joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1560
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5b5e50]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test eax, eax
jne 0x4b159e
push dword [ebp + 0xc]
push esi
push dword [0x5d7c38]
call fcn.0052796c
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x4b167b
test edi, edi
jne 0x4b1653
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
cmp eax, 1
mov eax, dword [ebp + 0xc]
jne 0x4b15ed
shr eax, 1
push eax
lea ebx, [esi + eax]
push ebx
push dword [0x5d7c38]
call fcn.0052796c
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x4b167b
test edi, edi
je 0x4b167b
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov byte [esi], al
inc esi
cmp al, 0xa
jne 0x4b15e4
mov word [esi - 1], 0xa0d
inc esi
inc edi
sub ecx, 1
jne 0x4b15d0
sub esi, edi
jmp 0x4b1653
dec eax
mov ebx, esi
push eax
push esi
push dword [0x5d7c38]
call fcn.0052796c
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x4b167b
test edi, edi
je 0x4b167b
mov byte [edi + esi], 0xa
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov edx, esi
mov byte [esi], al
inc esi
cmp al, 0xd
jne 0x4b1627
cmp byte [ebx], 0xa
jne 0x4b1627
mov esi, edx
dec edi
mov eax, esi
sub ecx, 1
jne 0x4b1611
test edi, edi
jne 0x4b164a
push 1
push esi
push dword [0x5d7c38]
call fcn.0052796c
add esp, 0xc
mov edi, 1
jmp 0x4b1653
sub esi, edi
cmp byte [eax - 1], 0x1a
jne 0x4b1653
dec edi
mov ecx, dword [0x5d7830]
mov edx, esi
push edi
call fcn.004aa210
mov dword [0x5d7830], eax
add esp, 4
mov eax, dword [0x5d7c40]
add eax, edi
mov dword [0x5d7c40], eax
cmp eax, edi
jb 0x4b1681
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov edx, str.file_exceeds_Zips_4GB_uncompressed_size_limit
mov ecx, 6
call fcn.004ac700
int3
Function at 0x4b1c40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x5b5e5c], 1
push ebx
push esi
push edi
mov esi, ecx
jne 0x4b1d20
mov dword [0x5b5e5c], 2
test esi, esi
je 0x4b1c7e
mov al, byte [esi]
cmp al, 0x80
jae 0x4b1c7e
cmp byte [esi + 1], 0x3a
jne 0x4b1c7e
movzx eax, al
movzx ebx, byte [eax + 0x622740]
jmp 0x4b1c80
xor ebx, ebx
mov ecx, 0x210000
mov dword [0x5d7c48], 0x28
mov dword [0x5d7c4c], 0x210000
call fcn.004b0120
push 0
push 0
mov dword [0x5d7c50], eax
xor ecx, ecx
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x5c3a78
push eax
lea eax, [ebp - 0xc]
mov dword [0x5d7c54], edx
push eax
push 0
push 0xd
test ebx, ebx
mov byte [ebp - 4], bl
lea eax, [ebp - 4]
push 0x5d781c
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4b1cf8
push 0
mov ecx, 0x5d781c
mov dword [0x5b5e34], 0x5d781c
call fcn.004afb40
add esp, 4
jmp 0x4b1d02
mov dword [0x5b5e34], 0
test esi, esi
je 0x4b1d17
cmp byte [esi], 0x80
jae 0x4b1d20
cmp byte [esi + 1], 0x3a
jne 0x4b1d20
cmp byte [esi + 2], 0
jne 0x4b1d20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x59bd38
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4b1d47
test dl, dl
je 0x4b1d43
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4b1d47
add eax, 2
add ecx, 2
test dl, dl
jne 0x4b1d27
xor eax, eax
jmp 0x4b1d4c
sbb eax, eax
or eax, 1
mov ecx, esi
test eax, eax
jne 0x4b1d62
push eax
call fcn.004afb40
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b1d65
sub ecx, edx
lea eax, [ecx + 2]
push eax
call fcn.00517363
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4b1d8a
lea eax, [ebx + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4b1d90
mov al, byte [ebx]
mov esi, ebx
test al, al
je 0x4b1dc3
cmp al, 0x5c
jne 0x4b1dac
mov byte [esi], 0x2f
call fcn.005292a9
push eax
push esi
call fcn.00529122
add esi, eax
add esp, 8
mov al, byte [esi]
test al, al
jne 0x4b1da5
mov edx, 0x3a
mov ecx, ebx
call fcn.004b07d0
mov edi, eax
test edi, edi
je 0x4b1e1a
mov cl, byte [edi + 1]
inc edi
mov esi, edi
test cl, cl
je 0x4b1dfd
nop
cmp cl, 0x3a
je 0x4b1e10
call fcn.005292a9
push eax
push esi
call fcn.00529122
mov cl, byte [esi + eax]
add esi, eax
add esp, 8
test cl, cl
jne 0x4b1de0
cmp edi, ebx
jbe 0x4b1e1c
cmp byte [edi], 0
jne 0x4b1e1c
mov eax, 0x2e
mov word [edi], ax
jmp 0x4b1e1c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, ebx
mov edx, edi
mov ecx, ebx
call fcn.004b1910
push ebx
mov esi, eax
call fcn.00515679
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b5800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x5d7c64]
xor edx, edx
push esi
mov esi, dword [0x5f25a4]
xor ecx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov dword [0x622600], 2
push edi
test ebx, ebx
je 0x4b59d7
mov edi, dword [0x5d7c60]
cmp ebx, 3
jb 0x4b587b
movzx eax, byte [esi + 0x6025e2]
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
mov dword [0x5d7c60], edi
movzx ecx, word [edi*2 + 0x5f25c0]
mov edx, ecx
mov word [eax*2 + 0x612600], cx
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov word [edi*2 + 0x5f25c0], si
test edx, edx
je 0x4b58aa
mov eax, esi
sub eax, edx
cmp eax, 0x7efa
ja 0x4b58aa
mov eax, dword [0x5f25ac]
mov ecx, edx
cmp eax, ebx
cmova eax, ebx
mov dword [0x5f25ac], eax
call fcn.004b5540
mov ecx, eax
cmp ecx, ebx
cmova ecx, ebx
mov dword [ebp - 4], ecx
cmp ecx, 3
jb 0x4b594f
lea edx, [ecx - 3]
mov ecx, esi
sub ecx, dword [0x6025c0]
call fcn.004b6e60
mov edx, dword [ebp - 4]
mov ecx, eax
sub ebx, edx
mov dword [ebp - 0xc], ecx
mov dword [0x5d7c64], ebx
cmp edx, dword [0x5d7c58]
ja 0x4b5929
cmp ebx, 3
jb 0x4b5929
dec edx
movzx eax, byte [esi + 0x6025e3]
inc esi
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
movzx ecx, word [edi*2 + 0x5f25c0]
mov dword [ebp - 8], ecx
mov word [eax*2 + 0x612600], cx
mov word [edi*2 + 0x5f25c0], si
sub edx, 1
jne 0x4b58e1
mov ecx, dword [ebp - 0xc]
mov dword [0x5d7c60], edi
mov dword [ebp - 4], edx
jmp 0x4b5966
add esi, edx
mov dword [ebp - 4], 0
mov edx, esi
movzx edi, byte [edx + 0x6025e0]
movzx eax, byte [edx + 0x6025e1]
shl edi, 5
xor edi, eax
mov dword [0x5d7c60], edi
jmp 0x4b5969
movzx edx, byte [esi + 0x6025e0]
xor ecx, ecx
call fcn.004b6e60
dec ebx
mov ecx, eax
mov dword [0x5d7c64], ebx
inc esi
mov edx, esi
mov dword [0x5f25a4], esi
test ecx, ecx
je 0x4b59aa
mov eax, dword [0x6125e0]
test eax, eax
js 0x4b5984
lea ecx, [eax + 0x6025e0]
jmp 0x4b5986
xor ecx, ecx
push 0
sub edx, eax
call fcn.004b6af0
mov esi, dword [0x5f25a4]
add esp, 4
mov ebx, dword [0x5d7c64]
mov edi, dword [0x5d7c60]
mov dword [0x6125e0], esi
cmp ebx, 0x106
jae 0x4b59c9
call fcn.004b5690
mov ebx, dword [0x5d7c64]
mov edi, dword [0x5d7c60]
mov esi, dword [0x5f25a4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
test ebx, ebx
jne 0x4b5837
mov eax, dword [0x6125e0]
test eax, eax
js 0x4b59e8
lea ecx, [eax + 0x6025e0]
jmp 0x4b59ea
xor ecx, ecx
sub esi, eax
push 1
mov edx, esi
call fcn.004b6af0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b5cb0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, 0x12345678
mov esi, 0x23456789
mov dword [0x5d7c70], eax
mov edx, 0x34567890
mov dword [0x5d7c74], esi
mov dword [0x5d7c78], edx
mov cl, byte [edi]
test cl, cl
je 0x4b5d26
push ebx
mov ebx, dword [0x622cd4]
movsx ecx, cl
lea edi, [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ebx + ecx*4]
movzx ecx, al
add ecx, esi
imul esi, ecx, 0x8088405
inc esi
mov ecx, esi
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [ebx + ecx*4]
mov cl, byte [edi]
test cl, cl
jne 0x4b5ce1
mov dword [0x5d7c70], eax
mov dword [0x5d7c78], edx
mov dword [0x5d7c74], esi
pop ebx
pop edi
pop esi
ret
Function at 0x4b5fc0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x5b5e80], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
je 0x4b6078
mov dword [ebp - 8], eax
mov edx, ecx
mov dword [ebp - 4], edx
test eax, eax
je 0x4b6078
mov eax, dword [0x5d7c70]
push ebx
mov ebx, dword [0x5d7c74]
push esi
push edi
mov edi, dword [0x5d7c78]
nop dword [eax]
mov dl, byte [edx]
mov esi, edi
and esi, 0xfffd
movsx ecx, dl
xor ecx, eax
or esi, 2
movzx ecx, cl
mov dword [ebp - 0xc], esi
mov esi, dword [0x622cd4]
shr eax, 8
xor eax, dword [esi + ecx*4]
movzx ecx, al
add ecx, ebx
imul ebx, ecx, 0x8088405
inc ebx
mov ecx, ebx
shr ecx, 0x18
xor ecx, edi
shr edi, 8
movzx ecx, cl
xor edi, dword [esi + ecx*4]
mov ecx, dword [ebp - 0xc]
xor ecx, 1
imul ecx, dword [ebp - 0xc]
shr ecx, 8
xor cl, dl
mov edx, dword [ebp - 4]
mov byte [edx], cl
inc edx
sub dword [ebp - 8], 1
mov dword [ebp - 4], edx
jne 0x4b6000
mov ecx, dword [ebp - 0x10]
mov dword [0x5d7c78], edi
pop edi
pop esi
mov dword [0x5d7c70], eax
mov eax, dword [ebp + 8]
mov dword [0x5d7c74], ebx
pop ebx
push dword [ebp + 0xc]
push eax
push 1
push ecx
call fcn.0052c9c6
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4b7450
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5a6008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5b6008], 0
push esi
push edi
je 0x4b7480
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00511339
mov esp, ebp
pop ebp
ret
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
jne 0x4b74a2
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00511339
mov esp, ebp
pop ebp
ret
mov esi, edi
mov ecx, 0x5b6004
xchg dword [ecx], esi
test esi, esi
je 0x4b74df
mov eax, esi
xchg dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x5b6008]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00511339
mov esp, ebp
pop ebp
ret
push 0x624e40
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x124
push 0
push 0x5f2480
call fcn.00513330
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4b75d5
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeBackupPrivilege
push 0
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4b757b
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4b757b
call esi
test eax, eax
jne 0x4b757b
mov dword [0x5b5f08], 1
push dword [ebp - 0x18]
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4b75da
cmp dword [0x5b5f08], 0
jne 0x4b756b
lea eax, [ebp - 0x10]
push eax
push str.SeSecurityPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4b756b
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4b756b
call esi
mov ecx, dword [0x5b6e24]
test eax, eax
push dword [ebp - 0x18]
mov esi, 1
cmove ecx, esi
mov dword [0x5b6e24], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4b75da
mov esi, 1
push edi
mov dword [0x5b6008], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00511339
mov esp, ebp
pop ebp
ret
Function at 0x4b8070
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.winvnc.exe_crc32_z
Function at 0x4bab40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x4bad1d
cmp dword [ebx + 0x20], 0
je 0x4bad1d
cmp dword [ebx + 0x24], 0
je 0x4bad1d
mov esi, dword [ebx + 0x1c]
test esi, esi
je 0x4bad1d
cmp dword [esi], ebx
jne 0x4bad1d
mov eax, dword [esi + 4]
cmp eax, 0x2a
je 0x4babab
cmp eax, 0x39
je 0x4babab
cmp eax, 0x45
je 0x4babab
cmp eax, 0x49
je 0x4babab
cmp eax, 0x5b
je 0x4babab
cmp eax, 0x67
je 0x4babab
cmp eax, 0x71
je 0x4babab
cmp eax, 0x29a
jne 0x4bad1d
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4bad1d
mov edx, dword [esi + 0x18]
mov dword [ebp - 8], edx
cmp edx, 2
je 0x4bad1d
cmp edx, 1
jne 0x4babd3
cmp eax, 0x2a
jne 0x4bad1d
cmp dword [esi + 0x74], 0
jne 0x4bad1d
push edi
mov edi, dword [ebp + 0x10]
cmp edx, 1
jne 0x4babfc
push edi
push ecx
push dword [ebx + 0x30]
call sym.winvnc.exe_adler32_z
mov ecx, dword [ebp + 0xc]
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x18], 0
cmp edi, eax
jb 0x4bac54
test edx, edx
jne 0x4bac4e
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x4c]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00513330
mov eax, dword [esi + 0x2c]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x16b4], 0
sub edi, eax
add ecx, edi
mov edi, eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
mov dword [ebx], ecx
mov ecx, esi
mov dword [ebp - 0xc], eax
mov dword [ebx + 4], edi
call fcn.004ba640
mov ecx, dword [esi + 0x74]
cmp ecx, 3
jb 0x4bacd8
mov ebx, dword [esi + 0x6c]
add ecx, 0xfffffffe
mov dword [ebp - 4], ecx
nop dword [eax]
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x34]
and edx, ebx
movzx edi, byte [eax + ebx + 2]
mov eax, dword [esi + 0x48]
shl eax, cl
mov ecx, dword [esi + 0x40]
xor edi, eax
and edi, dword [esi + 0x54]
mov eax, dword [esi + 0x44]
mov dword [esi + 0x48], edi
mov ax, word [eax + edi*2]
mov word [ecx + edx*2], ax
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2], bx
inc ebx
sub dword [ebp - 4], 1
jne 0x4bac80
mov ecx, esi
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x74], 2
call fcn.004ba640
mov ecx, dword [esi + 0x74]
cmp ecx, 3
jae 0x4bac73
mov ebx, dword [ebp + 8]
add dword [esi + 0x6c], ecx
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x16b4], ecx
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [ebx], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 8]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bdc80
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.winvnc.exe_adler32_z

Function at 0x4c0b40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x964], 0
je 0x4c0b81
cmp edx, 0x190
jg case.0x4c0b67.10
je case.0x4c0b67.10
lea eax, [edx - 0xa]
cmp eax, 0xc0
ja case.0x4c0b67.10
movzx eax, byte [eax + 0x4c0c04]
jmp dword [eax*4 + 0x4c0bf8]
mov dword [ecx + 4], 1
lea eax, [edx - 0xa]
jmp 0x4c0b95
mov eax, 0xffffffc4
pop ebp
ret
cmp edx, 0x190
jg 0x4c0bb9
je 0x4c0ba3
lea eax, [edx - 0xa]
cmp eax, 0xc0
ja case.default.0x4c0be8
movzx eax, byte [eax + 0x4c0cd0]
jmp dword [eax*4 + 0x4c0cc8]
cmp dword [ebp + 8], 0
je case.0x4c0be8.1001
cmp dword [ecx + 0x2c8], 0
je case.0x4c0be8.1001
mov eax, 0xffffffd8
pop ebp
ret
cmp edx, 0x3e8
jg 0x4c0bd6
je case.0x4c0be8.1001
mov eax, edx
sub eax, 0x191
je case.0x4c0be8.1001
sub eax, 1
je case.0x4c0be8.1001
sub eax, 0x62
jmp 0x4c0bb0
lea eax, [edx - 0x3e9]
cmp eax, 0xf
ja case.default.0x4c0be8
movzx eax, byte [eax + 0x4c0d98]
jmp dword [eax*4 + 0x4c0d94]
add ecx, 0xc
pop ebp
jmp fcn.004c0db0

Function at 0x4c0b6e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x964], 0
je 0x4c0b81
cmp edx, 0x190
jg case.0x4c0b67.10
je case.0x4c0b67.10
lea eax, [edx - 0xa]
cmp eax, 0xc0
ja case.0x4c0b67.10
movzx eax, byte [eax + 0x4c0c04]
jmp dword [eax*4 + 0x4c0bf8]
mov dword [ecx + 4], 1
lea eax, [edx - 0xa]
jmp 0x4c0b95
mov eax, 0xffffffc4
pop ebp
ret
cmp edx, 0x190
jg 0x4c0bb9
je 0x4c0ba3
lea eax, [edx - 0xa]
cmp eax, 0xc0
ja case.default.0x4c0be8
movzx eax, byte [eax + 0x4c0cd0]
jmp dword [eax*4 + 0x4c0cc8]
cmp dword [ebp + 8], 0
je case.0x4c0be8.1001
cmp dword [ecx + 0x2c8], 0
je case.0x4c0be8.1001
mov eax, 0xffffffd8
pop ebp
ret
cmp edx, 0x3e8
jg 0x4c0bd6
je case.0x4c0be8.1001
mov eax, edx
sub eax, 0x191
je case.0x4c0be8.1001
sub eax, 1
je case.0x4c0be8.1001
sub eax, 0x62
jmp 0x4c0bb0
lea eax, [edx - 0x3e9]
cmp eax, 0xf
ja case.default.0x4c0be8
movzx eax, byte [eax + 0x4c0d98]
jmp dword [eax*4 + 0x4c0d94]
add ecx, 0xc
pop ebp
jmp fcn.004c0db0
Function at 0x4f9bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, edx
mov dword [ebp - 4], eax
and edi, 0x1f
mov dword [ebp - 8], edi
cmp edi, 8
jb 0x4f9c73
mov ecx, edi
shr ecx, 3
mov dword [ebp - 8], ecx
nop dword [eax]
push 0xc2b2ae3d
push 0x27d4eb4f
push dword [eax + 4]
push dword [eax]
call fcn.0053d600
add dword [ebp - 4], 8
mov ecx, eax
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.0053d600
mov ecx, eax
xor edx, esi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.0053d600
mov ebx, eax
mov esi, edx
mov eax, dword [ebp - 4]
add ebx, 0xc2b2ae63
adc esi, 0x85ebca77
sub edi, 8
sub dword [ebp - 8], 1
jne 0x4f9c00
mov dword [ebp - 8], edi
mov ecx, eax
cmp edi, 4
jb 0x4f9ccc
mov ecx, dword [ecx]
add eax, 4
mov dword [ebp - 4], eax
mov eax, 0x9e3779b1
mul ecx
push 0xc2b2ae3d
mov edi, eax
mov eax, 0x85ebca87
mul ecx
push 0x27d4eb4f
add edi, edx
xor eax, ebx
xor edi, esi
mov ecx, eax
shld ecx, edi, 0x17
shld edi, eax, 0x17
push edi
push ecx
call fcn.0053d600
mov edi, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 4]
add ebx, 0x9e3779f9
mov esi, edx
adc esi, 0x165667b1
sub edi, 4
test edi, edi
je 0x4f9d13
movzx eax, byte [eax]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.0053d600
inc dword [ebp - 4]
xor ebx, eax
xor esi, edx
mov eax, ebx
push 0x9e3779b1
shld eax, esi, 0xb
push 0x85ebca87
shld esi, ebx, 0xb
push esi
push eax
call fcn.0053d600
mov ebx, eax
mov eax, dword [ebp - 4]
mov esi, edx
sub edi, 1
jne 0x4f9cd0
push 0xc2b2ae3d
xor ecx, ecx
mov edx, esi
push 0x27d4eb4f
shr edx, 1
xor ecx, esi
xor edx, ebx
push ecx
push edx
call fcn.0053d600
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.0053d600
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x505eb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x28], 0x504fd0
push eax
mov dword [ebp - 0x20], 0
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
lea eax, [ebp - 0x28]
push eax
push 0x505e60
push 0
push 0
call fcn.0052d576
add esp, 0x18
mov dword [esi], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0x20], 0
jne 0x505f2a
mov esi, dword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
cmp dword [ebp - 0x20], 0
je 0x505f18
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x505fa0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
push edi
push dword [0x5f1c18]
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi + 4], eax
test eax, eax
jne 0x506045
push 0x5b6eb8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x5b6e30]
test eax, eax
je 0x505ff4
mov dword [esi], eax
mov eax, dword [eax + 0x60]
mov edi, dword [esi]
push 0x5b6eb8
mov dword [0x5b6e30], eax
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
ret
push 0x64
call fcn.0051134c
mov edi, eax
add esp, 4
lea ecx, [edi + 4]
mov dword [edi], vtable.omni_thread.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 0xc
mov ecx, edi
call fcn.00506500
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi], vtable._internal_omni_thread_dummy.0
mov dword [edi + 0x60], 0
push 0x5b6eb8
mov dword [esi], edi
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
ret
Function at 0x506260
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [0x5f1c48]
push ebx
mov ebx, ecx
lea eax, [edx + 1]
mov dword [0x5f1c48], eax
test edx, edx
jne 0x506316
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x5f1c18], eax
cmp eax, 0xffffffff
je 0x50631d
push esi
push edi
push 0x18
call fcn.0051134c
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x60
mov dword [0x5b6e2c], esi
call fcn.0051134c
push ecx
mov ecx, eax
call fcn.005064c0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
push 2
push 0
push 0
lea eax, [edi + 0x44]
mov dword [edi + 0x1c], 1
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x506339
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
push dword [0x5f1c18]
mov dword [edi + 0x48], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x506355
push 0
push dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
test eax, eax
je 0x506371
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.00505f50
push 0x5a2918
mov eax, ecx
push eax
call fcn.00513a04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.00505f50
push 0x5a2918
mov eax, ecx
push eax
call fcn.00513a04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.00505f50
push 0x5a2918
mov eax, ecx
push eax
call fcn.00513a04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 4]
call fcn.00505f50
push 0x5a2918
mov eax, ecx
push eax
call fcn.00513a04
int3