joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ee20
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0
push 0
push 1
push 0
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, dword [esp + 0x20]
mov edi, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 4], edi
test edi, edi
jne 0x44ee71
call esi
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [esp + 0x14], esi
call fcn.004436b0
mov dword [esp + 0x18], eax
test esi, esi
jne 0x44ef2e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp + 8], eax
mov dword [ebx + 8], eax
cmp dword [ebp + 8], 0
jne 0x44eeac
call esi
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [esp + 0x14], esi
call fcn.004436b0
mov dword [esp + 0x18], eax
test esi, esi
jne 0x44ef3d
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0
push ebx
push 0x450b60
push dword [esp + 0x34]
push 0
call fcn.004f40df
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x18
mov dword [ebp + 4], eax
test eax, eax
jne 0x44ef14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov dword [esp + 0x24], eax
call dword [edx]
test edi, edi
je 0x44eef5
push edi
call esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x44eeff
push eax
call esi
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
call fcn.004436b0
mov dword [esp + 0x18], eax
test ebx, ebx
jne 0x44ef4c
test edi, edi
je 0x44ef24
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
push str.thread.entry_event
lea eax, [esp + 0x18]
push eax
call fcn.0043c050
push str.thread.exit_event
lea eax, [esp + 0x18]
push eax
call fcn.0043c050
push str.thread
lea eax, [esp + 0x18]
push eax
call fcn.0043c050
int3
Function at 0x450be0
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x68
push 0xffffffffffffffff
push 0x514255
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x56fcd4]
xor eax, ebp
mov dword [ebp + 0x64], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x70]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x1c]
cmp eax, dword [ebx]
je 0x450d72
mov edi, dword [ebp + 0x78]
lea esi, [ebx + 0x20]
mov eax, edi
and eax, dword [ebp + 0x7c]
push esi
cmp eax, 0xffffffff
je 0x450cd8
mov dword [ebp - 0x10], esi
call fcn.004dd278
add esp, 4
test eax, eax
jne 0x450dbe
mov eax, dword [esi + 0x2c]
cmp eax, 0x7fffffff
je 0x450dc5
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
push dword [ebp + 0x7c]
push edi
push dword [ebx + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x450dd0
mov edi, dword [ebp + 0x74]
lea eax, [ebp]
push 0
push eax
push edi
push dword [ebp - 0x14]
mov dword [ebp], 0
push dword [ebx + 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp edi, dword [ebp]
je 0x450d4a
call fcn.004eac8d
push dword [eax]
call fcn.004f2d21
add esp, 4
lea ecx, [ebp + 0x34]
push eax
call fcn.0041fa40
push eax
lea eax, [ebp + 0x4c]
mov byte [ebp - 4], 5
push str.Failed_to_write_to_file.
push eax
call fcn.00403560
add esp, 0xc
mov byte [ebp - 4], 6
jmp 0x450dfa
mov dword [ebp], esi
call fcn.004dd278
add esp, 4
test eax, eax
jne 0x450e11
mov eax, dword [esi + 0x2c]
cmp eax, 0x7fffffff
je 0x450e18
mov edi, dword [ebp + 0x74]
lea eax, [ebp - 0x10]
push 0
push eax
push edi
push dword [ebp - 0x14]
mov dword [ebp - 4], 7
push dword [ebx + 0x1c]
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp edi, dword [ebp - 0x10]
je 0x450d4a
lea eax, [ebp + 0x1c]
push eax
call fcn.0043d360
push eax
lea eax, [ebp + 4]
mov byte [ebp - 4], 8
push str.Failed_to_write_to_file.
push eax
call fcn.00403560
add esp, 0x10
mov byte [ebp - 4], 9
jmp 0x450dfa
push esi
call fcn.004dd29d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x64]
xor ecx, ebp
call fcn.004df28f
lea esp, [ebp + 0x68]
pop ebp
ret 0x10
call fcn.004eac8d
push dword [eax]
call fcn.004f2d21
add esp, 4
lea ecx, [ebp + 0x4c]
push eax
call fcn.0041fa40
push eax
lea eax, [ebp + 0x34]
mov dword [ebp - 4], 0
push str.File_not_opened.
push eax
call fcn.00403560
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00424bb0
push 0x552298
lea eax, [ebp - 0x2c]
push eax
call fcn.004e084f
push 5
call fcn.004dd640
dec eax
push 6
mov dword [esi + 0x2c], eax
call fcn.004dd640
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp + 0x34]
push eax
call fcn.00444f10
push eax
lea eax, [ebp + 0x4c]
mov byte [ebp - 4], 3
push str.Failed_to_seek_file:
push eax
call fcn.00403560
add esp, 0x14
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x20]
call fcn.00424bb0
push 0x552298
lea eax, [ebp - 0x20]
push eax
call fcn.004e084f
push 5
call fcn.004dd640
dec eax
push 6
mov dword [esi + 0x2c], eax
call fcn.004dd640
int3
Function at 0x495170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x34]
test eax, eax
push ebx
mov ebx, 0xb
cmovne ebx, eax
mov dword [esp + 0x18], ebx
push esi
cmp ebx, 5
jb 0x49538a
cmp ebx, 0xc
jbe 0x4951a0
pop esi
mov eax, 0xffffffd4
pop ebx
add esp, 0x2c
ret
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
bsr eax, eax
bsr ecx, esi
add eax, 2
inc ecx
cmp ecx, eax
cmovb eax, ecx
cmp ebx, eax
jb 0x49538a
push ebp
xor eax, eax
mov ebp, 0x3e
cmp dword [esp + 0x50], eax
push edi
sete al
sub ebp, ebx
push 0
push esi
push 0x40000000
lea eax, [eax*2 - 1]
mov dword [esp + 0x24], ebp
movzx eax, ax
push 0
mov dword [esp + 0x30], eax
call fcn.004dfb80
xor ecx, ecx
mov dword [esp + 0x28], edx
xor edx, edx
mov dword [esp + 0x2c], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], 0
bts ecx, eax
mov ebp, 1
cmp eax, 0x20
cmovae edx, ecx
xor ecx, edx
cmp eax, 0x40
mov eax, dword [esp + 0x50]
cmovae edx, ecx
mov dword [esp + 0x34], ecx
mov ecx, ebx
mov dword [esp + 0x30], edx
mov edx, esi
shl ebp, cl
shr edx, cl
xor edi, edi
mov ecx, dword [esp + 0x48]
xor ebx, ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x38], edx
mov ecx, dword [ecx + ebx*4]
cmp ecx, esi
je 0x495380
test ecx, ecx
jne 0x495259
xor edx, edx
jmp 0x49530f
cmp ecx, edx
ja 0x49526a
mov ecx, dword [esp + 0x20]
dec ebp
movzx edx, cx
jmp 0x49530f
mov eax, dword [esp + 0x28]
mul ecx
mov esi, eax
mov eax, dword [esp + 0x2c]
mul ecx
mov ecx, dword [esp + 0x18]
add esi, edx
mov dword [esp + 0x10], eax
mov edx, esi
mov dword [esp + 0x44], esi
call fcn.004df490
movzx esi, ax
cmp si, 8
jge 0x4952e1
mov ecx, dword [esp + 0x18]
movsx edi, si
mov eax, edi
cdq
call fcn.004df470
sub dword [esp + 0x10], eax
mov ecx, dword [edi*4 + 0x520e9c]
sbb dword [esp + 0x44], edx
mov eax, dword [esp + 0x30]
mul ecx
mov edi, eax
mov eax, dword [esp + 0x34]
mul ecx
add edi, edx
cmp dword [esp + 0x44], edi
jb 0x4952d9
ja 0x4952d2
cmp dword [esp + 0x10], eax
jbe 0x4952d9
mov eax, 1
jmp 0x4952db
xor eax, eax
mov edi, dword [esp + 0x1c]
add esi, eax
movsx eax, si
sub ebp, eax
movzx ecx, si
cmp si, di
movzx edx, si
mov esi, dword [esp + 0x4c]
mov eax, ebx
cmovle eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
movzx eax, di
cmovle ecx, eax
mov eax, dword [esp + 0x50]
movzx edi, cx
mov dword [esp + 0x1c], edi
mov ecx, dword [esp + 0x40]
mov word [ecx + ebx*2], dx
inc ebx
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x48]
cmp ebx, eax
jbe 0x495243
mov ecx, dword [esp + 0x14]
mov eax, ebp
mov ebx, dword [esp + 0x40]
neg eax
movzx edi, word [ebx + ecx*2]
lea edx, [ebx + ecx*2]
movsx ecx, di
sar ecx, 1
cmp eax, ecx
jl 0x49536c
push dword [esp + 0x20]
push dword [esp + 0x54]
push esi
push dword [esp + 0x54]
mov esi, dword [esp + 0x34]
push esi
push ebx
call fcn.004953a0
add esp, 0x18
cmp eax, 0xffffff88
jbe 0x495376
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x2c
ret
mov esi, dword [esp + 0x24]
lea ecx, [edi + ebp]
mov word [edx], cx
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 0x2c
ret
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0x2c
ret
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret
Function at 0x497950
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x18]
and ebp, 0x1f
push edi
mov edi, dword [esp + 0x20]
cmp ebp, 8
jb 0x497a6d
mov eax, ebp
shr eax, 3
cmp dword [esp + 0x28], 1
jne 0x4979f0
mov dword [esp + 0x10], eax
push 0xc2b2ae3d
push 0x27d4eb4f
push dword [edi + 4]
push dword [edi]
call fcn.004df430
mov ecx, eax
add edi, 8
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.004df430
mov ecx, eax
xor edx, esi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.004df430
mov ebx, eax
mov esi, edx
add ebx, 0xc2b2ae63
adc esi, 0x85ebca77
sub ebp, 8
sub dword [esp + 0x10], 1
jne 0x497981
jmp 0x497a6d
mov dword [esp + 0x10], eax
nop dword [eax]
nop dword [eax + eax]
push 0xc2b2ae3d
push 0x27d4eb4f
push dword [edi + 4]
push dword [edi]
call fcn.004df430
mov ecx, eax
add edi, 8
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.004df430
mov ecx, eax
xor edx, esi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.004df430
mov ebx, eax
mov esi, edx
add ebx, 0xc2b2ae63
adc esi, 0x85ebca77
sub ebp, 8
sub dword [esp + 0x10], 1
jne 0x497a00
mov ecx, edi
cmp ebp, 4
jb 0x497ac3
mov eax, 0x9e3779b1
add edi, 4
mul dword [ecx]
mov dword [esp + 0x20], edi
mov edi, eax
mov eax, 0x85ebca87
mul dword [ecx]
push 0xc2b2ae3d
add edi, edx
xor eax, ebx
xor edi, esi
mov ecx, eax
shld ecx, edi, 0x17
shld edi, eax, 0x17
push 0x27d4eb4f
push edi
push ecx
call fcn.004df430
mov edi, dword [esp + 0x20]
mov ebx, eax
add ebx, 0x9e3779f9
mov esi, edx
adc esi, 0x165667b1
sub ebp, 4
test ebp, ebp
je 0x497b07
movzx eax, byte [edi]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.004df430
xor ebx, eax
lea edi, [edi + 1]
xor esi, edx
mov eax, ebx
push 0x9e3779b1
shld eax, esi, 0xb
push 0x85ebca87
shld esi, ebx, 0xb
push esi
push eax
call fcn.004df430
mov ebx, eax
mov esi, edx
sub ebp, 1
jne 0x497ac7
push 0xc2b2ae3d
xor ecx, ecx
mov edi, esi
push 0x27d4eb4f
xor ecx, esi
shr edi, 1
push ecx
xor edi, ebx
push edi
call fcn.004df430
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.004df430
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x49ee00
Capabilities:
Create thread

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [esp + 0x30]
test esi, esi
jne 0x49ee14
or eax, 0xffffffff
pop esi
add esp, 0x28
ret
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
lea eax, [esp + 0x10]
push eax
mov dword [esi], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0x49ef10
push 0
push 0
call fcn.004f40df
add esp, 0x18
mov dword [esi], eax
test eax, eax
lea eax, [esp + 0x14]
push eax
jne 0x49ee7f
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.004eac8d
pop esi
mov eax, dword [eax]
add esp, 0x28
ret
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0xc], 0
jne 0x49eea7
mov esi, dword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
push 0xffffffffffffffff
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
call esi
cmp dword [esp + 0xc], 0
je 0x49ee92
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
pop esi
add esp, 0x28
ret
Function at 0x4aeae0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x18
test eax, eax
je 0x4aec76
mov edx, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x24]
push edi
cmp eax, 4
jb 0x4aeb23
mov edi, eax
shr edi, 2
mov ecx, dword [edx]
sub eax, 4
xor ecx, dword [ebx]
add edx, 4
mov dword [esi], ecx
add ebx, 4
add esi, 4
sub edi, 1
jne 0x4aeb08
mov dword [esp + 0x34], eax
push ebp
xor ebp, ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebx
test eax, eax
je 0x4aec72
cmp eax, 8
jb 0x4aec57
lea ecx, [ebx - 1]
lea edi, [esi - 1]
add ecx, eax
add edi, eax
cmp esi, ecx
ja 0x4aeb55
cmp edi, ebx
jae 0x4aec57
lea ecx, [edx - 1]
add ecx, eax
cmp esi, ecx
ja 0x4aeb66
cmp edi, edx
jae 0x4aec57
cmp eax, 0x40
jb 0x4aec08
mov edi, eax
mov ecx, eax
and edi, 0x3f
mov eax, esi
sub eax, ebx
mov dword [esp + 0x24], edi
sub ecx, edi
mov dword [esp + 0x10], eax
mov edi, edx
mov dword [esp + 0x20], ecx
sub edi, ebx
lea ecx, [ebx + 0x10]
mov ebx, dword [esp + 0x10]
mov eax, edx
sub eax, esi
mov dword [esp + 0x1c], eax
lea eax, [esi + 0x20]
nop
movups xmm0, xmmword [ecx - 0x10]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [edx + ebp]
lea eax, [eax + 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x60], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [edi + ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [ebx + ecx - 0x40], xmm1
mov ebx, dword [esp + 0x1c]
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [ebx + eax - 0x40]
mov ebx, dword [esp + 0x10]
xorps xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm1, xmmword [edx + ebp + 0x30]
add ebp, 0x40
movups xmm0, xmmword [ecx - 0x20]
xorps xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
cmp ebp, dword [esp + 0x20]
jb 0x4aeba0
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x14]
jb 0x4aec53
jmp 0x4aec0c
mov edi, edx
sub edi, ebx
and eax, 0xfffffff8
lea ecx, [ebx + ebp]
mov dword [esp + 0x20], eax
mov eax, esi
sub eax, ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
nop word [eax + eax]
movq xmm1, qword [ecx + edi]
lea ecx, [ecx + 8]
movq xmm0, qword [ecx - 8]
add ebp, 8
xorps xmm1, xmm0
movq qword [ecx + edx - 8], xmm1
cmp ebp, dword [esp + 0x20]
jb 0x4aec30
mov edx, dword [esp + 0x18]
cmp ebp, eax
jae 0x4aec72
sub edx, ebx
lea edi, [ebx + ebp]
sub esi, ebx
sub eax, ebp
mov cl, byte [edi + edx]
lea edi, [edi + 1]
xor cl, byte [edi - 1]
mov byte [edi + esi - 1], cl
sub eax, 1
jne 0x4aec60
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x4ca290
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x24
mov ecx, dword [esp + 0x2c]
xor edx, edx
push ebp
push esi
push edi
xor esi, esi
mov dword [esp + 0xc], edx
xor ebp, ebp
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esp + 0x1c], edx
test ecx, ecx
js 0x4ca446
push ebx
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], eax
cmp edi, ecx
jge 0x4ca371
mov eax, dword [esp + 0x38]
mov eax, dword [eax + edi*4]
cmp byte [eax], 5
jne 0x4ca2fa
nop dword [eax + eax]
movzx ecx, word [eax + 6]
test cx, cx
je 0x4ca2fa
add eax, 8
cmp ecx, 1
jbe 0x4ca2f3
mov eax, dword [eax]
mov eax, dword [eax]
cmp byte [eax], 5
je 0x4ca2e0
movzx edx, word [eax + 2]
mov cl, byte [eax]
and edx, 0x21
mov dword [esp + 0x28], edx
cmp cl, 3
jne 0x4ca316
mov ebx, 1
add eax, 0x10
jmp 0x4ca327
cmp cl, 4
jne 0x4ca323
mov ebx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
jmp 0x4ca327
xor ebx, ebx
xor eax, eax
cmp edx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
jne 0x4ca36d
xor ecx, ecx
test ebp, ebp
jle 0x4ca36d
mov esi, eax
sub esi, edx
cmp ecx, ebx
jge 0x4ca356
mov eax, dword [edx]
cmp eax, dword [esi + edx]
jne 0x4ca356
inc ecx
add edx, 4
cmp ecx, ebp
jl 0x4ca343
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
test ecx, ecx
jle 0x4ca36d
mov ebp, ecx
mov ecx, dword [esp + 0x3c]
jmp 0x4ca43c
mov ecx, dword [esp + 0x3c]
cmp edi, esi
je 0x4ca41a
lea eax, [esi + 1]
cmp edi, eax
je 0x4ca41a
push dword [esp + 0x20]
push ebp
push edx
call fcn.004c3ad0
add esp, 0xc
mov dword [esp + 0x24], eax
cmp dword [esp + 0x14], edi
jge 0x4ca3b1
mov ebx, dword [esp + 0x38]
push ebp
push dword [ebx + esi*4]
call fcn.004c9ed0
inc esi
add esp, 8
cmp esi, edi
jl 0x4ca3a0
mov esi, dword [esp + 0x14]
mov ecx, edi
mov eax, dword [esp + 0x38]
sub ecx, esi
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x2c], ecx
lea edx, [eax + esi*4]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x30], edx
mov eax, dword [eax + 4]
cmp eax, dword [ebx + 8]
mov ebx, dword [esp + 0x18]
je 0x4ca3fd
mov esi, dword [esp + 0x24]
mov dword [eax], esi
mov esi, dword [esp + 0x14]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0xffffffff
mov eax, dword [esp + 0x44]
add dword [eax + 4], 0x10
jmp 0x4ca416
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x50]
push eax
call fcn.004c5980
mov ecx, dword [esp + 0x3c]
cmp edi, ecx
jge 0x4ca438
mov edx, dword [esp + 0x1c]
mov esi, edi
mov eax, dword [esp + 0x28]
mov ebp, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x20], eax
jmp 0x4ca43c
mov edx, dword [esp + 0x10]
inc edi
cmp edi, ecx
jle 0x4ca2b7
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
Function at 0x4cb210
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x516645
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x56fcd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 4]
mov dword [edi], vtable.re2::Regexp::Walker_struct_re2::Frag_.0
mov dword [ebp - 0x14], esi
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.004deddf
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov byte [edi + 0x18], 0
mov dword [edi], vtable.re2::Compiler.0
mov dword [ebp - 4], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [ebp - 0x24], 0x532ad0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [edi + 0x48], xmm0
mov eax, dword [0x527580]
mov ecx, dword [0x527584]
push 0x180
mov byte [ebp - 4], 2
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], eax
mov dword [edi + 0x60], ecx
mov byte [edi + 0x64], 0
call fcn.004deddf
add esp, 8
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x4cb300
mov ecx, eax
call fcn.004b4f70
jmp 0x4cb302
xor eax, eax
push 1
mov ecx, edi
mov byte [ebp - 4], 2
mov dword [edi + 0x20], eax
mov byte [edi + 0x24], 0
mov dword [edi + 0x28], 1
mov byte [edi + 0x2c], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 1
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
call fcn.004cbe60
mov ecx, dword [edi + 0x34]
lea ecx, [ecx + eax*8]
call fcn.004b7030
mov dword [edi + 0x3c], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4d1730
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x18]
cmp ebx, 0x400
jb 0x4d17c5
mov eax, ebx
mov dword [esp + 8], ecx
shr eax, 0xa
push esi
mov dword [esp + 0x10], eax
mov esi, 0xcc9e2d51
mov eax, dword [esp + 0x18]
push edi
mov dword [esp + 0x28], eax
push 0x400
push ecx
call fcn.004d17f0
mul esi
mov ecx, 0xcc9e2d51
add esp, 8
mov esi, eax
mov edi, edx
mov eax, ebp
mul ecx
mov edx, 0xcc9e2d51
mov ecx, eax
mov eax, dword [esp + 0x28]
mul edx
add ecx, edx
add esi, eax
adc edi, ecx
mov ecx, dword [esp + 0x10]
xor ebp, ebp
mov eax, edi
xor eax, esi
add ecx, 0x400
xor ebp, edi
mov dword [esp + 0x28], eax
sub ebx, 0x400
mov dword [esp + 0x10], ecx
sub dword [esp + 0x14], 1
mov esi, 0xcc9e2d51
jne 0x4d1765
pop edi
pop esi
jmp 0x4d17c9
mov eax, dword [esp + 0x14]
mov byte [esp + 0x20], 0
push dword [esp + 0x20]
push ebx
push ecx
push ebp
push eax
call fcn.004be310
add esp, 0x14
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4d7e20
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
push 0
mov esi, ecx
call fcn.004d9fa0
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x94], eax
lea eax, [esp + 4]
push eax
mov dword [esi + 0x90], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 8]
lea eax, [esi + 4]
cmp ecx, dword [esp + 0x20]
mov dword [eax], 0
cmovb ecx, dword [esp + 0x20]
xor eax, 0xb37cc16a
push 0x78
mov dword [esi + 8], eax
lea eax, [esi + 0x18]
push 0
push eax
mov dword [esi + 0x98], ecx
mov dword [esi + 0x9c], 0x10
mov dword [esi + 0xa0], 0x20
mov dword [esi + 0xa4], 0
mov dword [esi + 0xc], esi
mov dword [esi + 0x14], 0
call fcn.004e1450
add esp, 0xc
mov eax, esi
pop esi
add esp, 0x24
ret 4
Function at 0x4dba30
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, ecx
push esi
mov esi, dword [esp + 0x14]
test eax, eax
jg 0x4dba51
jl 0x4dba47
test esi, esi
jne 0x4dba51
pop esi
xor eax, eax
xor edx, edx
pop ebx
pop ecx
ret 0xc
cmp dword [ebx + 0x38], 0
push ebp
push edi
mov edi, esi
je 0x4dbb04
mov ebp, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
nop dword [eax]
mov ecx, ebx
call fcn.00434d60
mov esi, eax
mov eax, edx
mov dword [esp + 0x10], eax
test eax, eax
jl 0x4dbac1
jg 0x4dba89
test esi, esi
je 0x4dbac1
cmp ebp, eax
jg 0x4dba99
jl 0x4dba93
cmp edi, esi
jae 0x4dba99
mov esi, edi
mov dword [esp + 0x10], ebp
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push dword [esp + 0x20]
call fcn.004e0ed0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
sub edi, esi
sbb ebp, dword [esp + 0x10]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x18]
jmp 0x4dbae0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4dbaf0
mov eax, dword [esp + 0x18]
add edi, 0xffffffff
mov esi, 1
adc ebp, 0xffffffff
mov byte [eax], cl
add eax, esi
mov dword [esp + 0x18], eax
test ebp, ebp
jg 0x4dba70
jl 0x4dbaf0
test edi, edi
jne 0x4dba70
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub eax, edi
pop edi
sbb edx, ebp
pop ebp
pop esi
pop ebx
pop ecx
ret 0xc
mov eax, dword [ebx + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, dword [eax]
test edx, edx
je 0x4dbb49
mov eax, dword [ebx + 0x2c]
lea ecx, [ebx + 0x2c]
mov dword [esp + 0x10], ecx
mov eax, dword [eax]
test eax, eax
je 0x4dbb50
mov edi, dword [esp + 0x1c]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ebp
call fcn.004e0ed0
mov eax, dword [ebx + 0x2c]
add ebp, esi
sub edi, esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x4dbb50
lea eax, [ebx + 0x2c]
mov dword [esp + 0x10], eax
cmp dword [ebx + 0x4c], 0
je 0x4dbbb9
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x4dbb7a
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax], edx
cmp edi, 0xfff
jbe 0x4dbba4
push dword [ebx + 0x4c]
push 0xfff
push 1
push ebp
call fcn.004f7093
add esp, 0x10
add ebp, eax
sub edi, eax
cmp eax, 0xfff
jne 0x4dbbb9
cmp edi, eax
ja 0x4dbb82
test edi, edi
je 0x4dbbb9
push dword [ebx + 0x4c]
push edi
push 1
push ebp
call fcn.004f7093
add esp, 0x10
sub edi, eax
mov edx, dword [esp + 0x20]
sub esi, edi
pop edi
pop ebp
mov eax, esi
sbb edx, 0
pop esi
pop ebx
pop ecx
ret 0xc