joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483be0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x531eab
mov eax, dword fs:[0]
push eax
mov eax, 0x4028
call fcn.0050d8a0
mov eax, dword [0x59099c]
xor eax, esp
mov dword [esp + 0x4024], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59099c]
xor eax, esp
push eax
lea eax, [esp + 0x403c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x4050]
imul edi, dword [esp + 0x4054]
test edi, edi
mov eax, dword [esp + 0x404c]
mov ebx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
jbe 0x483d1f
lea ebp, [ebx + 0x1c]
mov eax, dword [ebx + 0x30]
cmp edi, eax
mov esi, edi
jbe 0x483c59
mov esi, eax
cmp dword [ebp + 0x18], 0x10
jb 0x483c64
mov eax, dword [ebp + 4]
jmp 0x483c67
lea eax, [ebp + 4]
mov ecx, dword [esp + 0x18]
push esi
push eax
push ecx
call fcn.0050bcb0
add dword [esp + 0x20], esi
add esp, 0xc
push esi
sub edi, esi
xor esi, esi
push esi
mov ecx, ebp
call fcn.0040b6fb
cmp dword [ebx + 0x30], esi
jne 0x483d17
mov eax, dword [ebx + 0x38]
cmp eax, esi
je 0x483d12
push eax
push 0x4000
lea edx, [esp + 0x40]
push 1
push edx
call fcn.00508cbd
add esp, 0x10
push eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], esi
mov byte [esp + 0x28], 0
call fcn.0040b689
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebp
mov dword [esp + 0x4050], esi
call fcn.0040a999
cmp dword [esp + 0x34], 0x10
mov dword [esp + 0x4044], 0xffffffff
jb 0x483d01
mov edx, dword [esp + 0x20]
push edx
call fcn.0050b609
add esp, 4
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], esi
mov byte [esp + 0x20], 0
cmp dword [ebx + 0x30], esi
je 0x483d1f
cmp edi, esi
ja 0x483c4e
mov eax, dword [esp + 0x14]
xor edx, edx
div dword [esp + 0x4050]
mov ecx, dword [esp + 0x403c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4024]
xor ecx, esp
call fcn.0050bc9c
add esp, 0x4034
ret 0xc

Function at 0x4b1880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5334d1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x59099c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edx, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.004b0e20
mov esi, dword [esp + 0x30]
mov ecx, esi
mov dword [esp + 0x28], 1
call fcn.004b0e20
mov ecx, dword [esp + 0x34]
push esi
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, edx
mov dword [esp + 0x14], 1
call fcn.004b1450
lea ecx, [esp + 0xc]
call fcn.004b0e40
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret 8
Function at 0x4b4910
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
ret

Function at 0x4b5136
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
lea eax, [ebp - 1]
push 1
push 1
push eax
mov byte [ebp - 1], 0
call fcn.00508cbd
push dword [ebp + 8]
movzx eax, byte [ebp - 1]
push eax
push 1
push dword [ebp + 0xc]
call fcn.00508cbd
movzx eax, byte [ebp - 1]
add esp, 0x20
leave
ret

Function at 0x4b853e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, 0x593870
jmp 0x4d1d8c
cmp dword [ecx + 0x9c0], 0x270
push ebx
mov ebx, 0x7fffffff
jl 0x4d1d45
push ebp
push esi
push edi
xor esi, esi
lea edi, [ecx + esi*4 + 0x634]
mov eax, dword [edi - 0x630]
lea edx, [ecx + esi*4]
xor eax, dword [edx]
and eax, ebx
xor eax, dword [edx]
mov ebp, eax
shr eax, 1
and ebp, 1
xor eax, dword [ebp*4 + 0x58e6f4]
xor eax, dword [edi]
inc esi
cmp esi, 0xe3
mov dword [edx], eax
jl 0x4d1cab
jmp 0x4d1d07
lea edi, [ecx + esi*4 - 0x38c]
mov eax, dword [edi + 0x390]
lea edx, [ecx + esi*4]
xor eax, dword [edx]
and eax, ebx
xor eax, dword [edx]
mov ebp, eax
shr eax, 1
and ebp, 1
xor eax, dword [ebp*4 + 0x58e6f4]
xor eax, dword [edi]
inc esi
mov dword [edx], eax
cmp esi, 0x26f
jl 0x4d1cde
mov eax, dword [ecx + 0x9bc]
xor eax, dword [ecx]
pop edi
and eax, ebx
xor eax, dword [ecx + 0x9bc]
pop esi
mov edx, eax
and edx, 1
mov edx, dword [edx*4 + 0x58e6f4]
xor edx, dword [ecx + 0x630]
shr eax, 1
xor edx, eax
and dword [ecx + 0x9c0], 0
mov dword [ecx + 0x9bc], edx
pop ebp
mov eax, dword [ecx + 0x9c0]
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ecx + 0x9c0], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
and eax, ebx
pop ebx
ret
jmp 0x4d1c90
Function at 0x4baa0f
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x59099c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
push dword [eax + 0xc]
mov dword [ebp - 0x28], esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4bab08
mov eax, dword [esi + 0x14]
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
inc eax
push eax
push 0x2002
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov dword [ebp - 0x24], eax
call ebx
push 0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.004b8a73
add esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x4baa76
mov eax, dword [eax + 4]
jmp 0x4baa79
add eax, 4
push eax
push dword [ebp - 0x2c]
call fcn.0050b650
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.0040aca3
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x24]
mov esi, dword [sym.imp.USER32.dll_SetClipboardData]
push 1
call esi
push dword [ebp - 0x24]
push 7
call esi
push dword [ebp - 0x24]
push 0x10
call esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x20]
call fcn.0040a428
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax + 2]
push eax
push 0x2002
call edi
mov edi, eax
push edi
call ebx
cmp dword [ebp - 8], 8
mov ecx, dword [ebp - 0x1c]
jae 0x4baadf
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.00512f77
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call esi
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.0040afb1
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0050bc9c
leave
ret 4
Function at 0x4ca4e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov byte [eax], 1
push dword [ecx + 0x40]
lea eax, [ebp - 4]
push 1
push 1
xor esi, esi
push eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], esi
call fcn.00508cbd
add esp, 0x10
cmp eax, 1
jne 0x4ca657
mov eax, dword [ebp - 4]
test al, al
jns 0x4ca5ff
mov ecx, eax
and cx, 0xc0
cmp cl, 0xc0
je 0x4ca533
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
mov dword [ebp - 0x24], eax
lea edi, [ebp - 0x20]
movzx ecx, word [esi*2 + 0x54bf74]
lea edx, [ecx + ecx]
and edx, ecx
and ecx, eax
cmp ecx, edx
je 0x4ca552
inc esi
cmp esi, 5
jl 0x4ca539
cmp esi, 5
jge 0x4ca52a
movzx ecx, word [esi*2 + 0x54bf74]
not ecx
and eax, ecx
and dword [ebp - 8], 0
lea ebx, [esi + 1]
jmp 0x4ca5a7
mov eax, dword [ebp - 0xc]
push dword [eax + 0x40]
lea eax, [ebp - 8]
push 1
push 1
push eax
call fcn.00508cbd
add esp, 0x10
cmp eax, 1
jne 0x4ca52a
mov eax, dword [ebp - 8]
mov ecx, eax
and cx, 0xc0
cmp cl, 0x80
jne 0x4ca52a
mov ecx, dword [ebp - 4]
mov dword [edi], eax
and eax, 0x3f
shl ecx, 6
add edi, 4
or eax, ecx
dec esi
test esi, esi
mov dword [ebp - 4], eax
jg 0x4ca56c
mov ecx, ebx
dec ecx
dec ecx
je 0x4ca5f0
dec ecx
je 0x4ca5e4
dec ecx
je 0x4ca5d8
dec ecx
je 0x4ca5cc
dec ecx
jne 0x4ca5ff
test byte [ebp - 0x24], 3
jne 0x4ca5ff
test byte [ebp - 0x20], 0x3c
jmp 0x4ca5f9
test byte [ebp - 0x24], 7
jne 0x4ca5ff
test byte [ebp - 0x20], 0x38
jmp 0x4ca5f9
test byte [ebp - 0x24], 0xf
jne 0x4ca5ff
test byte [ebp - 0x20], 0x30
jmp 0x4ca5f9
test byte [ebp - 0x24], 0x1f
jne 0x4ca5ff
test byte [ebp - 0x20], 0x20
jmp 0x4ca5f9
test byte [ebp - 0x24], 0x3e
setne cl
test cl, cl
je 0x4ca52a
cmp eax, 0xd800
jl 0x4ca611
cmp eax, 0xdfff
jle 0x4ca52a
lea ecx, [eax - 0xfffe]
cmp ecx, 1
jbe 0x4ca52a
cmp eax, 0xfeff
jne 0x4ca644
mov ecx, dword [ebp - 0xc]
cmp byte [ecx + 0x79], 0
je 0x4ca644
push dword [ebp + 0xc]
mov byte [ecx + 0x79], 0
push dword [ebp + 8]
call fcn.004ca4e0
jmp 0x4ca52c
mov ecx, dword [ebp + 8]
mov word [ecx], ax
mov al, 1
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
jmp 0x4ca52c
xor al, al
jmp 0x4ca64c
Function at 0x4ca65b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push dword [esi + 0x40]
lea eax, [ebp - 4]
push 1
push 2
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00508cbd
add esp, 0x10
cmp eax, 1
je 0x4ca687
xor al, al
jmp 0x4ca72d
cmp byte [esi + 0x79], bl
mov eax, dword [ebp - 4]
je 0x4ca6b9
cmp ax, 0xfeff
mov byte [esi + 0x79], bl
jne 0x4ca6ad
mov byte [esi + 0x7a], bl
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.004ca65b
jmp 0x4ca72d
cmp ax, 0xfffe
jne 0x4ca6b9
mov byte [esi + 0x7a], 1
jmp 0x4ca69b
cmp byte [esi + 0x7a], bl
je 0x4ca6c8
rol ax, 8
movzx eax, ax
mov dword [ebp - 4], eax
mov ecx, eax
and cx, 0xd800
cmp cx, 0xd800
jne 0x4ca725
push dword [esi + 0x40]
lea eax, [ebp + 0xc]
push 1
push 2
push eax
mov dword [ebp + 0xc], ebx
call fcn.00508cbd
add esp, 0x10
cmp eax, 1
jne 0x4ca680
cmp byte [esi + 0x7a], bl
je 0x4ca703
mov ax, word [ebp + 0xc]
rol ax, 8
movzx eax, ax
jmp 0x4ca706
mov eax, dword [ebp + 0xc]
mov ecx, eax
and cx, 0xdc00
cmp cx, 0xdc00
jne 0x4ca680
mov ecx, dword [ebp - 4]
and eax, 0xffff23ff
shl ecx, 0xa
or eax, ecx
mov ecx, dword [ebp + 8]
mov word [ecx], ax
mov al, 1
pop esi
pop ebx
leave
ret 8

Function at 0x4d1c41
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x4d1c4e
mov eax, 0x1105
push esi
mov dword [ecx], eax
mov dword [ecx + 0x9c0], 1
push edi
mov edx, dword [ecx + 0x9c0]
lea eax, [ecx + edx*4]
mov esi, dword [eax - 4]
mov edi, esi
shr edi, 0x1e
xor edi, esi
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax], edi
inc dword [ecx + 0x9c0]
cmp dword [ecx + 0x9c0], 0x270
jl 0x4d1c5c
pop edi
pop esi
ret 4
Function at 0x4dc82a
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 2
mov dword [ebp - 8], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push eax
call edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x4dc863
xor edx, edx
jmp 0x4dc8dc
push ebx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0x64
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.0050d7b0
add dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], eax
adc dword [ebp - 0xc], edx
mov ebx, dword [ebp - 4]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jl 0x4dc893
jg 0x4dc8af
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x10]
jb 0x4dc893
lea eax, [ebp - 0x18]
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
rdtsc
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], edx
push dword [ebp - 8]
call esi
push eax
call edi
push 0
push 0x64
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0050d860
pop ebx
pop edi
pop esi
leave
ret

Function at 0x4dd476
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0x14]
push edi
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor edi, edi
cmp dword [0x5c8fdc], edi
jle 0x4dd4b5
push esi
push edi
mov ecx, 0x5c8fe0
call fcn.004dc9ed
mov esi, eax
call fcn.004dd399
inc edi
cmp edi, dword [0x5c8fdc]
jl 0x4dd499
pop esi
and dword [0x5c8fdc], 0
lea eax, [ebp - 0xc]
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
sbb ecx, dword [ebp - 0x10]
add dword [0x5c8fb8], eax
pop edi
pop ebx
adc dword [0x5c8fbc], ecx
leave
ret
Function at 0x4eb8a4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov byte [eax], 1
push dword [ecx + 4]
lea eax, [ebp - 1]
push 1
push 1
push eax
mov dword [ebp - 8], ecx
mov byte [ebp - 1], 0
call fcn.00508cbd
add esp, 0x10
cmp eax, 1
jne 0x4eba1b
movzx ebx, byte [ebp - 1]
test bl, bl
jns 0x4eb9c0
mov eax, ebx
and ax, 0xc0
cmp al, 0xc0
je 0x4eb8f5
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
xor esi, esi
movzx eax, word [esi*2 + 0x54bf74]
lea ecx, [eax + eax]
and ecx, eax
and eax, ebx
cmp eax, ecx
je 0x4eb916
inc esi
cmp esi, 5
jl 0x4eb8fd
cmp esi, 5
jge 0x4eb8ec
movzx eax, word [esi*2 + 0x54bf74]
not eax
and ebx, eax
lea eax, [esi + 1]
mov dword [ebp - 0xc], eax
jmp 0x4eb96a
mov eax, dword [ebp - 8]
push dword [eax + 4]
lea eax, [ebp - 1]
push 1
push 1
push eax
call fcn.00508cbd
add esp, 0x10
cmp eax, 1
jne 0x4eb8ec
movzx eax, byte [ebp - 1]
mov ecx, eax
and cx, 0xc0
cmp cl, 0x80
jne 0x4eb8ec
mov dword [edi], eax
shl ebx, 6
and eax, 0x3f
or eax, ebx
add edi, 4
mov ebx, eax
dec esi
test esi, esi
jg 0x4eb92f
mov eax, dword [ebp - 0xc]
dec eax
dec eax
je 0x4eb9b1
dec eax
je 0x4eb9a5
dec eax
je 0x4eb999
dec eax
je 0x4eb98d
dec eax
jne 0x4eb9c0
test byte [ebp - 0x24], 3
jne 0x4eb9c0
test byte [ebp - 0x20], 0x3c
jmp 0x4eb9ba
test byte [ebp - 0x24], 7
jne 0x4eb9c0
test byte [ebp - 0x20], 0x38
jmp 0x4eb9ba
test byte [ebp - 0x24], 0xf
jne 0x4eb9c0
test byte [ebp - 0x20], 0x30
jmp 0x4eb9ba
test byte [ebp - 0x24], 0x1f
jne 0x4eb9c0
test byte [ebp - 0x20], 0x20
jmp 0x4eb9ba
test byte [ebp - 0x24], 0x3e
setne al
test al, al
je 0x4eb8ec
cmp ebx, 0xd800
jl 0x4eb9d4
cmp ebx, 0xdfff
jle 0x4eb8ec
lea eax, [ebx - 0xfffe]
cmp eax, 1
jbe 0x4eb8ec
cmp ebx, 0xfeff
jne 0x4eba08
mov ecx, dword [ebp - 8]
cmp byte [ecx + 0x1d], 0
je 0x4eba08
push dword [ebp + 0xc]
mov byte [ecx + 0x1d], 0
push dword [ebp + 8]
call fcn.004eb8a4
jmp 0x4eb8ee
mov eax, dword [ebp + 8]
mov word [eax], bx
mov al, 1
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
jmp 0x4eb8ee
xor al, al
jmp 0x4eba10
Function at 0x4eba1f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push dword [esi + 4]
lea eax, [ebp - 4]
push 1
push 2
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00508cbd
add esp, 0x10
cmp eax, 1
je 0x4eba4b
xor al, al
jmp 0x4ebaf7
cmp byte [esi + 0x1d], bl
mov eax, dword [ebp - 4]
je 0x4eba7d
cmp ax, 0xfeff
mov byte [esi + 0x1d], bl
jne 0x4eba71
mov byte [esi + 0x1e], bl
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.004eba1f
jmp 0x4ebaf7
cmp ax, 0xfffe
jne 0x4eba7d
mov byte [esi + 0x1e], 1
jmp 0x4eba5f
cmp byte [esi + 0x1e], bl
je 0x4eba8c
rol ax, 8
movzx eax, ax
mov dword [ebp - 4], eax
mov ecx, eax
and cx, 0xfc00
cmp cx, 0xd800
push edi
mov edi, dword [ebp + 0xc]
jne 0x4ebaec
mov byte [edi], 1
push dword [esi + 4]
lea eax, [ebp + 0xc]
push 1
push 2
push eax
mov dword [ebp + 0xc], ebx
call fcn.00508cbd
add esp, 0x10
cmp eax, 1
jne 0x4ebafd
cmp byte [esi + 0x1e], bl
je 0x4ebace
mov ax, word [ebp + 0xc]
rol ax, 8
movzx eax, ax
jmp 0x4ebad1
mov eax, dword [ebp + 0xc]
mov ecx, eax
and cx, 0xfc00
cmp cx, 0xdc00
jne 0x4ebafd
mov ecx, dword [ebp - 4]
and eax, 0xffff03ff
shl ecx, 0xa
or eax, ecx
mov ecx, dword [ebp + 8]
mov word [ecx], ax
mov byte [edi], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
xor al, al
jmp 0x4ebaf6

Function at 0x4f2dc3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x4f2dce
xor eax, eax
ret
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x4f2e89
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x54ce20]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x54ce20]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x54ce20]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x54ce20]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x54ce20]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x54ce20]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x54ce20]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x54ce20]
inc edx
sub eax, 8
dec edi
jne 0x4f2dee
pop edi
test eax, eax
je 0x4f2ea2
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x54ce20]
inc edx
dec eax
jne 0x4f2e8d
mov eax, esi
pop esi
not eax
pop ebx
ret
Function at 0x4f3546
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
test ecx, ecx
mov dword [ebp - 4], eax
je 0x4f359b
push ebx
push esi
push edi
mov esi, dword [ecx]
mov edx, dword [ecx + 4]
add edx, dword [esi]
mov esi, dword [ecx + 8]
cmp dword [ebp + 8], esi
mov edi, dword [ebp + 8]
jl 0x4f356a
mov edi, esi
xor esi, esi
test edi, edi
jle 0x4f358e
movzx ebx, byte [esi + edx]
shr eax, 0x18
xor ebx, eax
mov eax, dword [ebp - 4]
shl eax, 8
xor eax, dword [ebx*4 + 0x58f138]
inc esi
cmp esi, edi
mov dword [ebp - 4], eax
jl 0x4f3570
mov ecx, dword [ecx + 0xc]
sub dword [ebp + 8], esi
test ecx, ecx
jne 0x4f3556
pop edi
pop esi
pop ebx
leave
ret
Function at 0x508a21
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x508a5e
cmp dword [ebp + 0x14], edi
je 0x508a5e
cmp ecx, edi
jne 0x508a65
call fcn.0050fb76
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0050bb8d
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x508a79
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x508a9a
cmp ebx, 0xffffffff
je 0x508a89
push ebx
push edi
push ecx
call fcn.00509c30
add esp, 0xc
cmp esi, edi
je 0x508a46
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x508a46
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x508ab6
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x508abd
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x508bae
test word [esi + 0xc], 0x10c
je 0x508b11
mov eax, dword [esi + 4]
test eax, eax
je 0x508b11
jl 0x508c0f
cmp ebx, eax
mov edi, ebx
jb 0x508ae2
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x508bb6
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0050b3b8
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x508ba6
cmp ebx, dword [ebp - 0xc]
jb 0x508b7e
cmp dword [ebp - 0xc], 0
je 0x508b3b
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x508b30
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x508b37
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x508b46
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x508b46
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x508be2
push eax
push dword [ebp - 8]
push esi
call fcn.0051757c
pop ecx
push eax
call fcn.0051747f
add esp, 0xc
test eax, eax
je 0x508c21
cmp eax, 0xffffffff
je 0x508c0f
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x508ba6
push esi
call fcn.00516d9e
cmp eax, 0xffffffff
pop ecx
je 0x508c13
cmp dword [ebp - 4], 0
je 0x508be2
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x508ac5
mov eax, dword [ebp + 0x14]
jmp 0x508a60
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x508bcd
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00509c30
add esp, 0xc
call fcn.0050fb76
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x508a56
cmp dword [ebp + 0xc], 0xffffffff
je 0x508bf8
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00509c30
add esp, 0xc
call fcn.0050fb76
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x508a56
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x508a60
or dword [esi + 0xc], 0x10
jmp 0x508c13
Function at 0x50bc9c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x59099c]
jne 0x50bca6
repz ret
jmp fcn.0051acb5

Function at 0x50edcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x50eded
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
invalid
inc ebp
pop ebp
rol esi, 0x45
ret 0x88ec
ret