joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434747
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xa8
mov eax, 0x5a71a2
call fcn.00553bc0
mov ebx, ecx
xor esi, esi
inc esi
cmp dword [ebp + 0x10], esi
jne 0x43478b
push dword [ebp + 0xc]
lea ecx, [ebp - 0x9c]
push dword [ebp + 8]
call fcn.004489ec
xor edi, edi
push esi
mov dword [ebp - 4], edi
mov ecx, dword [ebx + 0x50]
push eax
call fcn.0043d9ce
lea ecx, [ebp - 0x9c]
jmp 0x4348d7
xor edi, edi
cmp dword [ebx + 0x64], edi
je 0x4348ad
push edi
sub esp, 0xc
mov dword [ebp - 0x84], 0x356f3253
mov ecx, esp
mov dword [ebp - 0x80], 0x65513248
lea eax, [ebp - 0x19]
mov dword [ebp - 0x7c], 0x6e595342
lea edx, [ebp - 0x84]
mov dword [ebp - 0x78], 0x59556847
push ecx
push eax
push edx
mov dword [ebp - 0x74], 0x7259324c
mov dword [ebp - 0x70], 0x7777544b
mov dword [ebp - 0x6c], 0x616b6a42
mov dword [ebp - 0x68], 0x39776e43
mov dword [ebp - 0x64], 0x414d784b
mov dword [ebp - 0x60], 0x79636943
mov dword [ebp - 0x5c], 0x47553243
mov dword [ebp - 0x58], 0x7a384846
mov dword [ebp - 0x54], 0x466f5147
mov dword [ebp - 0x50], 0x4e457a48
mov dword [ebp - 0x4c], 0x4c774845
mov dword [ebp - 0x48], 0x67775243
mov dword [ebp - 0x44], 0x6d496849
mov dword [ebp - 0x40], 0x776c4343
mov dword [ebp - 0x3c], 0x426f6761
mov dword [ebp - 0x38], 0x65554165
mov dword [ebp - 0x34], 0x62635446
mov dword [ebp - 0x30], 0x74677764
mov dword [ebp - 0x2c], 0x5849694a
mov dword [ebp - 0x28], 0x30676a4b
mov dword [ebp - 0x24], 0x58677942
mov dword [ebp - 0x20], 0x41414141
mov word [ebp - 0x1c], 0x4541
mov byte [ebp - 0x1a], 0x73
call fcn.00450208
lea ecx, [ebp - 0x90]
call fcn.00451402
add esp, 0xc
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.00451547
mov esi, eax
push esi
call fcn.0045161e
pop ecx
push eax
push esi
lea ecx, [ebx + 0x54]
call fcn.0044fa93
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.004513e1
xor esi, esi
inc esi
push dword [ebp + 0xc]
lea ecx, [ebp - 0xb4]
push dword [ebp + 8]
call fcn.004489ec
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebx + 0x54]
mov dword [ebp - 4], 2
call fcn.0044fb54
lea ecx, [ebp - 0xb4]
push edi
push esi
call fcn.00451c1f
call fcn.00553b8e
ret 0xc
Function at 0x438f52
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x110
mov eax, 0x5a7656
call fcn.00553bf3
mov edi, ecx
cmp dword [edi], 0
mov esi, dword [ebp + 8]
je 0x438f73
push dword [edi]
call fcn.0054e49f
pop ecx
mov al, byte [esi]
test al, al
je 0x4391d8
cmp al, 0x2f
je 0x4391d8
push 0
sub esp, 0xc
mov dword [ebp - 0x100], 0x6a306a41
mov ecx, esp
mov dword [ebp - 0xfc], 0x76637a49
lea eax, [ebp - 0x1a]
mov dword [ebp - 0xf8], 0x6b4a6a4f
lea edx, [ebp - 0x100]
mov dword [ebp - 0xf4], 0x78637a49
push ecx
push eax
push edx
mov dword [ebp - 0xf0], 0x6845584e
mov dword [ebp - 0xec], 0x3255434d
mov dword [ebp - 0xe8], 0x39634849
mov dword [ebp - 0xe4], 0x676b7a4a
mov dword [ebp - 0xe0], 0x6d4d3263
mov dword [ebp - 0xdc], 0x7a304450
mov dword [ebp - 0xd8], 0x47735444
mov dword [ebp - 0xd4], 0x724d444b
mov dword [ebp - 0xd0], 0x7851334e
mov dword [ebp - 0xcc], 0x67637a42
mov dword [ebp - 0xc8], 0x71635443
mov dword [ebp - 0xc4], 0x646b4166
mov dword [ebp - 0xc0], 0x36304445
mov dword [ebp - 0xbc], 0x4a515349
mov dword [ebp - 0xb8], 0x2b354359
mov dword [ebp - 0xb4], 0x48516a66
mov dword [ebp - 0xb0], 0x32467849
mov dword [ebp - 0xac], 0x30455349
mov dword [ebp - 0xa8], 0x73777959
mov dword [ebp - 0xa4], 0x7955484e
mov dword [ebp - 0xa0], 0x6d555764
mov dword [ebp - 0x9c], 0x656f774d
mov dword [ebp - 0x98], 0x59554248
mov dword [ebp - 0x94], 0x73555842
mov dword [ebp - 0x90], 0x7630684a
mov dword [ebp - 0x8c], 0x41347a66
mov dword [ebp - 0x88], 0x446b5447
mov dword [ebp - 0x84], 0x724d5248
mov dword [ebp - 0x80], 0x466b4449
mov dword [ebp - 0x7c], 0x706f584c
mov dword [ebp - 0x78], 0x2b596946
mov dword [ebp - 0x74], 0x774e7763
mov dword [ebp - 0x70], 0x45516d4f
mov dword [ebp - 0x6c], 0x6141574f
mov dword [ebp - 0x68], 0x6c306e42
mov dword [ebp - 0x64], 0x51735841
mov dword [ebp - 0x60], 0x636b4265
mov dword [ebp - 0x5c], 0x4d59424b
mov dword [ebp - 0x58], 0x70395145
mov dword [ebp - 0x54], 0x6138324c
mov dword [ebp - 0x50], 0x6c357743
mov dword [ebp - 0x4c], 0x4749524c
mov dword [ebp - 0x48], 0x6c415346
mov dword [ebp - 0x44], 0x75557843
mov dword [ebp - 0x40], 0x4f73775a
mov dword [ebp - 0x3c], 0x30496743
mov dword [ebp - 0x38], 0x39316a4c
mov dword [ebp - 0x34], 0x354d4742
mov dword [ebp - 0x30], 0x4630694b
mov dword [ebp - 0x2c], 0x526f794c
mov dword [ebp - 0x28], 0x4234774f
mov dword [ebp - 0x24], 0x63594346
mov dword [ebp - 0x20], 0x41414141
mov word [ebp - 0x1c], 0x676a
call fcn.00450208
lea ecx, [ebp - 0x11c]
call fcn.00451402
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, eax
call fcn.00451547
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x10c]
lea eax, [ebp - 0x14]
push eax
call fcn.0054e202
mov dword [ebp - method.std::runtime_error.virtual_0], vtable.std::runtime_error.0
push 0x5f18ec
lea eax, [ebp - 0x10c]
push eax
call fcn.00553b2b
or edx, 0xffffffff
mov ecx, esi
call fcn.00438b4c
mov dword [edi], eax
call fcn.00553ba2
ret 4
Function at 0x43ca64
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xac
mov eax, 0x5a7881
call fcn.00553bf3
movsx eax, byte [ecx + 8]
cmp eax, 7
ja case.0x43ca20.0
jmp dword [eax*4 + 0x43cbbc]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
call fcn.005a53ff
jmp 0x43cbb6
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
call fcn.005a536e
jmp 0x43cbb6
movsd xmm0, qword [ecx]
jmp 0x43cbb6
cmp byte [ecx], 0
je case.0x43ca20.0
movsd xmm0, qword [0x5d19b8]
jmp 0x43cbb6
push 0
sub esp, 0xc
mov dword [ebp - 0x9c], 0x2b735346
mov ecx, esp
mov dword [ebp - 0x98], 0x6f49334b
lea eax, [ebp - 0x21]
mov dword [ebp - 0x94], 0x71455750
lea edx, [ebp - 0x9c]
mov dword [ebp - 0x90], 0x695a5449
push ecx
push eax
push edx
mov dword [ebp - 0x8c], 0x38346a49
mov dword [ebp - 0x88], 0x3245694d
mov dword [ebp - 0x84], 0x6f344449
mov dword [ebp - 0x80], 0x6f686949
mov dword [ebp - 0x7c], 0x724e794a
mov dword [ebp - 0x78], 0x676b444c
mov dword [ebp - 0x74], 0x72347a49
mov dword [ebp - 0x70], 0x65385266
mov dword [ebp - 0x6c], 0x57454265
mov dword [ebp - 0x68], 0x47557944
mov dword [ebp - 0x64], 0x51557a45
mov dword [ebp - 0x60], 0x4c775142
mov dword [ebp - 0x5c], 0x37705247
mov dword [ebp - 0x58], 0x754d6943
mov dword [ebp - 0x54], 0x414d5148
mov dword [ebp - 0x50], 0x35516d42
mov dword [ebp - 0x4c], 0x6d596946
mov dword [ebp - 0x48], 0x456f4141
mov dword [ebp - 0x44], 0x4663514a
mov dword [ebp - 0x40], 0x3445434b
mov dword [ebp - 0x3c], 0x6e52324b
mov dword [ebp - 0x38], 0x4d594463
mov dword [ebp - 0x34], 0x53775448
mov dword [ebp - 0x30], 0x6d385347
mov dword [ebp - 0x2c], 0x55596841
mov dword [ebp - 0x28], 0x41417766
mov word [ebp - 0x24], 0x4441
mov byte [ebp - 0x22], 0x63
call fcn.00450208
lea ecx, [ebp - 0xb8]
call fcn.00451402
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, eax
call fcn.00451547
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0xa8]
lea eax, [ebp - 0x18]
push eax
call fcn.0054e202
push 0x5f18ec
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], vtable.std::runtime_error.0
push eax
call fcn.00553b2b
xorps xmm0, xmm0
call fcn.00553ba2
ret
Function at 0x43e70e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xa4
mov eax, 0x5a7ba6
call fcn.00553bc0
mov esi, ecx
xor edi, edi
push edi
sub esp, 0xc
mov dword [ebp - 0x94], edi
mov ecx, esp
push ecx
test dl, dl
je 0x43e7f3
lea eax, [ebp - 0x42]
mov dword [ebp - 0x90], 0x3741534e
lea edx, [ebp - 0x90]
mov dword [ebp - 0x8c], 0x73637a4b
push eax
push edx
mov dword [ebp - 0x88], 0x394e7866
mov dword [ebp - 0x84], 0x786f514c
mov dword [ebp - 0x80], 0x63414744
mov dword [ebp - 0x7c], 0x5277524b
mov dword [ebp - 0x78], 0x46554241
mov dword [ebp - 0x74], 0x374e6764
mov dword [ebp - 0x70], 0x55675249
mov dword [ebp - 0x6c], 0x68774442
mov dword [ebp - 0x68], 0x39776849
mov dword [ebp - 0x64], 0x3059674e
mov dword [ebp - 0x60], 0x33637766
mov dword [ebp - 0x5c], 0x7a554246
mov dword [ebp - 0x58], 0x3377524b
mov dword [ebp - 0x54], 0x4a305348
mov dword [ebp - 0x50], 0x49516a59
mov dword [ebp - 0x4c], 0x61414348
mov dword [ebp - 0x48], 0x41414141
mov word [ebp - 0x44], 0x674d
call fcn.00450208
lea ecx, [ebp - 0xb0]
call fcn.00451402
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 4], edi
inc ebx
jmp 0x43e872
lea eax, [ebp - 0xe]
mov dword [ebp - 0x40], 0x694d7a4a
lea edx, [ebp - 0x40]
mov dword [ebp - 0x3c], 0x5a635450
push eax
push edx
mov dword [ebp - 0x38], 0x77527744
mov dword [ebp - 0x34], 0x68556749
mov dword [ebp - 0x30], 0x69556d4a
mov dword [ebp - 0x2c], 0x77414350
mov dword [ebp - 0x28], 0x65553259
mov dword [ebp - 0x24], 0x2b394841
mov dword [ebp - 0x20], 0x736f524b
mov dword [ebp - 0x1c], 0x67566865
mov dword [ebp - 0x18], 0x50675247
mov dword [ebp - 0x14], 0x41414141
mov word [ebp - 0x10], 0x4148
call fcn.00450208
lea ecx, [ebp - 0xa4]
call fcn.00451402
add esp, 0xc
push 2
mov dword [ebp - 4], 1
pop ebx
mov ecx, eax
mov dword [ebp - 0x94], ebx
call fcn.00451547
push eax
mov ecx, esi
call fcn.0045165a
or ebx, 4
test bl, 2
je 0x43e89d
lea ecx, [ebp - 0xa4]
and ebx, 0xfffffffd
call fcn.004513e1
test bl, 1
je 0x43e8ad
lea ecx, [ebp - 0xb0]
call fcn.004513e1
mov eax, esi
call fcn.00553b8e
ret
Function at 0x447de9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xb4
mov eax, 0x5a826a
call fcn.00553bc0
mov esi, ecx
mov ecx, dword [ebp + 8]
xor edi, edi
push edi
call fcn.0043d9e9
test al, al
je 0x447f77
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc0]
push edi
push eax
call fcn.0043da04
mov edx, eax
mov dword [ebp - 4], edi
lea ecx, [ebp - 0xa8]
call fcn.004486ef
mov byte [ebp - 4], 1
mov edx, eax
mov ecx, dword [esi + 0xc]
call fcn.0044c5c4
push edi
push 1
lea ecx, [ebp - 0xa8]
call fcn.00451c1f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
push edi
push 1
call fcn.00451c1f
push edi
sub esp, 0xc
mov dword [ebp - 0x84], 0x6f417a53
mov ecx, esp
mov dword [ebp - 0x80], 0x7063694f
lea eax, [ebp - 0xe]
mov dword [ebp - 0x7c], 0x54416a66
lea edx, [ebp - 0x84]
mov dword [ebp - 0x78], 0x6f63694b
push ecx
push eax
push edx
mov dword [ebp - 0x74], 0x5859514d
mov dword [ebp - 0x70], 0x77465161
mov dword [ebp - 0x6c], 0x51385759
mov dword [ebp - 0x68], 0x6c787841
mov dword [ebp - 0x64], 0x45384341
mov dword [ebp - 0x60], 0x6a526843
mov dword [ebp - 0x5c], 0x33643246
mov dword [ebp - 0x58], 0x656b5242
mov dword [ebp - 0x54], 0x43514247
mov dword [ebp - 0x50], 0x7a305249
mov dword [ebp - 0x4c], 0x3230444e
mov dword [ebp - 0x48], 0x3130794b
mov dword [ebp - 0x44], 0x79595445
mov dword [ebp - 0x40], 0x78457744
mov dword [ebp - 0x3c], 0x6d737a4e
mov dword [ebp - 0x38], 0x6d4e4244
mov dword [ebp - 0x34], 0x6867784f
mov dword [ebp - 0x30], 0x49305445
mov dword [ebp - 0x2c], 0x424d5143
mov dword [ebp - 0x28], 0x36467959
mov dword [ebp - 0x24], 0x686c3244
mov dword [ebp - 0x20], 0x5767774e
mov dword [ebp - 0x1c], 0x51387741
mov dword [ebp - 0x18], 0x4f344144
mov dword [ebp - 0x14], 0x41414141
mov word [ebp - 0x10], 0x7755
call fcn.00450208
lea ecx, [ebp - 0x90]
call fcn.00451402
add esp, 0xc
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.00451547
mov ecx, dword [esi + 0xc]
mov edx, eax
call fcn.0044c3c7
lea ecx, [ebp - 0x90]
call fcn.004513e1
call fcn.00553b8e
ret 4
Function at 0x4504b2
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0xc
mov eax, 0x5a8e2e
call fcn.00553bf3
mov esi, ecx
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
je 0x45052c
push ebx
push ebx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push 1
push dword [eax - 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x4504ee
mov eax, dword [esi]
mov dword [esi + 4], eax
jmp 0x450524
push dword [ebp - 0x14]
mov ecx, esi
call fcn.00450469
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push ebx
push ebx
push eax
mov esi, dword [edi - 0xc]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.00450beb
push eax
push 1
push esi
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x45052c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00450c0a
mov eax, ebx
call fcn.00553ba2
ret
Function at 0x451402
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x5a8ea7
call fcn.00553bf3
mov ebx, ecx
xor edx, edx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], edx
xor ecx, ecx
mov dword [ebp - 0x34], edx
mov edi, ebx
inc ecx
mov dword [ebp - 4], ecx
xor eax, eax
mov esi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
xor eax, eax
mov dword [ebp - 0x38], ecx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x29]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 0x29], dl
call fcn.004502c3
push ecx
lea ecx, [ebp + 8]
lea edi, [ebp - 0x28]
call fcn.00450beb
push ecx
mov ecx, esp
push eax
call fcn.00450baa
mov ecx, edi
call fcn.004504b2
mov edx, dword [ebp - 0x28]
pop ecx
mov ecx, dword [ebp - 0x24]
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x30], eax
je 0x4514d4
push dword [ebp - 0x3c]
and dword [ebp - 0x18], esi
lea eax, [ecx - 4]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.00450d57
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00450e5c
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esp
push eax
call fcn.0045109d
call fcn.00450ea8
mov edx, dword [ebp - 0x28]
add esp, 0xc
add eax, 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
xor edi, edi
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
je 0x451507
mov al, byte [edx + edi]
mov ecx, ebx
xor al, byte [esi + 0x5c6700]
mov byte [ebp - 0x29], al
lea eax, [ebp - 0x29]
push eax
call fcn.00451301
mov edx, dword [ebp - 0x28]
inc esi
xor eax, eax
cmp esi, 0x1e
cmovge esi, eax
inc edi
cmp edi, dword [ebp - 0x30]
jb 0x4514de
lea eax, [ebp - 0x29]
mov byte [ebp - 0x29], 0
push eax
mov ecx, ebx
call fcn.00451301
lea ecx, [ebp - 0x1c]
call fcn.00451121
lea ecx, [ebp - 0x28]
call fcn.00451121
lea ecx, [ebp + 8]
call fcn.00451121
mov eax, ebx
call fcn.00553ba2
ret
Function at 0x4766ee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0xc], ebx
test esi, esi
jne 0x476708
xor eax, eax
jmp 0x4767e1
push edi
push 8
pop edx
call fcn.004543e5
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x47674e
test byte [ebp + 8], 1
mov eax, dword [esi]
mov dword [edi], eax
jne 0x476731
xor eax, eax
inc eax
cmp dword [esi], eax
jle 0x476731
add eax, eax
cmp eax, dword [esi]
jl 0x47672b
imul edx, eax, 0x18
mov ecx, ebx
call fcn.004543e5
mov ebx, eax
mov dword [edi + 4], ebx
test ebx, ebx
jne 0x476755
mov ecx, dword [ebp - 0xc]
mov edx, edi
call fcn.00454220
xor eax, eax
jmp 0x4767e0
and dword [ebp - 0x10], 0
cmp dword [esi], 0
mov ecx, dword [esi + 4]
mov dword [ebp - 4], ecx
jle 0x4767de
mov edi, dword [ebp - 0xc]
lea eax, [ebx + 0x10]
mov dword [ebp - 8], eax
sub ebx, ecx
mov edx, dword [ecx]
mov ecx, edi
push 0
push dword [ebp + 8]
call fcn.0047644b
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ebx + ecx], eax
mov edx, dword [ecx + 4]
mov ecx, edi
call fcn.0045450c
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ecx - 0xc], eax
mov ecx, edi
mov edx, dword [edx + 8]
call fcn.0045450c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [edx - 8], eax
mov al, byte [ecx + 0xc]
and dword [edx], 0xfffffffe
mov byte [edx - 4], al
mov eax, dword [ecx + 0x10]
xor eax, dword [edx]
and eax, 2
xor dword [edx], eax
mov eax, dword [ecx + 0x14]
add ecx, 0x18
mov dword [edx + 4], eax
add edx, 0x18
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ecx
cmp eax, dword [esi]
jl 0x47676f
mov edi, dword [ebp - 0x14]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49f8ad
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
ret
Function at 0x4a36cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4a36d7
xor eax, eax
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 8]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x4a378f
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5c9f30]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5c9f30]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5c9f30]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5c9f30]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5c9f30]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5c9f30]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5c9f30]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5c9f30]
dec edi
jne 0x4a36f2
pop edi
test esi, esi
je 0x4a37a8
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x5c9f30]
inc edx
dec esi
jne 0x4a3793
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x4a37b0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov edx, 0xff
mov esi, dword [edi]
xor eax, esi
and eax, edx
shr esi, 8
mov eax, dword [eax*4 + 0x5c9f30]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, edx
xor eax, dword [ecx*4 + 0x5c9f30]
mov dword [edi + 8], eax
pop edi
pop esi
ret
Function at 0x4a4bd8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x5f4748]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x4a4c1d
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4a4c18
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x4a4c44
mov edx, dword [edi + 0x1c]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x18]
jbe 0x4a4c2d
mov esi, dword [edi + 0x18]
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 8]
call fcn.00553450
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
mov ecx, dword [ebp - 4]
xor edx, edx
pop edi
div ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0054d1e7
mov esp, ebp
pop ebp
ret

Function at 0x4a5ae9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi], ebx
jne 0x4a5ba2
cmp dword [edi + 4], 0xffffffff
jne 0x4a5ba2
lea esi, [edi + 0x244]
push esi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x4a5b1c
sub esi, ecx
sar esi, 1
movzx eax, word [edi + esi*2 + 0x242]
cmp eax, 0x5c
je 0x4a5b52
push 0x2f
pop ecx
cmp ax, cx
je 0x4a5b52
xor eax, eax
mov word [edi + esi*2 + 0x244], cx
mov word [edi + esi*2 + 0x246], ax
cmp dword [ebp + 0x10], 1
jne 0x4a5b6c
mov ecx, dword [ebp + 8]
call fcn.0049f800
cmp eax, 0xffffffff
jne 0x4a5b6c
mov eax, 0x2000000
jmp 0x4a5ba7
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 4]
mov ecx, dword [ebp + 8]
push eax
push dword [ebp + 0x10]
call fcn.004a4a18
pop ecx
pop ecx
test eax, eax
jne 0x4a5b89
mov eax, dword [ebp - 4]
jmp 0x4a5ba7
mov ecx, eax
call fcn.004a4eb5
xor ecx, ecx
mov dword [edi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
jmp 0x4a5ba7
mov eax, 0x1000000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a6f77
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x5f4748]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, ecx
mov dword [ebp - 0x41c], 0x5c
xor esi, esi
mov dword [ebp - 0x418], eax
mov edi, edx
mov ebx, 0x104
push 0x2f
pop edx
test eax, eax
je 0x4a7034
push ebx
push eax
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0054efab
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4a6fce
sub ecx, edx
sar ecx, 1
je 0x4a7014
movzx eax, word [ebp + ecx*2 - 0x20e]
push 0x2f
pop edx
cmp ax, dx
je 0x4a6ff7
push 0x5c
pop edx
cmp ax, dx
jne 0x4a7014
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x4a713a
xor eax, eax
mov word [ebp + ecx - 0x20c], ax
lea ecx, [ebp - 0x20c]
call fcn.0049f8ad
test al, al
jne 0x4a7031
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x2f
pop edx
movzx eax, word [edi]
test ax, ax
je 0x4a7129
mov esi, edi
mov ecx, edi
cmp ax, dx
je 0x4a7052
cmp ax, word [ebp - 0x41c]
jne 0x4a7054
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x4a7044
cmp esi, edi
je 0x4a70a4
sub esi, edi
lea eax, [ebp - 0x20c]
and esi, 0xfffffffe
push esi
push edi
push eax
call fcn.00553450
add esp, 0xc
cmp esi, 0x208
jae 0x4a713a
xor eax, eax
lea edx, [ebp - 0x20c]
mov word [ebp + esi - 0x20c], ax
mov esi, dword [ebp - 0x418]
mov ecx, esi
call fcn.004a6f77
jmp 0x4a70aa
mov esi, dword [ebp - 0x418]
xor eax, eax
mov word [ebp - 0x414], ax
test esi, esi
je 0x4a70c9
push ebx
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0054efab
add esp, 0x10
xor eax, eax
lea ecx, [ebp - 0x414]
mov word [ebp - 0x20e], ax
lea edx, [ecx + 2]
xor esi, esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4a70dd
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
sub ebx, ecx
push ebx
push edi
lea eax, [eax + ecx*2]
push ebx
push eax
call fcn.0054efab
add esp, 0x10
lea ecx, [ebp - 0x414]
xor eax, eax
mov word [ebp - 0x20e], ax
call fcn.0049f8ad
test al, al
jne 0x4a7129
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054d1e7
mov esp, ebp
pop ebp
ret
call fcn.0054dca2
int3