joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8cb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
push esi
call fcn.0052e022
add esp, 8
test eax, eax
jne 0x4b8dd6
mov ecx, esi
call fcn.004b8990
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4b8dcd
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4b8dcd
cmp dword [ebp - 4], 0
lea edx, [edi + 0x20]
lea ecx, [ebp - 0x1c]
jne 0x4b8d77
call fcn.004b8ab0
cmp dword [ebp - 0xc], 0
jne 0x4b8d4c
cmp dword [ebp - 8], 0
jne 0x4b8d4c
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
jmp 0x4b8d57
lea edx, [edi + 0x18]
lea ecx, [ebp - 0xc]
call fcn.004b8ab0
cmp dword [ebp - 0x14], 0
jne 0x4b8d63
cmp dword [ebp - 0x10], 0
je 0x4b8dad
lea edx, [edi + 0x28]
lea ecx, [ebp - 0x14]
call fcn.004b8ab0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004b8b90
cmp dword [ebp - 0xc], 0
jne 0x4b8d96
cmp dword [ebp - 8], 0
jne 0x4b8d96
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
jmp 0x4b8da1
lea edx, [edi + 0x18]
lea ecx, [ebp - 0xc]
call fcn.004b8b90
cmp dword [ebp - 0x14], 0
jne 0x4b8dc2
cmp dword [ebp - 0x10], 0
jne 0x4b8dc2
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [edi + 0x2c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [edi + 0x28]
lea ecx, [ebp - 0x14]
call fcn.004b8b90
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4b8e30
test bl, 0x10
je 0x4b8e30
push 0x30
push 0
push edi
call fcn.0051b450
add esp, 0xc
mov ecx, 0x210000
call fcn.004b8260
shl ebx, 7
not ebx
mov dword [edi + 0x20], eax
and ebx, 0x80
mov dword [edi + 0x28], eax
or ebx, 0x4100
mov dword [edi + 0x18], eax
mov dword [edi + 0x24], edx
xor eax, eax
mov dword [edi + 0x2c], edx
mov dword [edi + 0x1c], edx
mov word [edi + 6], bx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b96a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5bd06c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test eax, eax
jne 0x4b96de
push dword [ebp + 0xc]
push esi
push dword [0x5dee50]
call fcn.00530fe3
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x4b97bb
test edi, edi
jne 0x4b9793
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
cmp eax, 1
mov eax, dword [ebp + 0xc]
jne 0x4b972d
shr eax, 1
push eax
lea ebx, [esi + eax]
push ebx
push dword [0x5dee50]
call fcn.00530fe3
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x4b97bb
test edi, edi
je 0x4b97bb
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov byte [esi], al
inc esi
cmp al, 0xa
jne 0x4b9724
mov word [esi - 1], 0xa0d
inc esi
inc edi
sub ecx, 1
jne 0x4b9710
sub esi, edi
jmp 0x4b9793
dec eax
mov ebx, esi
push eax
push esi
push dword [0x5dee50]
call fcn.00530fe3
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x4b97bb
test edi, edi
je 0x4b97bb
mov byte [edi + esi], 0xa
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov edx, esi
mov byte [esi], al
inc esi
cmp al, 0xd
jne 0x4b9767
cmp byte [ebx], 0xa
jne 0x4b9767
mov esi, edx
dec edi
mov eax, esi
sub ecx, 1
jne 0x4b9751
test edi, edi
jne 0x4b978a
push 1
push esi
push dword [0x5dee50]
call fcn.00530fe3
add esp, 0xc
mov edi, 1
jmp 0x4b9793
sub esi, edi
cmp byte [eax - 1], 0x1a
jne 0x4b9793
dec edi
mov ecx, dword [0x5dea48]
mov edx, esi
push edi
call fcn.004b2330
mov dword [0x5dea48], eax
add esp, 4
mov eax, dword [0x5dee58]
add eax, edi
mov dword [0x5dee58], eax
cmp eax, edi
jb 0x4b97c1
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov edx, str.file_exceeds_Zips_4GB_uncompressed_size_limit
mov ecx, 6
call fcn.004b4820
int3
Function at 0x4b9d80
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x5bd078], 1
push ebx
push esi
push edi
mov esi, ecx
jne 0x4b9e60
mov dword [0x5bd078], 2
test esi, esi
je 0x4b9dbe
mov al, byte [esi]
cmp al, 0x80
jae 0x4b9dbe
cmp byte [esi + 1], 0x3a
jne 0x4b9dbe
movzx eax, al
movzx ebx, byte [eax + 0x629940]
jmp 0x4b9dc0
xor ebx, ebx
mov ecx, 0x210000
mov dword [0x5dee60], 0x28
mov dword [0x5dee64], 0x210000
call fcn.004b8260
push 0
push 0
mov dword [0x5dee68], eax
xor ecx, ecx
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x5c3a78
push eax
lea eax, [ebp - 0xc]
mov dword [0x5dee6c], edx
push eax
push 0
push 0xd
test ebx, ebx
mov byte [ebp - 4], bl
lea eax, [ebp - 4]
push 0x5dea34
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4b9e38
push 0
mov ecx, 0x5dea34
mov dword [0x5bd050], 0x5dea34
call fcn.004b7c80
add esp, 4
jmp 0x4b9e42
mov dword [0x5bd050], 0
test esi, esi
je 0x4b9e57
cmp byte [esi], 0x80
jae 0x4b9e60
cmp byte [esi + 1], 0x3a
jne 0x4b9e60
cmp byte [esi + 2], 0
jne 0x4b9e60
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x59d2f4
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4b9e87
test dl, dl
je 0x4b9e83
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4b9e87
add eax, 2
add ecx, 2
test dl, dl
jne 0x4b9e67
xor eax, eax
jmp 0x4b9e8c
sbb eax, eax
or eax, 1
mov ecx, esi
test eax, eax
jne 0x4b9ea2
push eax
call fcn.004b7c80
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b9ea5
sub ecx, edx
lea eax, [ecx + 2]
push eax
call fcn.0051f3c3
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4b9eca
lea eax, [ebx + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4b9ed0
mov al, byte [ebx]
mov esi, ebx
test al, al
je 0x4b9f03
cmp al, 0x5c
jne 0x4b9eec
mov byte [esi], 0x2f
call fcn.00532919
push eax
push esi
call fcn.00532799
add esi, eax
add esp, 8
mov al, byte [esi]
test al, al
jne 0x4b9ee5
mov edx, 0x3a
mov ecx, ebx
call fcn.004b8910
mov edi, eax
test edi, edi
je 0x4b9f5a
mov cl, byte [edi + 1]
inc edi
mov esi, edi
test cl, cl
je 0x4b9f3d
nop
cmp cl, 0x3a
je 0x4b9f50
call fcn.00532919
push eax
push esi
call fcn.00532799
mov cl, byte [esi + eax]
add esi, eax
add esp, 8
test cl, cl
jne 0x4b9f20
cmp edi, ebx
jbe 0x4b9f5c
cmp byte [edi], 0
jne 0x4b9f5c
mov eax, 0x2e
mov word [edi], ax
jmp 0x4b9f5c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, ebx
mov edx, edi
mov ecx, ebx
call fcn.004b9a50
push ebx
mov esi, eax
call fcn.0051d799
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bd930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x5dee7c]
xor edx, edx
push esi
mov esi, dword [0x5f97a4]
xor ecx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov dword [0x629804], 2
push edi
test ebx, ebx
je 0x4bdb07
mov edi, dword [0x5dee78]
cmp ebx, 3
jb 0x4bd9ab
movzx eax, byte [esi + 0x6097e2]
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
mov dword [0x5dee78], edi
movzx ecx, word [edi*2 + 0x5f97c0]
mov edx, ecx
mov word [eax*2 + 0x619800], cx
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov word [edi*2 + 0x5f97c0], si
test edx, edx
je 0x4bd9da
mov eax, esi
sub eax, edx
cmp eax, 0x7efa
ja 0x4bd9da
mov eax, dword [0x5f97ac]
mov ecx, edx
cmp eax, ebx
cmova eax, ebx
mov dword [0x5f97ac], eax
call fcn.004bd670
mov ecx, eax
cmp ecx, ebx
cmova ecx, ebx
mov dword [ebp - 4], ecx
cmp ecx, 3
jb 0x4bda7f
lea edx, [ecx - 3]
mov ecx, esi
sub ecx, dword [0x6097c0]
call fcn.004befa0
mov edx, dword [ebp - 4]
mov ecx, eax
sub ebx, edx
mov dword [ebp - 0xc], ecx
mov dword [0x5dee7c], ebx
cmp edx, dword [0x5dee70]
ja 0x4bda59
cmp ebx, 3
jb 0x4bda59
dec edx
movzx eax, byte [esi + 0x6097e3]
inc esi
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
movzx ecx, word [edi*2 + 0x5f97c0]
mov dword [ebp - 8], ecx
mov word [eax*2 + 0x619800], cx
mov word [edi*2 + 0x5f97c0], si
sub edx, 1
jne 0x4bda11
mov ecx, dword [ebp - 0xc]
mov dword [0x5dee78], edi
mov dword [ebp - 4], edx
jmp 0x4bda96
add esi, edx
mov dword [ebp - 4], 0
mov edx, esi
movzx edi, byte [edx + 0x6097e0]
movzx eax, byte [edx + 0x6097e1]
shl edi, 5
xor edi, eax
mov dword [0x5dee78], edi
jmp 0x4bda99
movzx edx, byte [esi + 0x6097e0]
xor ecx, ecx
call fcn.004befa0
dec ebx
mov ecx, eax
mov dword [0x5dee7c], ebx
inc esi
mov edx, esi
mov dword [0x5f97a4], esi
test ecx, ecx
je 0x4bdada
mov eax, dword [0x629800]
test eax, eax
js 0x4bdab4
lea ecx, [eax + 0x6097e0]
jmp 0x4bdab6
xor ecx, ecx
push 0
sub edx, eax
call fcn.004bec20
mov esi, dword [0x5f97a4]
add esp, 4
mov ebx, dword [0x5dee7c]
mov edi, dword [0x5dee78]
mov dword [0x629800], esi
cmp ebx, 0x106
jae 0x4bdaf9
call fcn.004bd7c0
mov ebx, dword [0x5dee7c]
mov edi, dword [0x5dee78]
mov esi, dword [0x5f97a4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
test ebx, ebx
jne 0x4bd967
mov eax, dword [0x629800]
test eax, eax
js 0x4bdb18
lea ecx, [eax + 0x6097e0]
jmp 0x4bdb1a
xor ecx, ecx
sub esi, eax
push 1
mov edx, esi
call fcn.004bec20
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bdde0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, 0x12345678
mov esi, 0x23456789
mov dword [0x5dee88], eax
mov edx, 0x34567890
mov dword [0x5dee8c], esi
mov dword [0x5dee90], edx
mov cl, byte [edi]
test cl, cl
je 0x4bde56
push ebx
mov ebx, dword [0x629ed4]
movsx ecx, cl
lea edi, [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ebx + ecx*4]
movzx ecx, al
add ecx, esi
imul esi, ecx, 0x8088405
inc esi
mov ecx, esi
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [ebx + ecx*4]
mov cl, byte [edi]
test cl, cl
jne 0x4bde11
mov dword [0x5dee88], eax
mov dword [0x5dee90], edx
mov dword [0x5dee8c], esi
pop ebx
pop edi
pop esi
ret
Function at 0x4be0f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x5bd09c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
je 0x4be1a8
mov dword [ebp - 8], eax
mov edx, ecx
mov dword [ebp - 4], edx
test eax, eax
je 0x4be1a8
mov eax, dword [0x5dee88]
push ebx
mov ebx, dword [0x5dee8c]
push esi
push edi
mov edi, dword [0x5dee90]
nop dword [eax]
mov dl, byte [edx]
mov esi, edi
and esi, 0xfffd
movsx ecx, dl
xor ecx, eax
or esi, 2
movzx ecx, cl
mov dword [ebp - 0xc], esi
mov esi, dword [0x629ed4]
shr eax, 8
xor eax, dword [esi + ecx*4]
movzx ecx, al
add ecx, ebx
imul ebx, ecx, 0x8088405
inc ebx
mov ecx, ebx
shr ecx, 0x18
xor ecx, edi
shr edi, 8
movzx ecx, cl
xor edi, dword [esi + ecx*4]
mov ecx, dword [ebp - 0xc]
xor ecx, 1
imul ecx, dword [ebp - 0xc]
shr ecx, 8
xor cl, dl
mov edx, dword [ebp - 4]
mov byte [edx], cl
inc edx
sub dword [ebp - 8], 1
mov dword [ebp - 4], edx
jne 0x4be130
mov ecx, dword [ebp - 0x10]
mov dword [0x5dee90], edi
pop edi
pop esi
mov dword [0x5dee88], eax
mov eax, dword [ebp + 8]
mov dword [0x5dee8c], ebx
pop ebx
push dword [ebp + 0xc]
push eax
push 1
push ecx
call fcn.00536106
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4bf590
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b0008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5bd224], 0
push esi
push edi
je 0x4bf5c0
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00519459
mov esp, ebp
pop ebp
ret
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
jne 0x4bf5e2
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00519459
mov esp, ebp
pop ebp
ret
mov esi, edi
mov ecx, 0x5bd128
xchg dword [ecx], esi
test esi, esi
je 0x4bf61f
mov eax, esi
xchg dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x5bd224]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00519459
mov esp, ebp
pop ebp
ret
push 0x62c040
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x124
push 0
push 0x5f9680
call fcn.0051b450
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4bf715
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeBackupPrivilege
push 0
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4bf6bb
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4bf6bb
call esi
test eax, eax
jne 0x4bf6bb
mov dword [0x5bd0a8], 1
push dword [ebp - 0x18]
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4bf71a
cmp dword [0x5bd0a8], 0
jne 0x4bf6ab
lea eax, [ebp - 0x10]
push eax
push str.SeSecurityPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4bf6ab
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4bf6ab
call esi
mov ecx, dword [0x5bd228]
test eax, eax
push dword [ebp - 0x18]
mov esi, 1
cmove ecx, esi
mov dword [0x5bd228], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4bf71a
mov esi, 1
push edi
mov dword [0x5bd224], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00519459
mov esp, ebp
pop ebp
ret
Function at 0x4bfd00
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
push edi
push dword [0x5f8e30]
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi + 4], eax
test eax, eax
jne 0x4bfda5
push 0x5be0dc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x5be04c]
test eax, eax
je 0x4bfd54
mov dword [esi], eax
mov eax, dword [eax + 0x60]
mov edi, dword [esi]
push 0x5be0dc
mov dword [0x5be04c], eax
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
ret
push 0x64
call fcn.0051946c
mov edi, eax
add esp, 4
lea ecx, [edi + 4]
mov dword [edi], vtable.omni_thread.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 0xc
mov ecx, edi
call fcn.004c0260
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi], vtable._internal_omni_thread_dummy.0
mov dword [edi + 0x60], 0
push 0x5be0dc
mov dword [esi], edi
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
ret

Function at 0x4bffc0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [0x5f8e58]
push ebx
mov ebx, ecx
lea eax, [edx + 1]
mov dword [0x5f8e58], eax
test edx, edx
jne 0x4c0076
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x5f8e30], eax
cmp eax, 0xffffffff
je 0x4c007d
push esi
push edi
push 0x18
call fcn.0051946c
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x60
mov dword [0x5be048], esi
call fcn.0051946c
push ecx
mov ecx, eax
call fcn.004c0220
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
push 2
push 0
push 0
lea eax, [edi + 0x44]
mov dword [edi + 0x1c], 1
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4c0099
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
push dword [0x5f8e30]
mov dword [edi + 0x48], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4c00b5
push 0
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
test eax, eax
je 0x4c00d1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.004bfcb0
push 0x5acef0
mov eax, ecx
push eax
call fcn.0051bb24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.004bfcb0
push 0x5acef0
mov eax, ecx
push eax
call fcn.0051bb24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.004bfcb0
push 0x5acef0
mov eax, ecx
push eax
call fcn.0051bb24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.004bfcb0
push 0x5acef0
mov eax, ecx
push eax
call fcn.0051bb24
int3
Function at 0x4c03d0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x1c], 0
jne 0x4c0470
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 4
push esi
push 0x4c0150
push dword [0x5be050]
push 0
call fcn.00536cb6
mov ecx, dword [ebp - 8]
mov edx, eax
add esp, 0x18
mov dword [esi + 0x44], edx
mov dword [esi + 0x48], ecx
test edx, edx
je 0x4c047e
mov eax, dword [esi + 0x20]
sub eax, 0
je 0x4c043d
sub eax, 1
je 0x4c0439
sub eax, 1
jne 0x4c049a
mov eax, 2
jmp 0x4c0442
xor eax, eax
jmp 0x4c0442
mov eax, 0xfffffffe
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x4c04a8
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x4c04c4
push edi
mov dword [esi + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x5aced8
lea eax, [ebp - 1]
push eax
call fcn.0051bb24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xc]
call fcn.004bfcb0
push 0x5acef0
mov eax, ecx
push eax
call fcn.0051bb24
push 0x5aced8
lea eax, [ebp - 1]
push eax
call fcn.0051bb24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xc]
call fcn.004bfcb0
push 0x5acef0
mov eax, ecx
push eax
call fcn.0051bb24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xc]
call fcn.004bfcb0
push 0x5acef0
mov eax, ecx
push eax
call fcn.0051bb24
int3

Function at 0x4c04f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1c]
cmp eax, 1
je 0x4c050e
cmp eax, 2
jne 0x4c0554
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [0x5f8e30]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp esi, eax
je 0x4c0569
cmp dword [esi + 0x34], 0
jne 0x4c0577
push 0xffffffffffffffff
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4c0585
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4c0546
mov eax, dword [esi + 0x4c]
mov dword [ecx], eax
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
pop edi
pop esi
pop ebp
ret 4
mov ecx, edi
call fcn.0041e960
push 0x5aced8
lea eax, [ebp + 0xb]
push eax
call fcn.0051bb24
push 0x5aced8
lea eax, [ebp + 0xb]
push eax
call fcn.0051bb24
push 0x5aced8
lea eax, [ebp + 0xb]
push eax
call fcn.0051bb24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp + 8]
call fcn.004bfcb0
push 0x5acef0
mov eax, ecx
push eax
call fcn.0051bb24
int3
Function at 0x4c0620
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push edi
push dword [0x5f8e30]
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x4c066e
push esi
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [edi + 0x1c], 2
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi + 0x34], 0
pop esi
je 0x4c066b
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
push 0
call fcn.00536d39
add esp, 4
pop edi
pop ebx
ret
mov dword [edi + 0x4c], ebx
push 0
call fcn.00536d39
add esp, 4
pop edi
pop ebx
ret
Function at 0x4c0b80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.winvnc.exe_crc32_z
Function at 0x4c3650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x4c382d
cmp dword [ebx + 0x20], 0
je 0x4c382d
cmp dword [ebx + 0x24], 0
je 0x4c382d
mov esi, dword [ebx + 0x1c]
test esi, esi
je 0x4c382d
cmp dword [esi], ebx
jne 0x4c382d
mov eax, dword [esi + 4]
cmp eax, 0x2a
je 0x4c36bb
cmp eax, 0x39
je 0x4c36bb
cmp eax, 0x45
je 0x4c36bb
cmp eax, 0x49
je 0x4c36bb
cmp eax, 0x5b
je 0x4c36bb
cmp eax, 0x67
je 0x4c36bb
cmp eax, 0x71
je 0x4c36bb
cmp eax, 0x29a
jne 0x4c382d
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4c382d
mov edx, dword [esi + 0x18]
mov dword [ebp - 8], edx
cmp edx, 2
je 0x4c382d
cmp edx, 1
jne 0x4c36e3
cmp eax, 0x2a
jne 0x4c382d
cmp dword [esi + 0x74], 0
jne 0x4c382d
push edi
mov edi, dword [ebp + 0x10]
cmp edx, 1
jne 0x4c370c
push edi
push ecx
push dword [ebx + 0x30]
call sym.winvnc.exe_adler32_z
mov ecx, dword [ebp + 0xc]
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x18], 0
cmp edi, eax
jb 0x4c3764
test edx, edx
jne 0x4c375e
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x4c]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.0051b450
mov eax, dword [esi + 0x2c]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x16b4], 0
sub edi, eax
add ecx, edi
mov edi, eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
mov dword [ebx], ecx
mov ecx, esi
mov dword [ebp - 0xc], eax
mov dword [ebx + 4], edi
call fcn.004c3150
mov ecx, dword [esi + 0x74]
cmp ecx, 3
jb 0x4c37e8
mov ebx, dword [esi + 0x6c]
add ecx, 0xfffffffe
mov dword [ebp - 4], ecx
nop dword [eax]
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x34]
and edx, ebx
movzx edi, byte [eax + ebx + 2]
mov eax, dword [esi + 0x48]
shl eax, cl
mov ecx, dword [esi + 0x40]
xor edi, eax
and edi, dword [esi + 0x54]
mov eax, dword [esi + 0x44]
mov dword [esi + 0x48], edi
mov ax, word [eax + edi*2]
mov word [ecx + edx*2], ax
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2], bx
inc ebx
sub dword [ebp - 4], 1
jne 0x4c3790
mov ecx, esi
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x74], 2
call fcn.004c3150
mov ecx, dword [esi + 0x74]
cmp ecx, 3
jae 0x4c3783
mov ebx, dword [ebp + 8]
add dword [esi + 0x6c], ecx
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x16b4], ecx
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [ebx], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 8]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret