joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
movzx edx, byte [esi]
test dl, dl
jne 0x46009b
jmp 0x4600bf
mov edx, eax
sub edx, 0x83
jne 0x4600d0
test ebx, ebx
je 0x46008e
mov byte [ebx], 0x83
movzx eax, byte [esi + 1]
add ebx, 2
xor eax, 0x20
mov byte [ebx - 1], al
add edi, 2
add esi, 2
movzx edx, byte [esi]
test dl, dl
je 0x4600bf
movzx eax, dl
test byte [eax + eax + 0x523921], 0x10
jne 0x460070
test ebx, ebx
je 0x4600b1
mov byte [ebx], dl
add ebx, 1
movzx edx, byte [esi + 1]
add esi, 1
add edi, 1
test dl, dl
jne 0x46009b
test ebx, ebx
je 0x4600c6
mov byte [ebx], 0
add esp, 0x2c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
cmp edx, 0x15
je 0x460138
sub eax, 0x84
add esi, 1
cmp eax, 0x12
ja 0x460094
mov edx, dword [eax*4 + 0x4ea680]
mov dword [esp], edx
mov dword [esp + 0x1c], edx
call sub.cygwin1.dll_strlen
mov ebp, eax
test ebx, ebx
je 0x46012c
mov edx, dword [esp + 0x1c]
mov eax, 0x3a5b
add ebx, 2
mov word [ebx - 2], ax
mov dword [esp + 4], edx
mov dword [esp], ebx
add ebx, ebp
mov dword [esp + 8], ebp
add ebx, 2
call sub.cygwin1.dll_memcpy
mov byte [ebx], 0
mov edx, 0x5d3a
mov word [ebx - 2], dx
lea edi, [edi + ebp + 4]
jmp 0x460094
movzx ecx, byte [esi]
cmp cl, 0x83
je 0x460188
add edi, 1
lea eax, [esi + 1]
test ebx, ebx
je 0x460170
mov byte [ebx], cl
lea edx, [ebx + 1]
mov byte [edx], 0x2d
movzx ecx, byte [eax]
cmp cl, 0x83
je 0x4601a1
mov byte [edx + 1], cl
add edi, 2
lea esi, [eax + 1]
lea ebx, [edx + 2]
jmp 0x460094
cmp byte [eax], 0x83
je 0x4601ba
add edi, 2
lea esi, [eax + 1]
xor ebx, ebx
jmp 0x460094
add edi, 2
lea eax, [esi + 2]
test ebx, ebx
je 0x460170
mov byte [ebx], 0x83
movzx ecx, byte [esi + 1]
lea edx, [ebx + 2]
mov byte [ebx + 1], cl
jmp 0x46014f
mov byte [edx + 1], 0x83
lea esi, [eax + 2]
movzx eax, byte [eax + 1]
add edi, 3
lea ebx, [edx + 3]
mov byte [edx + 2], al
jmp 0x460094
add edi, 3
lea esi, [eax + 2]
xor ebx, ebx
jmp 0x460094
Function at 0x476200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push ebx
mov ebx, eax
cmp edx, ecx
jae 0x476267
mov eax, edx
mov esi, ecx
lea esi, [esi]
movzx edx, byte [eax]
cmp dl, 0x83
jne 0x476225
movzx edx, byte [eax + 1]
add eax, 1
xor edx, 0x20
movzx edx, dl
cmp edx, 0xd
ja case.0x47622a.1
jmp dword [edx*4 + 0x4f9b40]
mov ecx, edx
mov byte [ebx], 0x5c
add ebx, 4
sar ecx, 6
add ecx, 0x30
mov byte [ebx - 3], cl
mov ecx, edx
and edx, 7
sar ecx, 3
add edx, 0x30
and ecx, 7
mov byte [ebx - 1], dl
add ecx, 0x30
mov byte [ebx - 2], cl
add eax, 1
cmp esi, eax
ja 0x476210
mov eax, ebx
pop ebx
pop esi
ret
mov edx, 0x725c
add ebx, 2
mov word [ebx - 2], dx
jmp 0x476260
mov edx, 0x665c
add ebx, 2
mov word [ebx - 2], dx
jmp 0x476260
mov edx, 0x765c
add ebx, 2
mov word [ebx - 2], dx
jmp 0x476260
mov ecx, 0x6e5c
add ebx, 2
mov word [ebx - 2], cx
jmp 0x476260
mov ecx, 0x745c
add ebx, 2
mov word [ebx - 2], cx
jmp 0x476260
mov ecx, 0x625c
add ebx, 2
mov word [ebx - 2], cx
jmp 0x476260
mov edx, 0x615c
add ebx, 2
mov word [ebx - 2], dx
jmp 0x476260
mov edx, 0x305c
mov word [ebx], dx
movzx ecx, byte [eax + 1]
lea edx, [ecx - 0x30]
cmp dl, 7
ja 0x476308
mov ecx, 0x3030
add ebx, 4
mov word [ebx - 2], cx
jmp 0x476260
add ebx, 2
jmp 0x476260

Function at 0x476310
Capabilities:
Set current directory

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x1028
call fcn.004e6390
mov edi, 0xffffffff
sub esp, eax
mov eax, dword [esp + eax]
lea esi, [esp + 0x1f]
lea ebp, [esp + 0x101b]
mov ebx, eax
test ebx, ebx
jle 0x47637a
lea esi, [esi]
sub ebx, 1
mov eax, esi
lea esi, [esi]
mov byte [eax], 0x2e
mov edx, eax
add eax, 3
mov byte [eax - 2], 0x2e
mov byte [eax - 1], 0x2f
cmp eax, ebp
je 0x476361
sub ebx, 1
jae 0x476348
mov byte [edx + 2], 0
mov dword [esp], esi
call fcn.004e5da0
test eax, eax
jne 0x47637c
mov edi, 0xfffffffe
test ebx, ebx
jg 0x476340
xor edi, edi
add esp, 0x102c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x476400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x10
movzx ecx, byte [eax]
test cl, cl
je 0x4764e0
mov edx, ecx
xor ebx, ebx
mov edi, 1
lea esi, [esi]
cmp dl, 0x83
cmove ebx, edi
movzx edx, byte [eax + 1]
add eax, 1
test dl, dl
jne 0x476420
test ebx, ebx
je 0x4764e0
mov edi, dword [0x523b98]
sub eax, esi
lea ebx, [eax + 1]
test edi, edi
je 0x4764ac
mov eax, dword [0x523b9c]
cmp ebx, eax
jg 0x4764a0
cmp eax, 0x4000
jle 0x476460
cmp ebx, 0x4000
jle 0x4764a0
mov eax, edi
jmp 0x476475
movzx ecx, byte [esi + 1]
mov esi, edx
add eax, 1
test cl, cl
je 0x47648a
mov byte [eax], cl
lea edx, [esi + 1]
cmp cl, 0x83
jne 0x476468
movzx edx, byte [esi + 1]
test dl, dl
jne 0x4764d0
add eax, 1
mov byte [eax], 0
add esp, 0x10
mov eax, edi
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], eax
mov dword [esp], edi
call sym.zsh.exe_zfree
mov dword [esp], ebx
mov dword [0x523b9c], ebx
call sym.zsh.exe_zalloc
mov dword [0x523b98], eax
mov edi, eax
test eax, eax
je 0x47651c
movzx ecx, byte [esi]
test cl, cl
jne 0x476460
jmp 0x47648a
xor edx, 0x20
add esi, 2
mov byte [eax], dl
movzx ecx, byte [esi]
jmp 0x47646e
mov eax, dword [0x523b9c]
mov edi, esi
cmp eax, 0x4000
jle 0x47648d
mov dword [esp + 4], eax
mov eax, dword [0x523b98]
mov dword [esp], eax
call sym.zsh.exe_zfree
mov eax, edi
mov dword [0x523b98], 0
mov dword [0x523b9c], 0
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [0x523b9c], 0
jmp 0x47648d

Function at 0x476530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, edx
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
mov ebx, eax
sub esp, 0x2c
movzx eax, byte [ebx]
test al, al
je 0x4765b0
cmp al, 0x83
je 0x4765a0
movzx edx, al
test byte [edx + edx + 0x523921], 0x10
jne 0x4765b0
mov byte [esp + 0x1d], al
lea eax, [esp + 0x1d]
add ebx, 1
mov dword [esp + 4], eax
lea eax, [esp + 0x1e]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp], eax
call sub.cygwin1.dll_mbrtowc
cmp eax, 0xffffffff
je 0x4765b0
cmp eax, 0xfffffffe
je 0x47653f
test ebp, ebp
je 0x476594
movzx eax, word [esp + 0x1e]
mov dword [ebp], eax
mov eax, ebx
sub eax, esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [ebx + 1]
add ebx, 1
xor eax, 0x20
jmp 0x476557
test ebp, ebp
je 0x4765bb
mov dword [ebp], 0xffffffff
mov dword [edi], 0
xor eax, eax
mov dword [edi + 4], 0
cmp esi, ebx
jae 0x476598
xor eax, eax
cmp byte [esi], 0x83
sete al
add eax, 1
jmp 0x476598
Function at 0x477550
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
movzx edx, word [0x523b6e]
movzx ebp, word [0x523b6c]
mov esi, dword [esp + 0x40]
mov dword [esp + 0x1c], edx
mov edx, dword [0x4ea920]
cmp esi, 1
sete al
test edx, edx
setne bl
or bl, al
je 0x477640
mov edi, eax
mov eax, dword [sym.zsh.exe_SHTTY]
cmp eax, 0xffffffff
je 0x477621
mov dword [esp + 8], 0x523b6c
mov dword [esp + 4], 0x5401
mov dword [esp], eax
call sub.cygwin1.dll_ioctl
test eax, eax
jne 0x477678
cmp bp, word [0x523b6c]
mov edx, dword [esp + 0x1c]
je 0x477630
test esi, esi
jne 0x477710
test bp, bp
setne al
test dx, dx
setne dl
movzx edx, dl
and edx, eax
mov esi, edx
mov dword [0x4ea920], 0
mov eax, esi
call fcn.00476060
test eax, eax
jne 0x477760
mov eax, esi
call fcn.00476130
test eax, eax
jne 0x477720
mov dword [0x4ea920], 1
mov eax, dword [sym.zsh.exe_zleactive]
test eax, eax
je 0x477621
test bl, bl
jne 0x4776c0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dx, word [0x523b6e]
jne 0x4775c3
lea esi, [esi]
cmp esi, 2
je 0x4776f8
jle 0x477660
cmp esi, 3
jne 0x477621
xor eax, eax
call fcn.00476130
test eax, eax
setne bl
jmp 0x477610
xor ebx, ebx
cmp esi, 1
jbe 0x4775de
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.zsh.exe_zterm_lines]
mov word [0x523b6c], ax
mov eax, dword [sym.zsh.exe_zterm_columns]
mov word [0x523b6e], ax
mov eax, edi
movzx edi, al
cmp esi, 2
je 0x4776f8
jle 0x4776b0
cmp esi, 3
je 0x477650
mov ebx, edi
and ebx, 1
jmp 0x477610
cmp esi, 1
ja 0x47769f
mov ebx, edi
and ebx, 1
jmp 0x4775de
mov dword [esp], 4
mov dword [sym.zsh.exe_resetneeded], 1
mov dword [sym.zsh.exe_winchanged], 1
call sym.zsh.exe_zleentry
mov dword [esp + 0x40], 5
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp sym.zsh.exe_zleentry
xor eax, eax
call fcn.00476060
test eax, eax
setne bl
jmp 0x477610
mov edi, 1
jmp 0x477693
mov dword [esp], str.COLUMNS
call sym.zsh.exe_zgetenv
test eax, eax
je 0x477606
mov edx, dword [0x522e34]
mov eax, dword [sym.zsh.exe_zterm_columns]
mov dword [esp], str.COLUMNS
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call sym.zsh.exe_setiparam
jmp 0x477606
mov dword [esp], str.LINES
call sym.zsh.exe_zgetenv
test eax, eax
je 0x4775f7
mov edx, dword [0x522e2c]
mov eax, dword [sym.zsh.exe_zterm_lines]
mov dword [esp], str.LINES
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call sym.zsh.exe_setiparam
jmp 0x4775f7
Function at 0x4782d0
Capabilities:
Get socket status

Disassembly:
push edi
push esi
push ebx
sub esp, 0x50
lea eax, [esp + 0x28]
mov edx, dword [esp + 0x70]
mov ebx, dword [esp + 0x60]
mov dword [esp + 8], 0xf4240
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 0x3c], 0xffffffff
call sub.cyggcc_s_1.dll___divmoddi4
mov edi, dword [esp + 0x28]
mov esi, eax
test ebx, ebx
js 0x478398
mov edx, dword [esp + 0x68]
test edx, edx
jne 0x4783f0
mov edx, ebx
mov eax, 1
mov ecx, ebx
mov dword [esp + 0x48], esi
sar edx, 5
shl eax, cl
mov dword [esp + 0x4c], edi
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
or dword [esp + edx*4 + 0x40], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
lea eax, [ebx + 1]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.cygwin1.dll_select
test eax, eax
jns 0x4783de
mov eax, dword [sym.zsh.exe_errflag]
xor edx, edx
test eax, eax
je 0x478400
add esp, 0x50
mov eax, edx
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x48], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x4c], edi
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
call sub.cygwin1.dll_select
test eax, eax
setg dl
add esp, 0x50
movzx edx, dl
pop ebx
pop esi
mov eax, edx
pop edi
ret
mov dword [esp], ebx
call sub.cygwin1.dll_isatty
jmp 0x478328
lea eax, [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], 0
call sym.zsh.exe_setblock_fd
mov edx, eax
test eax, eax
jne 0x478450
mov eax, dword [esp + 0x3c]
cmp eax, 0xffffffff
je 0x47838c
mov dword [esp + 8], eax
mov dword [esp + 4], 4
mov dword [esp], ebx
mov dword [esp + 0x24], edx
call sub.cygwin1.dll__fcntl64
mov edx, dword [esp + 0x24]
jmp 0x47838c
lea eax, [esp + 0x3b]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.cygwin1.dll_read
xor edx, edx
test eax, eax
jle 0x47841e
movsx edx, byte [esp + 0x3b]
mov eax, dword [esp + 0x64]
mov dword [eax], edx
mov edx, 1
jmp 0x47841e
Function at 0x478d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [edi]
mov dword [esp + 0x18], esi
test eax, eax
je 0x478df9
mov ebx, esi
xor ebp, ebp
movzx esi, bl
mov ebx, edi
mov dword [esp + 0x14], esi
movsx esi, word [esi + esi + sym.zsh.exe_typtab]
sar esi, 0xc
and esi, 1
mov dword [esp], eax
lea ebp, [esi + ebp + 1]
add ebx, 4
call sub.cygwin1.dll_strlen
add ebp, eax
mov eax, dword [ebx]
test eax, eax
jne 0x478d40
test ebp, ebp
je 0x478df9
mov eax, dword [esp + 0x1c]
mov dword [esp], ebp
test eax, eax
jne 0x478de2
call sym.zsh.exe_zalloc
mov ebp, eax
mov edx, dword [edi]
mov eax, ebp
test edx, edx
je 0x478dc0
movzx ebx, byte [esp + 0x18]
xor ebx, 0x20
mov byte [esp + 0x1c], bl
lea esi, [esi]
movzx ecx, byte [edx]
mov ebx, eax
add edx, 1
add eax, 1
mov byte [eax - 1], cl
test cl, cl
jne 0x478d88
mov esi, dword [esp + 0x14]
test byte [esi + esi + 0x523921], 0x10
je 0x478df0
movzx edx, byte [esp + 0x1c]
mov byte [ebx], 0x83
lea eax, [ebx + 2]
mov byte [ebx + 1], dl
mov edx, dword [edi + 4]
add edi, 4
test edx, edx
jne 0x478d88
mov edi, dword [esp + 0x14]
movsx edx, word [edi + edi + sym.zsh.exe_typtab]
sar edx, 0xc
and edx, 1
not edx
mov byte [eax + edx], 0
add esp, 0x2c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.zsh.exe_zhalloc
mov ebp, eax
jmp 0x478d71
movzx edx, byte [esp + 0x18]
mov byte [ebx], dl
jmp 0x478db6
mov edx, dword [esp + 0x1c]
mov ebp, 0x4f9cbe
test edx, edx
jne 0x478dd8
mov dword [esp + 0x40], ebp
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp sym.zsh.exe_ztrdup

Function at 0x47a520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
movzx eax, byte [esi]
mov edx, esi
test al, al
jne 0x47a54b
jmp 0x47a54f
movzx eax, byte [edx + 1]
add edx, 1
test al, al
je 0x47a54f
cmp al, 0x83
jne 0x47a540
lea ecx, [edx + 1]
mov ebp, ecx
test al, al
je 0x47a598
mov ebx, edx
mov edx, ecx
cmp al, 0x83
je 0x47a577
mov ebx, ebp
movzx eax, byte [ebx]
lea ebp, [ebx + 1]
mov byte [ecx], al
test al, al
je 0x47a598
add ecx, 1
mov edx, ecx
cmp al, 0x83
jne 0x47a560
movzx eax, byte [ebx + 1]
test al, al
je 0x47a560
add ebx, 2
xor eax, 0x20
mov byte [ecx - 1], al
movzx eax, byte [ebx]
lea ebp, [ebx + 1]
mov byte [ecx], al
test al, al
jne 0x47a56e
lea esi, [esi]
test edi, edi
je 0x47a5a0
sub edx, esi
mov dword [edi], edx
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x47a6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x47a6dd
jmp fcn.00476400
xor eax, eax
ret
Function at 0x47a8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
movzx eax, byte [edi]
test al, al
jne 0x47a8e9
jmp 0x47a909
movzx edx, al
test byte [edx + edx + sym.zsh.exe_typtab], 0x10
jne 0x47a900
movsx eax, al
mov dword [esp + 4], ebx
mov edi, esi
mov dword [esp], eax
call sub.cygwin1.dll_fputc
test eax, eax
js 0x47a918
movzx eax, byte [esi]
test al, al
je 0x47a909
lea esi, [edi + 1]
cmp al, 0x83
jne 0x47a8c0
movzx eax, byte [edi + 1]
lea esi, [edi + 2]
xor eax, 0x20
movsx eax, al
jmp 0x47a8d0
movzx eax, byte [esi]
mov edi, esi
test al, al
jne 0x47a8e9
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
add esp, 0x10
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
ret
Function at 0x47cb10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
movsx eax, byte [ebx]
test al, al
jns 0x47cb30
mov eax, ebx
pop ebx
jmp fcn.00476530
test edx, edx
je 0x47cb36
mov dword [edx], eax
mov eax, 1
pop ebx
ret

Function at 0x47dcc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
cmp byte [0x522d37], 0
mov ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x58]
jne 0x47dd20
mov eax, edi
sub eax, ebx
test edi, edi
je 0x47dcf0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, byte [ebx]
xor eax, eax
test dl, dl
je 0x47dce0
lea esi, [esi]
mov ecx, ebx
xor ebx, ebx
cmp dl, 0x83
sete bl
add eax, 1
lea ebx, [ebx + ecx + 1]
movzx edx, byte [ebx]
test dl, dl
jne 0x47dd00
jmp 0x47dce0
call sub.cygwin1.dll___locale_mb_cur_max
cmp eax, 1
je 0x47dcd8
mov dword [0x528c24], 0
mov dword [0x528c28], 0
movzx eax, byte [ebx]
test al, al
je 0x47de98
test edi, edi
sete byte [esp + 0x1f]
movzx ecx, byte [esp + 0x1f]
cmp ebx, edi
jb 0x47dd61
test cl, cl
je 0x47de98
mov dword [esp + 0x58], edi
mov edx, dword [esp + 0x58]
mov ecx, 1
xor ebp, ebp
xor esi, esi
mov edi, ebx
lea esi, [esi]
cmp al, 0x83
jne 0x47dd86
movzx eax, byte [ebx + 1]
add ebx, 1
xor eax, 0x20
mov byte [esp + 0x2d], al
add ebx, 1
test al, al
js 0x47ddc8
test ecx, ecx
je 0x47ddc8
add esi, 1
mov edi, ebx
mov ecx, 1
xor ebp, ebp
movzx eax, byte [ebx]
test al, al
je 0x47ddb3
cmp ebx, edx
jb 0x47dd78
cmp byte [esp + 0x1f], 0
jne 0x47dd78
cmp ebp, 1
mov eax, esi
sbb eax, 0xffffffff
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x2d]
mov dword [esp + 0xc], 0x528c24
add ebp, 1
mov dword [esp + 4], eax
lea eax, [esp + 0x2e]
mov dword [esp + 8], 1
mov dword [esp], eax
mov dword [esp + 0x58], edx
call sub.cygwin1.dll_mbrtowc
xor ecx, ecx
mov edx, dword [esp + 0x58]
cmp eax, 0xfffffffe
je 0x47dda1
cmp eax, 0xffffffff
je 0x47de70
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x47de20
add esi, 1
xor ebp, ebp
mov edi, ebx
mov ecx, 1
jmp 0x47dda1
movzx eax, word [esp + 0x2e]
mov dword [esp + 0x58], edx
mov dword [esp], eax
call sub.cygwin1.dll_wcwidth
mov edx, dword [esp + 0x58]
test eax, eax
jle 0x47de58
cmp dword [esp + 0x54], 1
jne 0x47dd95
add esi, eax
mov ecx, 1
mov edi, ebx
xor ebp, ebp
jmp 0x47dda1
mov edi, ebx
mov ecx, 1
xor ebp, ebp
jmp 0x47dda1
mov dword [0x528c24], 0
xor eax, eax
mov dword [0x528c28], 0
cmp byte [edi], 0x83
sete al
lea ebx, [edi + eax + 1]
jmp 0x47dd95
xor eax, eax
jmp 0x47dce0
Function at 0x47dfd0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov ecx, dword [esp + 0x5c]
test edi, edi
je 0x47e0ba
mov ebp, 1
mov dword [esp + 0x1c], ebp
mov ebp, ecx
jmp 0x47e052
cmp al, 0xa
je 0x47e148
cmp al, 0xd
je 0x47e148
cmp byte [0x522d37], 0
jne 0x47e0c8
mov ecx, dword [esp + 0x60]
mov dword [esp], eax
add esi, 1
sub edi, 1
add ebp, 1
mov dword [esp + 4], ecx
call sub.cygwin1.dll_fputc
mov dword [esp + 0x1c], 0
test edi, edi
je 0x47e0b8
movsx eax, byte [esi]
cmp al, 9
jne 0x47e010
mov eax, dword [esp + 0x1c]
add esi, 1
sub edi, 1
or eax, dword [esp + 0x64]
je 0x47e1d0
mov eax, dword [esp + 0x58]
lea ebx, [ebp + 1]
test eax, eax
jle 0x47e1b0
mov eax, ebp
cdq
idiv dword [esp + 0x58]
test edx, edx
jne 0x47e170
mov eax, dword [esp + 0x60]
mov dword [esp], 0x20
mov dword [esp + 4], eax
call sub.cygwin1.dll_fputc
mov eax, ebx
cdq
idiv dword [esp + 0x58]
test edx, edx
jne 0x47e16d
mov ebp, ebx
test edi, edi
jne 0x47e052
lea esi, [esi]
mov ecx, ebp
add esp, 0x3c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x28]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
lea eax, [esp + 0x26]
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.cygwin1.dll_mbrtowc
mov ebx, eax
cmp eax, 0xffffffff
je 0x47e220
cmp eax, 0xfffffffe
je 0x47e200
lea eax, [esi + eax]
sub edi, ebx
mov dword [esp + 0x1c], eax
movzx eax, word [esp + 0x26]
mov dword [esp], eax
call sub.cygwin1.dll_wcwidth
lea edx, [ebp + eax]
test eax, eax
cmovg ebp, edx
mov eax, dword [esp + 0x60]
mov dword [esp], esi
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
call sub.cygwin1.dll_fwrite
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x1c], 0
jmp 0x47e04e
mov ecx, dword [esp + 0x60]
mov dword [esp], eax
add esi, 1
sub edi, 1
xor ebp, ebp
mov dword [esp + 4], ecx
call sub.cygwin1.dll_fputc
mov dword [esp + 0x1c], 1
jmp 0x47e04e
lea ebx, [ebp + 2]
mov dword [esp + 0x50], esi
mov ebp, dword [esp + 0x60]
mov esi, dword [esp + 0x58]
jmp 0x47e183
add ebx, 1
mov dword [esp + 4], ebp
mov dword [esp], 0x20
call sub.cygwin1.dll_fputc
mov eax, ebx
cdq
idiv esi
test edx, edx
jne 0x47e180
mov esi, dword [esp + 0x50]
mov ebp, ebx
jmp 0x47e04e
mov eax, dword [esp + 0x60]
mov dword [esp], 0x20
mov ebp, ebx
mov dword [esp + 4], eax
call sub.cygwin1.dll_fputc
jmp 0x47e0b0
mov eax, ebp
mov dword [esp], 9
cdq
idiv dword [esp + 0x58]
mov eax, dword [esp + 0x58]
sub eax, edx
add ebp, eax
mov eax, dword [esp + 0x60]
mov dword [esp + 4], eax
call sub.cygwin1.dll_fputc
mov dword [esp + 0x1c], 0
jmp 0x47e04e
lea eax, [esi + 1]
sub edi, 1
mov dword [esp + 0x1c], eax
add ebp, 1
mov ebx, 1
jmp 0x47e117
lea eax, [esi + 1]
mov dword [esp + 0x28], 0
sub edi, 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], eax
jmp 0x47e20a
Function at 0x47e240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
movzx eax, byte [ebx]
test al, al
jne 0x47e25b
jmp 0x47e288
movzx eax, byte [ecx + 1]
lea ebx, [ecx + 1]
test al, al
je 0x47e288
movzx edx, al
mov ecx, ebx
cmp al, 0x83
jne 0x47e271
movzx edx, byte [ebx + 1]
add ecx, 1
xor edx, 0x20
movzx edx, dl
test byte [edx + edx + 0x523921], 8
je 0x47e250
mov eax, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x480270
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ecx, dword [sym.zsh.exe_shout]
mov esi, dword [esp + 0x30]
test ecx, ecx
je 0x4804f0
cmp byte [esi], 0x2f
je 0x4802b7
mov eax, dword [sym.zsh.exe_pwd]
cmp byte [eax + 1], 0
jne 0x4803f0
mov dword [esp + 4], esi
mov dword [esp], 0x4f9f27
call sym.zsh.exe_dyncat
mov esi, eax
test esi, esi
je 0x4804b8
mov eax, esi
call fcn.00476400
mov dword [esp], eax
call sub.cygwin1.dll_opendir
mov ebx, eax
mov eax, dword [sym.zsh.exe_shout]
test ebx, ebx
je 0x480490
movzx edi, byte [0x522d02]
xor ebp, ebp
jmp 0x4802f7
mov edx, edi
test dl, dl
jne 0x4802eb
cmp byte [eax], 0x2e
je 0x4802f7
add ebp, 1
cmp ebp, 0x64
jg 0x4804c0
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym.zsh.exe_zreaddir
test eax, eax
jne 0x4802e0
mov dword [esp], ebx
call sub.cygwin1.dll_closedir
cmp ebp, 0x64
jg 0x4804c8
mov eax, dword [sym.zsh.exe_shout]
cmp ebp, 1
jne 0x480410
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2e
mov dword [esp + 4], 1
mov dword [esp], str.zsh:_sure_you_want_to_delete_the_only_file_in
call sub.cygwin1.dll_fwrite
lea esi, [esi]
mov eax, dword [sym.zsh.exe_shout]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.zsh.exe_mb_niceformat
cmp byte [0x522d5e], 0
jne 0x480430
mov edx, dword [sym.zsh.exe_errflag]
xor eax, eax
test edx, edx
jne 0x4803de
mov eax, dword [sym.zsh.exe_shout]
mov dword [esp + 8], 7
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], str.__yn__
call sub.cygwin1.dll_fwrite
mov eax, dword [sym.zsh.exe_shout]
mov dword [esp], eax
call sub.cygwin1.dll_fflush
call sym.zsh.exe_zbeep
mov dword [esp + 4], 1
mov dword [esp], 0x4fa573
call fcn.0047ff30
cmp eax, 0x79
sete al
movzx eax, al
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], esi
mov dword [esp + 4], 0x4f9f27
mov dword [esp], eax
call sym.zsh.exe_zhtricat
mov esi, eax
jmp 0x4802af
test ebp, ebp
je 0x480490
mov dword [esp + 8], ebp
mov dword [esp + 4], str.zsh:_sure_you_want_to_delete_all__d_files_in
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x480350
mov eax, dword [sym.zsh.exe_shout]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], str.___waiting_ten_seconds_
call sub.cygwin1.dll_fwrite
mov eax, dword [sym.zsh.exe_shout]
mov dword [esp], eax
call sub.cygwin1.dll_fflush
call sym.zsh.exe_zbeep
mov dword [esp], 0xa
call sub.cygwin1.dll_sleep
mov eax, dword [sym.zsh.exe_shout]
mov dword [esp], 0xa
mov dword [esp + 4], eax
call sub.cygwin1.dll_fputc
jmp 0x48037e
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2e
mov dword [esp + 4], 1
mov dword [esp], str.zsh:_sure_you_want_to_delete_all_the_files_in
call sub.cygwin1.dll_fwrite
jmp 0x480350
xor eax, eax
jmp 0x4802be
mov dword [esp], ebx
call sub.cygwin1.dll_closedir
mov eax, dword [sym.zsh.exe_shout]
mov dword [esp + 8], 0x64
mov dword [esp + 4], str.zsh:_sure_you_want_to_delete_more_than__d_files_in
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x480350
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret