joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4790
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0xc], edx
push 0x4000
mov dword [ebp - 8], esi
call fcn.0052c198
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x4c47c1
lea eax, [edx + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 8]
xor edi, edi
cmp ebx, 0xffffffff
je 0x4c47e3
cmp edi, ebx
jae 0x4c4872
mov eax, ebx
mov ecx, 0x4000
sub eax, edi
cmp eax, ecx
cmovb ecx, eax
jmp 0x4c47e8
mov ecx, 0x4000
push esi
push ecx
push 1
push edx
call fcn.00543781
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4c4849
push dword [ebp - 0xc]
push esi
push 1
push dword [ebp - 4]
call fcn.0054356e
add esp, 0x10
cmp eax, esi
jne 0x4c481a
mov edx, dword [ebp - 4]
add edi, esi
mov esi, dword [ebp - 8]
jmp 0x4c47c6
push dword [ebp - 4]
call fcn.0052a52b
add esp, 4
push str._fcopy:_write_error_n
push 2
call fcn.005359d0
add esp, 4
push eax
call fcn.0045d410
add esp, 8
mov eax, 0xa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
call fcn.00542a65
add esp, 4
test eax, eax
je 0x4c486f
push dword [ebp - 4]
call fcn.0052a52b
add esp, 4
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call fcn.0052a52b
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c5050
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5c3040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
movzx eax, byte [esi]
push eax
call fcn.00535160
add esp, 4
test eax, eax
je 0x4c507c
cmp byte [esi + 1], 0x3a
je 0x4c509c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea esi, [ebp - 0x20c]
push 3
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], esi
push esi
push eax
call fcn.00535bf0
add esp, 0xc
mov byte [ebp - 0x20d], 0
lea eax, [ebp - 0x108]
push 0x104
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 3
lea eax, [ebp - 0x108]
push 0x5b6a08
push eax
call fcn.00535875
add esp, 4
push eax
call fcn.00534300
add esp, 0xc
pop esi
test eax, eax
je 0x4c515d
push 4
lea eax, [ebp - 0x108]
push str.VFAT
push eax
call fcn.00534300
add esp, 0xc
test eax, eax
je 0x4c515d
push 4
lea eax, [ebp - 0x108]
push str.HPFS
push eax
call fcn.00534300
add esp, 0xc
test eax, eax
je 0x4c515d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret
Function at 0x4c5370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
push esi
call fcn.005369ef
add esp, 8
test eax, eax
jne 0x4c5496
mov ecx, esi
call fcn.004c5050
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4c548d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4c548d
cmp dword [ebp - 4], 0
lea edx, [edi + 0x20]
lea ecx, [ebp - 0x1c]
jne 0x4c5437
call fcn.004c5170
cmp dword [ebp - 0xc], 0
jne 0x4c540c
cmp dword [ebp - 8], 0
jne 0x4c540c
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
jmp 0x4c5417
lea edx, [edi + 0x18]
lea ecx, [ebp - 0xc]
call fcn.004c5170
cmp dword [ebp - 0x14], 0
jne 0x4c5423
cmp dword [ebp - 0x10], 0
je 0x4c546d
lea edx, [edi + 0x28]
lea ecx, [ebp - 0x14]
call fcn.004c5170
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004c5250
cmp dword [ebp - 0xc], 0
jne 0x4c5456
cmp dword [ebp - 8], 0
jne 0x4c5456
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
jmp 0x4c5461
lea edx, [edi + 0x18]
lea ecx, [ebp - 0xc]
call fcn.004c5250
cmp dword [ebp - 0x14], 0
jne 0x4c5482
cmp dword [ebp - 0x10], 0
jne 0x4c5482
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [edi + 0x2c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [edi + 0x28]
lea ecx, [ebp - 0x14]
call fcn.004c5250
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4c54f0
test bl, 0x10
je 0x4c54f0
push 0x30
push 0
push edi
call fcn.00526a30
add esp, 0xc
mov ecx, 0x210000
call fcn.004c4700
shl ebx, 7
not ebx
mov dword [edi + 0x20], eax
and ebx, 0x80
mov dword [edi + 0x28], eax
or ebx, 0x4100
mov dword [edi + 0x18], eax
mov dword [edi + 0x24], edx
xor eax, eax
mov dword [edi + 0x2c], edx
mov dword [edi + 0x1c], edx
mov word [edi + 6], bx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c6410
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x5d0898], 1
push ebx
push esi
push edi
mov esi, ecx
jne 0x4c64e3
mov dword [0x5d0898], 2
test esi, esi
je 0x4c644e
mov al, byte [esi]
cmp al, 0x80
jae 0x4c644e
cmp byte [esi + 1], 0x3a
jne 0x4c644e
movzx eax, al
movzx ebx, byte [eax + 0x63d400]
jmp 0x4c6450
xor ebx, ebx
mov ecx, 0x210000
mov dword [0x5f2908], 0x28
mov dword [0x5f290c], 0x210000
call fcn.004c4700
push 0
push 0
mov dword [0x5f2910], eax
xor ecx, ecx
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x5c3a78
push eax
lea eax, [ebp - 0xc]
mov dword [0x5f2914], edx
push eax
push 0
push 0xd
test ebx, ebx
mov byte [ebp - 4], bl
lea eax, [ebp - 4]
push 0x5f24dc
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
neg eax
sbb eax, eax
and eax, 0x5f24dc
mov dword [0x5d0870], eax
je 0x4c64c5
push 0
mov ecx, eax
call fcn.004c4190
add esp, 4
test esi, esi
je 0x4c64da
cmp byte [esi], 0x80
jae 0x4c64e3
cmp byte [esi + 1], 0x3a
jne 0x4c64e3
cmp byte [esi + 2], 0
jne 0x4c64e3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x5b6ce4
mov eax, esi
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4c6510
test dl, dl
je 0x4c650c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4c6510
add eax, 2
add ecx, 2
test dl, dl
jne 0x4c64f0
xor eax, eax
jmp 0x4c6515
sbb eax, eax
or eax, 1
mov ecx, esi
test eax, eax
jne 0x4c652b
push eax
call fcn.004c4190
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c6530
sub ecx, edx
lea eax, [ecx + 2]
push eax
call fcn.0052c198
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4c6555
lea eax, [ebx + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
sub ecx, esi
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x4c6560
mov al, byte [ebx]
mov esi, ebx
test al, al
je 0x4c6593
cmp al, 0x5c
jne 0x4c657c
mov byte [esi], 0x2f
call fcn.005401be
push eax
push esi
call fcn.0054013e
add esi, eax
add esp, 8
mov al, byte [esi]
test al, al
jne 0x4c6575
mov edx, 0x3a
mov ecx, ebx
call fcn.004c4fd0
mov edi, eax
test edi, edi
je 0x4c65ea
mov cl, byte [edi + 1]
inc edi
mov esi, edi
test cl, cl
je 0x4c65cd
nop
cmp cl, 0x3a
je 0x4c65e0
call fcn.005401be
push eax
push esi
call fcn.0054013e
mov cl, byte [esi + eax]
add esi, eax
add esp, 8
test cl, cl
jne 0x4c65b0
cmp edi, ebx
jbe 0x4c65ec
cmp byte [edi], 0
jne 0x4c65ec
mov eax, 0x2e
mov word [edi], ax
jmp 0x4c65ec
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, ebx
mov edx, edi
mov ecx, ebx
call fcn.004c60e0
push ebx
mov esi, eax
call fcn.0052a52b
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ca010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [0x5f2924]
xor edx, edx
push esi
mov esi, dword [0x60d264]
xor ecx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov dword [0x63d2c4], 2
push edi
test ebx, ebx
je 0x4ca1e6
mov edi, dword [0x5f2920]
cmp ebx, 3
jb 0x4ca08b
movzx eax, byte [esi + 0x61d2a2]
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
mov dword [0x5f2920], edi
movzx ecx, word [edi*2 + 0x60d280]
mov edx, ecx
mov word [eax*2 + 0x62d2c0], cx
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov word [edi*2 + 0x60d280], si
test edx, edx
je 0x4ca0b9
mov eax, esi
sub eax, edx
cmp eax, 0x7efa
ja 0x4ca0b9
cmp dword [0x60d26c], ebx
jbe 0x4ca0a8
mov dword [0x60d26c], ebx
mov ecx, edx
call fcn.004c9d60
mov ecx, eax
cmp ecx, ebx
cmova ecx, ebx
mov dword [ebp - 4], ecx
cmp ecx, 3
jb 0x4ca15e
lea edx, [ecx - 3]
mov ecx, esi
sub ecx, dword [0x60d270]
call fcn.004cb660
mov edx, dword [ebp - 4]
mov ecx, eax
sub ebx, edx
mov dword [ebp - 0xc], ecx
mov dword [0x5f2924], ebx
cmp edx, dword [0x5f2918]
ja 0x4ca138
cmp ebx, 3
jb 0x4ca138
dec edx
movzx eax, byte [esi + 0x61d2a3]
inc esi
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
movzx ecx, word [edi*2 + 0x60d280]
mov dword [ebp - 8], ecx
mov word [eax*2 + 0x62d2c0], cx
mov word [edi*2 + 0x60d280], si
sub edx, 1
jne 0x4ca0f0
mov ecx, dword [ebp - 0xc]
mov dword [0x5f2920], edi
mov dword [ebp - 4], edx
jmp 0x4ca175
add esi, edx
mov dword [ebp - 4], 0
mov edx, esi
movzx edi, byte [edx + 0x61d2a0]
movzx eax, byte [edx + 0x61d2a1]
shl edi, 5
xor edi, eax
mov dword [0x5f2920], edi
jmp 0x4ca178
movzx edx, byte [esi + 0x61d2a0]
xor ecx, ecx
call fcn.004cb660
dec ebx
mov ecx, eax
mov dword [0x5f2924], ebx
inc esi
mov edx, esi
mov dword [0x60d264], esi
test ecx, ecx
je 0x4ca1b9
mov eax, dword [0x63d2c0]
test eax, eax
js 0x4ca193
lea ecx, [eax + 0x61d2a0]
jmp 0x4ca195
xor ecx, ecx
push 0
sub edx, eax
call fcn.004cb300
mov esi, dword [0x60d264]
add esp, 4
mov ebx, dword [0x5f2924]
mov edi, dword [0x5f2920]
mov dword [0x63d2c0], esi
cmp ebx, 0x106
jae 0x4ca1d8
call fcn.004c9eb0
mov ebx, dword [0x5f2924]
mov edi, dword [0x5f2920]
mov esi, dword [0x60d264]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
test ebx, ebx
jne 0x4ca047
mov eax, dword [0x63d2c0]
test eax, eax
js 0x4ca1f7
lea ecx, [eax + 0x61d2a0]
jmp 0x4ca1f9
xor ecx, ecx
sub esi, eax
push 1
mov edx, esi
call fcn.004cb300
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ca4c0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, 0x12345678
mov esi, 0x23456789
mov dword [0x5f2930], eax
mov edx, 0x34567890
mov dword [0x5f2934], esi
mov dword [0x5f2938], edx
mov cl, byte [edi]
test cl, cl
je 0x4ca536
push ebx
mov ebx, dword [0x63d994]
movsx ecx, cl
lea edi, [edi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ebx + ecx*4]
movzx ecx, al
add ecx, esi
imul esi, ecx, 0x8088405
inc esi
mov ecx, esi
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [ebx + ecx*4]
mov cl, byte [edi]
test cl, cl
jne 0x4ca4f1
pop ebx
mov dword [0x5f2930], eax
mov dword [0x5f2938], edx
mov dword [0x5f2934], esi
pop edi
pop esi
ret
Function at 0x4ca7d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x5d08c0], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
je 0x4ca886
mov dword [ebp - 8], eax
mov edx, ecx
mov dword [ebp - 4], edx
test eax, eax
je 0x4ca886
mov eax, dword [0x5f2930]
push ebx
mov ebx, dword [0x5f2934]
push edi
mov edi, dword [0x5f2938]
push esi
nop dword [eax]
movsx ecx, byte [edx]
mov esi, edi
xor ecx, eax
and esi, 0xfffd
movzx ecx, cl
or esi, 2
mov dword [ebp - 0xc], esi
mov esi, dword [0x63d994]
shr eax, 8
xor eax, dword [esi + ecx*4]
movzx ecx, al
add ecx, ebx
imul ebx, ecx, 0x8088405
inc ebx
mov ecx, ebx
shr ecx, 0x18
xor ecx, edi
shr edi, 8
movzx ecx, cl
xor edi, dword [esi + ecx*4]
mov ecx, dword [ebp - 0xc]
xor ecx, 1
imul ecx, dword [ebp - 0xc]
shr ecx, 8
xor cl, byte [edx]
mov edx, dword [ebp - 4]
mov byte [edx], cl
inc edx
sub dword [ebp - 8], 1
mov dword [ebp - 4], edx
jne 0x4ca810
mov ecx, dword [ebp - 0x10]
pop esi
mov dword [0x5f2938], edi
pop edi
mov dword [0x5f2930], eax
mov eax, dword [ebp + 8]
mov dword [0x5f2934], ebx
pop ebx
push dword [ebp + 0xc]
push eax
push 1
push ecx
call fcn.0054356e
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4cbc50
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5c3040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5d186c], 0
push esi
push edi
jne 0x4cbdbd
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
jne 0x4cbc91
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret
mov esi, edi
mov ecx, 0x5d1868
xchg dword [ecx], esi
test esi, esi
je 0x4cbcce
mov eax, esi
xchg dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x5d186c]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret
push 0x63fb00
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x124
push 0
push 0x60d140
call fcn.00526a30
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4cbdac
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeBackupPrivilege
push 0
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4cbd5c
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4cbd5c
call esi
test eax, eax
jne 0x4cbd5c
mov dword [0x5d1864], 1
jmp 0x4cbda3
cmp dword [0x5d1864], 0
jne 0x4cbda3
lea eax, [ebp - 0x10]
push eax
push str.SeSecurityPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4cbda3
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x4cbda3
call esi
test eax, eax
jne 0x4cbda3
mov dword [0x5d1870], 1
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov dword [0x5d186c], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00524763
mov esp, ebp
pop ebp
ret
Function at 0x4cc820
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.winvnc.exe_crc32_z
Function at 0x4cf2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x4cf4bd
cmp dword [ebx + 0x20], 0
je 0x4cf4bd
cmp dword [ebx + 0x24], 0
je 0x4cf4bd
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x4cf4bd
cmp dword [eax], ebx
jne 0x4cf4bd
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x4cf34b
cmp eax, 0x39
je 0x4cf34b
cmp eax, 0x45
je 0x4cf34b
cmp eax, 0x49
je 0x4cf34b
cmp eax, 0x5b
je 0x4cf34b
cmp eax, 0x67
je 0x4cf34b
cmp eax, 0x71
je 0x4cf34b
cmp eax, 0x29a
jne 0x4cf4bd
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4cf4bd
mov esi, dword [ebx + 0x1c]
mov eax, dword [esi + 0x18]
mov dword [ebp - 8], eax
cmp eax, 2
je 0x4cf4bd
cmp eax, 1
jne 0x4cf377
cmp dword [esi + 4], 0x2a
jne 0x4cf4bd
cmp dword [esi + 0x74], 0
jne 0x4cf4bd
push edi
mov edi, dword [ebp + 0x10]
cmp eax, 1
jne 0x4cf3a0
push edi
push ecx
push dword [ebx + 0x30]
call sym.winvnc.exe_adler32_z
mov ecx, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x18], 0
cmp edi, dword [esi + 0x2c]
jb 0x4cf3f7
test eax, eax
jne 0x4cf3ef
mov eax, dword [esi + 0x44]
xor edx, edx
mov ecx, dword [esi + 0x4c]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00526a30
mov ecx, dword [ebp + 0xc]
add esp, 0xc
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x16b4], 0
sub edi, dword [esi + 0x2c]
add ecx, edi
mov edi, dword [esi + 0x2c]
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
mov dword [ebx], ecx
mov ecx, esi
mov dword [ebp - 0xc], eax
mov dword [ebx + 4], edi
call fcn.004cedd0
mov ecx, dword [esi + 0x74]
cmp ecx, 3
jb 0x4cf478
mov ebx, dword [esi + 0x6c]
add ecx, 0xfffffffe
mov dword [ebp - 4], ecx
nop
mov eax, dword [esi + 0x38]
mov edx, ebx
mov ecx, dword [esi + 0x58]
and edx, dword [esi + 0x34]
movzx edi, byte [ebx + eax + 2]
mov eax, dword [esi + 0x48]
shl eax, cl
mov ecx, dword [esi + 0x40]
xor edi, eax
and edi, dword [esi + 0x54]
mov eax, dword [esi + 0x44]
mov dword [esi + 0x48], edi
mov ax, word [eax + edi*2]
mov word [ecx + edx*2], ax
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2], bx
inc ebx
sub dword [ebp - 4], 1
jne 0x4cf420
mov ecx, esi
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x74], 2
call fcn.004cedd0
mov ecx, dword [esi + 0x74]
cmp ecx, 3
jae 0x4cf416
mov ebx, dword [ebp + 8]
add dword [esi + 0x6c], ecx
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x16b4], ecx
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [ebx], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 8]
pop edi
mov dword [esi + 0x18], eax
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d25d0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.winvnc.exe_adler32_z
Function at 0x50d370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, edx
mov dword [ebp - 4], eax
and edi, 0x1f
mov dword [ebp - 8], edi
cmp edi, 8
jb 0x50d496
mov ecx, edi
shr ecx, 3
cmp dword [ebp + 0x10], 1
jne 0x50d415
mov dword [ebp - 8], ecx
push 0xc2b2ae3d
push 0x27d4eb4f
push dword [eax + 4]
push dword [eax]
call fcn.00525430
add dword [ebp - 4], 8
mov ecx, eax
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.00525430
mov ecx, eax
xor edx, esi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.00525430
mov ebx, eax
mov esi, edx
mov eax, dword [ebp - 4]
add ebx, 0xc2b2ae63
adc esi, 0x85ebca77
sub edi, 8
sub dword [ebp - 8], 1
jne 0x50d3a3
jmp 0x50d490
mov dword [ebp - 8], ecx
nop dword [eax + eax]
push 0xc2b2ae3d
push 0x27d4eb4f
push dword [eax + 4]
push dword [eax]
call fcn.00525430
add dword [ebp - 4], 8
mov ecx, eax
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.00525430
mov ecx, eax
xor edx, esi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.00525430
mov ebx, eax
mov esi, edx
mov eax, dword [ebp - 4]
add ebx, 0xc2b2ae63
adc esi, 0x85ebca77
sub edi, 8
sub dword [ebp - 8], 1
jne 0x50d420
mov eax, dword [ebp - 4]
mov dword [ebp - 8], edi
mov ecx, eax
cmp edi, 4
jb 0x50d4ed
add eax, 4
mov dword [ebp - 4], eax
mov eax, 0x9e3779b1
mul dword [ecx]
push 0xc2b2ae3d
mov edi, eax
mov eax, 0x85ebca87
mul dword [ecx]
push 0x27d4eb4f
add edi, edx
xor eax, ebx
xor edi, esi
mov ecx, eax
shld ecx, edi, 0x17
shld edi, eax, 0x17
push edi
push ecx
call fcn.00525430
mov edi, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 4]
add ebx, 0x9e3779f9
mov esi, edx
adc esi, 0x165667b1
sub edi, 4
test edi, edi
je 0x50d534
movzx eax, byte [eax]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.00525430
inc dword [ebp - 4]
xor ebx, eax
xor esi, edx
mov eax, ebx
push 0x9e3779b1
shld eax, esi, 0xb
push 0x85ebca87
shld esi, ebx, 0xb
push esi
push eax
call fcn.00525430
mov ebx, eax
mov eax, dword [ebp - 4]
mov esi, edx
sub edi, 1
jne 0x50d4f1
push 0xc2b2ae3d
xor ecx, ecx
mov edx, esi
push 0x27d4eb4f
shr edx, 1
xor ecx, esi
xor edx, ebx
push ecx
push edx
call fcn.00525430
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.00525430
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x518920
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x28], 0x517a10
push eax
mov dword [ebp - 0x20], 0
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
lea eax, [ebp - 0x28]
push eax
push 0x5188d0
push 0
push 0
call fcn.0054411d
add esp, 0x18
mov dword [esi], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0x20], 0
jne 0x51899a
mov esi, dword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
cmp dword [ebp - 0x20], 0
je 0x518988
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x518a20
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x60c8d8]
mov edi, ecx
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [edi + 4], eax
test eax, eax
jne 0x518ac4
push 0x5d1b78
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x5d1880]
test esi, esi
je 0x518a73
mov dword [edi], esi
mov eax, dword [esi + 0x54]
push 0x5d1b78
mov dword [0x5d1880], eax
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
ret
push 0x58
call fcn.00524776
mov esi, eax
add esp, 4
lea ecx, [esi + 4]
mov dword [esi], vtable.omni_thread.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 0xc
mov ecx, esi
call fcn.00518ee0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi], vtable._internal_omni_thread_dummy.0
mov dword [esi + 0x54], 0
push 0x5d1b78
mov dword [edi], esi
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
ret