joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b24e0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4b2525
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push dword [esp + 0x18]
call fcn.0047f760
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x10
jne 0x4b257c
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x4b258b
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 4]
test eax, eax
je 0x4b259c
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add esp, 0xc
ret

Function at 0x4b25f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4b2617
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x4b2662
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x4b2666
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4b26c6
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x4b2685
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x4b26f7
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x4edcfe
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x4edcff
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4b26d0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x4b3863
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004b383f
pop esi
leave
ret 8

Function at 0x4b573d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4b577c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b577c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b577c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4b577c
cmp dword [ecx + 0x74], 0xe
jbe 0x4b577c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4be27d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x534094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x51d5c0
push esi
call fcn.004c5dfb
pop ecx
pop ecx
test eax, eax
jne 0x4be2ab
xor al, al
jmp 0x4be328
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.004bdfb4
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x4be2e5
push dword [ebp - 0x210]
call fcn.004be97e
xor al, al
jmp 0x4be326
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4be2eb
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x4be30b
push edx
call fcn.004be1b3
pop ecx
test al, al
je 0x4be2d6
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4be319
mov bl, 1
push dword [ebp - 0x210]
call fcn.004be97e
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b446a
leave
ret
Function at 0x4c0e1d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004b5110
mov eax, dword [0x534094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004d02d9
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4c0e5f
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4c0fbb
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004b5060
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x543ad0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004c70fa
mov ecx, dword [esi*4 + 0x543ad0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4c0fb4
cmp eax, dword [edi + ecx + 0x24]
jne 0x4c0fb4
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c0fb4
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c70fa
add esp, 0x14
test edx, edx
jl 0x4c0fb4
jg 0x4c0f2a
test eax, eax
jb 0x4c0fb4
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4c0fb4
jl 0x4c0f44
cmp dword [ebp - 0x1008], eax
ja 0x4c0fb4
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4c0f62
test ebx, ebx
je 0x4c0f9b
cmp ecx, edi
jae 0x4c0f9b
mov al, byte [ecx]
cmp al, 0xd
jne 0x4c0f7c
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4c0f88
cmp byte [ecx + 1], 0xa
jne 0x4c0f88
inc ecx
jmp 0x4c0f88
movzx eax, al
movsx eax, byte [eax + 0x53ded8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4c0f62
cmp edx, ebx
jne 0x4c0f62
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4c0fb9
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004b446a
leave
ret
Function at 0x4cb80e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x543ad0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4cb84e
cmp byte [ebx], 0xa
jne 0x4cb84e
or byte [eax + edi + 0x28], 4
jmp 0x4cb853
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4cb951
mov al, byte [edx]
cmp al, 0x1a
je 0x4cb933
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4cb882
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4cb8a7
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4cb8b1
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4cb864
jmp 0x4cb951
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4cb92e
cmp dword [ebp - 0xc], 0
je 0x4cb92e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x543ad0]
test byte [eax + edi + 0x28], 0x48
je 0x4cb908
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4cb8f3
mov byte [esi], dl
jmp 0x4cb904
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x543ad0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4cb951
cmp byte [ebp - 1], 0xa
jne 0x4cb917
cmp esi, ebx
jne 0x4cb917
mov byte [esi], 0xa
jmp 0x4cb950
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004c7118
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4cb951
mov byte [esi], 0xd
jmp 0x4cb950
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x543ad0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4cb94d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4cb951
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4cb95a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x543ad0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4cb99d
cmp word [esi], dx
jne 0x4cb99d
or byte [edi + eax + 0x28], 4
jmp 0x4cb9a2
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4cbaf5
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4cbad5
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4cb9e4
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4cba1a
cmp eax, edx
jae 0x4cba26
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4cb9bc
jmp 0x4cbaf5
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4cbad1
cmp dword [ebp - 0x14], 0
je 0x4cbad1
mov eax, dword [ebx*4 + 0x543ad0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4cbaa9
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4cba72
mov word [esi], cx
jmp 0x4cbaa5
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x543ad0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x543ad0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x543ad0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4cbaf5
pop ebx
cmp word [ebp - 4], bx
jne 0x4cbaba
cmp esi, dword [ebp + 0xc]
jne 0x4cbaba
mov word [esi], bx
jmp 0x4cbaf2
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004c7118
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4cbaf5
push 0xd
jmp 0x4cbaee
mov ecx, dword [ebx*4 + 0x543ad0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4cbaec
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4cbaf5
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4ced14
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x51fc04
push 0x51fbfc
push str.FlsAlloc
push 0x1e
call fcn.004ceb41
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4ced48
push dword [ebp + 8]
mov ecx, esi
call dword [0x4e2524]
call esi
jmp 0x4ced4e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4ced92
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x51fc14
push 0x51fc0c
push str.FlsGetValue
push 0x20
call fcn.004ceb41
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4cedc9
push dword [ebp + 8]
mov ecx, esi
call dword [0x4e2524]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4d1124
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d0f95
Function at 0x4d6fdd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4d707a
push ebx
push esi
call fcn.004d6fa6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004d5f5f
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4d7027
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4d7079
push edi
push eax
call fcn.004cf3b0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4d7047
call fcn.004ce866
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4d7078
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004d5f5f
add esp, 0x20
test eax, eax
jne 0x4d7066
push edi
call fcn.004ce866
jmp 0x4d706e
push ebx
call fcn.004ce866
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4d707d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4d708e
pop esi
ret
push ebx
push edi
push esi
call fcn.004d6fa6
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004cf3b0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4d70b6
push ebx
push esi
push edi
call fcn.004b6770
add esp, 0xc
push 0
call fcn.004ce866
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4d7802
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d7329
Function at 0x4da04f
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004d9fcb
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4da1c7
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4da1c7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4da176
jg 0x4da0a8
test eax, eax
je 0x4da16c
push 1
push 0x1000
call fcn.004ce809
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4da0ce
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4da163
push 0x8000
push ebx
call fcn.004c964e
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4da0fa
jg 0x4da0f5
cmp ecx, 0x1000
jb 0x4da0fa
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004cca74
add esp, 0x10
cmp eax, 0xffffffff
je 0x4da13f
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4da0f5
jl 0x4da126
test ecx, ecx
jne 0x4da0e7
push dword [ebp - 0xc]
push ebx
call fcn.004c964e
push esi
call fcn.004ce866
add esp, 0xc
xor edi, edi
jmp 0x4da1d8
cmp byte [edi + 0x24], 0
je 0x4da156
cmp dword [edi + 0x20], 5
jne 0x4da156
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4da161
mov edi, dword [edi + 0x18]
jmp 0x4da163
xor edi, edi
push esi
call fcn.004ce866
pop ecx
jmp 0x4da1d8
test ecx, ecx
jg 0x4da138
jl 0x4da176
test eax, eax
jae 0x4da138
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c7118
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4da199
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4da138
jmp 0x4da1d0
push ebx
call fcn.004d2013
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4da138
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4da1d8
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4da1d5
mov edi, dword [edi + 0x18]
jmp 0x4da1d8
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004c7118
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4de700
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4de72d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4de72d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403cf0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x224
mov eax, dword [0x47e680]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [esp + 0x228]
push ebx
push ebp
push esi
push edi
push 0x2c
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], 0
call fcn.0040ab06
mov esi, dword [esp + 0x248]
mov ebx, eax
mov edi, dword [esp + 0x244]
add esp, 4
xor ecx, ecx
mov dword [ebx], ebx
mov dword [ebx + 4], ebx
mov dword [ebx + 8], ebx
mov word [ebx + 0xc], 0x101
mov dword [esp + 0x18], ebx
nop dword [eax]
mov eax, ecx
mov byte [esp + ecx + 0x30], cl
cdq
idiv esi
mov al, byte [edx + edi]
mov byte [esp + ecx + 0x130], al
inc ecx
cmp ecx, 0x100
jl 0x403d50
xor esi, esi
xor edi, edi
mov dl, byte [esp + esi + 0x30]
movzx eax, byte [esp + esi + 0x130]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x403d93
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + edi + 0x30]
mov byte [esp + esi + 0x30], al
inc esi
mov byte [esp + edi + 0x30], dl
cmp esi, 0x100
jl 0x403d70
mov ebp, dword [esp + 0x23c]
xor eax, eax
xor ecx, ecx
xor edi, edi
test ebp, ebp
jle 0x403ebb
nop dword [eax]
inc eax
and eax, 0x800000ff
jns 0x403dcf
dec eax
or eax, 0xffffff00
inc eax
mov bl, byte [esp + eax + 0x30]
movzx esi, bl
add ecx, esi
mov dword [esp + 0x10], eax
and ecx, 0x800000ff
jns 0x403dec
dec ecx
or ecx, 0xffffff00
inc ecx
push 0
push 0
push 0
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_OffsetRect]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 0
push 0
movzx eax, byte [esp + edx + 0x38]
mov byte [esp + ecx + 0x38], al
push 0
mov byte [esp + edx + 0x3c], bl
call dword [sym.imp.GDI32.dll_Polyline]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
movzx eax, byte [esp + eax + 0x30]
add eax, esi
movzx eax, al
add eax, ecx
lea ecx, [esp + 0x20]
push eax
push 0
call fcn.00401680
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
movzx eax, byte [edx]
xor byte [ecx + edi], al
mov eax, edx
mov ecx, dword [esp + 0x28]
sub ecx, edx
cmp ecx, 0x1000
jb 0x403e83
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403ef1
push ecx
push edx
call fcn.0040ab36
inc edi
mov dword [esp + 0x28], 0
add esp, 8
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
cmp edi, ebp
jge 0x403eb7
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jmp 0x403dc0
mov ebx, dword [esp + 0x18]
push dword [ebx + 4]
lea eax, [esp + 0x1c]
push eax
mov ecx, eax
call fcn.004019a0
push 0x2c
push dword [esp + 0x1c]
call fcn.0040ab36
mov ecx, dword [esp + 0x238]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040ab49
add esp, 0x224
ret
call fcn.0040f5af
int3
Function at 0x41b600
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041b2a2

Function at 0x41b60b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041b431

Function at 0x41ba05
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040b8f0
mov eax, dword [0x47e680]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041a497
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41ba47
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41bba3
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00427370
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x480620]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041cbd5
mov ecx, dword [esi*4 + 0x480620]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41bb9c
cmp eax, dword [edi + ecx + 0x24]
jne 0x41bb9c
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41bb9c
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041cbd5
add esp, 0x14
test edx, edx
jl 0x41bb9c
jg 0x41bb12
test eax, eax
jb 0x41bb9c
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41bb9c
jl 0x41bb2c
cmp dword [ebp - 0x1008], eax
ja 0x41bb9c
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41bb4a
test ebx, ebx
je 0x41bb83
cmp ecx, edi
jae 0x41bb83
mov al, byte [ecx]
cmp al, 0xd
jne 0x41bb64
lea eax, [edi - 1]
cmp ecx, eax
jae 0x41bb70
cmp byte [ecx + 1], 0xa
jne 0x41bb70
inc ecx
jmp 0x41bb70
movzx eax, al
movsx eax, byte [eax + 0x47e940]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41bb4a
cmp edx, ebx
jne 0x41bb4a
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x41bba1
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040ab49
leave
ret