7c64
lea ecx, [eax + 0x634680]
jmp 0x4c7c66
xor ecx, ecx
push 0
sub edx, eax
call fcn.004c8dd0
mov esi, dword [0x624644]
add esp, 4
mov ebx, dword [0x609d0c]
mov edi, dword [0x609d08]
mov dword [0x6546a0], esi
cmp ebx, 0x106
jae 0x4c7ca9
call fcn.004c7970
mov ebx, dword [0x609d0c]
mov edi, dword [0x609d08]
mov esi, dword [0x624644]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
test ebx, ebx
jne 0x4c7b17
mov eax, dword [0x6546a0]
test eax, eax
js 0x4c7cc8
lea ecx, [eax + 0x634680]
jmp 0x4c7cca
xor ecx, ecx
sub esi, eax
push 1
mov edx, esi
call fcn.004c8dd0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c7f90
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, 0x12345678
mov esi, 0x23456789
mov dword [0x609d18], eax
mov edx, 0x34567890
mov dword [0x609d1c], esi
mov dword [0x609d20], edx
mov cl, byte [edi]
test cl, cl
je 0x4c8006
push ebx
mov ebx, dword [0x654d74]
movsx ecx, cl
lea edi, [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ebx + ecx*4]
movzx ecx, al
add ecx, esi
imul esi, ecx, 0x8088405
inc esi
mov ecx, esi
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [ebx + ecx*4]
mov cl, byte [edi]
test cl, cl
jne 0x4c7fc1
mov dword [0x609d18], eax
mov dword [0x609d20], edx
mov dword [0x609d1c], esi
pop ebx
pop edi
pop esi
ret
Function at 0x4c82a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x5e7d0c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
je 0x4c8358
mov dword [ebp - 8], eax
mov edx, ecx
mov dword [ebp - 4], edx
test eax, eax
je 0x4c8358
mov eax, dword [0x609d18]
push ebx
mov ebx, dword [0x609d1c]
push esi
push edi
mov edi, dword [0x609d20]
nop dword [eax]
mov dl, byte [edx]
mov esi, edi
and esi, 0xfffd
movsx ecx, dl
xor ecx, eax
or esi, 2
movzx ecx, cl
mov dword [ebp - 0xc], esi
mov esi, dword [0x654d74]
shr eax, 8
xor eax, dword [esi + ecx*4]
movzx ecx, al
add ecx, ebx
imul ebx, ecx, 0x8088405
inc ebx
mov ecx, ebx
shr ecx, 0x18
xor ecx, edi
shr edi, 8
movzx ecx, cl
xor edi, dword [esi + ecx*4]
mov ecx, dword [ebp - 0xc]
xor ecx, 1
imul ecx, dword [ebp - 0xc]
shr ecx, 8
xor cl, dl
mov edx, dword [ebp - 4]
mov byte [edx], cl
inc edx
sub dword [ebp - 8], 1
mov dword [ebp - 4], edx
jne 0x4c82e0
mov ecx, dword [ebp - 0x10]
mov dword [0x609d20], edi
pop edi
pop esi
mov dword [0x609d18], eax
mov eax, dword [ebp + 8]
mov dword [0x609d1c], ebx
pop ebx
push dword [ebp + 0xc]
push eax
push 1
push ecx
call fcn.005561a2
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4c9730
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5d7008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5e7e94], 0
push esi
push edi
je 0x4c9760
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d630
mov esp, ebp
pop ebp
ret
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
jne 0x4c9782
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d630
mov esp, ebp
pop ebp
ret
mov esi, edi
mov ecx, 0x5e7d98
xchg dword [ecx], esi
test esi, esi
je 0x4c97bf
mov eax, esi
xchg dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x5e7e94]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053d630
mov esp, ebp
pop ebp
ret
push 0x656ee0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x124
push 0
push 0x624520
call fcn.0053f2b0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4c98b5
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeBackupPrivilege
push 0
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4c985b
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4c985b
call esi
test eax, eax
jne 0x4c985b
mov dword [0x5e7d18], 1
push dword [ebp - 0x18]
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4c98ba
cmp dword [0x5e7d18], 0
jne 0x4c984b
lea eax, [ebp - 0x10]
push eax
push str.SeSecurityPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4c984b
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4c984b
call esi
mov ecx, dword [0x5e7e98]
test eax, eax
push dword [ebp - 0x18]
mov esi, 1
cmove ecx, esi
mov dword [0x5e7e98], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4c98ba
mov esi, 1
push edi
mov dword [0x5e7e94], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0053d630
mov esp, ebp
pop ebp
ret
Function at 0x4c9e60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4c9e70
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
not eax
cmp edi, 4
jb 0x4c9ecc
mov ecx, edi
shr ecx, 2
mov dword [ebp + 0xc], ecx
push ebx
mov ebx, dword [esi]
sub edi, 4
xor ebx, eax
add esi, 4
mov eax, ebx
shr eax, 0x10
movzx edx, al
mov eax, ebx
shr eax, 8
movzx ecx, al
mov eax, dword [edx*4 + 0x5b1d60]
xor eax, dword [ecx*4 + 0x5b2160]
mov ecx, ebx
shr ecx, 0x18
xor eax, dword [ecx*4 + 0x5b1960]
movzx ecx, bl
xor eax, dword [ecx*4 + 0x5b2560]
sub dword [ebp + 0xc], 1
jne 0x4c9e87
pop ebx
test edi, edi
je 0x4c9eea
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5b1960]
sub edi, 1
jne 0x4c9ed0
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x4c9ef0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.winvnc.exe_crc32_z
Function at 0x4c9f00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x5d7008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], esi
test edi, edi
jg 0x4c9f3c
jl 0x4ca0ec
test esi, esi
je 0x4ca0ec
mov ecx, 1
mov dword [ebp - 0x84], 0xedb88320
mov eax, ecx
nop dword [eax]
mov dword [ebp + eax*4 - 0x84], ecx
inc eax
add ecx, ecx
cmp eax, 0x20
jl 0x4c9f50
xor esi, esi
mov eax, dword [ebp + esi - 0x84]
lea ecx, [ebp - 0x84]
xor edx, edx
test eax, eax
je 0x4c9f81
test al, 1
je 0x4c9f7a
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x4c9f74
mov dword [ebp + esi - 0x104], edx
add esi, 4
cmp esi, 0x80
jl 0x4c9f61
xor esi, esi
nop word [eax + eax]
mov eax, dword [ebp + esi - 0x104]
lea ecx, [ebp - 0x104]
xor edx, edx
test eax, eax
je 0x4c9fc0
test al, 1
je 0x4c9fb9
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x4c9fb3
mov dword [ebp + esi - 0x84], edx
add esi, 4
cmp esi, 0x80
jl 0x4c9fa0
nop dword [eax]
nop word [eax + eax]
xor esi, esi
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp + esi - 0x84]
lea ecx, [ebp - 0x84]
xor edx, edx
test eax, eax
je 0x4ca010
test al, 1
je 0x4ca009
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x4ca003
mov dword [ebp + esi - 0x104], edx
add esi, 4
cmp esi, 0x80
jl 0x4c9ff0
mov edx, dword [ebp - 0x108]
mov eax, edx
and eax, 1
or eax, 0
je 0x4ca050
xor ecx, ecx
lea eax, [ebp - 0x104]
test ebx, ebx
je 0x4ca04e
nop
test bl, 1
je 0x4ca047
xor ecx, dword [eax]
add eax, 4
shr ebx, 1
jne 0x4ca040
mov ebx, ecx
shrd edx, edi, 1
sar edi, 1
mov eax, edx
or eax, edi
mov dword [ebp - 0x108], edx
je 0x4ca0e6
xor esi, esi
nop dword [eax + eax]
mov eax, dword [ebp + esi - 0x104]
lea ecx, [ebp - 0x104]
xor edx, edx
test eax, eax
je 0x4ca090
test al, 1
je 0x4ca089
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x4ca083
mov dword [ebp + esi - 0x84], edx
add esi, 4
cmp esi, 0x80
jl 0x4ca070
mov esi, dword [ebp - 0x108]
mov eax, esi
and eax, 1
or eax, 0
je 0x4ca0d0
xor ecx, ecx
lea eax, [ebp - 0x84]
test ebx, ebx
je 0x4ca0ce
nop
test bl, 1
je 0x4ca0c7
xor ecx, dword [eax]
add eax, 4
shr ebx, 1
jne 0x4ca0c0
mov ebx, ecx
shrd esi, edi, 1
sar edi, 1
mov eax, esi
or eax, edi
mov dword [ebp - 0x108], esi
jne 0x4c9fe0
xor ebx, dword [ebp - 0x10c]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d630
mov esp, ebp
pop ebp
ret