joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ab50
Capabilities:
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff4c
mov eax, dword [0x769648]
mov dword [ebp - 0x20], eax
mov eax, dword [0x76964c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x769650]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], SysStringLen
mov dword [ebp - 8], 1
xor edx, edx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x49acea
mov eax, dword [0x769654]
cmp eax, 0xffffffff
je 0x49abb1
push dword [0x769654]
call sub.KERNEL32.DLL_CloseHandle
mov dword [0x769654], 0xffffffff
push 0x94
push 0
lea edx, [ebp - 0xb4]
push edx
call fcn.0066cc88
add esp, 0xc
push 0xc
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.0066cc88
add esp, 0xc
mov dword [ebp - 0xb4], 0x94
lea eax, [ebp - 0xb4]
push eax
call sub.KERNEL32.DLL_GetVersionExA
mov edx, dword [ebp - 0xa4]
cmp edx, 2
jne 0x49ac0e
mov ecx, dword [ebp - 0xb0]
cmp ecx, 4
jbe 0x49ac0e
or dword [ebp - 4], 0x40000000
or dword [ebp - 8], 2
mov al, byte [ebp + 8]
add al, 0x41
movsx edx, al
push edx
push 0x769737
lea ecx, [ebp - 0x20]
push ecx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
push 0
push 0x80
push 3
push 0
push dword [ebp - 8]
push dword [ebp - 4]
lea eax, [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [0x769654], eax
mov edx, dword [0x769654]
cmp edx, 0xffffffff
jne 0x49ac7c
xor dword [ebp - 4], 0x40000000
xor dword [ebp - 8], 2
push 0
push 0x80
push 3
push 0
push dword [ebp - 8]
push dword [ebp - 4]
lea ecx, [ebp - 0x20]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov dword [0x769654], eax
mov eax, dword [0x769654]
cmp eax, 0xffffffff
jne 0x49ac8d
xor eax, eax
jmp 0x49ad14
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 0x14], eax
push 0
lea edx, [ebp - 0x10]
push edx
push 0
push 0
push 0
push 0
push 0x90018
push dword [0x769654]
call sub.KERNEL32.DLL_DeviceIoControl
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x49ace0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0x90020
push dword [0x769654]
call sub.KERNEL32.DLL_DeviceIoControl
mov dword [ebp - 0xc], eax
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_SetErrorMode
jmp 0x49ad11
mov edx, dword [0x769654]
cmp edx, 0xffffffff
je 0x49ad0a
push dword [0x769654]
call sub.KERNEL32.DLL_CloseHandle
mov dword [0x769654], 0xffffffff
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x49bb68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov eax, dword [ebp + 8]
add eax, 0x810
mov dword [ebp - 8], eax
xor edx, edx
mov dword [ebp - 0x10], edx
xor ecx, ecx
mov word [ebp - 0x14], cx
mov word [ebp - 0x12], cx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x13
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx]
mov edx, dword [ebp - 0xc]
shl edx, 9
lea ecx, [edx + 0x76a9e4]
mov ax, word [ecx + eax*2]
xor word [ebp - 0x12], ax
inc dword [ebp - 4]
mov edx, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [edx]
mov eax, dword [ebp - 0xc]
shl eax, 9
lea edx, [eax + 0x76a9e4]
mov cx, word [edx + ecx*2]
xor word [ebp - 0x14], cx
add dword [ebp - 4], 0x55
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, 0x2b
jl 0x49bb95
movzx edx, word [ebp - 0x12]
sar edx, 8
mov ecx, dword [ebp - 8]
mov byte [ecx], dl
mov al, byte [ebp - 0x12]
mov edx, dword [ebp - 8]
mov byte [edx + 0x56], al
movzx ecx, word [ebp - 0x14]
sar ecx, 8
mov eax, dword [ebp - 8]
mov byte [eax + 1], cl
mov dl, byte [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov byte [ecx + 0x57], dl
add dword [ebp - 8], 2
add dword [ebp + 8], 2
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 0x2b
jl 0x49bb7e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x49ea24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
mov eax, dword [ebp + 8]
test eax, eax
je 0x49ea3d
mov edx, dword [ebp + 8]
mov cl, byte [edx]
test cl, cl
jne 0x49ea44
xor eax, eax
jmp 0x49ebe6
mov dword [ebp - 0x10], 0x3e76f499
xor dword [ebp - 0x10], 0x20060624
push dword [ebp - 0x10]
push 0x770cbb
lea edx, [ebp - 0xc]
push edx
call fcn.006712b0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [eax*4 + 0x7709a0]
mov cl, byte [ebp + edx - 0xc]
mov eax, dword [ebp - 0x14]
mov dl, byte [eax + 0x7709c0]
xor cl, dl
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x120], cl
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jl 0x49ea6b
push dword [ebp + 8]
call fcn.0066ce38
pop ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x40
jle 0x49eab4
mov dword [ebp - 0x1c], 0x40
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
jge 0x49eb03
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov al, byte [edx + ecx]
mov edx, dword [ebp - 0x18]
mov cl, byte [ebp + edx - 0x120]
xor al, cl
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
mov byte [edx + ecx], al
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 8
jl 0x49eaf6
xor eax, eax
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
jl 0x49eac8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
mov byte [eax + edx], 0
mov cl, byte [ebp - 0x1c]
not cl
mov al, byte [ebp - 0x11b]
xor cl, al
xor edx, edx
mov dl, cl
push edx
push 0x770cbf
lea ecx, [ebp - 0x120]
push ecx
call fcn.006712b0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
jge 0x49eb76
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax + edx]
push ecx
push 0x770cc4
mov eax, dword [ebp - 0x14]
add eax, eax
lea edx, [ebp - 0x11e]
add eax, edx
push eax
call fcn.006712b0
add esp, 0xc
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
jl 0x49eb42
mov edx, dword [ebp - 0x14]
cmp edx, 0x40
jge 0x49ebcf
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
mov al, byte [ecx + edx]
mov edx, dword [ebp - 0x14]
and edx, 0x80000007
jns 0x49eb9b
dec edx
or edx, 0xfffffff8
inc edx
mov cl, byte [edx + 0x7709c0]
xor al, cl
and eax, 0xff
push eax
push 0x770cc9
mov edx, dword [ebp - 0x14]
add edx, edx
lea ecx, [ebp - 0x11e]
add edx, ecx
push edx
call fcn.006712b0
add esp, 0xc
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x40
jl 0x49eb7e
lea edx, [ebp - 0x120]
push edx
push dword [ebp + 0xc]
call fcn.0066ce08
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4a47ec
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
mov dword [ebp - 0x2c], eax
mov eax, 0x773668
call fcn.0066d220
mov dx, word [0x770a84]
mov word [ebp - 0x3c], dx
mov dl, byte [0x770a86]
mov byte [ebp - 0x3a], dl
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx + 0x438]
add eax, 0x23c
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov eax, dword [edx]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4a4851
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx + 0x438]
add eax, 0x23c
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov eax, dword [edx]
mov edx, dword [eax]
call dword [edx + 0x44]
push 0x104
push 0
lea ecx, [ebp - 0x164]
push ecx
call fcn.0066cc88
add esp, 0xc
lea eax, [ebp - 0x164]
push eax
push 0x104
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
mov dword [ebp - 0x38], eax
xor edx, edx
mov dword [ebp - 0x34], edx
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x38]
cmp eax, edx
jge 0x4a48e4
mov ecx, dword [ebp - 0x30]
mov al, byte [ebp + ecx - 0x164]
mov byte [ebp - 0x39], al
mov dl, byte [ebp - 0x39]
cmp dl, 0x61
jb 0x4a48b0
mov cl, byte [ebp - 0x39]
cmp cl, 0x7a
ja 0x4a48b0
add byte [ebp - 0x39], 0xe0
mov al, byte [ebp - 0x39]
cmp al, 0x42
jbe 0x4a48c9
mov edx, dword [ebp - 0x34]
mov cl, byte [ebp - 0x39]
mov byte [ebp + edx - 0x60], cl
inc dword [ebp - 0x34]
jmp 0x4a48c9
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dl, byte [ebp + eax - 0x164]
test dl, dl
jne 0x4a48c6
inc dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
jl 0x4a488f
mov edx, dword [ebp - 0x34]
mov byte [ebp + edx - 0x60], 0
mov dword [ebp - 0x30], 2
mov cl, byte [ebp - 0x30]
add cl, 0x41
mov byte [ebp - 0x39], cl
xor eax, eax
mov al, byte [ebp - 0x39]
push eax
lea edx, [ebp - 0x60]
push edx
call fcn.0066cf45
add esp, 8
test eax, eax
jne 0x4a4951
mov cl, byte [ebp - 0x39]
mov byte [ebp - 0x3c], cl
mov word [ebp - 0x18], 8
lea edx, [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.0067d2d0
inc dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x438]
xor ecx, ecx
mov ebx, dword [eax]
call dword [ebx + 0xd0]
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0067d4bc
inc dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
cmp ecx, 0x1a
jl 0x4a48f3
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x438]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a8218
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 8]
test edx, edx
je 0x4a8233
mov ecx, dword [ebp + 8]
mov al, byte [ecx]
test al, al
jne 0x4a823a
xor eax, eax
jmp 0x4a82e4
push 0x44
push 0
lea edx, [ebp - 0x60]
push edx
call fcn.0066cc88
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 0x101
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x24], eax
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x28], eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x20], eax
mov word [ebp - 0x30], 0
lea ecx, [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push dword [ebp + 8]
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x4a82a2
xor eax, eax
jmp 0x4a82e4
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_CloseHandle
test eax, eax
push 0x1388
push dword [ebp - 0x1c]
call sub.KERNEL32.DLL_WaitForSingleObject
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
test edx, edx
jne 0x4a82d9
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x1c]
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
je 0x4a82d9
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4af0a8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
mov eax, 0x77554c
call fcn.0066d220
mov edx, dword [ebp + 8]
test edx, edx
jne 0x4af0d4
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x4af2b4
mov edx, dword [ebp + 8]
add edx, 0x23c
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x4af0ff
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x4af2b4
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0xc8]
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov dword [ebp - 0x34], ecx
jmp 0x4af27c
mov word [ebp - 0x1c], 8
mov eax, dword [ebp + 8]
add eax, 0x23c
mov dword [ebp - 0x50], eax
xor edx, edx
mov dword [ebp - 4], edx
lea ecx, [ebp - 4]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov edx, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4af14c
mov edx, dword [ebp - 4]
jmp 0x4af151
mov edx, 0x774fdd
push edx
lea eax, [ebp - 0x158]
push eax
call fcn.0066ce08
add esp, 8
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0067d4bc
movsx ecx, byte [ebp - 0x158]
push ecx
push 0x774fde
lea eax, [ebp - 0x16c]
push eax
call fcn.006712b0
add esp, 0xc
mov dl, byte [ebp - 0x158]
mov byte [ebp - 0x2d], dl
mov cl, byte [ebp - 0x2d]
cmp cl, 0x61
jb 0x4af1a9
mov al, byte [ebp - 0x2d]
cmp al, 0x7a
ja 0x4af1a9
add byte [ebp - 0x2d], 0xe0
xor edx, edx
mov dl, byte [ebp - 0x2d]
movsx ecx, byte [ebp + 0xc]
cmp edx, ecx
jne 0x4af279
mov byte [ebp - 0x270], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4af1ee
push 0
push 0
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x38]
push ecx
push 0
push 0x104
lea eax, [ebp - 0x270]
push eax
lea edx, [ebp - 0x16c]
push edx
call sub.KERNEL32.DLL_GetVolumeInformationA
mov cl, byte [ebp - 0x270]
test cl, cl
je 0x4af21b
lea eax, [ebp - 0x270]
push eax
xor edx, edx
mov dl, byte [ebp - 0x2d]
push edx
push 0x774fe3
lea ecx, [ebp - 0x158]
push ecx
call fcn.006712b0
add esp, 0x10
jmp 0x4af235
xor eax, eax
mov al, byte [ebp - 0x2d]
push eax
push 0x774fe9
lea edx, [ebp - 0x158]
push edx
call fcn.006712b0
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x23c
mov dword [ebp - 0x54], ecx
mov word [ebp - 0x1c], 0x14
lea edx, [ebp - 0x158]
lea eax, [ebp - 8]
call fcn.0067d2d0
inc dword [ebp - 0x10]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov edx, dword [ebp - 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x20]
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0067d4bc
jmp 0x4af29d
inc dword [ebp - 0x34]
mov ecx, dword [ebp + 8]
add ecx, 0x23c
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ecx, dword [ebp - 0x34]
cmp eax, ecx
jg 0x4af117
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebp - 0x2c]
mov dword fs:[0], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b74cc
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], edx
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
pop ebp
ret

Function at 0x4b7a78
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff764
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x4b7aaa
xor eax, eax
jmp 0x4b7b8b
lea edx, [ebp - 0x89c]
push edx
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileInformationByHandle
test eax, eax
jne 0x4b7acc
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4b7b8b
mov eax, dword [ebp - 0x87c]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x878]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
lea ecx, [ebp - 0x68]
push ecx
call fcn.004b74cc
pop ecx
jmp 0x4b7b4f
push 0
lea eax, [ebp - 0x10]
push eax
push 0x800
lea edx, [ebp - 0x868]
push edx
push dword [ebp - 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x4b7b5f
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4b7b5f
push dword [ebp - 0x10]
lea eax, [ebp - 0x868]
push eax
lea edx, [ebp - 0x68]
push edx
call fcn.004b7508
add esp, 0xc
mov eax, dword [ebp - 0x10]
xor edx, edx
sub dword [ebp - 0xc], eax
sbb dword [ebp - 8], edx
inc dword [0x7e36a4]
call fcn.004fd2e4
cmp dword [ebp - 8], 0
jne 0x4b7b5d
cmp dword [ebp - 0xc], 0
ja 0x4b7afe
jmp 0x4b7b5f
jg 0x4b7afe
lea ecx, [ebp - 0x68]
push ecx
push dword [ebp + 8]
call fcn.004b75f0
add esp, 8
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 8], 0
jne 0x4b7b89
cmp dword [ebp - 0xc], 0
jne 0x4b7b89
mov eax, 1
jmp 0x4b7b8b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4b7dac
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7b4
mov dword [ebp - 8], 0xffffffff
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x4b7de5
xor eax, eax
jmp 0x4b7ef1
lea edx, [ebp - 0x84c]
push edx
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileInformationByHandle
test eax, eax
jne 0x4b7e07
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4b7ef1
mov eax, dword [ebp - 0x82c]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x828]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x4b7eb2
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0x800
lea eax, [ebp - 0x818]
push eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x4b7eca
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x4b7eca
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jae 0x4b7e9c
mov ecx, dword [ebp - 8]
shr ecx, 8
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ebp + eax - 0x818]
mov eax, dword [ebp - 8]
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x777214]
xor ecx, edx
mov dword [ebp - 8], ecx
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
jb 0x4b7e66
mov eax, dword [ebp - 0x18]
xor edx, edx
sub dword [ebp - 0x10], eax
sbb dword [ebp - 0xc], edx
inc dword [0x7e36a4]
call fcn.004fd2e4
cmp dword [ebp - 0xc], 0
jne 0x4b7ec4
cmp dword [ebp - 0x10], 0
ja 0x4b7e32
jmp 0x4b7eca
jg 0x4b7e32
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp - 8]
not ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
cmp dword [ebp - 0xc], 0
jne 0x4b7eef
cmp dword [ebp - 0x10], 0
jne 0x4b7eef
mov eax, 1
jmp 0x4b7ef1
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4be7ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
mov eax, dword [ebp + 0xc]
imul dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov edx, dword [0x7dc52c]
test edx, edx
je 0x4be953
mov eax, dword [ebp - 4]
xor edx, edx
add eax, dword [0x7dc530]
adc edx, dword [0x7dc534]
cmp edx, dword [0x7dc53c]
jne 0x4be830
cmp eax, dword [0x7dc538]
ja 0x4be85f
jmp 0x4be832
jg 0x4be85f
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 4]
push dword [ebp + 8]
push dword [0xa84398]
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 4]
xor edx, edx
add dword [0x7dc530], eax
adc dword [0x7dc534], edx
jmp 0x4be96a
mov eax, dword [0x7dc538]
mov ecx, eax
mov eax, dword [0x7dc530]
sub ecx, eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
test edx, edx
jbe 0x4be8a4
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0x18]
push dword [ebp + 8]
push dword [0xa84398]
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x4be974
mov ecx, dword [ebp - 0x18]
sub dword [ebp - 4], ecx
mov eax, dword [0xa84398]
mov dword [ebp - 0x1c], eax
inc dword [0x7dc540]
push dword [0x7dc540]
push dword [0x900208]
push str._s._03i
lea edx, [ebp - 0x124]
push edx
call fcn.006712b0
add esp, 0x10
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x124]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov dword [0xa84398], eax
mov eax, dword [0xa84398]
cmp eax, 0xffffffff
jne 0x4be907
mov edx, dword [ebp - 0x1c]
mov dword [0xa84398], edx
jmp 0x4be974
push dword [ebp - 0x1c]
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp - 4]
test ecx, ecx
jbe 0x4be93b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
add ecx, eax
push ecx
push dword [0xa84398]
call sub.KERNEL32.DLL_WriteFile
jmp 0x4be940
xor edx, edx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [0x7dc530], eax
mov dword [0x7dc534], edx
jmp 0x4be96a
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 4]
push dword [ebp + 8]
push dword [0xa84398]
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp eax, edx
je 0x4be991
mov ecx, dword [0x6fb15c]
test ecx, ecx
jne 0x4be98d
call fcn.00462b40
mov dword [0x6fb15c], 1
xor eax, eax
jmp 0x4be994
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4c5d2c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, dword [ebp + 0xc]
cdq
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [0x777e30]
cdq
push edx
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
call fcn.00674900
push edx
push eax
mov eax, dword [0x777e38]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
jne 0x4c5d93
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x4c5d93
xor eax, eax
jmp 0x4c5e92
mov edx, dword [ebp + 0x14]
imul edx, dword [0x777e30]
mov dword [ebp - 0x14], edx
mov ecx, dword [0x777e30]
cmp ecx, 0x930
jne 0x4c5dd7
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.KERNEL32.DLL_ReadFile
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
je 0x4c5e8b
xor eax, eax
jmp 0x4c5e92
push dword [ebp - 0x14]
call fcn.0066c62c
pop ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
test edx, edx
jne 0x4c5e0b
push 0x59fa
call fcn.00402b9c
pop ecx
push eax
push dword [0x76875c]
call fcn.00462a84
add esp, 8
xor eax, eax
jmp 0x4c5e92
push 0
lea edx, [ebp - 0x18]
push edx
push dword [ebp - 0x14]
push dword [ebp - 0x24]
push dword [ebp + 8]
call sub.KERNEL32.DLL_ReadFile
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
je 0x4c5e36
push dword [ebp - 0x24]
call fcn.0066c63c
pop ecx
xor eax, eax
jmp 0x4c5e92
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
cmp eax, edx
jge 0x4c5e82
push 0x930
mov ecx, dword [ebp - 4]
imul ecx, dword [0x777e30]
mov eax, dword [ebp - 0x24]
add ecx, eax
push ecx
imul edx, dword [ebp - 4], 0x930
mov ecx, dword [ebp - 0x28]
add edx, ecx
push edx
call fcn.0066cc18
add esp, 0xc
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
cmp eax, edx
jl 0x4c5e4b
push dword [ebp - 0x24]
call fcn.0066c63c
pop ecx
imul eax, dword [ebp + 0x14], 0x930
mov esp, ebp
pop ebp
ret
Function at 0x4c64a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov eax, dword [ebp + 0xc]
cdq
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [0x777e30]
cdq
push edx
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
call fcn.00674900
push edx
push eax
mov eax, dword [0x777e38]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [0x777e34]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
push 0
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
jne 0x4c651a
call sub.KERNEL32.DLL_GetLastError
test eax, eax
je 0x4c651a
xor eax, eax
jmp 0x4c6548
mov dword [ebp - 0x14], 0x800
push 0
lea edx, [ebp - 0x18]
push edx
push dword [ebp - 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
je 0x4c6543
xor eax, eax
jmp 0x4c6548
mov eax, 0x800
mov esp, ebp
pop ebp
ret