joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 0x22c], edx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x230], ebx
test edx, edx
je 0x4b2568
test ebx, ebx
je 0x4b2568
push edi
mov edi, dword [ebp + 0xc]
add dword [ebx + 0x20], edi
cmp dword [ebx + 0x20], edi
jae 0x4b23b5
inc dword [ebx + 0x24]
test edi, edi
je 0x4b2554
push esi
nop
mov ecx, dword [ebx + 0x70]
mov eax, 0x40
sub eax, ecx
mov esi, edi
cmp edi, eax
cmovae esi, eax
lea eax, [ecx + 0x30]
push esi
push edx
add eax, ebx
push eax
call fcn.004d6950
mov edx, dword [ebp - 0x22c]
sub edi, esi
add dword [ebx + 0x70], esi
add edx, esi
add esp, 0xc
mov dword [ebp - 0x22c], edx
cmp dword [ebx + 0x70], 0x40
mov dword [ebp + 0xc], edi
jne 0x4b254b
xor ecx, ecx
lea edx, [ebx + 0x30]
mov eax, dword [edx]
lea edx, [edx + 4]
bswap eax
mov dword [ebp + ecx*4 - 0x104], eax
inc ecx
cmp ecx, 0x10
jb 0x4b2406
lea eax, [ebp - 0xcc]
mov ebx, 0x30
mov edx, dword [eax - 0x34]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov edi, edx
mov ecx, edx
ror edi, 0x12
ror ecx, 7
xor edi, ecx
shr edx, 3
xor edi, edx
mov ecx, esi
mov edx, esi
ror ecx, 0x11
ror edx, 0x13
xor edx, ecx
shr esi, 0xa
xor edx, esi
add edi, edx
add edi, dword [eax - 0x3c]
add edi, dword [eax - 0x18]
mov dword [eax + 4], edi
sub ebx, 1
jne 0x4b2425
mov ebx, dword [ebp - 0x230]
lea edi, [ebp - 0x124]
movups xmm0, xmmword [ebx]
movups xmmword [ebp - 0x124], xmm0
movups xmm0, xmmword [ebx + 0x10]
xor ebx, ebx
movups xmmword [ebp - 0x114], xmm0
mov ecx, dword [edi + 0x10]
mov edx, edi
sub edi, 4
mov esi, ecx
mov eax, ecx
ror esi, 0x19
ror eax, 0xb
xor esi, eax
mov eax, ecx
ror eax, 6
not ecx
and ecx, dword [edi + 0x1c]
xor esi, eax
mov eax, dword [edi + 0x18]
and eax, dword [edi + 0x14]
xor ecx, eax
add esi, ecx
mov ecx, dword [edx]
add esi, dword [ebx + 0x50abe0]
mov edx, ecx
add esi, dword [ebp + ebx - 0x104]
mov eax, ecx
add esi, dword [edi + 0x20]
add ebx, 4
add dword [edi + 0x10], esi
ror eax, 0xd
ror edx, 0x16
xor edx, eax
mov dword [ebp - 0x228], ecx
mov eax, ecx
ror eax, 2
xor edx, eax
mov eax, dword [edi + 8]
mov ecx, eax
add edx, esi
xor ecx, dword [ebp - 0x228]
and ecx, dword [edi + 0xc]
and eax, dword [ebp - 0x228]
xor eax, ecx
mov ecx, dword [edi + 0x10]
add eax, edx
mov dword [edi], eax
cmp ebx, 0x100
jb 0x4b2483
mov ebx, dword [ebp - 0x230]
mov edx, dword [ebp - 0x22c]
add dword [ebx], eax
mov eax, dword [ebp - 0x228]
add dword [ebx + 4], eax
mov eax, dword [edi + 8]
add dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
add dword [ebx + 0xc], eax
mov eax, dword [edi + 0x14]
add dword [ebx + 0x14], eax
mov eax, dword [edi + 0x18]
add dword [ebx + 0x18], eax
add dword [ebx + 0x10], ecx
mov eax, dword [edi + 0x1c]
add dword [ebx + 0x1c], eax
mov edi, dword [ebp + 0xc]
mov dword [ebx + 0x70], 0
test edi, edi
jne 0x4b23c0
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.004d3878
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b29c0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
test eax, eax
je 0x4b2a35
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4b2a35
push esi
push dword [ebp + 0xc]
mov dword [esi + 0x24], 0
push eax
mov dword [esi + 0x20], 0
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x70], 0
call fcn.004b2370
push esi
call fcn.004b2880
xor eax, eax
pop esi
pop ebp
ret 0xc
mov eax, 1
pop esi
pop ebp
ret 0xc
Function at 0x4b4290
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov dword [ecx], eax
mov esi, 1
mov dword [ecx + 0x9c0], 1
nop dword [eax + eax]
mov edx, dword [ecx + esi*4 - 4]
shr edx, 0x1e
xor edx, dword [ecx + esi*4 - 4]
imul eax, edx, 0x6c078965
add eax, esi
mov dword [ecx + esi*4], eax
mov esi, dword [ecx + 0x9c0]
inc esi
mov dword [ecx + 0x9c0], esi
cmp esi, 0x270
jl 0x4b42b0
pop esi
xor eax, eax
pop ebp
ret 4
Function at 0x4bd420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [edx]
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [edx + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [edx + 4]
mov edx, dword [edx + 0xc]
mov ecx, edx
mov dword [esi], eax
mov eax, ebx
shr eax, 0x10
shl ecx, 0x10
or ecx, eax
mov dword [esi + 8], edi
mov eax, dword [ebp - 4]
shl eax, 0x10
mov dword [esi + 4], ecx
mov ecx, edx
shr ecx, 0x10
or ecx, eax
mov dword [esi + 0x10], ebx
mov eax, dword [ebp - 4]
shr eax, 0x10
mov dword [esi + 0xc], ecx
mov ecx, edi
shl ecx, 0x10
or ecx, eax
mov dword [esi + 0x18], edx
mov dword [esi + 0x14], ecx
mov eax, edi
shr eax, 0x10
mov ecx, ebx
shl ecx, 0x10
or ecx, eax
mov dword [esi + 0x40], 0
mov eax, ebx
mov dword [esi + 0x1c], ecx
mov ecx, dword [ebp - 4]
rol eax, 0x10
mov dword [esi + 0x20], eax
mov eax, edx
rol eax, 0x10
mov dword [esi + 0x28], eax
mov eax, ecx
rol eax, 0x10
mov dword [esi + 0x30], eax
mov eax, edi
rol eax, 0x10
mov dword [esi + 0x38], eax
mov eax, edi
xor eax, ecx
movzx eax, ax
xor eax, ecx
mov dword [esi + 0x24], eax
mov eax, ebx
xor eax, edi
movzx eax, ax
xor eax, edi
mov edi, 4
mov dword [esi + 0x2c], eax
mov eax, edx
xor eax, ebx
movzx eax, ax
xor eax, ebx
mov dword [esi + 0x34], eax
mov eax, edx
xor eax, ecx
movzx eax, ax
xor eax, edx
mov dword [esi + 0x3c], eax
mov ecx, esi
call fcn.004bd130
sub edi, 1
jne 0x4bd4e1
mov eax, dword [esi + 0x10]
xor dword [esi + 0x20], eax
mov eax, dword [esi + 0x14]
xor dword [esi + 0x24], eax
mov eax, dword [esi + 0x18]
xor dword [esi + 0x28], eax
mov eax, dword [esi + 0x1c]
xor dword [esi + 0x2c], eax
mov edi, dword [esi]
xor dword [esi + 0x30], edi
mov edx, dword [esi + 4]
xor dword [esi + 0x34], edx
mov ecx, dword [esi + 8]
xor dword [esi + 0x38], ecx
mov eax, dword [esi + 0xc]
xor dword [esi + 0x3c], eax
mov ebx, dword [esi + 0x3c]
mov dword [esi + 0x44], edi
mov edi, dword [esi + 0x20]
mov dword [esi + 0x64], edi
mov dword [esi + 0x48], edx
mov edx, dword [esi + 0x24]
mov dword [esi + 0x68], edx
mov dword [esi + 0x4c], ecx
mov ecx, dword [esi + 0x28]
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x70], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x34]
mov dword [esi + 0x78], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x38]
mov dword [esi + 0x7c], eax
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x80], ebx
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x40]
pop edi
mov dword [esi + 0x84], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bd830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], edi
test edi, edi
je 0x4bd9d8
test esi, esi
je 0x4bd9d8
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], eax
call fcn.004bd420
lea ecx, [edi + 0x44]
cmp ebx, 0x10
jb 0x4bd8e1
mov eax, ebx
shr eax, 4
mov dword [ebp - 8], eax
call fcn.004bd130
mov eax, dword [edi + 0x50]
sub ebx, 0x10
movzx ecx, word [edi + 0x5a]
shl eax, 0x10
xor ecx, eax
xor ecx, dword [edi + 0x44]
xor dword [esi], ecx
mov eax, dword [edi + 0x58]
movzx ecx, word [edi + 0x62]
shl eax, 0x10
xor ecx, eax
xor ecx, dword [edi + 0x4c]
xor dword [esi + 4], ecx
mov eax, dword [edi + 0x60]
movzx ecx, word [edi + 0x4a]
shl eax, 0x10
xor ecx, eax
xor ecx, dword [edi + 0x54]
xor dword [esi + 8], ecx
mov eax, dword [edi + 0x48]
movzx ecx, word [edi + 0x52]
shl eax, 0x10
xor ecx, eax
xor ecx, dword [edi + 0x5c]
xor dword [esi + 0xc], ecx
add esi, 0x10
sub dword [ebp - 8], 1
lea ecx, [edi + 0x44]
jne 0x4bd880
mov dword [ebp + 8], ebx
lea ecx, [edi + 0x44]
test ebx, ebx
je 0x4bd9cf
call fcn.004bd130
mov edx, dword [ebp - 4]
mov edi, dword [edi + 0x58]
mov eax, edi
shr eax, 0x10
shl edi, 0x10
mov ebx, dword [edx + 0x50]
mov ecx, ebx
shl ecx, 0x10
xor ecx, eax
shr ebx, 0x10
xor ecx, dword [edx + 0x44]
mov dword [ebp - 0x18], ecx
mov ecx, edx
mov edx, dword [ecx + 0x60]
mov eax, edx
shr eax, 0x10
xor edi, eax
shl edx, 0x10
xor edi, dword [ecx + 0x4c]
mov ecx, dword [ecx + 0x48]
mov eax, ecx
shr eax, 0x10
xor eax, edx
shl ecx, 0x10
mov edx, dword [ebp - 4]
xor ebx, ecx
xor ecx, ecx
mov dword [ebp - 0x14], edi
xor eax, dword [edx + 0x54]
xor ebx, dword [edx + 0x5c]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x4bd9cf
cmp edx, 0x40
jb 0x4bd9c0
lea edi, [edx - 1]
lea eax, [ebp + edx - 0x19]
add edi, esi
cmp esi, eax
ja 0x4bd968
lea eax, [ebp - 0x18]
cmp edi, eax
jae 0x4bd9c0
mov eax, edx
lea ebx, [ebp - 0x18]
and eax, 0xffffffc0
movups xmm0, xmmword [esi]
movups xmm1, xmmword [ebx + ecx]
xorps xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [esi + 0x10]
movups xmm1, xmmword [ebp + ecx - 8]
xorps xmm1, xmm0
movups xmmword [esi + 0x10], xmm1
movups xmm0, xmmword [esi + 0x20]
movups xmm1, xmmword [ebp + ecx + 8]
xorps xmm1, xmm0
movups xmmword [esi + 0x20], xmm1
movups xmm0, xmmword [esi + 0x30]
movups xmm1, xmmword [ebp + ecx + 0x18]
add ecx, 0x40
mov edi, ecx
xorps xmm1, xmm0
movups xmmword [esi + 0x30], xmm1
add esi, 0x40
cmp ecx, eax
jb 0x4bd970
cmp edi, edx
jae 0x4bd9cf
nop dword [eax]
mov al, byte [ebp + ecx - 0x18]
lea esi, [esi + 1]
xor byte [esi - 1], al
inc ecx
cmp ecx, edx
jb 0x4bd9c0
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4bd9f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 8], edi
test edi, edi
je 0x4bdb98
test esi, esi
je 0x4bdb98
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x28]
push ebx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
call fcn.004bd420
mov ebx, dword [ebp + 8]
lea ecx, [edi + 0x44]
cmp ebx, 0x10
jb 0x4bdaa1
mov eax, ebx
shr eax, 4
mov dword [ebp - 4], eax
call fcn.004bd130
mov eax, dword [edi + 0x50]
sub ebx, 0x10
movzx ecx, word [edi + 0x5a]
shl eax, 0x10
xor ecx, eax
xor ecx, dword [esi]
xor ecx, dword [edi + 0x44]
mov dword [esi], ecx
mov eax, dword [edi + 0x58]
movzx ecx, word [edi + 0x62]
shl eax, 0x10
xor ecx, eax
xor ecx, dword [esi + 4]
xor ecx, dword [edi + 0x4c]
mov dword [esi + 4], ecx
mov eax, dword [edi + 0x60]
movzx ecx, word [edi + 0x4a]
shl eax, 0x10
xor ecx, eax
xor ecx, dword [esi + 8]
xor ecx, dword [edi + 0x54]
mov dword [esi + 8], ecx
mov eax, dword [edi + 0x48]
movzx ecx, word [edi + 0x52]
shl eax, 0x10
xor ecx, eax
xor ecx, dword [esi + 0xc]
xor ecx, dword [edi + 0x5c]
mov dword [esi + 0xc], ecx
add esi, 0x10
sub dword [ebp - 4], 1
lea ecx, [edi + 0x44]
jne 0x4bda35
mov dword [ebp + 8], ebx
lea ecx, [edi + 0x44]
test ebx, ebx
je 0x4bdb8f
call fcn.004bd130
mov edx, dword [edi + 0x58]
mov ecx, edx
mov ebx, dword [edi + 0x50]
mov eax, ebx
shl eax, 0x10
shr ecx, 0x10
xor ecx, eax
shl edx, 0x10
xor ecx, dword [edi + 0x44]
mov edi, dword [edi + 0x60]
mov eax, edi
shr eax, 0x10
xor eax, edx
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
shl edi, 0x10
shr ebx, 0x10
xor eax, dword [edx + 0x4c]
mov ecx, dword [edx + 0x48]
mov dword [ebp - 0x14], eax
mov eax, ecx
shl ecx, 0x10
shr eax, 0x10
xor ebx, ecx
xor ebx, dword [edx + 0x5c]
xor edi, eax
xor edi, dword [edx + 0x54]
xor ecx, ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
test edx, edx
je 0x4bdb8f
cmp edx, 0x40
jb 0x4bdb80
lea edi, [edx - 1]
lea eax, [ebp + edx - 0x19]
add edi, esi
cmp esi, eax
ja 0x4bdb23
lea eax, [ebp - 0x18]
cmp edi, eax
jae 0x4bdb80
mov eax, edx
lea ebx, [ebp - 0x18]
and eax, 0xffffffc0
nop dword [eax + eax]
movups xmm0, xmmword [esi]
movups xmm1, xmmword [ebx + ecx]
xorps xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [esi + 0x10]
movups xmm1, xmmword [ebp + ecx - 8]
xorps xmm1, xmm0
movups xmmword [esi + 0x10], xmm1
movups xmm0, xmmword [esi + 0x20]
movups xmm1, xmmword [ebp + ecx + 8]
xorps xmm1, xmm0
movups xmmword [esi + 0x20], xmm1
movups xmm0, xmmword [esi + 0x30]
movups xmm1, xmmword [ebp + ecx + 0x18]
add ecx, 0x40
mov edi, ecx
xorps xmm1, xmm0
movups xmmword [esi + 0x30], xmm1
add esi, 0x40
cmp ecx, eax
jb 0x4bdb30
cmp edi, edx
jae 0x4bdb8f
nop dword [eax]
mov al, byte [ebp + ecx - 0x18]
lea esi, [esi + 1]
xor byte [esi - 1], al
inc ecx
cmp ecx, edx
jb 0x4bdb80
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4cc630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [edx + 4]
push edi
cmp esi, dword [ebx + 4]
mov edi, ecx
mov ecx, edx
mov dword [ebp - 0xc], edi
cmovge ecx, ebx
cmovge ebx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebx + 4]
mov dword [ebp + 8], eax
cmp eax, dword [edi + 8]
jle 0x4cc686
mov edx, eax
mov ecx, edi
call fcn.004bff30
mov esi, eax
test esi, esi
je 0x4cc683
mov ecx, dword [edi]
test ecx, ecx
je 0x4cc67b
push ecx
call fcn.004d9a63
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi], esi
mov dword [edi + 8], eax
mov ecx, dword [ebp - 4]
xor esi, esi
cmp dword [ecx + 4], esi
jle 0x4cc6bd
xor edx, edx
mov dword [ebp + 8], esi
mov dword [ebp - 8], edx
mov eax, dword [ebx]
mov ecx, dword [ecx]
mov edx, dword [eax + edx]
mov eax, dword [ebp + 8]
add dword [ebp + 8], 4
xor edx, dword [eax + ecx]
mov eax, dword [edi]
mov ecx, dword [ebp - 4]
mov dword [eax + esi*4], edx
inc esi
mov edx, dword [ebp - 8]
add edx, 4
mov dword [ebp - 8], edx
cmp esi, dword [ecx + 4]
jl 0x4cc695
mov eax, dword [ebx + 4]
cmp esi, eax
jge 0x4cc6f0
lea edx, [esi*4]
mov dword [ebp + 8], edx
nop
mov ecx, dword [edi]
lea edx, [edx + 4]
mov eax, dword [ebx]
inc esi
mov edi, dword [ebp + 8]
add dword [ebp + 8], 4
mov eax, dword [edx + eax - 4]
mov dword [edi + ecx], eax
mov eax, dword [ebx + 4]
mov edi, dword [ebp - 0xc]
cmp esi, eax
jl 0x4cc6d0
mov dword [edi + 4], eax
test eax, eax
jle 0x4cc711
mov ecx, dword [edi]
lea edx, [eax - 1]
lea edx, [ecx + edx*4]
nop
mov ecx, dword [edx]
lea edx, [edx - 4]
test ecx, ecx
jne 0x4cc711
dec eax
mov dword [edi + 4], eax
test eax, eax
jg 0x4cc700
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cf7e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi + 0x2c]
nop
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x3c]
add eax, 0xfffffefa
sub edi, dword [esi + 0x74]
add eax, ebx
sub edi, dword [esi + 0x6c]
mov dword [ebp - 8], edi
cmp dword [esi + 0x6c], eax
jb 0x4cf877
mov ecx, dword [esi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.004d6950
mov edi, dword [esi + 0x4c]
add esp, 0xc
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
sub dword [esi + 0x5c], ebx
lea esi, [eax + edi*2]
nop
movzx edx, word [esi - 2]
lea esi, [esi - 2]
mov ecx, edx
xor eax, eax
sub ecx, ebx
cmp edx, ebx
cmovae eax, ecx
mov word [esi], ax
sub edi, 1
jne 0x4cf830
mov esi, dword [ebp + 8]
mov edi, ebx
mov eax, dword [esi + 0x40]
lea esi, [eax + ebx*2]
movzx edx, word [esi - 2]
lea esi, [esi - 2]
mov ecx, edx
xor eax, eax
sub ecx, ebx
cmp edx, ebx
cmovae eax, ecx
mov word [esi], ax
sub edi, 1
jne 0x4cf855
mov edi, dword [ebp - 8]
mov esi, dword [ebp + 8]
add edi, ebx
mov ecx, dword [esi]
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 4]
test eax, eax
je 0x4cf925
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
add edx, dword [esi + 0x38]
cmp eax, edi
mov dword [ebp - 8], edx
cmovbe edi, eax
test edi, edi
je 0x4cf8e9
sub eax, edi
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4cf8b9
push edi
push dword [ecx]
push dword [ecx + 0x30]
call fcn.004ce9d0
jmp 0x4cf8c9
cmp eax, 2
jne 0x4cf8d5
push edi
push dword [ecx]
push dword [ecx + 0x30]
call fcn.004d2bc0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ecx + 0x30], eax
push edi
push dword [ecx]
push edx
call fcn.004d6950
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [eax], edi
add dword [eax + 8], edi
add edi, dword [esi + 0x74]
mov dword [esi + 0x74], edi
cmp edi, 3
jb 0x4cf911
mov eax, dword [esi + 0x38]
add eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
movzx edx, byte [eax]
mov dword [esi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [esi + 0x54]
mov dword [esi + 0x48], edx
cmp edi, 0x106
jae 0x4cf925
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4cf7f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d2bc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4d2bcc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004d2be0

Function at 0x4d463f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4d467e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4d467e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4d467e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4d467e
cmp dword [ecx + 0x74], 0xe
jbe 0x4d467e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4e79ce
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4ffc2c
push 0x4ffc24
push str.FlsAlloc
push 0x1f
call fcn.004e7875
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4e7a02
push dword [ebp + 8]
mov ecx, esi
call dword [0x4f8550]
call esi
jmp 0x4e7a08
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4e7a4c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4ffc3c
push 0x4ffc34
push str.FlsGetValue
push 0x21
call fcn.004e7875
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4e7a83
push dword [ebp + 8]
mov ecx, esi
call dword [0x4f8550]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4e7a8b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4ffc44
push 0x4ffc3c
push str.FlsSetValue
push 0x22
call fcn.004e7875
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4e7ac5
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4f8550]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4e97da
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4e9825
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004e9975
test al, al
jne 0x4e981f
sub edx, 2
cmp edx, edi
jne 0x4e9805
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4e9847
lea eax, [edi + 2]
cmp edx, eax
je 0x4e9847
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004e9726
add esp, 0x10
jmp 0x4e9941
push esi
lea ecx, [ebp - 0x255]
call fcn.004e9975
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4e988a
push dword [ebp - 0x25c]
jmp 0x4e9837
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4e98c7
cmp word [ebp - 0x226], 0
je 0x4e98e8
cmp word [ebp - 0x226], ax
jne 0x4e98c7
cmp word [ebp - 0x224], 0
je 0x4e98e8
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004e9726
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4e9934
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4e98a1
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4e991c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4e9941
push 0x4e9556
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004e2bb0
add esp, 0x10
jmp 0x4e9911
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3878
leave
ret

Function at 0x4ece25
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004e72e5
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4ece94
cmp esi, dword [ebp - 4]
je 0x4ece8f
cmp dword [ebp + 0xc], 0
je 0x4ece8f
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4ece6c
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.004ec977
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x4ece96
xor eax, eax
inc eax
jmp 0x4ece96
xor eax, eax
pop edi
pop esi
leave
ret