joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7fd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
push esi
call fcn.0052d362
add esp, 8
test eax, eax
jne 0x4b80f6
mov ecx, esi
call fcn.004b7ca0
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4b80ed
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4b80ed
cmp dword [ebp - 4], 0
lea edx, [edi + 0x20]
lea ecx, [ebp - 0x1c]
jne 0x4b8097
call fcn.004b7dc0
cmp dword [ebp - 0xc], 0
jne 0x4b806c
cmp dword [ebp - 8], 0
jne 0x4b806c
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
jmp 0x4b8077
lea edx, [edi + 0x18]
lea ecx, [ebp - 0xc]
call fcn.004b7dc0
cmp dword [ebp - 0x14], 0
jne 0x4b8083
cmp dword [ebp - 0x10], 0
je 0x4b80cd
lea edx, [edi + 0x28]
lea ecx, [ebp - 0x14]
call fcn.004b7dc0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004b7ea0
cmp dword [ebp - 0xc], 0
jne 0x4b80b6
cmp dword [ebp - 8], 0
jne 0x4b80b6
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
jmp 0x4b80c1
lea edx, [edi + 0x18]
lea ecx, [ebp - 0xc]
call fcn.004b7ea0
cmp dword [ebp - 0x14], 0
jne 0x4b80e2
cmp dword [ebp - 0x10], 0
jne 0x4b80e2
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [edi + 0x2c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [edi + 0x28]
lea ecx, [ebp - 0x14]
call fcn.004b7ea0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4b8150
test bl, 0x10
je 0x4b8150
push 0x30
push 0
push edi
call fcn.0051a780
add esp, 0xc
mov ecx, 0x210000
call fcn.004b7570
shl ebx, 7
not ebx
mov dword [edi + 0x20], eax
and ebx, 0x80
mov dword [edi + 0x28], eax
or ebx, 0x4100
mov dword [edi + 0x18], eax
mov dword [edi + 0x24], edx
xor eax, eax
mov dword [edi + 0x2c], edx
mov dword [edi + 0x1c], edx
mov word [edi + 6], bx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b89c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5bcfd8]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test eax, eax
jne 0x4b89fe
push dword [ebp + 0xc]
push esi
push dword [0x5de9b4]
call fcn.00530323
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x4b8adb
test edi, edi
jne 0x4b8ab3
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
cmp eax, 1
mov eax, dword [ebp + 0xc]
jne 0x4b8a4d
shr eax, 1
push eax
lea ebx, [esi + eax]
push ebx
push dword [0x5de9b4]
call fcn.00530323
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x4b8adb
test edi, edi
je 0x4b8adb
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov byte [esi], al
inc esi
cmp al, 0xa
jne 0x4b8a44
mov word [esi - 1], 0xa0d
inc esi
inc edi
sub ecx, 1
jne 0x4b8a30
sub esi, edi
jmp 0x4b8ab3
dec eax
mov ebx, esi
push eax
push esi
push dword [0x5de9b4]
call fcn.00530323
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x4b8adb
test edi, edi
je 0x4b8adb
mov byte [edi + esi], 0xa
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov edx, esi
mov byte [esi], al
inc esi
cmp al, 0xd
jne 0x4b8a87
cmp byte [ebx], 0xa
jne 0x4b8a87
mov esi, edx
dec edi
mov eax, esi
sub ecx, 1
jne 0x4b8a71
test edi, edi
jne 0x4b8aaa
push 1
push esi
push dword [0x5de9b4]
call fcn.00530323
add esp, 0xc
mov edi, 1
jmp 0x4b8ab3
sub esi, edi
cmp byte [eax - 1], 0x1a
jne 0x4b8ab3
dec edi
mov ecx, dword [0x5de9ac]
mov edx, esi
push edi
call fcn.004b1660
mov dword [0x5de9ac], eax
add esp, 4
mov eax, dword [0x5dedbc]
add eax, edi
mov dword [0x5dedbc], eax
cmp eax, edi
jb 0x4b8ae1
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov edx, str.file_exceeds_Zips_4GB_uncompressed_size_limit
mov ecx, 6
call fcn.004b3b50
int3
Function at 0x4b90a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x5bcfe4], 1
push ebx
push esi
push edi
mov esi, ecx
jne 0x4b9180
mov dword [0x5bcfe4], 2
test esi, esi
je 0x4b90de
mov al, byte [esi]
cmp al, 0x80
jae 0x4b90de
cmp byte [esi + 1], 0x3a
jne 0x4b90de
movzx eax, al
movzx ebx, byte [eax + 0x6298c0]
jmp 0x4b90e0
xor ebx, ebx
mov ecx, 0x210000
mov dword [0x5dedc4], 0x28
mov dword [0x5dedc8], 0x210000
call fcn.004b7570
push 0
push 0
mov dword [0x5dedd0], eax
xor ecx, ecx
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x5c3a78
push eax
lea eax, [ebp - 0xc]
mov dword [0x5dedd4], edx
push eax
push 0
push 0xd
test ebx, ebx
mov byte [ebp - 4], bl
lea eax, [ebp - 4]
push 0x5de998
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4b9158
push 0
mov ecx, 0x5de998
mov dword [0x5bcfbc], 0x5de998
call fcn.004b6f90
add esp, 4
jmp 0x4b9162
mov dword [0x5bcfbc], 0
test esi, esi
je 0x4b9177
cmp byte [esi], 0x80
jae 0x4b9180
cmp byte [esi + 1], 0x3a
jne 0x4b9180
cmp byte [esi + 2], 0
jne 0x4b9180
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x5a5ec0
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4b91a7
test dl, dl
je 0x4b91a3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4b91a7
add eax, 2
add ecx, 2
test dl, dl
jne 0x4b9187
xor eax, eax
jmp 0x4b91ac
sbb eax, eax
or eax, 1
mov ecx, esi
test eax, eax
jne 0x4b91c2
push eax
call fcn.004b6f90
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b91c5
sub ecx, edx
lea eax, [ecx + 2]
push eax
call fcn.0051e703
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4b91ea
lea eax, [ebx + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4b91f0
mov al, byte [ebx]
mov esi, ebx
test al, al
je 0x4b9223
cmp al, 0x5c
jne 0x4b920c
mov byte [esi], 0x2f
call fcn.00531c59
push eax
push esi
call fcn.00531ad9
add esi, eax
add esp, 8
mov al, byte [esi]
test al, al
jne 0x4b9205
mov edx, 0x3a
mov ecx, ebx
call fcn.004b7c20
mov edi, eax
test edi, edi
je 0x4b927a
mov cl, byte [edi + 1]
inc edi
mov esi, edi
test cl, cl
je 0x4b925d
nop
cmp cl, 0x3a
je 0x4b9270
call fcn.00531c59
push eax
push esi
call fcn.00531ad9
mov cl, byte [esi + eax]
add esi, eax
add esp, 8
test cl, cl
jne 0x4b9240
cmp edi, ebx
jbe 0x4b927c
cmp byte [edi], 0
jne 0x4b927c
mov eax, 0x2e
mov word [edi], ax
jmp 0x4b927c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, ebx
mov edx, edi
mov ecx, ebx
call fcn.004b8d70
push ebx
mov esi, eax
call fcn.0051cad9
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bcc50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x5dede0]
xor edx, edx
push esi
mov esi, dword [0x5f9724]
xor ecx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov dword [0x629780], 2
push edi
test ebx, ebx
je 0x4bce27
mov edi, dword [0x5deddc]
cmp ebx, 3
jb 0x4bcccb
movzx eax, byte [esi + 0x609762]
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
mov dword [0x5deddc], edi
movzx ecx, word [edi*2 + 0x5f9740]
mov edx, ecx
mov word [eax*2 + 0x619780], cx
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov word [edi*2 + 0x5f9740], si
test edx, edx
je 0x4bccfa
mov eax, esi
sub eax, edx
cmp eax, 0x7efa
ja 0x4bccfa
mov eax, dword [0x5f972c]
mov ecx, edx
cmp eax, ebx
cmova eax, ebx
mov dword [0x5f972c], eax
call fcn.004bc990
mov ecx, eax
cmp ecx, ebx
cmova ecx, ebx
mov dword [ebp - 4], ecx
cmp ecx, 3
jb 0x4bcd9f
lea edx, [ecx - 3]
mov ecx, esi
sub ecx, dword [0x5f9730]
call fcn.004be2d0
mov edx, dword [ebp - 4]
mov ecx, eax
sub ebx, edx
mov dword [ebp - 0xc], ecx
mov dword [0x5dede0], ebx
cmp edx, dword [0x5dedcc]
ja 0x4bcd79
cmp ebx, 3
jb 0x4bcd79
dec edx
movzx eax, byte [esi + 0x609763]
inc esi
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
movzx ecx, word [edi*2 + 0x5f9740]
mov dword [ebp - 8], ecx
mov word [eax*2 + 0x619780], cx
mov word [edi*2 + 0x5f9740], si
sub edx, 1
jne 0x4bcd31
mov ecx, dword [ebp - 0xc]
mov dword [0x5deddc], edi
mov dword [ebp - 4], edx
jmp 0x4bcdb6
add esi, edx
mov dword [ebp - 4], 0
mov edx, esi
movzx edi, byte [edx + 0x609760]
movzx eax, byte [edx + 0x609761]
shl edi, 5
xor edi, eax
mov dword [0x5deddc], edi
jmp 0x4bcdb9
movzx edx, byte [esi + 0x609760]
xor ecx, ecx
call fcn.004be2d0
dec ebx
mov ecx, eax
mov dword [0x5dede0], ebx
inc esi
mov edx, esi
mov dword [0x5f9724], esi
test ecx, ecx
je 0x4bcdfa
mov eax, dword [0x619760]
test eax, eax
js 0x4bcdd4
lea ecx, [eax + 0x609760]
jmp 0x4bcdd6
xor ecx, ecx
push 0
sub edx, eax
call fcn.004bdf60
mov esi, dword [0x5f9724]
add esp, 4
mov ebx, dword [0x5dede0]
mov edi, dword [0x5deddc]
mov dword [0x619760], esi
cmp ebx, 0x106
jae 0x4bce19
call fcn.004bcae0
mov ebx, dword [0x5dede0]
mov edi, dword [0x5deddc]
mov esi, dword [0x5f9724]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
test ebx, ebx
jne 0x4bcc87
mov eax, dword [0x619760]
test eax, eax
js 0x4bce38
lea ecx, [eax + 0x609760]
jmp 0x4bce3a
xor ecx, ecx
sub esi, eax
push 1
mov edx, esi
call fcn.004bdf60
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bd100
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, 0x12345678
mov esi, 0x23456789
mov dword [0x5dedec], eax
mov edx, 0x34567890
mov dword [0x5dedf0], esi
mov dword [0x5dedf4], edx
mov cl, byte [edi]
test cl, cl
je 0x4bd176
push ebx
mov ebx, dword [0x629e54]
movsx ecx, cl
lea edi, [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ebx + ecx*4]
movzx ecx, al
add ecx, esi
imul esi, ecx, 0x8088405
inc esi
mov ecx, esi
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [ebx + ecx*4]
mov cl, byte [edi]
test cl, cl
jne 0x4bd131
mov dword [0x5dedec], eax
mov dword [0x5dedf4], edx
mov dword [0x5dedf0], esi
pop ebx
pop edi
pop esi
ret
Function at 0x4bd410
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x5bd008], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
je 0x4bd4c8
mov dword [ebp - 8], eax
mov edx, ecx
mov dword [ebp - 4], edx
test eax, eax
je 0x4bd4c8
mov eax, dword [0x5dedec]
push ebx
mov ebx, dword [0x5dedf0]
push esi
push edi
mov edi, dword [0x5dedf4]
nop dword [eax]
mov dl, byte [edx]
mov esi, edi
and esi, 0xfffd
movsx ecx, dl
xor ecx, eax
or esi, 2
movzx ecx, cl
mov dword [ebp - 0xc], esi
mov esi, dword [0x629e54]
shr eax, 8
xor eax, dword [esi + ecx*4]
movzx ecx, al
add ecx, ebx
imul ebx, ecx, 0x8088405
inc ebx
mov ecx, ebx
shr ecx, 0x18
xor ecx, edi
shr edi, 8
movzx ecx, cl
xor edi, dword [esi + ecx*4]
mov ecx, dword [ebp - 0xc]
xor ecx, 1
imul ecx, dword [ebp - 0xc]
shr ecx, 8
xor cl, dl
mov edx, dword [ebp - 4]
mov byte [edx], cl
inc edx
sub dword [ebp - 8], 1
mov dword [ebp - 4], edx
jne 0x4bd450
mov ecx, dword [ebp - 0x10]
mov dword [0x5dedf4], edi
pop edi
pop esi
mov dword [0x5dedec], eax
mov eax, dword [ebp + 8]
mov dword [0x5dedf0], ebx
pop ebx
push dword [ebp + 0xc]
push eax
push 1
push ecx
call fcn.00535446
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4be8c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b0008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5bd098], 0
push esi
push edi
je 0x4be8f0
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00518799
mov esp, ebp
pop ebp
ret
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
jne 0x4be912
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00518799
mov esp, ebp
pop ebp
ret
mov esi, edi
mov ecx, 0x5bd018
xchg dword [ecx], esi
test esi, esi
je 0x4be94f
mov eax, esi
xchg dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x5bd098]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00518799
mov esp, ebp
pop ebp
ret
push 0x62bfa0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x124
push 0
push 0x5f9600
call fcn.0051a780
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4bea45
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeBackupPrivilege
push 0
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4be9eb
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4be9eb
call esi
test eax, eax
jne 0x4be9eb
mov dword [0x5bd014], 1
push dword [ebp - 0x18]
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4bea4a
cmp dword [0x5bd014], 0
jne 0x4be9db
lea eax, [ebp - 0x10]
push eax
push str.SeSecurityPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4be9db
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4be9db
call esi
mov ecx, dword [0x5bd194]
test eax, eax
push dword [ebp - 0x18]
mov esi, 1
cmove ecx, esi
mov dword [0x5bd194], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4bea4a
mov esi, 1
push edi
mov dword [0x5bd098], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00518799
mov esp, ebp
pop ebp
ret
Function at 0x4bf4e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.winvnc.exe_crc32_z
Function at 0x4c1fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x4c218d
cmp dword [ebx + 0x20], 0
je 0x4c218d
cmp dword [ebx + 0x24], 0
je 0x4c218d
mov esi, dword [ebx + 0x1c]
test esi, esi
je 0x4c218d
cmp dword [esi], ebx
jne 0x4c218d
mov eax, dword [esi + 4]
cmp eax, 0x2a
je 0x4c201b
cmp eax, 0x39
je 0x4c201b
cmp eax, 0x45
je 0x4c201b
cmp eax, 0x49
je 0x4c201b
cmp eax, 0x5b
je 0x4c201b
cmp eax, 0x67
je 0x4c201b
cmp eax, 0x71
je 0x4c201b
cmp eax, 0x29a
jne 0x4c218d
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4c218d
mov edx, dword [esi + 0x18]
mov dword [ebp - 8], edx
cmp edx, 2
je 0x4c218d
cmp edx, 1
jne 0x4c2043
cmp eax, 0x2a
jne 0x4c218d
cmp dword [esi + 0x74], 0
jne 0x4c218d
push edi
mov edi, dword [ebp + 0x10]
cmp edx, 1
jne 0x4c206c
push edi
push ecx
push dword [ebx + 0x30]
call sym.winvnc.exe_adler32_z
mov ecx, dword [ebp + 0xc]
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x18], 0
cmp edi, eax
jb 0x4c20c4
test edx, edx
jne 0x4c20be
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x4c]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.0051a780
mov eax, dword [esi + 0x2c]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x16b4], 0
sub edi, eax
add ecx, edi
mov edi, eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
mov dword [ebx], ecx
mov ecx, esi
mov dword [ebp - 0xc], eax
mov dword [ebx + 4], edi
call fcn.004c1ab0
mov ecx, dword [esi + 0x74]
cmp ecx, 3
jb 0x4c2148
mov ebx, dword [esi + 0x6c]
add ecx, 0xfffffffe
mov dword [ebp - 4], ecx
nop dword [eax]
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x34]
and edx, ebx
movzx edi, byte [eax + ebx + 2]
mov eax, dword [esi + 0x48]
shl eax, cl
mov ecx, dword [esi + 0x40]
xor edi, eax
and edi, dword [esi + 0x54]
mov eax, dword [esi + 0x44]
mov dword [esi + 0x48], edi
mov ax, word [eax + edi*2]
mov word [ecx + edx*2], ax
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2], bx
inc ebx
sub dword [ebp - 4], 1
jne 0x4c20f0
mov ecx, esi
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x74], 2
call fcn.004c1ab0
mov ecx, dword [esi + 0x74]
cmp ecx, 3
jae 0x4c20e3
mov ebx, dword [ebp + 8]
add dword [esi + 0x6c], ecx
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x16b4], ecx
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [ebx], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 8]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c50f0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.winvnc.exe_adler32_z

Function at 0x4c7fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x964], 0
je 0x4c7ff1
cmp edx, 0x190
jg case.0x4c7fd7.10
je case.0x4c7fd7.10
lea eax, [edx - 0xa]
cmp eax, 0xc0
ja case.0x4c7fd7.10
movzx eax, byte [eax + 0x4c8074]
jmp dword [eax*4 + 0x4c8068]
mov dword [ecx + 4], 1
lea eax, [edx - 0xa]
jmp 0x4c8005
mov eax, 0xffffffc4
pop ebp
ret
cmp edx, 0x190
jg 0x4c8029
je 0x4c8013
lea eax, [edx - 0xa]
cmp eax, 0xc0
ja case.default.0x4c8058
movzx eax, byte [eax + 0x4c8140]
jmp dword [eax*4 + 0x4c8138]
cmp dword [ebp + 8], 0
je case.0x4c8058.1001
cmp dword [ecx + 0x2c8], 0
je case.0x4c8058.1001
mov eax, 0xffffffd8
pop ebp
ret
cmp edx, 0x3e8
jg 0x4c8046
je case.0x4c8058.1001
mov eax, edx
sub eax, 0x191
je case.0x4c8058.1001
sub eax, 1
je case.0x4c8058.1001
sub eax, 0x62
jmp 0x4c8020
lea eax, [edx - 0x3e9]
cmp eax, 0xf
ja case.default.0x4c8058
movzx eax, byte [eax + 0x4c8208]
jmp dword [eax*4 + 0x4c8204]
add ecx, 0xc
pop ebp
jmp fcn.004c8220

Function at 0x4c7fde
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x964], 0
je 0x4c7ff1
cmp edx, 0x190
jg case.0x4c7fd7.10
je case.0x4c7fd7.10
lea eax, [edx - 0xa]
cmp eax, 0xc0
ja case.0x4c7fd7.10
movzx eax, byte [eax + 0x4c8074]
jmp dword [eax*4 + 0x4c8068]
mov dword [ecx + 4], 1
lea eax, [edx - 0xa]
jmp 0x4c8005
mov eax, 0xffffffc4
pop ebp
ret
cmp edx, 0x190
jg 0x4c8029
je 0x4c8013
lea eax, [edx - 0xa]
cmp eax, 0xc0
ja case.default.0x4c8058
movzx eax, byte [eax + 0x4c8140]
jmp dword [eax*4 + 0x4c8138]
cmp dword [ebp + 8], 0
je case.0x4c8058.1001
cmp dword [ecx + 0x2c8], 0
je case.0x4c8058.1001
mov eax, 0xffffffd8
pop ebp
ret
cmp edx, 0x3e8
jg 0x4c8046
je case.0x4c8058.1001
mov eax, edx
sub eax, 0x191
je case.0x4c8058.1001
sub eax, 1
je case.0x4c8058.1001
sub eax, 0x62
jmp 0x4c8020
lea eax, [edx - 0x3e9]
cmp eax, 0xf
ja case.default.0x4c8058
movzx eax, byte [eax + 0x4c8208]
jmp dword [eax*4 + 0x4c8204]
add ecx, 0xc
pop ebp
jmp fcn.004c8220
Function at 0x501030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, edx
mov dword [ebp - 4], eax
and edi, 0x1f
mov dword [ebp - 8], edi
cmp edi, 8
jb 0x5010d3
mov ecx, edi
shr ecx, 3
mov dword [ebp - 8], ecx
nop dword [eax]
push 0xc2b2ae3d
push 0x27d4eb4f
push dword [eax + 4]
push dword [eax]
call fcn.00546260
add dword [ebp - 4], 8
mov ecx, eax
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.00546260
mov ecx, eax
xor edx, esi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.00546260
mov ebx, eax
mov esi, edx
mov eax, dword [ebp - 4]
add ebx, 0xc2b2ae63
adc esi, 0x85ebca77
sub edi, 8
sub dword [ebp - 8], 1
jne 0x501060
mov dword [ebp - 8], edi
mov ecx, eax
cmp edi, 4
jb 0x50112c
mov ecx, dword [ecx]
add eax, 4
mov dword [ebp - 4], eax
mov eax, 0x9e3779b1
mul ecx
push 0xc2b2ae3d
mov edi, eax
mov eax, 0x85ebca87
mul ecx
push 0x27d4eb4f
add edi, edx
xor eax, ebx
xor edi, esi
mov ecx, eax
shld ecx, edi, 0x17
shld edi, eax, 0x17
push edi
push ecx
call fcn.00546260
mov edi, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 4]
add ebx, 0x9e3779f9
mov esi, edx
adc esi, 0x165667b1
sub edi, 4
test edi, edi
je 0x501173
movzx eax, byte [eax]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.00546260
inc dword [ebp - 4]
xor ebx, eax
xor esi, edx
mov eax, ebx
push 0x9e3779b1
shld eax, esi, 0xb
push 0x85ebca87
shld esi, ebx, 0xb
push esi
push eax
call fcn.00546260
mov ebx, eax
mov eax, dword [ebp - 4]
mov esi, edx
sub edi, 1
jne 0x501130
push 0xc2b2ae3d
xor ecx, ecx
mov edx, esi
push 0x27d4eb4f
shr edx, 1
xor ecx, esi
xor edx, ebx
push ecx
push edx
call fcn.00546260
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.00546260
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50d300
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x28], 0x50c420
push eax
mov dword [ebp - 0x20], 0
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
lea eax, [ebp - 0x28]
push eax
push 0x50d2b0
push 0
push 0
call fcn.00535ff6
add esp, 0x18
mov dword [esi], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0x20], 0
jne 0x50d37a
mov esi, dword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
cmp dword [ebp - 0x20], 0
je 0x50d368
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x50d3f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
push edi
push dword [0x5f8d98]
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi + 4], eax
test eax, eax
jne 0x50d495
push 0x5be040
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x5bdfbc]
test eax, eax
je 0x50d444
mov dword [esi], eax
mov eax, dword [eax + 0x60]
mov edi, dword [esi]
push 0x5be040
mov dword [0x5bdfbc], eax
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
ret
push 0x64
call fcn.005187ac
mov edi, eax
add esp, 4
lea ecx, [edi + 4]
mov dword [edi], vtable.omni_thread.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 0xc
mov ecx, edi
call fcn.0050d950
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi], vtable._internal_omni_thread_dummy.0
mov dword [edi + 0x60], 0
push 0x5be040
mov dword [esi], edi
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
ret