joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7e10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5530ad
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5a9008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 0x10
jb 0x4a7e47
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x4a7e65
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x4a7e53
push esi
push edx
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.0048e2e0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4a7e96
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x7ffffff
je 0x4a7fe1
lea eax, [ebx + 4]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x10], 0
call fcn.004ef5e0
add esp, 4
mov edi, eax
mov dword [ebp - 0x10], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call int.00416650
mov dword [ebp - 4], 1
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
movss xmm3, dword [ebx]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
movd xmm1, eax
addsd xmm0, qword [ecx*8 + 0x57ea80]
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x57ea80]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x4a7f71
divss xmm0, xmm3
call fcn.00489390
call fcn.00520bf0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x4a7f55
cmp eax, 0x200
jae 0x4a7f53
shl eax, 3
cmp eax, ecx
jae 0x4a7f55
mov eax, ecx
push eax
mov ecx, ebx
call fcn.004a7ff0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0048e2e0
mov edx, dword [eax]
jmp 0x4a7f74
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x4a7fa7
mov dword [ecx + eax*8], edi
jmp 0x4a7fb9
cmp esi, edx
jne 0x4a7fb0
mov dword [ecx + eax*8], edi
jmp 0x4a7fbd
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4a7fbd
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004f082e
int3
Function at 0x4ab460
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4ab46b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004ab480
Function at 0x4af0c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28c
mov eax, dword [0x5a9008]
xor eax, esp
mov dword [esp + 0x288], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [esp + 8], eax
xor al, al
push esi
push edi
mov byte [esp + 0xf], al
cmp ebx, dword [ebp + 0x14]
jne 0x4af1f9
lea eax, [esp + 0x9c]
mov edx, 0x20
push eax
push 0
mov ecx, 0x56a7f0
call fcn.004affd0
add esp, 8
test eax, eax
jne 0x4af1f5
mov esi, dword [0x5aa71c]
xor ecx, ecx
mov dword [esp + 0x18], esi
test esi, esi
jle 0x4af143
nop word [eax + eax]
mov al, byte [ecx + 0x56a7f0]
mov byte [esp + ecx + 0x1c], al
inc ecx
mov esi, dword [esp + 0x18]
cmp ecx, esi
jl 0x4af130
mov edi, dword [ebp + 8]
lea eax, [esi - 1]
cmp eax, 0x7f
ja 0x4af1f5
xor edx, edx
mov eax, ebx
div esi
test edx, edx
jne 0x4af1f5
test ebx, ebx
je 0x4af1de
lea eax, [esp + 0x9c]
mov ecx, edi
push eax
lea edx, [esp + 0x288]
call fcn.004b0280
add esp, 4
test eax, eax
jne 0x4af1f5
test esi, esi
jle 0x4af1ce
lea ebx, [esp + 0x284]
mov dword [esp + 0x14], edi
lea ecx, [esp + 0x1c]
sub ebx, edi
sub edi, ecx
lea edx, [esp + 0x1c]
mov ecx, dword [esp + 0x10]
sub ecx, edx
mov dword [esp + 0x14], ecx
lea esi, [esp + 0x1c]
add esi, eax
inc eax
lea ecx, [edi + esi]
mov dl, byte [ecx + ebx]
xor dl, byte [esi]
mov cl, byte [ecx]
mov byte [esi], cl
mov ecx, dword [esp + 0x14]
mov byte [ecx + esi], dl
mov esi, dword [esp + 0x18]
cmp eax, esi
jl 0x4af1a6
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
add dword [esp + 0x10], esi
add edi, esi
sub ebx, esi
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], ebx
jne 0x4af164
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x288]
xor ecx, esp
call fcn.004ef615
mov esp, ebp
pop ebp
ret
mov al, byte [esp + 0xf]
mov ecx, dword [esp + 0x294]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ef615
mov esp, ebp
pop ebp
ret
Function at 0x4b1c50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5547bd
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x5a9008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
test eax, eax
jne 0x4b1cce
mov eax, dword [0x5a99a0]
cmp eax, 0x5a99a0
je 0x4b1d37
test byte [eax + 0x1c], 8
je 0x4b1d37
push dword [ebp + 0xc]
mov ecx, 0xa
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004b1870
add esp, 0x10
jmp 0x4b1d37
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4b1d06
mov eax, dword [0x5a99a0]
cmp eax, 0x5a99a0
je 0x4b1d37
test byte [eax + 0x1c], 8
je 0x4b1d37
push dword [ebp + 0xc]
mov ecx, 0xb
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004b1870
add esp, 0x10
jmp 0x4b1d37
mov eax, dword [0x5a99a0]
cmp eax, 0x5a99a0
je 0x4b1d37
test byte [eax + 0x1c], 8
je 0x4b1d37
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x5a99a0]
push eax
push dword [ebp + 0xc]
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.004b18a0
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0043c280
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b22e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b186
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a9008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edi + 0x10], eax
xor eax, eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
movups xmm0, xmmword [esi + 0x18]
movups xmmword [edi + 0x18], xmm0
movq xmm0, qword [esi + 0x28]
movq qword [edi + 0x28], xmm0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 7
mov word [esi + 0x18], ax
mov dword [ebp - 4], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
movups xmm0, xmmword [esi + 0x30]
movups xmmword [edi + 0x30], xmm0
movq xmm0, qword [esi + 0x40]
movq qword [edi + 0x40], xmm0
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], 7
mov word [esi + 0x30], ax
mov byte [ebp - 4], 1
mov dword [edi + 0x48], eax
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], eax
movups xmm0, xmmword [esi + 0x48]
movups xmmword [edi + 0x48], xmm0
movq xmm0, qword [esi + 0x58]
movq qword [edi + 0x58], xmm0
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], 0xf
mov byte [esi + 0x48], al
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4bf610
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0x573df8
nop dword [eax + eax]
cmp ecx, dword [eax]
je 0x4bf632
add eax, 4
cmp eax, 0x573e0c
jne 0x4bf620
mov esp, ebp
pop ebp
ret
test dl, dl
je 0x4bf649
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0xc]
call fcn.004bf590
push 0x5a68dc
lea eax, [ebp - 0xc]
push eax
call fcn.004f2c1b
int3
Function at 0x4c4330
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], ecx
mov dword [esi + 0x28], 0x56c7a8
mov dword [esi + 0x2c], 0x12345678
mov dword [esi + 0x30], 0x23456789
mov dword [esi + 0x34], 0x34567890
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4c44af
xor ebx, ebx
mov dword [ebp - 0x14], ebx
test eax, eax
jle 0x4c43e9
lfence
mov ecx, dword [esi + 0x2c]
mov edi, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
nop word [eax + eax]
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax + ebx]
mov ebx, dword [esi + 0x28]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [ebx + eax*4]
movzx eax, cl
add eax, edi
mov dword [esi + 0x2c], ecx
imul edi, eax, 0x8088405
inc edi
mov eax, edi
mov dword [esi + 0x30], edi
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [ebx + eax*4]
mov ebx, dword [ebp - 0x14]
inc ebx
mov dword [esi + 0x34], edx
mov dword [ebp - 0x14], ebx
cmp ebx, dword [ebp - 0x18]
jl 0x4c43a0
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0xc
jb 0x4c44af
mov eax, dword [edi]
mov edx, dword [esi + 0x2c]
mov ebx, dword [esi + 0x30]
mov edi, dword [esi + 0x34]
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
movzx eax, word [esi + 0x34]
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
mov eax, dword [ebp - 0x14]
shr ecx, 8
xor cl, byte [ebp + eax - 0x10]
movzx eax, cl
xor eax, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [esi + 0x28]
movzx eax, al
shr edx, 8
xor edx, dword [ecx + eax*4]
movzx eax, dl
add eax, ebx
mov dword [esi + 0x2c], edx
imul ebx, eax, 0x8088405
inc ebx
mov eax, ebx
mov dword [esi + 0x30], ebx
shr eax, 0x18
xor eax, edi
shr edi, 8
movzx eax, al
xor edi, dword [ecx + eax*4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [esi + 0x34], edi
mov byte [ebp + eax - 0x10], cl
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0xc
jl 0x4c4416
mov eax, dword [ebp + 0x14]
shr eax, 0x18
cmp byte [ebp - 5], al
jne 0x4c44af
push dword [ebp - 0x1c]
mov ecx, esi
push dword [ebp - 0x20]
call fcn.004c44d0
test eax, eax
je 0x4c44af
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ef615
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c44d0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558415
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5a9008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
sub eax, 0xc
push eax
call fcn.004efd04
add esp, 4
lea ecx, [ebp - 0x20]
push dword [ebp + 8]
push eax
call fcn.00495160
mov dword [ebp - 4], 0
mov ecx, 0xc
mov dword [ebp - 0x10], ecx
cmp dword [edi], ecx
jbe 0x4c4599
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff4
mov dword [ebp - 0x14], eax
movzx eax, word [esi + 0x34]
or eax, 2
mov edx, dword [esi + 0x28]
mov ebx, eax
xor ebx, 1
imul ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
shr ebx, 8
xor bl, byte [eax + ecx]
mov ecx, dword [esi + 0x2c]
movzx eax, bl
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [edx + eax*4]
movzx eax, cl
add eax, dword [esi + 0x30]
imul eax, eax, 0x8088405
mov dword [esi + 0x2c], ecx
mov ecx, dword [esi + 0x34]
inc eax
mov dword [esi + 0x30], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [edx + eax*4]
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x34], ecx
mov ecx, dword [ebp - 0x10]
mov byte [eax + ecx], bl
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, dword [edi]
jb 0x4c4533
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test esi, esi
je 0x4c45b2
lock inc dword [esi + 4]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov dword [ebp - 0x18], eax
mov dword [ecx], edx
mov dword [ebp - 0x14], edi
mov dword [ecx + 4], esi
mov byte [ebp - 4], 0
or ebx, 0xffffffff
test edi, edi
je 0x4c45fc
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x4c45fc
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, ebx
lock xadd dword [edi + 8], eax
jne 0x4c45fc
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
add dword [eax], 0xfffffff4
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4c462b
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x4c462b
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x4c462b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c8720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
mov ecx, dword [0x5ad618]
push edi
mov edi, edx
test ecx, ecx
jne 0x4c8793
cmp byte [0x5ad614], cl
jne 0x4c8793
call fcn.004d38d0
mov dword [0x5ad610], eax
test eax, eax
je 0x4c877f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptProtectMemory
push eax
call esi
push str.CryptUnprotectMemory
push dword [0x5ad610]
mov dword [0x5ad618], eax
call esi
mov ecx, dword [0x5ad618]
mov dword [0x5ad61c], eax
mov byte [0x5ad614], 1
jmp 0x4c8798
mov eax, dword [0x5ad61c]
mov ecx, dword [0x5ad618]
mov byte [0x5ad614], 1
jmp 0x4c8798
mov eax, dword [0x5ad61c]
movzx esi, byte [ebp + 0xc]
mov edx, edi
and edx, 0xfffffff0
cmp byte [ebp + 8], 0
je 0x4c87b6
test ecx, ecx
je 0x4c87c5
push esi
push edx
push ebx
call ecx
test eax, eax
je 0x4c87ee
jmp 0x4c87e8
test eax, eax
je 0x4c87c5
push esi
push edx
push ebx
call eax
test eax, eax
je 0x4c8821
jmp 0x4c87e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
xor eax, eax
mov dword [ebp + 0xc], ecx
test edi, edi
je 0x4c87e8
add cl, 0x4b
lea edx, [eax + ebx]
add cl, al
inc eax
xor byte [edx], cl
mov ecx, dword [ebp + 0xc]
cmp eax, edi
jb 0x4c87d6
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
push str.CryptProtectMemory_failed
push 0x5aa7f8
call fcn.004d3010
add esp, 8
mov ecx, 0x5aa7f8
push 2
call fcn.004d3050
push 0x5a6948
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 2
push eax
call fcn.004f2c1b
push 0x57de20
push 0x5aa7f8
call fcn.004d3010
add esp, 8
mov ecx, 0x5aa7f8
push 2
call fcn.004d3050
push 0x5a6948
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 2
push eax
call fcn.004f2c1b
int3
Function at 0x4d38d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00520bc0
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4d390b
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret
push 0x7ff
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.0053048c
add esp, 0xc
lea ecx, [ebp - 0x1004]
xor eax, eax
lea edx, [ecx + 2]
mov word [ebp - 6], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d3935
sub ecx, edx
sar ecx, 1
je 0x4d3979
cmp word [ebp + ecx*2 - 0x1006], 0x5c
je 0x4d3979
lea eax, [ecx + 1]
cmp eax, 0x800
jae 0x4d3979
push edi
lea edi, [ebp - 0x1004]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4d3965
mov eax, dword [0x5741c8]
mov dword [edi], eax
pop edi
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d3982
sub ecx, edx
mov eax, 0x7ff
sar ecx, 1
sub eax, ecx
test eax, eax
jle 0x4d39b4
push eax
lea eax, [ebp - 0x1004]
push str.Crypt32.dll
push eax
lfence
call fcn.005304cf
add esp, 0xc
push 0x7ff
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x2004]
push eax
call fcn.0053048c
xor eax, eax
add esp, 0xc
mov word [ebp - 0x1006], ax
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret

Function at 0x4d3a00
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4d3a6b
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
test eax, eax
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret
Function at 0x4d5700
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00520bc0
mov eax, dword [0x5a9008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x4d577e
cmp dword [esi + 8], 0xffffffff
je 0x4d572b
mov eax, dword [esi]
call dword [eax + 8]
cmp byte [esi + 0x17], 0
je 0x4d577e
push ebx
push edi
lea edi, [esi + 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
test eax, eax
setne bl
test eax, eax
jne 0x4d576b
push ecx
lea edx, [ebp - 0x1004]
mov ecx, edi
call fcn.004cbc50
add esp, 4
test al, al
je 0x4d576b
lea eax, [ebp - 0x1004]
push eax
call esi
test eax, eax
setne bl
pop edi
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ef615
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.004ef615
mov esp, ebp
pop ebp
ret

Function at 0x4d5790
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 8], 0
je 0x4d5869
cmp dword [edi + 0x24], 0
jne 0x4d5869
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x4d57c2
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x10]
cmp eax, 1
jne 0x4d57e0
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 8], eax
mov eax, dword [edi + 0x10]
nop dword [eax + eax]
xor cl, cl
mov dword [esp + 0xc], 0
test eax, eax
je 0x4d5830
xor esi, esi
test ebx, ebx
je 0x4d584e
lfence
mov eax, ebx
mov ecx, 0x4000
sub eax, esi
cmp eax, ecx
push 0
cmovb ecx, eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [ebp + 8]
push ecx
add eax, esi
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete cl
jne 0x4d584a
add esi, 0x4000
cmp esi, ebx
jb 0x4d57f7
jmp 0x4d584a
push 0
lea eax, [esp + 0x10]
push eax
push ebx
push dword [ebp + 8]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete cl
test cl, cl
jne 0x4d585a
cmp byte [edi + 0x18], 0
je 0x4d585a
cmp dword [edi + 0x10], 0
je 0x4d5874
mov byte [edi + 0xc], 1
mov al, cl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
sub esp, 8
call fcn.004d2fe0
int3
Function at 0x4d59a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x10], 1
jne 0x4d59ba
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 8], eax
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 4]
mov edi, dword [ebp + 8]
push 0
push eax
push ebx
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4d5a67
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x4d5a10
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x4d59f2
cmp eax, 3
jne 0x4d5a10
cmp ebx, 0x4e20
jbe 0x4d5a10
push 0x4e20
push edi
mov ecx, esi
call fcn.004d59a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0x10], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4d5a2e
call edi
cmp eax, 0x6d
jne 0x4d5a2e
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0x10], 0
jne 0x4d5a5b
cmp ebx, 0x8000
jbe 0x4d5a5b
call edi
cmp eax, 0x21
jne 0x4d5a5b
push 0x8000
push dword [ebp + 8]
mov ecx, esi
call fcn.004d59a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d5ea0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1264
call fcn.00520bc0
mov eax, dword [0x5a9008]
xor eax, esp
mov dword [esp + 0x1260], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x14]
push edi
mov edi, edx
mov dword [esp + 0x10], esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [esp + 0x14], ebx
cmp ebx, 0xffffffff
jne 0x4d5f48
push ecx
lea edx, [esp + 0x26c]
mov ecx, edi
call fcn.004cbc50
add esp, 4
test al, al
je 0x4d5f15
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [esp + 0x14], eax
cmp ebx, 0xffffffff
jne 0x4d5f48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4d5f39
cmp eax, 3
je 0x4d5f39
cmp eax, 0x12
je 0x4d5f39
mov al, 1
mov byte [esi + 0x1044], al
mov eax, ebx
jmp 0x4d6062
xor al, al
mov byte [esi + 0x1044], al
mov eax, ebx
jmp 0x4d6062
push 0x7ff
push edi
push esi
call fcn.0053048c
add esp, 0xc
xor eax, eax
mov ecx, esi
mov word [esi + 0xffe], ax
call fcn.004cb610
mov ebx, eax
mov edi, 0x800
mov ecx, ebx
sub ecx, esi
sar ecx, 1
sub edi, ecx
je 0x4d5f94
lea eax, [edi - 1]
push eax
lea eax, [esp + 0x48]
push eax
push ebx
lfence
call fcn.0053048c
add esp, 0xc
xor eax, eax
mov word [ebx + edi*2 - 2], ax
mov ecx, dword [esp + 0x34]
xor eax, eax
add eax, dword [esp + 0x38]
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
adc ecx, 0
mov dword [esi + 0x1000], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x1008], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x1030], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x1004], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x1034], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x102c], edi
mov dword [ecx + 0x103c], eax
mov dword [esi + 0x1028], ebx
mov esi, dword [esp + 0x2c]
mov dword [ecx + 0x1038], esi
mov ecx, 0x64
mul ecx
mov edx, 0x64
mov ecx, eax
mov eax, esi
mov esi, dword [esp + 0x10]
mul edx
add ecx, edx
mov dword [esi + 0x1010], eax
mov dword [esi + 0x1014], ecx
mov eax, edi
mov ecx, 0x64
mov edi, 0x64
mul ecx
mov edx, 0x64
mov ecx, eax
mov eax, ebx
mul edx
mov dword [esi + 0x1018], eax
add ecx, edx
mov eax, dword [esp + 0x28]
mul edi
mov dword [esi + 0x101c], ecx
mov ecx, eax
mov eax, dword [esp + 0x24]
mul edi
add ecx, edx
mov dword [esi + 0x1020], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x1024], ecx
mov ecx, dword [esp + 0x126c]
pop edi
mov dword [esi + 0x1040], 0
pop esi
pop ebx
xor ecx, esp
call fcn.004ef615
mov esp, ebp
pop ebp
ret