joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f780
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1034
call int.004c3080
mov eax, dword [0x533a94]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1034], ecx
mov ecx, dword [ebp - 0x1034]
call fcn.0047fb90
movzx eax, al
test eax, eax
je 0x47f7be
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x47f8cf
lea ecx, [ebp - 0x1018]
call fcn.0047f8e0
mov dword [ebp - 0x1020], 0
jmp 0x47f7e4
mov edx, dword [ebp - 0x1020]
add edx, 1
mov dword [ebp - 0x1020], edx
mov ecx, dword [ebp - 0x1034]
call fcn.0047fb70
cmp dword [ebp - 0x1020], eax
jae 0x47f82a
mov eax, dword [ebp - 0x1020]
push eax
mov ecx, dword [ebp - 0x1034]
call fcn.0047fbb0
mov dword [ebp - 0x1024], eax
lea ecx, [ebp - 0x1018]
push ecx
mov edx, dword [ebp - 0x1024]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1024]
mov edx, dword [eax]
call edx
jmp 0x47f7d5
mov byte [ebp - 0x1019], 0
lea ecx, [ebp - 0x1018]
call fcn.0047f9a0
test eax, eax
je 0x47f88b
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1028]
call fcn.00417430
push 0
lea ecx, [ebp - 0x1018]
call fcn.0047f9a0
push eax
lea ecx, [ebp - 0x1018]
call fcn.0047f980
push eax
lea ecx, [ebp - 0x1028]
push ecx
call fcn.0045ba40
add esp, 0x10
mov byte [ebp - 0x1019], al
lea ecx, [ebp - 0x1028]
call fcn.00417470
jmp 0x47f8b4
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x102c]
call fcn.00417430
lea eax, [ebp - 0x102c]
push eax
call fcn.0045b9f0
add esp, 4
lea ecx, [ebp - 0x102c]
call fcn.00417470
mov dword [ebp - 0x1030], 1
lea ecx, [ebp - 0x1018]
call fcn.0047f940
mov eax, dword [ebp - 0x1030]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c1753
mov esp, ebp
pop ebp
ret 4
Function at 0x482940
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x533a94]
xor eax, ebp
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0xc]
call fcn.0041dbb0
push 0x20019
push 0x508498
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xc]
call fcn.0041de00
mov dword [ebp - 0x14], eax
push 0x208
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.004c1bc0
add esp, 0xc
mov dword [ebp - 0x18], 0x104
cmp dword [ebp - 0x14], 0
jne 0x4829d8
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x228]
push edx
push 0
lea ecx, [ebp - 0xc]
call fcn.00467f50
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4829d3
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0xc]
call fcn.0041dbe0
mov eax, dword [ebp - 0x22c]
jmp 0x482b6d
jmp 0x482a65
push 0x20019
push 0x508418
push SysReAllocString
lea ecx, [ebp - 0xc]
call fcn.0041de00
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x482a15
mov dword [ebp - 0x230], 0
lea ecx, [ebp - 0xc]
call fcn.0041dbe0
mov eax, dword [ebp - 0x230]
jmp 0x482b6d
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x228]
push ecx
push 0x5080f0
lea ecx, [ebp - 0xc]
call fcn.00467f50
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x482a53
mov dword [ebp - 0x234], 0
lea ecx, [ebp - 0xc]
call fcn.0041dbe0
mov eax, dword [ebp - 0x234]
jmp 0x482b6d
push 0x5083f8
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x482a93
mov dword [ebp - 0x238], 0
lea ecx, [ebp - 0xc]
call fcn.0041dbe0
mov eax, dword [ebp - 0x238]
jmp 0x482b6d
push 0
lea ecx, [ebp - 0x228]
push ecx
call fcn.00402050
test eax, eax
jne 0x482ac2
mov dword [ebp - 0x23c], 0
lea ecx, [ebp - 0xc]
call fcn.0041dbe0
mov eax, dword [ebp - 0x23c]
jmp 0x482b6d
lea edx, [ebp - 0x228]
push edx
mov ecx, dword [ebp + 8]
call fcn.004174b0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x228]
push edx
call fcn.00464c50
add esp, 0xc
test eax, eax
jne 0x482b14
mov dword [ebp - 0x240], 0
lea ecx, [ebp - 0xc]
call fcn.0041dbe0
mov eax, dword [ebp - 0x240]
jmp 0x482b6d
push 0x33c
push 0x70000
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00466350
add esp, 0x10
test eax, eax
jge 0x482b4c
mov dword [ebp - 0x244], 0
lea ecx, [ebp - 0xc]
call fcn.0041dbe0
mov eax, dword [ebp - 0x244]
jmp 0x482b6d
mov edx, dword [ebp + 0xc]
mov dword [edx], 1
mov dword [ebp - 0x248], 1
lea ecx, [ebp - 0xc]
call fcn.0041dbe0
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004c1753
mov esp, ebp
pop ebp
ret
Function at 0x48cc90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x508c54
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x48ccc3
push 0x508c6c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x48ccc3
xor eax, eax
jmp 0x48cd32
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x48cce9
xor eax, eax
jmp 0x48cd32
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x48cd0c
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x48cd32
cmp dword [ebp - 4], 0x100000
jbe 0x48cd23
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x48cd32
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x49c550
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x533a94]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0
push 0x110
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.004c1bc0
add esp, 0xc
mov dword [ebp - 0x120], 0x114
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x49c5d0
cmp dword [ebp - 0x11c], 5
jae 0x49c5c4
cmp dword [ebp - 0x11c], 4
jne 0x49c5d0
cmp dword [ebp - 0x118], 0x5a
jb 0x49c5d0
mov dword [ebp - 0x128], 0
jmp 0x49c5da
mov dword [ebp - 0x128], 1
mov al, byte [ebp - 0x128]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c1753
mov esp, ebp
pop ebp
ret
Function at 0x4bc9d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push 0x50a7c0
push 0x50a7d4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor eax, eax
cmp dword [ebp - 0xc], 0
setne al
mov esp, ebp
pop ebp
ret

Function at 0x4bca20
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x533a94]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x50a808
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x4bca6e
xor eax, eax
jmp 0x4bcba0
push 0x50a814
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x4bca8b
xor eax, eax
jmp 0x4bcba0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bcb3a
xor ecx, ecx
mov word [ebp - 0x428], cx
push 0x206
push 0
lea edx, [ebp - 0x426]
push edx
call fcn.004c1bc0
add esp, 0xc
mov dword [ebp - 0x220], 0x208
mov dword [ebp - 0x21c], 1
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x21c]
push edx
push 0x50a830
push 0x50a840
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
movzx eax, word [ebp - 0x428]
test eax, eax
je 0x4bcb36
push 0x50a8c0
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x4bcb36
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bcb3a
xor eax, eax
jmp 0x4bcba0
lea ecx, [ebp - 0x210]
push ecx
call fcn.00417160
add esp, 4
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x4bcb9a
push 0x50a8dc
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
je 0x4bcb8d
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x42c]
mov dword [ebp - 0x214], eax
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c1753
mov esp, ebp
pop ebp
ret
Function at 0x4bd750
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x14], 0
je 0x4bd76d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 0x14]
jmp 0x4bd911
mov ecx, dword [ebp - 0x18]
call fcn.004bd5c0
test eax, eax
jne 0x4bd780
xor eax, eax
jmp 0x4bd911
mov ecx, dword [ebp - 0x18]
call fcn.00417910
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bd798
jmp 0x4bd90b
push 0
mov ecx, dword [ebp - 0x18]
call fcn.00417910
push eax
call fcn.00402050
test eax, eax
jne 0x4bd7b1
jmp 0x4bd90b
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00417910
push eax
call fcn.00464c50
add esp, 0xc
test eax, eax
jne 0x4bd7e3
xor eax, eax
jmp 0x4bd911
push 0x30402
push 0x10000
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00466350
add esp, 0x10
test eax, eax
jge 0x4bd808
xor eax, eax
jmp 0x4bd911
mov ecx, dword [ebp - 0x18]
call fcn.00417910
push eax
call fcn.00415ee0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4bd824
jmp 0x4bd90b
push 0x50aae4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4bd84b
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4bd90b
push 0
push 0x50aaf4
call dword [ebp - 0x14]
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x1c], 0
jne 0x4bd876
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4bd90b
mov dword [ebp - 0x10], 3
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x1c]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx]
call eax
test eax, eax
jne 0x4bd8af
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4bd90b
mov ecx, dword [ebp - 0x18]
add ecx, 8
call fcn.00417910
push eax
push 0x50ab00
call fcn.004bd210
mov ecx, eax
call fcn.004bd280
test eax, eax
je 0x4bd8e5
mov ecx, dword [ebp - 0x18]
call fcn.004bda40
test eax, eax
je 0x4bd8e5
mov dword [ebp - 0x1c], 1
jmp 0x4bd8ec
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp - 0x18]
call fcn.004bd920
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x18], eax
xor eax, eax
jne 0x4bd76d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4bd920
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x10
call fcn.00417960
movzx eax, al
test eax, eax
je 0x4bd947
jmp 0x4bda30
mov ecx, dword [ebp - 0xc]
add ecx, 0x10
call fcn.00417910
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bd962
jmp 0x4bda30
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x10
call fcn.00417910
push eax
call fcn.00402050
test eax, eax
jne 0x4bd97e
jmp 0x4bda30
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.00417960
movzx ecx, al
test ecx, ecx
je 0x4bd995
jmp 0x4bda30
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.00417910
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bd9b0
jmp 0x4bda30
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.00417910
push eax
call fcn.00402050
test eax, eax
jne 0x4bd9c9
jmp 0x4bda30
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.00417910
push eax
call fcn.00415ee0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4bd9e5
jmp 0x4bda30
push 0x50ab0c
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x20], eax
push 0x50ab20
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x20], 0
je 0x4bda28
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x24], 0
je 0x4bda28
mov dword [ebp - 4], 1
xor ecx, ecx
jne 0x4bd930
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4bda40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0xc
call fcn.00417960
movzx eax, al
test eax, eax
je 0x4bda67
jmp 0x4bdba9
mov ecx, dword [ebp - 0x1c]
add ecx, 0xc
call fcn.00417910
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bda82
jmp 0x4bdba9
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0xc
call fcn.00417910
push eax
call fcn.00402050
test eax, eax
jne 0x4bda9e
jmp 0x4bdba9
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0xc
call fcn.00417910
push eax
call fcn.00464c50
add esp, 0xc
test eax, eax
jne 0x4bdad3
xor eax, eax
jmp 0x4bdbac
push 0x30402
push 0x10000
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00466350
add esp, 0x10
test eax, eax
jge 0x4bdaf8
xor eax, eax
jmp 0x4bdbac
mov ecx, dword [ebp - 0x1c]
add ecx, 0xc
call fcn.00417910
push eax
call fcn.00415ee0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4bdb17
jmp 0x4bdba9
push 0x50ab34
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 0x28], 0
jne 0x4bdb37
jmp 0x4bdba9
push 0
push 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x28]
call ecx
add esp, 8
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x2c], 0
jne 0x4bdb57
jmp 0x4bdba9
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x18]
push ecx
push 0x3e9
push 0x50ab48
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x2c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 0x2c]
mov edx, dword [eax]
mov eax, dword [edx + 0x14]
call eax
test eax, eax
jne 0x4bdb8c
jmp 0x4bdba9
cmp dword [ebp - 0x18], 1
jne 0x4bdb9a
cmp dword [ebp - 0x14], 0
jne 0x4bdb9a
jmp 0x4bdba9
mov dword [ebp - 4], 1
xor ecx, ecx
jne 0x4bda50
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4bde70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.00417910
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bde91
jmp 0x4bdefb
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.00417910
push eax
call fcn.00402050
test eax, eax
jne 0x4bdeaa
jmp 0x4bdefb
lea ecx, [ebp - 4]
call fcn.004173f0
push 0x50abe4
mov eax, dword [ebp + 8]
push eax
push 0x50abe8
push 0x50abf8
lea ecx, [ebp - 4]
push ecx
call fcn.00439780
add esp, 0x14
push 1
push 0
lea ecx, [ebp - 4]
call fcn.00417910
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.00417910
push eax
push 0
push 0
call fcn.00416ed0
lea ecx, [ebp - 4]
call fcn.00417470
mov esp, ebp
pop ebp
ret 4

Function at 0x4c1753
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x533a94]
jne 0x4c175d
repz ret
jmp fcn.004cdd32
Function at 0x4c33cd
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x72808005
adc byte [ecx], 0x80
and dword [eax + 0xf0800b0], edx
mov al, byte [0x5811d81]
add dword [eax - 0x7ffd75fb], ecx
add eax, 0x2c0008
add byte [ecx], al
and byte [ebx], 0x40
in al, 0x90
add al, byte [eax]
in al, 0x90
or byte [ebp + 0x7810b02], 0x80
adc eax, 0x33b8080
add byte [eax], al
pop es
inc edx
add byte [ecx - 0x27fffdfb], 0x90
adc dword [0x33805108], 0xffffffe4
nop
add eax, dword [esi + 0xf800815]
call dword [edi - 0x7e]
adc eax, 0x5824b80
add eax, dword [eax + 0x2b804215]
add al, byte [eax + eax]
jo 0x1dd1839
or ah, ah
and byte [eax + 0x4000004], 2
add byte [ecx - 0x7f1bffa9], al
or eax, dword [eax]
add byte [eax + 0x558c000b], ah
mov al, byte [0x19812f81]
add dword [eax], eax
sub dword [edi], 0x11981
in al, 0x80
aas
mov es, word [eax]
sbb byte [ecx], 0xc5
xor byte [edi], 2
add byte [ebp - 0x7f], dl
sbb edx, dword [ecx]
xor byte [ebx - 0x1c], 0x80
pop edx
ror byte [0x83080000], 0xc1
daa
rol dword [eax], 0x81
or eax, dword [eax]
stosb byte es:[edi], al
mov al, byte [0xc30d28c3]
sbb eax, 0xc147c006
pop es
add byte [eax], al
inc dword [eax + 0x4027c177]
jno 0x4c344a
or eax, 0xc214c090
xor al, bl
add eax, dword [eax]
invalid

Function at 0x4c684e
Capabilities:
Encode data using xor

Disassembly:
or byte [eax + 0x1809801], al
add bl, byte [eax + eax]
add al, 0x82
das
test dword [ebx], edx
or edi, dword [eax]
stosd dword es:[edi], eax
add ebx, dword [ebp - 0x80]
push cs
add al, 0x80
adc dword [ecx], eax
push ebp
add byte [edi], dl
add byte [edx], cl
ja 0x4c686f
push 0x8001abab
sidt [ebp + 0x96830f]
add byte [esi + 0x73], dh
pop edi
xor ebx, dword [edi + 0x30]
add byte [ebp], cl
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x4c688e
and byte [eax], ch
push edx
sub dword [eax], esp
dec eax
dec esp
push ebx
add byte [eax + 0x53], cl
push 0x72656461
and byte [eax], 0x43
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x4c690f
insb byte es:[edi], dx
add byte [eax + eax], al
cmp dword [esi], ebp
xor bh, byte [ecx]
cmp dword cs:[0x332e0032], esi
xor dword [ecx], esi
xor dword [eax], eax
push ecx
add byte [eax], al
add byte [0xa00f0008], al
xor esi, dword cs:[ecx]
xor dword [ecx], esi
add byte [ecx], dl
add byte [eax], al
add eax, 0xa00f0008
add byte [eax], al
mov word [eax - 0x7ac67ec1], es
add dword [edi], ebx
add byte [eax], al
add dword [ebx + 0x60], ebp
add byte [eax], 0
seto byte [ecx - 0x7f88fffb]
stosb byte es:[edi], al
add dword [ebp + eax + 0x2160006], eax
test byte [0xee058005], al
add eax, dword [ebp + eax + 0x17811d80]
loopne 0x4c68b3
or eax, ecx
add eax, 0xc4190bc0
add al, byte [edx]
add al, 0x43
les eax, [edx]
add eax, dword [eax + 0x7004403]
add eax, dword [eax + eax + 7]
add byte [0x8e00f00], 0
add byte [ecx], bh
add al, 0
Function at 0x4d31f4
Capabilities:
Authenticate hmac

Disassembly:
mov edi, 0x5a5107f3
jno 0x4d31fc
mov dl, 0xf
jb 0x4d3201
invalid
jae 0x4d3202
add dl, al
jns 0x4d3204
sar byte [ecx - 1], 1
invalid
jnp 0x4d3208
jae 0x4d3212
or dword [ebp + 1], esi
jne 0x4d320c
ja 0x4d3211
add al, 0x73
add dword [ebp + 4], esi
jae 0x4d3210
jne 0x4d3215
add al, 0x77
ja 0x4d3214
add ebx, esi
or bh, byte [edi + 0x17305ff]
or bh, byte [edi + 0x17305ff]
mov edi, 0x17305ff
jno 0x4d3220
loopne 0x4d3274
jo 0x4d322c
sar byte [eax - 0x70], cl
test dword [eax], 0x9078d2bd
jno 0x4d322e
int1
add eax, edx
sub edx, esi
push ss
mov eax, 0xf3636b50
add cl, dl
wait
in al, 0x80
mov ecx, 0x709100f6
in al, 0x5c
cmp byte [edx + 0xf3000f0], 0xf0
add al, 7
mov al, 0x1a
in al, 0xf4
cmp byte [ebx + 0x700101f6], 0x20
mov ebx, 0x700101f6
and byte [ebx + 0x12], dh
add dword [eax + 0x20], esi
jae 0x4d326a
sar byte [edx - 0x10], 1
sbb bh, byte [edi + 0x11]
jbe 0x4d3253
add ch, dh
add al, 0xb0
push es
pop es
add dword [ecx + 0x73], edx
in al, 0xdf
test byte [eax], 0xd0
jae 0x4d3250
fcompi st(6)
or al, dl
mov bl, 0xf2
add esi, ecx

Function at 0x4db2a1
Capabilities:
Encode data using xor

Disassembly:
add ecx, esi
add esi, dword [ecx + 0x305f0f01]
add bh, byte [esp + ebp*4 + 0x1900225]
bound ecx, qword [ecx]
push cs
add byte [eax], 0x56
sub byte [ecx + 0x65], 0x77
push eax
jb 0x4db2d7
push 0xffffffffffffffc3
pop es
xlatb
add dword [edi], 0x9e001d1
inc dword [ecx + 4]
or eax, 0x9b200c0
inc ecx
sal byte [eax + 0x6c616353], 0x65
and dword [eax + esi*2], eax
ret
xor byte [ecx], al
lahf
mov cl, 0x93
mov cl, 0xb1
add dl, byte [eax]
adc esi, dword [edx + 2]
adc dword [ecx], edx
adc edi, edi
xchg esp, eax
lodsd eax, dword [esi]
popal
add dword [eax + 3], edx
add word [ebx + ebp*4 + 0x61], ax
add eax, eax
and al, 0x66
add dword [edi + 0x64], edi
scasb al, byte es:[edi]
popal
add dword [eax + 0x6401661a], esp
mov bl, 0x61
add dword [eax + 0x50f00017], edx
dec ebp
inc ecx
push ebx
mov edi, 0xf1ba5f08
add bh, byte [edi + 0x6170fe08]
add dword [edi - 0x40fe9df8], edi
or byte [edx + 1], ah
mov edi, 0x19016208
mov cl, 8
inc esi
push ebp
xor byte [esi], ah
rol byte [esp + eax*2], 1
add dword [edi - 0x40fe9df8], edi
or byte [edx + 1], ah
sbb dword [ecx + 0x30554608], esi
rol byte es:[esp + eax*2], 1
dec eax
push ebx
dec ecx
loope 0x4db294
add byte [ecx], ah
add al, 3
invalid
Function at 0x4f4b8b
Capabilities:
Encode data using xor

Disassembly:
jb 0x4f4bee
add byte [eax + 0x6f], dl
jae 0x4f4bdb
outsb dx, byte [esi]
jbe 0x4f4bdb
popal
sub dh, byte [edx - 0x1b]
add esi, dword [eax + 0x24]
add cl, byte [esi]
jo 0x4f4ba0
push esi
imul eax, eax, 0x72507765
outsd dx, dword [esi]
push 0xffffffffffffffc3
pop es
add dword [edi], 0xc601403b
pop es
or eax, 0x9b200c0
add byte [ebx + edx*2], al
arpl ax, di
popal
insb byte es:[edi], dx
and dword gs:[ecx], eax
add edx, dword [ecx + 8]
push ecx
push es
and dword [eax + eax], eax
push ebx
dec eax
inc ebx
outsd dx, dword [esi]
imul ax, ax, 0x6963
outsb dx, byte gs:[esi]
je 0x4f4c4c
aad 1
popal
add al, 0x38
pop eax
inc ebp
push esp
mov cl, 0xa6
bound ecx, qword [esi]
loope 0x4f4bf5
imul esp, eax, 0x614d6666
jo 0x4f4bb1
add esp, ecx
add dword [ecx], eax
add al, 0xe1
popal
loope 0x4f4c58
add dword [esi + 0x6f], ebp
jb 0x4f4c69
add dword fs:[eax], eax
sbb eax, 0x623002d6
jne 0x4f4c73
jo 0x4f4c6c
add eax, esi
adc eax, dword [eax]
push eax
mov eax, 0xc053414d
sbb ecx, edi
add al, 1
adc eax, 0xcd016600
iretd
add byte [eax], 0xa4
xor byte [ecx], al
inc eax
add byte [bx + di + 0xa], dh
add byte [edx], bh
in al, dx
add byte [eax + 0x31], ch
add dh, byte [eax]
add byte [eax + 0x30], bh
add al, al
xchg ecx, eax
xchg edx, eax
sub al, 0
mov byte [eax - 0x67ffdf00], dh
mov al, 0
and dword [eax], eax
cwde
add byte [eax + 0x20040], bl
iretd
inc eax
add byte [edx], al
add bh, cl
and byte [ebx + 0x2750070], bl
jmp 0x4f4c91
add dword [eax], edx
add al, byte [ecx]
adc dh, dh
add dword [ebx + 0x76001a], esi
jae 0x4f4cfe
xor ebx, dword [edi + 0x30]
add byte [ebp + 0x69], cl
lahf
invalid
pushal
pop es
rol dword [esi - 0x1c], 0x90
inc ecx
cmp al, 0xf3
add byte [ecx - 0x6f691b2d], al
inc ecx
cmp esi, ebx
add byte [eax + esi*2], al
or esp, esp
nop
or byte [edi - 0x6e313f65], 0x1b
pop es
xor byte [eax], cl
add dword [eax - 0x1c], esp
mov al, byte [0x4ff01f1]
inc ebx
test byte [ebx], 1
inc ebx
rol byte [edx - 0xa], 3
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx