joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411d28
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x41f644]
push edi
jae 0x411efd
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0x41f660]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x411efd
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x411dd3
test dl, 2
jne 0x411dd3
test dl, 0x48
je 0x411d9d
cmp byte [eax + 5], 0xa
je 0x411d9d
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x411de6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x411dce
mov dword [0x41e270], ecx
jmp 0x411f04
cmp eax, 0x6d
jne 0x411dda
xor eax, eax
jmp 0x411f11
push eax
call fcn.004125f5
pop ecx
jmp 0x411f0e
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x411ef8
test eax, eax
je 0x411e0d
cmp byte [ebx], 0xa
jne 0x411e0d
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x411e16
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x411ef2
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x411ee2
cmp al, 0xd
je 0x411e48
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x411ed4
dec ecx
cmp dword [ebp - 8], ecx
jae 0x411e62
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x411e5d
add dword [ebp - 8], 2
jmp 0x411eb6
mov dword [ebp - 8], eax
jmp 0x411ed0
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x411e8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x411ed0
cmp dword [ebp - 0x10], 0
je 0x411ed0
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x411eab
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x411eb6
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x411ed3
cmp ebx, dword [ebp + 0xc]
jne 0x411ebb
cmp byte [ebp - 1], 0xa
jne 0x411ebb
mov byte [ebx], 0xa
jmp 0x411ed3
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00411f16
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x411ed4
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x411e2c
jmp 0x411ef2
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x411ef2
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x411f11
and dword [0x41e270], 0
mov dword [0x41e26c], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412654
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x41d334]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x41d790]
je 0x412689
inc eax
cmp eax, 0x13
jb 0x41267a
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x41d790]
jne 0x4127af
mov eax, dword [0x41e2c4]
cmp eax, 1
je 0x412787
cmp eax, edx
jne 0x4126b9
cmp dword [0x41d314], 1
je 0x412787
cmp ecx, 0xfc
je 0x4127af
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4126ef
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00411a40
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.0040d8e0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x412723
mov eax, edi
push eax
call fcn.0040d8e0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x419a20
push edi
call fcn.00413fd0
add esp, 0x10
push edi
call fcn.0040d8e0
push dword [esi + 0x41d794]
mov ebx, eax
call fcn.0040d8e0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.0040c5e0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00411a40
push edi
push ebx
call fcn.00411a50
push 0x419a00
push ebx
call fcn.00411a50
push dword [esi + 0x41d794]
push ebx
call fcn.00411a50
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00415a48
add esp, 0x2c
jmp 0x4127af
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x41d794]
push dword [esi]
call fcn.0040d8e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040e328
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x415a48
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x41e558], ebx
push esi
push edi
jne 0x415ac8
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x415b03
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x41e558], eax
je 0x415b03
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x41e55c], eax
call esi
cmp dword [0x41e278], 2
mov dword [0x41e560], eax
jne 0x415ac8
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x41e568], eax
je 0x415ac8
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x41e564], eax
mov eax, dword [0x41e564]
test eax, eax
je 0x415b0d
call eax
test eax, eax
je 0x415af4
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x41e568]
test eax, eax
je 0x415af4
test byte [ebp - 8], 1
jne 0x415b0d
cmp dword [0x41e284], 4
jb 0x415b07
or byte [ebp + 0x12], 0x20
jmp 0x415b2c
xor eax, eax
jmp 0x415b3c
or byte [ebp + 0x12], 4
jmp 0x415b2c
mov eax, dword [0x41e55c]
test eax, eax
je 0x415b2c
call eax
mov ebx, eax
test ebx, ebx
je 0x415b2c
mov eax, dword [0x41e560]
test eax, eax
je 0x415b2c
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x41e558]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415c00
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x41aa98
call fcn.0040f570
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x41e56c], edi
jne 0x415c44
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x415c2f
mov dword [0x41e56c], ebx
jmp 0x415c44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x415c44
mov dword [0x41e56c], 2
mov eax, dword [0x41e56c]
cmp eax, ebx
jne 0x415c64
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x415d27
cmp eax, 2
je 0x415c6d
cmp eax, edi
jne 0x415c95
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x415c80
mov eax, dword [0x41e374]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x415c9c
xor eax, eax
jmp 0x415d27
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.0040c5e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x415ccf
cmp esi, edi
jne 0x415ce5
push dword [ebp - 0x20]
call fcn.0040c2af
pop ecx
mov esi, eax
cmp esi, edi
je 0x415c95
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x415d18
cmp dword [ebp + 0x14], edi
jne 0x415d02
push edi
push edi
jmp 0x415d08
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x415d24
push esi
call fcn.0040c2c1
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.0040f5ab
ret
Function at 0x415d30
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x41aaa8
call fcn.0040f570
xor esi, esi
cmp dword [0x41e570], esi
jne 0x415d74
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x415d5f
mov dword [0x41e570], edi
jmp 0x415d74
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x415d74
mov dword [0x41e570], 2
mov eax, dword [0x41e570]
cmp eax, 2
je 0x415e55
cmp eax, esi
je 0x415e55
cmp eax, 1
jne 0x415db9
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x415da2
mov eax, dword [0x41e374]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x415dc0
xor eax, eax
jmp 0x415e67
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.0040c5e0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x415df6
cmp edi, esi
jne 0x415e11
lea eax, [ebx + ebx]
push eax
call fcn.0040c2af
pop ecx
mov edi, eax
cmp edi, esi
je 0x415db9
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x415e44
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x415e2e
push esi
push esi
jmp 0x415e34
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x415e50
push edi
call fcn.0040c2c1
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x415e67
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.0040f5ab
ret
Function at 0x41644f
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0040c5e0
mov eax, dword [0x41d334]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x41f644]
mov dword [ebp - 4], eax
jae 0x416592
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x41f660]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x416592
push 1
push esi
push ebx
call fcn.00411f16
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 0x1008], eax
je 0x41659c
push 2
push esi
push ebx
call fcn.00411f16
add esp, 0xc
cmp eax, 0xffffffff
je 0x41659c
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x41653c
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0040f510
push 0x8000
push ebx
call fcn.00416d69
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x4164fb
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.00411b38
add esp, 0xc
cmp eax, 0xffffffff
je 0x416519
sub edi, eax
test edi, edi
jg 0x4164f0
jmp 0x41652f
cmp dword [0x41e270], 5
jne 0x41652c
mov dword [0x41e26c], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.00416d69
pop ecx
pop ecx
jmp 0x41657c
jge 0x41657c
push 0
push dword [ebp + 0xc]
push ebx
call fcn.00411f16
push ebx
call fcn.00414f92
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x41657c
mov dword [0x41e26c], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x41e270], eax
push 0
push dword [ebp - 0x1008]
push ebx
call fcn.00411f16
add esp, 0xc
mov eax, esi
pop edi
jmp 0x41659f
mov dword [0x41e26c], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0040e328
leave
ret
Function at 0x40a020
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x200
lea eax, [esp]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40a0cb
push ebx
push esi
lea ecx, [esp + 8]
push edi
push ecx
lea edx, [esp + 0x110]
push 0x40e394
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, 0x40e38c
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x210]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test eax, eax
pop ebx
je 0x40a0b5
lea eax, [esp + 0x100]
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret
lea edx, [esp]
lea eax, [esp + 0x100]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret

Function at 0x4018a4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40d008], 0x8088405
inc edx
mov dword [ebx + 0x40d008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4047cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
dec esi
test esi, esi
jl 0x4047e9
inc esi
xor edx, edx
xor ebx, ebx
mov bl, byte [eax + edx]
xor bx, 0xb822
mov byte [ecx + edx], bl
inc edx
dec esi
jne 0x4047d8
pop esi
pop ebx
ret

Function at 0x405550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402558
xor eax, eax
push ebp
push 0x4055c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004021d8
mov eax, dword [ebp - 4]
call fcn.00402370
mov esi, eax
test esi, esi
jle 0x4055a6
mov ebx, 1
lea eax, [ebp - 4]
call fcn.004025bc
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, 0x49
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x40558c
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040222c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4055cd
lea eax, [ebp - 4]
call fcn.004021d8
ret
Function at 0x4d3caf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4d3cfb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4d3cf5
mov ecx, dword [0x505318]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4d3ce9
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4d3cce
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x4d3cf7
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4d530b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x4d5377
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x4d53c0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.004ee530
add esp, 8
test eax, eax
jne 0x4d53be
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x4d53c2
jmp 0x4d536e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4ddef0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004d79d3
add esp, 4
and eax, 0xff
test eax, eax
je 0x4ddf79
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.004e8ce0
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x4ddf77
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0x4ddf77
jmp 0x4ddf79
jmp 0x4ddef9
mov esp, ebp
pop ebp
ret

Function at 0x4de3dc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [0x505aa4]
test eax, eax
jne 0x4de3f0
call fcn.004de324
xor ecx, ecx
mov cl, byte [0x505aa1]
test ecx, ecx
jne 0x4de477
xor edx, edx
mov dl, byte [0x505aa0]
test edx, edx
jne 0x4de477
cmp dword [0x505ba8], 0
je 0x4de452
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x180
mov ecx, dword [0x505ba8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 4]
push edx
push 0x186
mov eax, dword [0x505ba8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x505ba8]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x4de477
push 0x10001
push 0x505aa4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x4de477
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x4e145a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4e146a
xor eax, eax
jmp 0x4e1633
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x4e15eb
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5039fc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5039fc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5039fc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5039fc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5039fc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5039fc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5039fc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x5039fc]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x4e1473
cmp dword [ebp + 0x10], 0
je 0x4e162d
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x5039fc]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x4e15f1
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x4eade0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x501018
cmp edx, dword [eax]
je 0x4eae02
add eax, 8
inc ecx
cmp eax, 0x5010a8
jl 0x4eadf3
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x501018]
jne 0x4eaf30
mov eax, dword [0x505c28]
cmp eax, 1
je 0x4eaf0a
test eax, eax
jne 0x4eae33
cmp dword [0x500d54], 1
je 0x4eaf0a
cmp edx, 0xfc
je 0x4eaf30
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4eae6a
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004e8e40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004e8f60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4eaead
lea eax, [ebp - 0x1a4]
push eax
call fcn.004e8f60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x504e14
push edi
call fcn.004e8fe0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004e8e40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004e8e50
lea eax, [ebp - 0xa0]
push 0x504df4
push eax
call fcn.004e8e50
push dword [esi + 0x50101c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004e8e50
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004ed3a8
add esp, 0x2c
pop edi
jmp 0x4eaf30
lea eax, [ebp + 8]
lea esi, [esi + 0x50101c]
push 0
push eax
push dword [esi]
call fcn.004e8f60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret