joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d764
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x49d8e6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.0049db58
mov eax, ebx
call fcn.0042657c
dec al
je 0x49d7a8
dec al
je 0x49d7ae
jmp 0x49d7b4
mov byte [ebp - 0x77], 2
jmp 0x49d7b8
mov byte [ebp - 0x77], 1
jmp 0x49d7b8
mov byte [ebp - 0x77], 0
mov eax, dword [ebp - 0x8c]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0x8c], eax
mov eax, ebx
call fcn.00426508
shl eax, 2
lea eax, [eax + eax*4]
mov dword [ebp - 0x84], eax
mov edi, dword [ebx + 0x18]
cmp edi, 0xff000008
je 0x49d805
cmp edi, 0x20000000
jne 0x49d811
mov dword [ebp - 0x88], 0x40000000
jmp 0x49d81b
mov eax, edi
call fcn.00425dc4
mov dword [ebp - 0x7c], eax
mov eax, ebx
call fcn.00426544
test al, 1
je 0x49d82d
or dword [ebp - 0x88], 1
mov eax, ebx
call fcn.00426544
test al, 2
je 0x49d83f
or dword [ebp - 0x88], 2
mov eax, ebx
call fcn.00426544
test al, 4
je 0x49d851
or dword [ebp - 0x88], 4
mov eax, ebx
call fcn.00426544
test al, 8
je 0x49d863
or dword [ebp - 0x88], 8
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.00426494
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x76]
mov ecx, 0x20
call fcn.0040a4f4
or dword [ebp - 0x8c], 0x8000000
mov eax, ebx
call fcn.004265ac
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x3c]
push eax
push 0x3c
mov eax, ebx
call fcn.00426298
push eax
call sub.gdi32.dll_GetObjectA
test eax, eax
je 0x49d8c0
or dword [ebp - 0x8c], 0x400000
mov ax, word [ebp - 0x2c]
mov word [ebp - 0x56], ax
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.0049db84
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d8ed
lea eax, [ebp - 0x94]
call fcn.00405140
ret
Function at 0x49e88c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, 0x4dd304
xor eax, eax
push ebp
push 0x49ea12
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x4e0dfc], 1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49e9f5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x49ea20
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x49e8e7
cmp dword [ebx], 0x20
jae 0x49e8e7
xor eax, eax
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x49e913
push 0x49ea30
call sub.kernel32.dll_LoadLibraryA
mov dword [ebx], eax
cmp dword [ebx], 0
jbe 0x49e9de
cmp dword [ebx], 0x20
jae 0x49e9de
xor eax, eax
mov dword [ebx], eax
jmp 0x49e9de
mov byte [0x4e0dfc], 2
lea eax, [ebp - 8]
mov edx, 0x49ea48
call fcn.004051d8
lea eax, [ebp - 8]
call fcn.00405660
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405610
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x49e9de
mov eax, ebx
call fcn.00402b60
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x49e9d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00405610
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x49e9c1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x49ea58
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x49e9c1
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
and eax, 0xffff
mov ecx, 0xa
xor edx, edx
div ecx
mov byte [0x4e0dfc], al
cmp byte [0x4e0dfc], 0
jne 0x49e9c1
mov byte [0x4e0dfc], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e9de
mov eax, dword [ebp - 0x10]
call fcn.00402b90
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e9fc
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4a1548
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4a1550
push ebx
push esi
push edi
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4a1732
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp - 1]
call fcn.004030a0
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0x41
jb 0x4a1702
cmp byte [ebp - 1], 0x5a
ja 0x4a1702
lea eax, [ebp - 0x14]
mov dl, byte [ebp - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.00403660
mov edx, 0x4a1740
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.00403630
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.004053b4
mov eax, dword [ebp - 0xc]
call fcn.00405610
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4a1702
lea eax, [ebp - 0x1c]
call fcn.004b5dc0
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 8]
mov edx, 0x4a174c
call fcn.0040a1cc
mov eax, dword [ebp - 8]
call fcn.00409ffc
test al, al
jne 0x4a15d2
push 0x4a175c
push 0x4a1764
mov ecx, dword [0x4df668]
mov dl, 1
mov eax, dword [0x418c78]
call fcn.0041d19c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4a1644
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.0041cf98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a164b
mov eax, dword [ebp - 0x10]
call fcn.004042f0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1739
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405164
lea eax, [ebp - 0x1c]
call fcn.00405140
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405164
ret
Function at 0x4af944
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x222], 0
je 0x4af96b
mov ecx, edi
mov dl, 1
mov eax, dword [0x4ae720]
call fcn.004ae784
mov dword [edi + 0x294], eax
jmp 0x4afa74
xor ebx, ebx
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
cmp byte [edi + 0x22b], 0
je 0x4af9ac
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp dx, word [edi + 0x226]
jbe 0x4af9a1
mov edx, eax
sub dl, byte [edi + 0x226]
mov eax, edi
call fcn.004aeef4
jmp 0x4af9e2
xor edx, edx
mov eax, edi
call fcn.004aeef4
jmp 0x4af9e2
movzx edx, word [edi + 0x226]
mov ecx, 0x64
sub ecx, edx
mov al, byte [edi + 0x22a]
xor edx, edx
mov dl, al
cmp ecx, edx
jle 0x4af9d9
mov edx, eax
add dl, byte [edi + 0x226]
mov eax, edi
call fcn.004aeef4
jmp 0x4af9e2
mov dl, 0x64
mov eax, edi
call fcn.004aeef4
cmp byte [edi + 0x22b], 0
je 0x4af9f4
cmp byte [edi + 0x22a], 0
je 0x4afa06
cmp byte [edi + 0x22b], 0
jne 0x4afa11
cmp byte [edi + 0x22a], 0x64
jne 0x4afa11
mov bl, byte [edi + 0x224]
xor bl, 1
jmp 0x4afa41
mov eax, dword [0x4de4b4]
mov eax, dword [eax]
call fcn.004602d4
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
movzx edx, word [edi + 0x228]
cmp eax, edx
ja 0x4afa41
cmp byte [edi + 0x224], 0
jne 0x4afa41
cmp byte [edi + 0x2a0], 0
je 0x4afa11
test bl, bl
jne 0x4afa5b
cmp byte [edi + 0x224], 0
jne 0x4afa5b
cmp byte [edi + 0x2a0], 0
je 0x4af96d
cmp byte [edi + 0x2a0], 0
jne 0x4afa6d
cmp byte [edi + 0x224], 0
jne 0x4afa74
mov eax, edi
call fcn.004afd68
pop edi
pop esi
pop ebx
ret
Function at 0x4b5dc0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
lea eax, [esp + 0x105]
push eax
push 0
push 0x4b5e04
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
lea eax, [esp + 0x105]
call fcn.0040a638
add esp, 0x20c
pop ebx
ret

Function at 0x4b60b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov ecx, dword [0x4de4b4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x4b5330]
call fcn.00458a88
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b6274
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4de714]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0045e410
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x1e4]
mov edx, edi
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax + 0x48]
mov eax, dword [ebp - 4]
call fcn.0045987c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 4]
call fcn.004598ac
mov eax, dword [0x4de714]
mov eax, dword [eax]
call fcn.0045de54
mov edx, eax
mov eax, dword [ebp - 4]
sub edx, dword [eax + 0x48]
sar edx, 1
jns 0x4b6153
adc edx, 0
mov eax, dword [ebp - 4]
call fcn.00440078
mov eax, dword [0x4de714]
mov eax, dword [eax]
call fcn.0045de48
mov edx, eax
mov eax, dword [ebp - 4]
sub edx, dword [eax + 0x4c]
sar edx, 1
jns 0x4b6176
adc edx, 0
mov eax, dword [ebp - 4]
call fcn.0044009c
test bl, bl
je 0x4b61c9
mov eax, dword [edi + 0xc]
mov edx, dword [0x46237c]
call fcn.00404488
test al, al
jne 0x4b61c9
mov eax, dword [edi + 0xc]
mov edx, dword [0x4253f8]
call fcn.00404488
test al, al
jne 0x4b61c9
push 0
mov eax, dword [edi + 0xc]
call fcn.004b5c7c
push eax
mov eax, dword [ebp - 4]
call fcn.00447128
push eax
call sub.user32.dll_SetWindowRgn
mov eax, dword [ebp - 4]
mov byte [eax + 0x2fc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x2fe], 0
mov eax, dword [ebp - 4]
mov dl, byte [ebp + 8]
mov byte [eax + 0x2fd], dl
mov eax, dword [ebp - 4]
call fcn.0045cdf8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x88]
mov eax, dword [0x4de4b4]
mov eax, dword [eax]
call fcn.0045ff58
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x4b6213
mov eax, dword [0x4de4b4]
mov eax, dword [eax]
call fcn.004602d4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2fe], 0
jne 0x4b6250
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
imul eax, esi, 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x4b624c
cmp eax, dword [esp]
pop edx
pop eax
ja 0x4b6207
jmp 0x4b6250
pop edx
pop eax
jg 0x4b6207
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b627b
mov eax, dword [0x4de714]
mov eax, dword [eax]
xor edx, edx
call fcn.0045e410
mov eax, dword [ebp - 4]
call fcn.004042f0
ret
Function at 0x4b6540
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405600
mov eax, dword [ebp - 8]
call fcn.00405600
xor eax, eax
push ebp
push 0x4b664b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4b6623
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.0047754c
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 4]
call fcn.004051d8
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 8]
call fcn.0047754c
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 8]
call fcn.004051d8
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov eax, 0x4b665c
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.00405610
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00405610
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x50]
call fcn.0040a424
mov eax, dword [ebp - 0x50]
call fcn.00405610
mov dword [ebp - 0x2c], eax
test bl, bl
je 0x4b65fa
mov dword [ebp - 0x28], 3
jmp 0x4b6601
mov dword [ebp - 0x28], 5
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x4b6623
cmp byte [ebp + 8], 0
je 0x4b6623
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4b6623
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6652
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.00405164
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405164
ret

Function at 0x4b6664
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov eax, dword [0x4de738]
cmp dword [eax], 2
je 0x4b667d
mov byte [esp], 1
jmp 0x4b6752
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4b66bb
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x4b66bb
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x4b6752
mov eax, 0x400
call fcn.00402b60
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
je 0x4b674b
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x4dd7c8
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x4b6741
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x4b673d
mov byte [esp], 1
jmp 0x4b6741
inc edi
dec ebx
jne 0x4b6724
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402b90
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4b685c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b68e8
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b68cb
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004b67f4
mov eax, dword [ebp - 0xc]
call fcn.00405610
push eax
call sub.kernel32.dll_GetFileAttributesA
test eax, eax
jns 0x4b68b1
call fcn.0040422c
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b68d2
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4c26f4
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x230], 1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x242], 0
jne 0x4c2741
mov eax, dword [ebp - 4]
cmp byte [eax + 0x232], 1
je 0x4c2741
mov eax, dword [ebp - 4]
cmp byte [eax + 0x232], 2
jne 0x4c28b3
mov eax, dword [ebp - 4]
call fcn.004c2180
test al, al
je 0x4c28b3
mov eax, dword [ebp - 4]
call fcn.00447128
push eax
call sub.user32.dll_HideCaret
xor eax, eax
push ebp
push 0x4c28ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00447128
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c2897
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4c2870
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00440350
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.0044030c
inc eax
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c2852
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov ebx, eax
push 0
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0044512c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x241], 0
je 0x4c27f6
mov eax, dword [ebp - 4]
call fcn.004c2518
push 0xcc0020
push 1
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00440350
push eax
mov eax, dword [ebp - 4]
call fcn.0044030c
push eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x20c]
mov esi, dword [eax*4 + 0x4dd808]
push esi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2859
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
ret
mov eax, dword [ebp - 4]
mov byte [eax + 0x230], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d21bc
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403800
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x4d7778
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4d7891
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x14]
mov eax, dword [0x4de4b4]
mov eax, dword [eax]
call fcn.00460b50
mov eax, dword [ebp - 0x14]
call fcn.00405610
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4d787b
push 2
push 0
push 0xfffffffffffffff6
push esi
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0xf]
xor ecx, ecx
mov edx, 0xb
call fcn.00403800
push 0
lea eax, [ebp - 4]
push eax
push 0xa
lea eax, [ebp - 0xf]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
mov edx, 0x4d78a0
lea eax, [ebp - 0xf]
call fcn.0040a51c
test eax, eax
jne 0x4d7830
push 2
push 0
push 0xfffffffffffffff2
push esi
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x4e1ffc
push esi
call sub.kernel32.dll_ReadFile_1
mov bl, 1
jmp 0x4d7875
mov edx, 0x4d78ac
lea eax, [ebp - 0xf]
call fcn.0040a51c
test eax, eax
jne 0x4d7875
push 2
push 0
push 0xfffffffffffffff2
push esi
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x4e1ffc
push esi
call sub.kernel32.dll_ReadFile_1
push 0
push esi
call sub.kernel32.dll_GetFileSize_1
sub eax, dword [0x4e1ffc]
mov dword [0x4e1ffc], eax
mov bl, 1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7898
lea eax, [ebp - 0x14]
call fcn.00405140
ret
Function at 0x4028a5
Capabilities:
Get common file path
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1400
call fcn.00408ea0
mov eax, dword [0x2b17ff8]
mov ecx, dword [0x2b16f48]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x402980
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x2b17ff8], 0x959
jne 0x40296e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
lea eax, [ebp - 0x1400]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call fcn.004026ee
add edi, 8
dec ebx
jne 0x4028d1
pop edi
pop ebx
pop esi
leave
ret
Function at 0x403870
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a30c8]
jne 0x40387a
repz ret
jmp fcn.00405dce

Function at 0x4059f4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404509
and dword [ebp - 4], 0
cmp dword [0x4a4884], 0
mov ebx, eax
jne 0x405aa5
push 0x401930
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405b56
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401924
push edi
call esi
test eax, eax
je 0x405b56
push eax
call fcn.00404497
mov dword [esp], 0x401914
push edi
mov dword [0x4a4884], eax
call esi
push eax
call fcn.00404497
mov dword [esp], 0x401900
push edi
mov dword [0x4a4888], eax
call esi
push eax
call fcn.00404497
mov dword [esp], 0x4018e4
push edi
mov dword [0x4a488c], eax
call esi
push eax
call fcn.00404497
pop ecx
mov dword [0x4a4894], eax
test eax, eax
je 0x405aa5
push 0x4018cc
push edi
call esi
push eax
call fcn.00404497
pop ecx
mov dword [0x4a4890], eax
mov eax, dword [0x4a4890]
cmp eax, ebx
je 0x405afd
cmp dword [0x4a4894], ebx
je 0x405afd
push eax
call fcn.00404512
push dword [0x4a4894]
mov esi, eax
call fcn.00404512
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405afd
test edi, edi
je 0x405afd
call esi
test eax, eax
je 0x405af4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405af4
test byte [ebp - 0xc], 1
jne 0x405afd
or dword [ebp + 0x10], 0x200000
jmp 0x405b36
mov eax, dword [0x4a4888]
cmp eax, ebx
je 0x405b36
push eax
call fcn.00404512
pop ecx
test eax, eax
je 0x405b36
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405b36
mov eax, dword [0x4a488c]
cmp eax, ebx
je 0x405b36
push eax
call fcn.00404512
pop ecx
test eax, eax
je 0x405b36
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a4884]
call fcn.00404512
pop ecx
test eax, eax
je 0x405b56
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405b58
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret