joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc3d1
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
lea eax, [edi + 8]
cmp dword [eax], esi
jne 0x4bc3e9
push eax
call fcn.004b12f4
pop ecx
test eax, eax
jne 0x4bc3fb
lea eax, [edi + 0xc]
cmp dword [eax], esi
jne 0x4bc3f9
push eax
call fcn.004b12f4
pop ecx
mov esi, eax
mov eax, esi
pop edi
pop esi
ret

Function at 0x4bc7d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0xc], ecx
mov word [esi], ax
cmp byte [edi + 1], al
je 0x4bc850
mov bl, byte [edi + 2]
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x24]
call fcn.0047a718
movzx eax, byte [edi + 4]
mov ecx, esi
push eax
push 0x800
call fcn.004bc8b5
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], ecx
mov eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], ecx
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], ecx
mov al, byte [edi + 3]
mov byte [esi + 0x80], al
jmp 0x4bc859
mov ecx, esi
call fcn.004a7a75
mov bl, al
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x3c]
mov dword [esi + 0x4c], ecx
xor ecx, ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x40], 0x3f
mov byte [esi + 5], cl
test bl, bl
jne 0x4bc884
mov eax, dword [ebp + 0xc]
mov byte [ebp + 0x14], 1
cmp byte [eax + 0x24], cl
jne 0x4bc887
mov byte [ebp + 0x14], cl
push dword [ebp + 0x14]
mov ecx, esi
push 1
call fcn.004bc8b5
test bl, bl
je 0x4bc8b0
xor eax, eax
mov byte [esi + 4], 0x14
mov word [esi + 2], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4bf659
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x4bf66c
xor eax, eax
jmp 0x4bf6f6
lea eax, [esi + 0x30]
push edi
push eax
call fcn.004b1308
pop ecx
test eax, eax
jne 0x4bf6f2
xor edi, edi
lea eax, [esi + 0x14]
inc edi
push eax
mov dword [esi + 0x28], edi
call fcn.004b12f4
pop ecx
test eax, eax
jne 0x4bf6f2
lea eax, [esi + 0x18]
push eax
call fcn.004b12f4
pop ecx
test eax, eax
jne 0x4bf6f2
lea eax, [esi + 0x1c]
push eax
call fcn.004b12f4
pop ecx
test eax, eax
jne 0x4bf6f2
push dword [ebp + 0x14]
lea eax, [esi + 0x20]
push dword [ebp + 0x14]
push eax
call fcn.004b1411
add esp, 0xc
test eax, eax
jne 0x4bf6f2
push dword [ebp + 0x14]
push eax
lea eax, [esi + 0x24]
push eax
call fcn.004b1411
add esp, 0xc
test eax, eax
jne 0x4bf6f2
push dword [ebp + 0x10]
lea eax, [esi + 0x10]
mov dword [esi + 4], edi
push dword [ebp + 0xc]
push eax
call fcn.004b1470
add esp, 0xc
test eax, eax
jne 0x4bf6f2
mov dword [esi], edi
jmp 0x4bf6f5
push 0xc
pop eax
pop edi
pop esi
pop ebp
ret
Function at 0x4bf8a4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x4bf8bb
push ebx
call fcn.004b12f4
pop ecx
test eax, eax
jne 0x4bf8fd
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x4bf8cf
push edi
call fcn.004b12f4
pop ecx
test eax, eax
jne 0x4bf8fc
push ebx
call fcn.004b137c
push edi
call fcn.004b137c
lea eax, [esi + 0xc]
mov byte [esi + 0x10], 0
cmp dword [eax], 0
pop ecx
pop ecx
je 0x4bf8ed
xor eax, eax
jmp 0x4bf8fc
push esi
push 0x4bf866
push eax
call fcn.004b1470
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4c55e1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5c5604]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.0047a826
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb al, al
xor ecx, ebp
inc al
pop esi
call fcn.004ee000
leave
ret

Function at 0x4c566e
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x4c5cde
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
pop ebp
ret
Function at 0x4ca090
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], 0
jne 0x4ca0a8
mov dword [ebp - 8], 0x578648
jmp 0x4ca0af
mov dword [ebp - 8], 0x578650
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
je 0x4ca0ec
mov dword [ebp - 0xc], 1
jmp 0x4ca0f3
mov dword [ebp - 0xc], 0
movzx eax, byte [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ca690
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0
push str.Microsoft_Internet_Explorer
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x4ca6ca
mov eax, dword [ebp - 4]
mov dword [eax + 0x84], 1
xor al, al
jmp 0x4ca6f0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x4ca950
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5c5604]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x35], 0
push 0x30
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.004fec20
add esp, 0xc
mov dword [ebp - 0x3c], 0x30
push 0
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x34]
push edx
push 0
push 5
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x4ca9bf
mov dword [ebp - 0x44], 0
push 0xa
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.00518d18
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov byte [ebp - 0x35], 1
movzx eax, byte [ebp - 0x35]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ee000
mov esp, ebp
pop ebp
ret 4

Function at 0x4ca9e0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5c5604]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x38], 0
push 0x30
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.004fec20
add esp, 0xc
mov dword [ebp - 0x3c], 0x30
push 0
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x34]
push edx
push 0
push 0x13
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x4caa4c
mov dword [ebp - 0x44], 0
push 0xa
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.00518d18
add esp, 0xc
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ee000
mov esp, ebp
pop ebp
ret
Function at 0x4cae20
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562b1d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5c5604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x28]
call fcn.00406d60
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.004ca700
movzx ecx, al
test ecx, ecx
jne 0x4caeac
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 8]
call fcn.00406c00
mov eax, dword [ebp - 0x3c]
or eax, 1
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406be0
mov eax, dword [ebp + 8]
jmp 0x4cafb6
mov ecx, dword [ebp - 0x30]
call fcn.004ca9e0
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x30]
cmp dword [edx + 4], 0x194
jne 0x4caedb
mov dword [ebp - 0x40], 5
push 0x5b808c
lea eax, [ebp - 0x40]
push eax
call fcn.005002f2
push 0x1000
call fcn.0051367e
add esp, 4
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x29], 0
mov ecx, 1
test ecx, ecx
je 0x4caf73
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x4caf0f
jmp 0x4caf73
cmp dword [ebp - 0x38], 0
ja 0x4caf1b
mov byte [ebp - 0x29], 1
jmp 0x4caf73
cmp dword [ebp - 0x38], 0x1000
jbe 0x4caf3f
mov edx, dword [ebp - 0x34]
push edx
call fcn.00508cb9
add esp, 4
mov eax, dword [ebp - 0x38]
push eax
call fcn.0051367e
add esp, 4
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x4caf5e
jmp 0x4caf73
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00408160
jmp 0x4caeef
mov edx, dword [ebp - 0x34]
push edx
call fcn.00508cb9
add esp, 4
movzx eax, byte [ebp - 0x29]
test eax, eax
jne 0x4caf8f
lea ecx, [ebp - 0x28]
call fcn.004cb170
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406c00
mov edx, dword [ebp - 0x3c]
or edx, 1
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406be0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ee000
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4cafe0
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x562b5d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x5c5604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x4c]
add ecx, 0x24
call fcn.004cd2f0
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x60]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.004c83c0
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00406be0
push 0xa0000000
lea ecx, [ebp - 0x28]
call fcn.004025e0
push eax
lea ecx, [ebp - 0x28]
call fcn.00402600
push eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
cmp dword [ebp + 8], 0
jne 0x4cb07c
mov dword [ebp - 0x50], 0
jmp 0x4cb08b
mov eax, dword [ebp + 8]
push eax
call fcn.00509ff0
add esp, 4
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x48], ecx
cmp dword [ebp + 0xc], 0
jne 0x4cb0de
push 0
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
cmp eax, 1
jne 0x4cb0c4
mov dword [ebp - 0x54], 1
jmp 0x4cb0cb
mov dword [ebp - 0x54], 0
mov cl, byte [ebp - 0x54]
mov byte [ebp - 0x41], cl
lea ecx, [ebp - 0x28]
call fcn.00402640
mov al, byte [ebp - 0x41]
jmp 0x4cb125
push 0
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
cmp eax, 1
jne 0x4cb10d
mov dword [ebp - 0x58], 1
jmp 0x4cb114
mov dword [ebp - 0x58], 0
mov dl, byte [ebp - 0x58]
mov byte [ebp - 0x42], dl
lea ecx, [ebp - 0x28]
call fcn.00402640
mov al, byte [ebp - 0x42]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ee000
mov esp, ebp
pop ebp
ret 8
Function at 0x4e5380
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5649b7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5c5604]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x10], 0
je 0x4e53d5
mov dword [ebx], 0x578d88
mov dword [ebx + 0x50], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
lea esi, [ebx + 4]
mov ecx, ebx
push 0
push esi
mov dword [ebp + 0xc], esi
call fcn.00408c60
mov eax, dword [ebx]
push 8
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + ebx - 4], eax
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004749cc
mov esi, eax
add esp, 4
test esi, esi
je 0x4e5432
push 1
mov byte [ebp - 4], 2
call fcn.004ec2de
add esp, 4
mov dword [esi + 4], eax
jmp 0x4e5434
xor esi, esi
lea eax, [ebx + 4]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea edx, [eax + 0x24]
mov dword [eax + 0x2c], edx
lea edi, [eax + 0x14]
mov dword [eax + 0x1c], edi
add eax, 0x28
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x10]
mov dword [esi], 0
mov esi, dword [ebp + 0xc]
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
not ecx
mov dword [edi], 0
mov dword [edx], 0
and ecx, 1
shl ecx, 2
mov eax, ebx
mov edx, ecx
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
or edx, 8
mov dword [esi + 0x38], 0
and al, 8
cmove edx, ecx
mov eax, edx
or eax, 0x10
and bl, 4
cmove eax, edx
mov dword [esi + 0x3c], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f534b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x4f5379
cmp eax, edi
jge 0x4f536d
push esi
call fcn.004f244c
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x4f539c
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x4f5382
mov dword [esi + 8], edx
jmp 0x4f53b1
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x4f53a7
xor dl, dl
jmp 0x4f53ac
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x4f539c
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x4f53ea
mov dword [0x5d0dd0], str.zlib_corrupt
xor eax, eax
jmp 0x4f542c
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4f53ff
mov dword [0x5d0dd0], str.read_past_buffer
jmp 0x4f53e6
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x4f5416
push edi
push esi
call fcn.004f77f2
pop ecx
pop ecx
test eax, eax
je 0x4f53e6
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004fe430
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x4fcea8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0x10]
mov ebx, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4fcf25
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 0x10], eax
test eax, eax
je 0x4fcf25
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4fcf25
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x4fcf25
push edi
mov ecx, ebx
call fcn.004fc9e0
push dword [ebp + 0x10]
lea ecx, [ebx + 4]
push dword [ebp + 8]
call fcn.004fc9c2
mov ecx, ebx
mov dword [ebx], esi
call fcn.004fcf83
test eax, eax
jne 0x4fcf22
xor ecx, ecx
or dword [ebx], 0xffffffff
mov dword [ebx + 4], ecx
mov dword [ebx + 0xc], ecx
mov dword [ebx + 8], ecx
pop edi
jmp 0x4fcf27
xor eax, eax
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4fd1d7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 0xc
pop edi
mov eax, dword [esi]
sub eax, edi
mov dword [ebp - 4], ebx
push eax
call fcn.004edc74
mov dword [ebp + 0xc], eax
pop ecx
test eax, eax
je 0x4fd24d
cmp dword [esi], edi
jbe 0x4fd237
movzx eax, word [ebx + 0x18]
mov ecx, dword [ebp - 4]
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
shr ebx, 8
xor bl, byte [eax + edi]
mov byte [ebp - 8], bl
push dword [ebp - 8]
call fcn.004fd372
mov eax, dword [ebp + 0xc]
mov byte [eax + edi - 0xc], bl
inc edi
mov ebx, dword [ebp - 4]
cmp edi, dword [esi]
jb 0x4fd200
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.004ed807
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
xor eax, eax
add dword [esi], 0xfffffff4
inc eax
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4fd29b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5c5604]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xc
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
jae 0x4fd2bb
xor eax, eax
jmp 0x4fd30b
push ebx
push esi
push 0xc
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004fe430
add esp, 0xc
xor esi, esi
movzx eax, word [edi + 0x18]
mov ecx, edi
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
shr ebx, 8
xor bl, byte [ebp + esi - 0x10]
mov byte [ebp - 0x14], bl
push dword [ebp - 0x14]
call fcn.004fd372
mov byte [ebp + esi - 0x10], bl
inc esi
cmp esi, 0xc
jl 0x4fd2ce
mov ecx, dword [ebp + 0x10]
xor eax, eax
shr ecx, 0x18
cmp byte [ebp - 5], cl
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004ee000
leave
ret 0xc
Function at 0x4fd372
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x10]
xor eax, edx
mov esi, dword [edi + 0xc]
mov ecx, dword [edi + 0x18]
movzx eax, al
shr edx, 8
xor edx, dword [esi + eax*4]
movzx eax, dl
add eax, dword [edi + 0x14]
imul eax, eax, 0x8088405
mov dword [edi + 0x10], edx
inc eax
mov dword [edi + 0x14], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [esi + eax*4]
mov dword [edi + 0x18], ecx
pop edi
pop esi
pop ebp
ret 4

Function at 0x502592
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5c5604]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x57c980
push esi
call fcn.0051da84
pop ecx
pop ecx
test eax, eax
jne 0x5025c0
xor al, al
jmp 0x50263d
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.005022c7
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x5025fa
push dword [ebp - 0x210]
call fcn.00508cb9
xor al, al
jmp 0x50263b
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x502600
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x502620
push edx
call fcn.005024c9
pop ecx
test al, al
je 0x5025eb
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x50262e
mov bl, 1
push dword [ebp - 0x210]
call fcn.00508cb9
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004ee000
leave
ret

Function at 0x512f05
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x512f44
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x512f44
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x512f44
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x512f44
cmp dword [ecx + 0x74], 0xe
jbe 0x512f44
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret