joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad330
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x28
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
mov ebp, ecx
mov edx, dword [ebp + 0x54]
sub edx, 6
test edx, edx
push esi
push edi
jle 0x4ad35a
mov esi, dword [esp + 0x3c]
mov ecx, edx
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor ecx, ecx
xor eax, eax
test edx, edx
jle 0x4ad399
cmp esi, dword [ebp + 0x54]
jg 0x4ad4e1
cmp eax, edx
jge 0x4ad38b
cmp ecx, 4
jge 0x4ad38e
mov ebx, dword [esp + eax*4 + 0x14]
lea edi, [ecx + esi*4]
add eax, 1
add ecx, 1
cmp eax, edx
mov dword [ebp + edi*4 + 0x58], ebx
jl 0x4ad371
cmp ecx, 4
jne 0x4ad395
add esi, 1
xor ecx, ecx
cmp eax, edx
jl 0x4ad364
cmp esi, dword [ebp + 0x54]
jg 0x4ad4e1
mov dword [esp + 0x10], 0x5e2428
lea ebx, [ebx]
movzx edi, byte [esp + edx*4 + 0x11]
mov al, byte [esp + 0x14]
xor al, byte [edi + str.cw]
mov byte [esp + 0x14], al
movzx edi, byte [esp + edx*4 + 0x12]
movzx ebx, byte [edi + str.cw]
xor byte [esp + 0x15], bl
movzx edi, byte [esp + edx*4 + 0x13]
movzx ebx, byte [edi + str.cw]
xor byte [esp + 0x16], bl
movzx edi, byte [esp + edx*4 + 0x10]
movzx ebx, byte [edi + str.cw]
mov edi, dword [esp + 0x10]
xor al, byte [edi]
xor byte [esp + 0x17], bl
add edi, 4
cmp edx, 8
mov byte [esp + 0x14], al
mov dword [esp + 0x10], edi
mov eax, 1
je 0x4ad431
cmp edx, eax
jle 0x4ad4a0
jmp 0x4ad420
mov edi, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], edi
add eax, 1
cmp eax, edx
jl 0x4ad420
jmp 0x4ad4a0
mov edi, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], edi
add eax, 1
cmp eax, 4
jl 0x4ad431
movzx eax, byte [esp + 0x20]
movzx eax, byte [eax + str.cw]
xor byte [esp + 0x24], al
movzx eax, byte [esp + 0x21]
movzx eax, byte [eax + str.cw]
xor byte [esp + 0x25], al
movzx eax, byte [esp + 0x22]
movzx eax, byte [eax + str.cw]
xor byte [esp + 0x26], al
movzx eax, byte [esp + 0x23]
movzx eax, byte [eax + str.cw]
xor byte [esp + 0x27], al
mov eax, 5
jmp 0x4ad490
mov edi, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], edi
add eax, 1
cmp eax, 8
jl 0x4ad490
xor eax, eax
test edx, edx
jle 0x4ad4d8
cmp esi, dword [ebp + 0x54]
jg 0x4ad4e1
cmp eax, edx
jge 0x4ad4ca
nop
cmp ecx, 4
jge 0x4ad4cd
mov ebx, dword [esp + eax*4 + 0x14]
lea edi, [ecx + esi*4]
add eax, 1
add ecx, 1
cmp eax, edx
mov dword [ebp + edi*4 + 0x58], ebx
jl 0x4ad4b0
cmp ecx, 4
jne 0x4ad4d4
add esi, 1
xor ecx, ecx
cmp eax, edx
jl 0x4ad4a6
cmp esi, dword [ebp + 0x54]
jle 0x4ad3b0
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d99c4
add esp, 0x28
ret 4
Function at 0x4ad500
Capabilities:
Encode data using xor

Disassembly:
mov edx, 1
cmp dword [ecx + 0x54], edx
jle 0x4ad5ec
push esi
lea eax, [ecx + 0x6a]
push edi
jmp 0x4ad520
movzx esi, byte [eax + 1]
mov esi, dword [esi*4 + 0x5e2028]
movzx edi, byte [eax - 1]
xor esi, dword [edi*4 + 0x5e1828]
movzx edi, byte [eax]
xor esi, dword [edi*4 + 0x5e1c28]
movzx edi, byte [eax - 2]
xor esi, dword [edi*4 + 0x5e1428]
add edx, 1
mov dword [eax - 2], esi
movzx esi, byte [eax + 5]
mov esi, dword [esi*4 + 0x5e2028]
movzx edi, byte [eax + 4]
xor esi, dword [edi*4 + 0x5e1c28]
movzx edi, byte [eax + 3]
xor esi, dword [edi*4 + 0x5e1828]
movzx edi, byte [eax + 2]
xor esi, dword [edi*4 + 0x5e1428]
add eax, 0x10
mov dword [eax - 0xe], esi
movzx esi, byte [eax - 7]
mov esi, dword [esi*4 + 0x5e2028]
movzx edi, byte [eax - 8]
xor esi, dword [edi*4 + 0x5e1c28]
movzx edi, byte [eax - 9]
xor esi, dword [edi*4 + 0x5e1828]
movzx edi, byte [eax - 0xa]
xor esi, dword [edi*4 + 0x5e1428]
mov dword [eax - 0xa], esi
movzx esi, byte [eax - 3]
movzx edi, byte [eax - 4]
mov esi, dword [esi*4 + 0x5e2028]
xor esi, dword [edi*4 + 0x5e1c28]
movzx edi, byte [eax - 5]
xor esi, dword [edi*4 + 0x5e1828]
movzx edi, byte [eax - 6]
xor esi, dword [edi*4 + 0x5e1428]
mov dword [eax - 6], esi
cmp edx, dword [ecx + 0x54]
jl 0x4ad520
pop edi
pop esi
ret
Function at 0x4ae040
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
mov ebx, ecx
push edi
mov edi, dword [esp + 0x34]
mov ecx, esi
call fcn.004c06c0
cmp eax, 0x10
jae 0x4ae07e
mov ebp, 0x10
lea ecx, [ecx]
push 0
mov ecx, esi
call fcn.00454f60
sub ebp, 1
jne 0x4ae070
cmp byte [esp + 0x3c], 0
jne 0x4ae0a7
mov ecx, esi
call fcn.004c4070
test eax, eax
je 0x4ae0a7
mov ecx, dword [eax]
mov dword [ebx + 0x44], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x48], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x4c], ecx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0x50], edx
cmp dword [ebx + 0x38], 0
je 0x4ae0c7
pop edi
pop esi
pop ebp
mov eax, 0xfffffffb
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004d99c4
add esp, 0x18
ret 0x14
cmp dword [ebx + 0x40], 0
je 0x4ae0e7
pop edi
pop esi
pop ebp
mov eax, 0xfffffffa
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004d99c4
add esp, 0x18
ret 0x14
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x4ae212
mov eax, dword [esp + 0x30]
test eax, eax
jle 0x4ae212
mov ecx, dword [ebx + 0x3c]
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
sub ecx, 0
mov dword [esp + 0x10], eax
je 0x4ae1d3
sub ecx, 1
je 0x4ae135
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004d99c4
add esp, 0x18
ret 0x14
mov eax, dword [ebx + 0x44]
xor eax, dword [esi]
mov ecx, dword [ebx + 0x48]
xor ecx, dword [esi + 4]
mov edx, dword [ebx + 0x4c]
xor edx, dword [esi + 8]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x50]
xor eax, dword [esi + 0xc]
mov dword [esp + 0x18], ecx
push edi
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
call fcn.004ad5f0
mov ebp, dword [esp + 0x10]
add ebp, 0xffffffff
add esi, 0x10
test ebp, ebp
jle 0x4ae1f6
mov edx, dword [esi]
xor edx, dword [edi]
mov eax, dword [edi + 4]
xor eax, dword [esi + 4]
mov ecx, dword [edi + 8]
xor ecx, dword [esi + 8]
mov dword [esp + 0x14], edx
mov edx, dword [edi + 0xc]
xor edx, dword [esi + 0xc]
mov dword [esp + 0x18], eax
add edi, 0x10
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x20], ecx
push eax
mov ecx, ebx
mov dword [esp + 0x28], edx
call fcn.004ad5f0
sub ebp, 1
add esi, 0x10
test ebp, ebp
jg 0x4ae177
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
shl eax, 7
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004d99c4
add esp, 0x18
ret 0x14
test eax, eax
mov ebp, eax
jle 0x4ae1fa
lea esp, [esp]
push edi
push esi
mov ecx, ebx
call fcn.004ad5f0
sub ebp, 1
add esi, 0x10
add edi, 0x10
test ebp, ebp
jg 0x4ae1e0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
shl eax, 7
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004d99c4
add esp, 0x18
ret 0x14
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004d99c4
add esp, 0x18
ret 0x14
Function at 0x4b0820
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fa6a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004afad0
xor eax, eax
push 0x48
mov dword [esp + 0x18], eax
mov dword [esi], vtable.BlowFish.0
mov dword [esi + 0x34], 0x80
mov dword [esi + 0x38], eax
mov byte [esi + 0x3c], al
call fcn.004cabe6
push 0x1000
mov dword [esi + 0x2c], eax
call fcn.004cabe6
mov dword [esi + 0x30], eax
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x4b08a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fa6a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.BlowFish.0
mov eax, dword [esi + 0x2c]
push eax
mov dword [esp + 0x18], 0
call fcn.004cac16
mov eax, dword [esi + 0x30]
push eax
call fcn.004cac16
add esp, 8
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004af860
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4b22a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
push esi
mov esi, ecx
je 0x4b2372
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebx
mov edi, dword [esi + 8]
cmp eax, edi
jb 0x4b2360
mov ecx, dword [esi + 0x18]
cmp eax, ecx
jb 0x4b2360
mov edx, eax
sub edx, ecx
cmp edx, 0x12c
jb 0x4b2370
mov ecx, dword [esi + 0x14]
test ecx, ecx
mov edx, dword [esi + 0x10]
jg 0x4b2370
jl 0x4b22f5
cmp edx, 0xffffffff
ja 0x4b2370
mov dword [esi + 0x18], eax
sub eax, edi
xor ebx, ebx
mov edi, eax
or eax, ebx
je 0x4b2370
push ebx
push 0x3e8
push ecx
push edx
call fcn.004de240
push ebx
push edi
push edx
push eax
call fcn.004de280
test edx, edx
jg 0x4b2370
jl 0x4b2323
cmp eax, 0xffffffff
ja 0x4b2370
mov ecx, dword [esi + 0x1c]
cmp ecx, 1
mov edx, dword [ebp]
push eax
mov eax, dword [esi + 0x10]
push eax
jne 0x4b2341
mov edx, dword [edx + 0x50]
mov ecx, ebp
call edx
pop edi
pop ebx
pop esi
pop ebp
ret 4
cmp ecx, 2
mov ecx, ebp
jne 0x4b2354
mov edx, dword [edx + 0x54]
call edx
pop edi
pop ebx
pop esi
pop ebp
ret 4
mov edx, dword [edx + 0x4c]
call edx
pop edi
pop ebx
pop esi
pop ebp
ret 4
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call ebx
mov dword [esi + 8], eax
pop edi
pop ebx
pop esi
pop ebp
ret 4

Function at 0x4b23d0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xcc
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0xc8], eax
push esi
mov esi, ecx
lea ecx, [esi + 4]
call fcn.004c06c0
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4b244b
mov ecx, dword [eax + 0xc]
cmp dword [ecx], 0
je 0x4b240b
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov dword [esi + 0x48], edx
jmp 0x4b2412
mov dword [esi + 0x48], 0
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 1]
push edx
movzx edx, byte [eax]
push ecx
push edx
lea eax, [esp + 0x14]
push str._d._d._d._d
push eax
call fcn.004daca4
add esp, 0x18
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x28]
call fcn.00452a60
jmp 0x4b2453
lea ecx, [esi + 0x28]
call fcn.00451240
mov ecx, dword [esp + 0xcc]
mov byte [esi + 0x44], 0
pop esi
xor ecx, esp
call fcn.004d99c4
add esp, 0xcc
ret
Function at 0x4b25a0
Capabilities:
Check for time delay via gettickcount
Create thread
Resolve dns

Disassembly:
sub esp, 0xe8
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0xe4], eax
mov eax, dword [esp + 0xfc]
mov edx, dword [esp + 0x110]
push ebx
mov ebx, dword [esp + 0x10c]
push ebp
mov ebp, dword [esp + 0xf4]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x118]
mov esi, ecx
mov ecx, dword [esp + 0x110]
push edi
mov edi, dword [esp + 0x110]
mov byte [eax], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov byte [edx], 0
call fcn.00451240
mov dword [ebx], 0
mov ebx, dword [esp + 0x108]
test ebx, ebx
je 0x4b2722
test edi, edi
je 0x4b2722
push ebp
lea ecx, [esi + 4]
call fcn.00452a60
lea ecx, [esp + 0x28]
push ecx
push 0
push esi
push 0x4b2540
push 0
push 0
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edi
mov byte [esi + 0x44], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebp, ebp
cmp byte [esi + 0x44], 0
mov dword [esp + 0x20], eax
je 0x4b26bf
lea ebx, [ebx]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebp, 0xa
cmp ebp, ebx
jb 0x4b26b9
push 0x74
push ebx
mov ecx, edi
xor ebp, ebp
call fcn.0046fca0
mov ecx, edi
call fcn.0046fbd0
test al, al
jne 0x4b26e5
cmp dword [esp + 0x104], 0
je 0x4b26b9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
jbe 0x4b26b9
sub eax, ecx
cmp eax, dword [esp + 0x104]
ja 0x4b2719
cmp byte [esi + 0x44], 0
jne 0x4b2670
mov edi, dword [esp + 0x14]
lea ecx, [esi + 0x28]
push ecx
mov ecx, edi
call fcn.00452b00
mov edx, dword [esi + 0x48]
mov eax, dword [esp + 0x10]
mov ecx, edi
mov dword [eax], edx
call fcn.004c49f0
test eax, eax
setne al
jmp 0x4b26fe
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov byte [edx], 1
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push str.DNS_lookup_aborted_by_application_callback
call edx
xor al, al
mov ecx, dword [esp + 0xf4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d99c4
add esp, 0xe8
ret 0x28
mov eax, dword [esp + 0x1c]
mov byte [eax], 1
jmp 0x4b26fc
push ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4b26fc
mov ecx, dword [eax + 0xc]
cmp dword [ecx], 0
je 0x4b273f
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x10]
mov dword [ecx], edx
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 1]
push edx
movzx edx, byte [eax]
push ecx
push edx
lea eax, [esp + 0x3c]
push str._d._d._d._d
push eax
call fcn.004daca4
add esp, 0x18
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00452a60
mov al, 1
jmp 0x4b26fe

Function at 0x4b27c0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
je 0x4b27eb
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x4b3c50
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
push edi
mov edi, ecx
jne 0x4b3c63
pop edi
xor al, al
pop ebx
ret 4
mov eax, dword [edi + 4]
test eax, eax
je 0x4b3c73
push eax
call fcn.004cac16
add esp, 4
push ebp
push esi
push ebx
push 1
lea ebp, [edi + 8]
push 4
lea esi, [edi + 0xc]
push ebp
mov dword [edi + 4], 0
mov dword [ebp], 0
mov dword [esi], 0
call fcn.004df0a6
add esp, 0x10
cmp eax, 1
jne 0x4b3d18
push ebx
push eax
push 4
push esi
call fcn.004df0a6
add esp, 0x10
cmp eax, 1
je 0x4b3cc4
pop esi
mov dword [ebp], 0
pop ebp
pop edi
xor al, al
pop ebx
ret 4
mov eax, dword [esi]
test eax, eax
je 0x4b3d21
xor ecx, ecx
add eax, eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004cabe6
mov ecx, dword [esi]
push ebx
push ecx
push 8
push eax
mov dword [edi + 4], eax
call fcn.004df0a6
add esp, 0x14
cmp eax, dword [esi]
je 0x4b3d21
mov edx, dword [edi + 4]
push edx
call fcn.004cac16
add esp, 4
mov dword [edi + 4], 0
mov dword [ebp], 0
mov dword [esi], 0
pop esi
pop ebp
pop edi
xor al, al
pop ebx
ret 4
pop esi
pop ebp
pop edi
mov al, 1
pop ebx
ret 4
Function at 0x4b77d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x4b77e7
xor al, al
pop esi
add esp, 0x14
ret 0x10
push ebx
mov ebx, dword [esi + 8]
push ebp
push edi
mov edi, dword [esp + 0x28]
mov edx, dword [edi]
xor ebp, ebp
push ebp
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x4b781e
pop edi
pop ebp
mov dword [esi + 8], ebx
pop ebx
xor al, al
pop esi
add esp, 0x14
ret 0x10
mov eax, dword [edi]
mov ecx, dword [esp + 0x34]
mov dword [esi + 8], eax
call fcn.00454750
push 0x4e20
call fcn.004cabe6
mov ecx, dword [esi + 8]
add esp, 4
push ebp
lea edx, [esp + 0x14]
push edx
mov edi, eax
mov eax, dword [esi + 4]
push 0x4e20
push edi
push eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b794a
mov ebx, dword [esp + 0x10]
cmp ebx, ebp
je 0x4b794a
cmp ebx, 4
jl 0x4b794a
mov edx, dword [esp + 0x2c]
add dword [esi + 8], ebx
cmp dword [edi], edx
mov eax, edi
je 0x4b793e
mov edi, edi
mov ecx, dword [esp + 0x30]
cmp dword [eax], ecx
je 0x4b793e
cmp ebx, 4
jl 0x4b78b1
add ebp, 1
sub ebx, 1
add dword [esp + 0x14], 1
lea eax, [edi + ebp]
jmp 0x4b7909
test ebx, ebx
je 0x4b78d3
push ebx
lea edx, [edi + ebp]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.004db700
push ebx
lea ecx, [esp + 0x2c]
push ecx
push edi
call fcn.004db700
add esp, 0x18
push 0
lea edx, [esp + 0x14]
push edx
mov edx, dword [esi + 4]
mov eax, 0x4e20
sub eax, ebx
push eax
lea ecx, [edi + ebx]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b794a
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b794a
add dword [esi + 8], eax
mov edx, dword [esp + 0x2c]
xor ebp, ebp
add ebx, eax
mov eax, edi
cmp dword [eax], edx
jne 0x4b7890
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
add ecx, edx
mov edx, dword [esp + 0x28]
push 4
mov dword [edx], ecx
mov ecx, dword [esp + 0x38]
push eax
call fcn.00454fa0
push edi
call fcn.004cac16
add esp, 4
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
add esp, 0x14
ret 0x10
mov ecx, dword [eax]
cmp ecx, edx
je 0x4b790d
cmp ecx, dword [esp + 0x30]
je 0x4b790d
push edi
call fcn.004cac16
add esp, 4
pop edi
pop ebp
pop ebx
xor al, al
pop esi
add esp, 0x14
ret 0x10
Function at 0x4b7960
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push edi
mov edi, ecx
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jne 0x4b7977
xor al, al
pop edi
add esp, 0x14
ret 0xc
push ebx
mov ebx, dword [edi + 8]
push ebp
push esi
mov esi, dword [esp + 0x28]
mov edx, dword [esi]
xor ebp, ebp
push ebp
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [edi + 8], eax
jne 0x4b79ae
pop esi
pop ebp
mov dword [edi + 8], ebx
pop ebx
xor al, al
pop edi
add esp, 0x14
ret 0xc
mov eax, dword [esi]
mov ecx, dword [esp + 0x30]
mov dword [edi + 8], eax
call fcn.00454750
push 0x4e40
call fcn.004cabe6
mov ecx, dword [edi + 8]
add esp, 4
push ebp
lea edx, [esp + 0x14]
push edx
mov esi, eax
mov eax, dword [edi + 4]
push 0x4e20
push esi
push eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b7ac2
mov ebx, dword [esp + 0x10]
cmp ebx, ebp
je 0x4b7ac2
cmp ebx, 4
jl 0x4b7ac2
add dword [edi + 8], ebx
mov ecx, dword [esi]
cmp ecx, dword [esp + 0x2c]
mov eax, esi
je 0x4b7a91
lea ebx, [ebx]
cmp ebx, 4
jle 0x4b7a35
add ebp, 1
sub ebx, 1
add dword [esp + 0x14], 1
lea eax, [esi + ebp]
jmp 0x4b7a89
test ebx, ebx
je 0x4b7a57
push ebx
lea edx, [esi + ebp]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.004db700
push ebx
lea ecx, [esp + 0x2c]
push ecx
push esi
call fcn.004db700
add esp, 0x18
push 0
lea edx, [esp + 0x14]
push edx
mov edx, dword [edi + 4]
mov eax, 0x4e20
sub eax, ebx
push eax
lea ecx, [esi + ebx]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b7ac2
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b7ac2
add dword [edi + 8], eax
xor ebp, ebp
add ebx, eax
mov eax, esi
mov ecx, dword [esp + 0x2c]
cmp dword [eax], ecx
jne 0x4b7a20
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
add edx, ecx
mov ecx, dword [esp + 0x28]
push 4
mov dword [ecx], edx
mov ecx, dword [esp + 0x34]
push eax
call fcn.00454fa0
push esi
call fcn.004cac16
add esp, 4
pop esi
pop ebp
pop ebx
mov al, 1
pop edi
add esp, 0x14
ret 0xc
push esi
call fcn.004cac16
add esp, 4
pop esi
pop ebp
pop ebx
xor al, al
pop edi
add esp, 0x14
ret 0xc
Function at 0x4b7ae0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x4b7af3
xor al, al
pop esi
pop ecx
ret 0xc
push ebx
mov ebx, dword [esi + 8]
push edi
mov edi, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x4b7b27
mov dword [esi + 8], ebx
pop edi
pop ebx
xor al, al
pop esi
pop ecx
ret 0xc
mov dword [esi + 8], edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
call fcn.00454750
mov ebx, dword [esp + 0x18]
push ebx
mov ecx, edi
call fcn.00455960
mov ecx, edi
call fcn.004c4070
test eax, eax
je 0x4b7b1e
push 0
lea edx, [esp + 0x18]
push edx
push ebx
push eax
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b7b1e
add dword [esi + 8], ebx
cmp dword [esp + 0x14], ebx
pop edi
pop ebx
sete al
pop esi
pop ecx
ret 0xc

Function at 0x4b7b80
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x4b7b93
xor al, al
pop esi
pop ecx
ret 0xc
push ebx
mov ebx, dword [esi + 8]
push edi
mov edi, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x4b7bc7
mov dword [esi + 8], ebx
pop edi
pop ebx
xor al, al
pop esi
pop ecx
ret 0xc
mov dword [esi + 8], edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
call fcn.00454750
mov ebx, dword [esp + 0x18]
push ebx
mov ecx, edi
call fcn.00455960
mov ecx, edi
call fcn.004c4070
test eax, eax
je 0x4b7bbe
push 0
lea edx, [esp + 0x18]
push edx
push ebx
push eax
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b7bbe
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, edi
call fcn.004547c0
mov edx, dword [esp + 0x14]
add dword [esi + 8], edx
pop edi
pop ebx
mov al, 1
pop esi
pop ecx
ret 0xc

Function at 0x4b8870
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x10]
push edi
mov ecx, ebx
mov dword [esi + 4], 0x12345678
mov dword [esi + 8], 0x23456789
mov dword [esi + 0xc], 0x34567890
xor edi, edi
call fcn.004c49f0
test eax, eax
jle 0x4b88fb
lea ebx, [ebx]
push edi
mov ecx, ebx
call fcn.00452bf0
mov ecx, dword [esi + 4]
add edi, 1
xor eax, ecx
and eax, 0xff
mov eax, dword [eax*4 + 0x5e3798]
shr ecx, 8
xor eax, ecx
mov ecx, dword [esi + 0xc]
mov dword [esi + 4], eax
movzx eax, al
add eax, dword [esi + 8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [esi + 8], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x5e3798]
mov dword [esi + 0xc], ecx
mov ecx, ebx
call fcn.004c49f0
cmp edi, eax
jl 0x4b88a0
pop edi
pop esi
pop ebx
ret
Function at 0x4b8900
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
test ebp, ebp
jbe 0x4b897b
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [ecx + 0xc]
and eax, 0xfffd
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
sar edx, 8
xor byte [esi + edi], dl
movzx eax, byte [esi + edi]
mov edx, dword [ecx + 4]
xor eax, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x5e3798]
shr edx, 8
xor eax, edx
mov edx, dword [ecx + 0xc]
mov dword [ecx + 4], eax
movzx eax, al
add eax, dword [ecx + 8]
add esi, 1
imul eax, eax, 0x8088405
add eax, 1
mov dword [ecx + 8], eax
shr eax, 0x18
xor eax, edx
and eax, 0xff
shr edx, 8
xor edx, dword [eax*4 + 0x5e3798]
cmp esi, ebp
mov dword [ecx + 0xc], edx
jb 0x4b8911
pop edi
pop esi
pop ebp
ret 8