joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca910
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
cmp esi, 0x26
je 0x4ca944
cmp esi, 0x28
je 0x4ca944
cmp esi, 0x24
je 0x4ca944
cmp esi, 0x23
je 0x4ca944
cmp esi, 0x21
je 0x4ca944
cmp esi, 0x22
je 0x4ca944
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xd0]
mov ecx, dword [eax]
test ecx, ecx
je 0x4caae6
lea eax, [esi - 0x21]
cmp eax, 7
ja case.0x4ca960.37
jmp dword [eax*4 + 0x4caaf0]
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x4ca960.36
mov edi, dword [eax + 0x20]
test edi, edi
je case.0x4ca960.36
dec edi
jmp 0x4caa0a
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x4ca960.36
mov eax, dword [eax + 0x20]
lea edi, [ecx - 1]
inc eax
cmp eax, ecx
cmovb edi, eax
jmp 0x4caa0a
lea edi, [ecx - 1]
jmp 0x4caa0a
mov edi, dword [ebx + 0x70]
test edi, edi
je 0x4ca9a1
mov edi, dword [edi + 0x20]
jmp 0x4ca9a3
xor edi, edi
test byte [ebx + 0x20], 8
je 0x4ca9ae
mov edx, dword [ebx + 0x58]
jmp 0x4ca9b0
xor edx, edx
mov eax, dword [ebx + 0x48]
sub eax, dword [ebx + 0x4c]
sub eax, edx
js 0x4caae6
cdq
idiv dword [ebx + 0x50]
mov edx, eax
sub edx, 1
js 0x4caae6
mov eax, dword [ebx + 0x5c]
cmp esi, 0x21
jne 0x4ca9e9
cmp edi, eax
jbe 0x4ca9dd
mov edi, eax
jmp 0x4caa0a
cmp edi, edx
jb case.0x4ca960.36
sub edi, edx
jmp 0x4caa0a
xor edi, edi
jmp 0x4caa0a
add eax, edx
lea esi, [ecx - 1]
cmp eax, ecx
cmovb esi, eax
cmp edi, esi
jae 0x4ca9fb
mov edi, esi
jmp 0x4caa0a
add edi, edx
lea eax, [ecx - 1]
cmp edi, ecx
cmovae edi, eax
jmp 0x4caa0a
mov edi, dword [ebp - 0xc]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
push 0x10
sets byte [ebp - 1]
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebx + 0xd0]
mov si, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + edi*4]
mov ecx, ebx
mov dword [ebx + 0x70], edx
call fcn.004ca290
test si, si
jns 0x4caa60
mov edx, dword [ebx + 0x78]
cmp edx, 0xffffffff
je 0x4caa60
lea eax, [ebp - 8]
cmp edi, edx
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, edi
cmovbe eax, edx
cmovbe edx, edi
push 4
push eax
jmp 0x4caa7c
cmp byte [ebp - 1], 0
jne 0x4caaa8
mov eax, dword [ebx + 0x70]
mov edx, edi
mov eax, dword [eax + 0x20]
mov dword [ebx + 0x78], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push edi
mov ecx, ebx
call fcn.004ca120
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
push eax
push 1
push dword [ebp - 8]
mov ecx, ebx
call fcn.004c9e80
test al, al
je 0x4caaa8
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, edi
mov ecx, ebx
call fcn.004ca410
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x4caae6
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx + 0xf4], 0xffffffff
mov dword [ebx + 0xf8], 0xffffffff
mov dword [ebx + 0x118], 0xffffffff
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ca995
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
cmp esi, 0x26
je 0x4ca944
cmp esi, 0x28
je 0x4ca944
cmp esi, 0x24
je 0x4ca944
cmp esi, 0x23
je 0x4ca944
cmp esi, 0x21
je 0x4ca944
cmp esi, 0x22
je 0x4ca944
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xd0]
mov ecx, dword [eax]
test ecx, ecx
je 0x4caae6
lea eax, [esi - 0x21]
cmp eax, 7
ja case.0x4ca960.37
jmp dword [eax*4 + 0x4caaf0]
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x4ca960.36
mov edi, dword [eax + 0x20]
test edi, edi
je case.0x4ca960.36
dec edi
jmp 0x4caa0a
mov eax, dword [ebx + 0x70]
test eax, eax
je case.0x4ca960.36
mov eax, dword [eax + 0x20]
lea edi, [ecx - 1]
inc eax
cmp eax, ecx
cmovb edi, eax
jmp 0x4caa0a
lea edi, [ecx - 1]
jmp 0x4caa0a
mov edi, dword [ebx + 0x70]
test edi, edi
je 0x4ca9a1
mov edi, dword [edi + 0x20]
jmp 0x4ca9a3
xor edi, edi
test byte [ebx + 0x20], 8
je 0x4ca9ae
mov edx, dword [ebx + 0x58]
jmp 0x4ca9b0
xor edx, edx
mov eax, dword [ebx + 0x48]
sub eax, dword [ebx + 0x4c]
sub eax, edx
js 0x4caae6
cdq
idiv dword [ebx + 0x50]
mov edx, eax
sub edx, 1
js 0x4caae6
mov eax, dword [ebx + 0x5c]
cmp esi, 0x21
jne 0x4ca9e9
cmp edi, eax
jbe 0x4ca9dd
mov edi, eax
jmp 0x4caa0a
cmp edi, edx
jb case.0x4ca960.36
sub edi, edx
jmp 0x4caa0a
xor edi, edi
jmp 0x4caa0a
add eax, edx
lea esi, [ecx - 1]
cmp eax, ecx
cmovb esi, eax
cmp edi, esi
jae 0x4ca9fb
mov edi, esi
jmp 0x4caa0a
add edi, edx
lea eax, [ecx - 1]
cmp edi, ecx
cmovae edi, eax
jmp 0x4caa0a
mov edi, dword [ebp - 0xc]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
push 0x10
sets byte [ebp - 1]
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebx + 0xd0]
mov si, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + edi*4]
mov ecx, ebx
mov dword [ebx + 0x70], edx
call fcn.004ca290
test si, si
jns 0x4caa60
mov edx, dword [ebx + 0x78]
cmp edx, 0xffffffff
je 0x4caa60
lea eax, [ebp - 8]
cmp edi, edx
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, edi
cmovbe eax, edx
cmovbe edx, edi
push 4
push eax
jmp 0x4caa7c
cmp byte [ebp - 1], 0
jne 0x4caaa8
mov eax, dword [ebx + 0x70]
mov edx, edi
mov eax, dword [eax + 0x20]
mov dword [ebx + 0x78], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push edi
mov ecx, ebx
call fcn.004ca120
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
push eax
push 1
push dword [ebp - 8]
mov ecx, ebx
call fcn.004c9e80
test al, al
je 0x4caaa8
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, edi
mov ecx, ebx
call fcn.004ca410
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x4caae6
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebx + 0xf4], 0xffffffff
mov dword [ebx + 0xf8], 0xffffffff
mov dword [ebx + 0x118], 0xffffffff
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ce470
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
test byte [0x548260], 1
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
jne 0x4ce556
mov esi, 0x548260
lock bts dword [esi], 0x1f
jae 0x4ce4b4
test byte [0x548260], 1
jne 0x4ce556
xor edx, edx
mov ecx, esi
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x4ce556
push str.cryptui.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, eax
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4ce506
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4ce506
cmp eax, 0x10000000
jae 0x4ce506
cmp dword [eax + ecx], 0x4550
jne 0x4ce506
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x4ce506
cmp dword [edx + 4], 0
je 0x4ce506
push 0
push str.CryptUIDlgViewSignerInfoW
add eax, ecx
push eax
push edx
call fcn.004a2140
jmp 0x4ce508
xor eax, eax
mov dword [0x54b4c4], eax
lock bts dword [esi], 0
jb 0x4ce556
mov esi, dword [0x548264]
test esi, esi
je 0x4ce527
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
mov ecx, 0x548260
lock xadd dword [ecx], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x4ce556
test esi, esi
je 0x4ce556
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x548264], 0
cmp dword [0x54b4c4], 0
je 0x4ce5be
push 0x2c
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x30
push 0
push eax
call fcn.004dce30
add esp, 0xc
push edi
call dword [0x54b5dc]
mov esi, eax
test esi, esi
je 0x4ce5be
push 0
push 0
push 0
push esi
call dword [0x54b5bc]
test eax, eax
je 0x4ce5be
mov ecx, dword [ebx + 0x14]
mov dword [esp + 0x14], ecx
mov eax, dword [eax + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x2c], str.1.3.6.1.5.5.7.3.3
call dword [0x54b4c4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cf4e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5392c0
push 0x4fce58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebp + 0x10]
mov dword [esi + 8], ebx
mov dword [ebp - 4], 0
push 0x40
mov edx, edi
mov ecx, esi
call fcn.004cf830
mov dword [ebp - 4], 0xffffffff
mov eax, 0x5a4d
cmp word [edi], ax
je 0x4cf550
mov eax, 0xc000012f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4cf626
cmp eax, 0x10000000
jae 0x4cf626
cmp eax, ebx
jae 0x4cf626
lea edx, [eax + edi]
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
push 0x18
mov ecx, esi
call fcn.004cf830
mov edx, dword [esi + 0xc]
movzx eax, word [edx + 6]
lea ecx, [eax + eax*4]
movzx eax, word [edx + 0x14]
lea eax, [eax + ecx*8]
add eax, 0x18
push eax
mov ecx, esi
call fcn.004cf830
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 0xc]
cmp dword [ecx], 0x4550
jne 0x4cf626
movzx eax, word [ecx + 0x18]
mov word [esi + 0x18], ax
mov edx, 0x10b
cmp ax, dx
je 0x4cf5ce
mov edx, 0x20b
cmp ax, dx
jne 0x4cf626
movzx eax, word [ecx + 6]
mov dword [esi + 0x10], eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
mov dword [esi + 0x14], eax
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xc000007b
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cf6e0
Capabilities:
Get file attributes
Map section object

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov byte [esp + 7], 0
mov dword [esp + 8], 0
push ebx
push esi
mov esi, edx
mov dword [esp + 0x14], esi
push edi
test ecx, ecx
jne 0x4cf715
test esi, esi
jne 0x4cf753
mov eax, 0xc0000030
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test esi, esi
jne 0x4cf753
push 0x60
xor eax, eax
mov edx, 0x106
cmp byte [ebp + 8], al
push 1
push 1
cmove eax, edx
push 0x80
or eax, 0x100081
push eax
push ecx
lea eax, [esp + 0x30]
push eax
call sym.ProcessHacker.exe_PhCreateFileWin32
test eax, eax
js 0x4cf823
mov esi, dword [esp + 0x18]
mov byte [esp + 0x13], 1
push 5
push 0x18
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, eax
test ecx, ecx
jns 0x4cf772
mov edi, eax
jmp 0x4cf784
mov eax, dword [esp + 0x38]
mov edi, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x2c], eax
test ecx, ecx
js 0x4cf804
xor ebx, ebx
lea eax, [esp + 0x28]
cmp byte [ebp + 8], bl
push esi
sete bl
push 0x8000000
lea ebx, [ebx*2 + 2]
push ebx
push eax
push 0
push 0xf001f
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test edi, edi
js 0x4cf804
mov eax, dword [esp + 0x28]
push ebx
push 0
push 1
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
push eax
push 0xffffffffffffffff
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov edi, eax
test edi, edi
js 0x4cf804
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0x20]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [esp + 0x28]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4cf813
push eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp byte [esp + 0x13], 0
je 0x4cf821
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cfa70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
lea eax, [ebp - 0x48]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 0
push 0x40
mov edi, edx
push eax
push edi
push ebx
mov dword [esi], edi
call dword [ebp + 8]
test eax, eax
js 0x4cfb96
mov eax, 0x5a4d
cmp word [ebp - 0x48], ax
je 0x4cfab3
mov eax, 0xc000012f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4cfb91
cmp eax, 0x10000000
jae 0x4cfb91
push 0
push 0xf8
lea ecx, [ebp - 0x140]
add eax, edi
push ecx
push eax
push ebx
mov dword [ebp - 4], eax
call dword [ebp + 8]
test eax, eax
js 0x4cfb96
cmp dword [ebp - 0x140], 0x4550
jne 0x4cfb91
mov ax, word [ebp - 0x128]
mov ecx, 0x10b
mov word [esi + 0x10], ax
cmp ax, cx
je 0x4cfb18
mov ecx, 0x20b
cmp ax, cx
jne 0x4cfb91
movzx eax, word [ebp - 0x13a]
mov dword [esi + 8], eax
lea edi, [eax + eax*4]
movzx eax, word [ebp - 0x12c]
lea edi, [edi + 3]
lea edi, [eax + edi*8]
cmp edi, 0x100000
ja 0x4cfb91
push edi
push 4
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0
push edi
push eax
push dword [ebp - 4]
mov dword [esi + 4], eax
push ebx
call dword [ebp + 8]
mov ecx, dword [esi + 4]
mov edi, eax
test edi, edi
jns 0x4cfb7a
push ecx
push 0
push dword [0x54b674]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
mov dword [esi + 0xc], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, 0xc000007b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d4e70
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
mov ebx, dword [ecx + 0x30]
mov eax, 0x38
push esi
push edi
mov esi, ebx
mov dword [ebp - 8], edx
and esi, 0x3f
mov dword [ebp - 4], ecx
sub eax, esi
mov edi, 0x78
sub edi, esi
cmp esi, 0x38
cmovb edi, eax
lea eax, [edi - 1]
push eax
lea eax, [ebp - 0x4f]
push 0
push eax
call fcn.004dce30
mov esi, dword [ebp - 4]
lea edx, [ebp - 0x50]
mov eax, ebx
mov byte [ebp - 0x50], 0x80
shr eax, 0x1d
add esp, 0xc
mov ecx, dword [esi + 0x2c]
shl ecx, 3
or ecx, eax
lea eax, [ebx*8]
bswap eax
bswap ecx
mov dword [ebp + edi - 0x4c], eax
lea eax, [edi + 8]
mov dword [ebp + edi - 0x50], ecx
mov ecx, esi
push eax
call fcn.004d4dc0
mov ecx, dword [esi + 0x18]
mov edx, ecx
mov ebx, dword [ebp - 8]
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebx], edx
mov ecx, dword [esi + 0x1c]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebx + 4], edx
mov ecx, dword [esi + 0x20]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebx + 8], edx
mov ecx, dword [esi + 0x24]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebx + 0xc], edx
mov ecx, dword [esi + 0x28]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [ebx + 0x10], edx
pop edi
mov dword [esi + 0x18], 0x67452301
mov dword [esi + 0x1c], 0xefcdab89
mov dword [esi + 0x20], 0x98badcfe
mov dword [esi + 0x24], 0x10325476
mov dword [esi + 0x28], 0xc3d2e1f0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d4ff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
cmp byte [edi], 0
je 0x4d5010
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 8]
test edx, edx
je 0x4d5041
mov ecx, edx
lea ebx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d5020
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + ecx]
mov word [esp + 0x10], ax
add eax, 2
mov word [esp + 0x12], ax
jmp 0x4d5047
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x14], edx
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
call dword [sym.imp.ntdll.dll_LdrGetDllHandle]
test eax, eax
js 0x4d50c6
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4d50c6
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4d50ad
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4d50ad
cmp eax, 0x10000000
jae 0x4d50ad
cmp dword [eax + ecx], 0x4550
jne 0x4d50ad
lea edx, [ecx + 0x78]
add edx, eax
mov eax, dword [edx]
test eax, eax
je 0x4d50ad
cmp dword [edx + 4], 0
je 0x4d50ad
push 0
push dword [ebp + 0xc]
add eax, ecx
push eax
push edx
call fcn.004a2140
jmp 0x4d50af
xor eax, eax
mov dword [esi], eax
lea ecx, [esp + 0xc]
xor edx, edx
lock or dword [ecx], edx
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d5eb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 8]
jb 0x4d5ef0
lea edi, [esi + 0xc]
cmp ecx, edi
je 0x4d5ef0
push 0
push 0
sub ecx, esi
lea eax, [ebp - 8]
sub ecx, 0xc
push ecx
push edi
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x4d5f02
mov dword [esi + 4], edi
mov ecx, edi
mov al, byte [ebp + 8]
mov byte [ecx], al
inc dword [esi + 4]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4d5f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4d5f5b
push 0
push 0
push 0x2000
lea edi, [esi + 0xc]
push edi
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
js 0x4d5f5b
mov eax, dword [ebp - 4]
test eax, eax
je 0x4d5f5b
add eax, 0xc
mov dword [esi + 4], edi
add eax, esi
mov dword [esi + 8], eax
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4d5f70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x4d5f87
lea eax, [ecx + 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
lea edi, [esi + 0xc]
cmp eax, edi
je 0x4d5fbe
push 0
push 0
sub eax, esi
sub eax, 0xc
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [esi]
call dword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
jns 0x4d5fbb
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 4], edi
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4dad00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov ecx, edx
mov dword [ebp - 8], edx
add esi, 0xdeadbeef
add esi, ecx
mov edx, esi
mov dword [ebp - 4], edx
push edi
mov edi, esi
cmp ecx, 0xc
jbe switch.0x004dae03
add ecx, 0xfffffff3
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 3
inc eax
mov dword [ebp - 0xc], eax
mov edi, edi
movzx ecx, byte [ebx + 7]
movzx eax, byte [ebx + 6]
shl ecx, 8
add ecx, eax
movzx edx, byte [ebx + 8]
movzx eax, byte [ebx + 5]
add edx, esi
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 4]
shl ecx, 8
add edi, eax
movzx eax, byte [ebx + 0xa]
add edi, ecx
movzx ecx, byte [ebx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [ebx + 3]
shl ecx, 8
mov esi, edx
add ecx, eax
rol esi, 4
movzx eax, byte [ebx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx]
shl ecx, 8
add ebx, 0xc
add ecx, eax
sub ecx, edx
add edx, edi
add ecx, dword [ebp - 4]
xor esi, ecx
sub edi, esi
mov eax, esi
add esi, edx
rol eax, 6
xor eax, edi
sub edx, eax
mov ecx, eax
rol ecx, 8
add eax, esi
xor ecx, edx
sub esi, ecx
mov edx, ecx
rol edx, 0x10
add ecx, eax
xor edx, esi
mov edi, edx
sub eax, edx
ror edi, 0xd
add edx, ecx
xor edi, eax
mov dword [ebp - 4], edx
sub ecx, edi
mov esi, edi
rol esi, 4
add edi, edx
xor esi, ecx
mov ecx, dword [ebp - 8]
sub ecx, 0xc
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], ecx
jne 0x4dad40
cmp ecx, 0xc
ja 0x4dae6f
jmp dword [ecx*4 + 0x4daec0]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add esi, eax
movzx eax, byte [ebx + 8]
add esi, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 4]
add edi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add edx, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add edx, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add edx, eax
movzx eax, byte [ebx]
add edx, eax
mov dword [ebp - 4], edx
xor esi, edi
mov eax, edi
rol eax, 0xe
sub esi, eax
mov eax, esi
mov edx, esi
xor edx, dword [ebp - 4]
rol eax, 0xb
sub edx, eax
xor edi, edx
mov eax, edx
ror eax, 7
sub edi, eax
mov eax, edi
xor esi, edi
rol eax, 0x10
sub esi, eax
mov eax, esi
mov ecx, esi
rol eax, 4
xor ecx, edx
sub ecx, eax
mov eax, ecx
xor edi, ecx
rol eax, 0xe
sub edi, eax
mov eax, edi
xor esi, edi
ror eax, 8
sub esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4f2147
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f1e06

Function at 0x4f2152
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f1f89
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x440008], 0x8088405
inc edx
mov dword [ebx + 0x440008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d2ec
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d31d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d305
add dl, dl
jne 0x41d328
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d379
xor eax, eax
add dl, dl
jne 0x41d335
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d416
add dl, dl
jne 0x41d344
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d34f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d35a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d365
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d36f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d314
mov eax, 1
add dl, dl
jne 0x41d387
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d392
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d37e
sub eax, ebx
mov ebx, 1
jne 0x41d3c5
mov ecx, 1
add dl, dl
jne 0x41d3ab
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3b6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3a2
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d314
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d3dc
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3e7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3d3
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d314
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d437
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d314
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret