joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f480
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi
Get disk size
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x522104]
xor eax, ebp
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1b4]
call fcn.00492190
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 8
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 4
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
push 0x3c
lea eax, [ebp - 0x88]
mov dword [ebp - 0x8c], 0x40
push 0
push eax
call fcn.004a7c50
add esp, 0x10
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x48f549
push 8
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
push 8
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
add esp, 8
push 0
push 0
lea eax, [ebp - 0x44]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x48f570
push 8
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
add esp, 4
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimes]
test eax, eax
je 0x48f5e9
push 4
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
push 4
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
push 4
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
push 4
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
push 4
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
push 4
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
add esp, 0x18
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x48f60a
push 8
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
add esp, 4
rdtsc
mov dword [ebp - 0x10], edx
lea ecx, [ebp - 0x1b4]
push 8
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.004921e0
add esp, 4
lea eax, [ebp - 0x18]
push 0xf0000040
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x48f67a
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 8
push dword [ebp - 0x18]
movlpd qword [ebp - 0x14], xmm0
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x48f66f
push 8
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x1b4]
call fcn.004921e0
add esp, 4
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x1b4]
call fcn.00492240
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor ecx, ebp
call fcn.004a4c5b
mov esp, ebp
pop ebp
ret
Function at 0x4905c0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ebedd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x522104]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], edx
mov esi, ecx
mov dword [ebp - 0x18], esi
push 0x10000
mov dword [ebp - 0x18], esi
call fcn.004a4cdf
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
push 0x8000
push edi
push dword [ebp - 0x1c]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x490682
cmp eax, 0x8000
ja 0x490682
xorps xmm0, xmm0
mov ecx, esi
push eax
movups xmmword [esi], xmm0
push edi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0040aa50
push edi
call fcn.004a4cd1
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a4c5b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push dword [ebp - 0x1c]
push str.Unable_to_retrieve_environment_variable__ls_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x34]
call fcn.004138d0
push 0x51f1f8
lea eax, [ebp - 0x34]
push eax
call fcn.004a765b
int3
Function at 0x492020
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push edi
mov dword [ebp - 0x28], ecx
lea eax, [ecx + 0x2c]
mov ebx, 0x30
push esi
mov edx, dword [eax + 0x34]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov edi, edx
mov ecx, edx
rol edi, 0xf
rol ecx, 0xd
xor edi, ecx
shr edx, 0xa
xor edi, edx
mov ecx, esi
mov edx, esi
ror ecx, 7
rol edx, 0xe
xor edx, ecx
shr esi, 3
xor edx, esi
add edi, edx
add edi, dword [eax + 0x1c]
add edi, dword [eax - 8]
mov dword [eax + 0x38], edi
sub ebx, 1
jne 0x492034
mov ebx, dword [ebp - 0x28]
mov edx, 0x50cc88
mov dword [ebp - 0x24], edx
mov eax, dword [ebx + 8]
mov edi, eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebx + 0x28]
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov esi, ebx
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror esi, 0xb
not ecx
and ecx, dword [ebp - 0xc]
xor esi, eax
mov eax, ebx
ror eax, 6
xor esi, eax
mov eax, dword [ebp - 8]
and eax, ebx
xor ecx, eax
mov eax, dword [ebp - 0x14]
add esi, ecx
add dword [ebp - 0x14], 4
add esi, dword [eax]
mov eax, edi
add esi, dword [edx]
mov edx, edi
add esi, dword [ebp - 0x20]
rol eax, 0xa
ror edx, 0xd
xor edx, eax
mov eax, edi
ror eax, 2
xor edx, eax
mov eax, dword [ebp - 0x10]
mov ecx, eax
and eax, edi
xor ecx, edi
and ecx, dword [ebp - 4]
xor ecx, eax
mov eax, dword [ebp - 0xc]
add edx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov ecx, edi
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x18]
lea edi, [edx + esi]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x24]
add ebx, esi
mov eax, dword [ebp - 4]
add edx, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], edx
cmp edx, 0x50cd88
jl 0x4920b5
mov eax, dword [ebp - 0x2c]
add eax, edi
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x28]
pop esi
pop edi
add dword [ebx + 0xc], ecx
mov dword [ebx + 8], eax
mov eax, dword [ebp - 4]
add dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x18]
add dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x1c]
add dword [ebx + 0x18], eax
mov eax, dword [ebp - 8]
add dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0xc]
add dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x20]
add dword [ebx + 0x24], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492190
Capabilities:
Hash data using sha256

Disassembly:
mov edx, ecx
xor eax, eax
push edi
mov ecx, 0x40
lea edi, [edx + 0x28]
rep stosd dword es:[edi], eax
mov dword [edx + 4], eax
mov dword [edx], eax
mov dword [edx + 8], 0x6a09e667
mov dword [edx + 0xc], 0xbb67ae85
mov dword [edx + 0x10], 0x3c6ef372
mov dword [edx + 0x14], 0xa54ff53a
mov dword [edx + 0x18], 0x510e527f
mov dword [edx + 0x1c], 0x9b05688c
mov dword [edx + 0x20], 0x1f83d9ab
mov dword [edx + 0x24], 0x5be0cd19
pop edi
ret

Function at 0x4934d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
cmp byte [edi + 0xc], 0
jne 0x4934ea
mov dword [edi + 0x18], 6
xor al, al
pop edi
pop ebp
ret 0xc
mov ecx, dword [ebp + 8]
mov edx, 0x400000
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov byte [edi + 0xd], 0
nop dword [eax]
cmp esi, 0x400000
mov eax, esi
cmova eax, edx
push eax
push ecx
push dword [edi + 0x14]
call fcn.004c472e
add esp, 0xc
test eax, eax
jle 0x49352f
mov ecx, dword [ebp + 8]
add ebx, eax
add ecx, eax
mov edx, 0x400000
mov dword [ebp + 8], ecx
sub esi, eax
jne 0x493500
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x493538
mov dword [eax], ebx
cmp dword [ebp + 0xc], ebx
pop esi
pop ebx
je 0x493555
call fcn.004bc81c
mov ecx, dword [eax]
call fcn.004936e0
mov dword [edi + 0x18], eax
xor al, al
pop edi
pop ebp
ret 0xc
push 1
push 0
push dword [edi + 0x14]
call fcn.004c4175
add esp, 0xc
mov dword [edi + 4], eax
mov al, 1
pop edi
pop ebp
ret 0xc
Function at 0x493ce0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x522104]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
push esi
push edi
mov eax, dword [ebx]
cmp eax, 5
ja 0x493d2d
mov eax, 0xea
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004a4c5b
mov esp, ebp
pop ebp
ret 0x10
add eax, 0xfffffffb
mov dword [esp + 0x10], ecx
push 0x200
mov dword [ebx], eax
add ecx, 5
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 5
push 0
push eax
mov dword [esp + 0x24], ecx
call fcn.004a7c50
add esp, 0xc
lea eax, [esp + 0x20]
push 0x100
push eax
push str.DisableOptimization
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, str.true
lea eax, [esp + 0x20]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x493d9d
test dx, dx
je 0x493d99
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x493d9d
add eax, 4
add ecx, 4
test dx, dx
jne 0x493d77
xor eax, eax
jmp 0x493da2
sbb eax, eax
or eax, 1
mov edi, eax
neg edi
sbb edi, edi
and edi, 9
test eax, eax
jne 0x493dfd
push str.DisableOptimization:_lzma_set_to_level
push 0x526e90
call fcn.0043e850
add esp, 8
push 0x507ef0
push ecx
push edi
mov ecx, eax
call fcn.0044b110
add esp, 4
push eax
call fcn.0043e850
mov esi, eax
add esp, 8
mov ecx, dword [esi]
push 0xa
mov ecx, dword [ecx + 4]
add ecx, esi
call fcn.0043f030
movzx ecx, al
push ecx
mov ecx, esi
call fcn.00493e90
mov ecx, esi
call fcn.004407e0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x400000
push edi
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x30]
push dword [ebp + 0xc]
push dword [esp + 0x3c]
push ebx
push dword [esp + 0x48]
call fcn.004d49a0
add dword [ebx], 5
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a4c5b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49dd00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
movzx eax, ax
push esi
mov esi, eax
mov dword [ebp - 4], eax
push edi
shr esi, 8
xor eax, eax
xor edi, edi
mov dword [ebp - 8], esi
cmp dword [ebp + 0x10], eax
jbe 0x49dd6c
mov ecx, dword [ebp + 0xc]
movzx ebx, word [ecx + edi*2]
mov edx, ebx
movzx ecx, bl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x49dd6c
movzx ecx, bl
cmp esi, ecx
jne 0x49dd64
cmp eax, edx
jge 0x49dd64
mov ecx, dword [ebp + 8]
movzx esi, cl
nop dword [eax]
mov ecx, dword [ebp + 0x14]
movzx ecx, byte [eax + ecx]
cmp cx, si
je 0x49dd98
inc eax
cmp eax, edx
jl 0x49dd50
mov esi, dword [ebp - 8]
inc edi
mov eax, edx
cmp edi, dword [ebp + 0x10]
jb 0x49dd23
mov edi, dword [ebp + 0x1c]
xor eax, eax
mov bl, 1
test edi, edi
je 0x49ddb0
mov esi, dword [ebp + 0x18]
nop word [eax + eax]
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x49dda1
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x49dda3
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ecx
sub dword [ebp - 4], edx
js 0x49ddb0
inc eax
xor bl, 1
cmp eax, edi
jb 0x49dd80
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a0070
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a0080

Function at 0x4a0300
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4a030c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004a0320

Function at 0x4a3b4b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004a3b27
pop esi
leave
ret 8

Function at 0x4a4700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x4a4721
jl 0x4a4718
test edi, edi
jne 0x4a4721
xor eax, eax
xor edx, edx
jmp 0x4a47e2
cmp dword [ebx + 0x38], 0
je 0x4a4736
push eax
push edi
push dword [ebp + 8]
call fcn.004400b0
jmp 0x4a47e2
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4a477d
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x4a477d
cmp eax, edi
jb 0x4a4757
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.004a76d0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x4a4783
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x4a47d7
mov ecx, ebx
call fcn.004a4000
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x4a47c2
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.004c12cb
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x4a47d7
jmp 0x4a4795
test edx, edx
je 0x4a47d7
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004c12cb
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x4a5a56
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4a5a95
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4a5a95
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4a5a95
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4a5a95
cmp dword [ecx + 0x74], 0xe
jbe 0x4a5a95
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4c1a89
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004a5850
mov eax, dword [0x522104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004c20aa
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4c1acb
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4c1c27
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004e1d40
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x527858]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004c41ec
mov ecx, dword [esi*4 + 0x527858]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4c1c20
cmp eax, dword [edi + ecx + 0x24]
jne 0x4c1c20
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c1c20
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c41ec
add esp, 0x14
test edx, edx
jl 0x4c1c20
jg 0x4c1b96
test eax, eax
jb 0x4c1c20
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4c1c20
jl 0x4c1bb0
cmp dword [ebp - 0x1008], eax
ja 0x4c1c20
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4c1bce
test ebx, ebx
je 0x4c1c07
cmp ecx, edi
jae 0x4c1c07
mov al, byte [ecx]
cmp al, 0xd
jne 0x4c1be8
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4c1bf4
cmp byte [ecx + 1], 0xa
jne 0x4c1bf4
inc ecx
jmp 0x4c1bf4
movzx eax, al
movsx eax, byte [eax + 0x522298]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4c1bce
cmp edx, ebx
jne 0x4c1bce
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4c1c25
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004a4c5b
leave
ret
Function at 0x4c4268
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x527858]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4c42a8
cmp byte [ebx], 0xa
jne 0x4c42a8
or byte [eax + edi + 0x28], 4
jmp 0x4c42ad
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4c43ab
mov al, byte [edx]
cmp al, 0x1a
je 0x4c438d
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4c42dc
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4c4301
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4c430b
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4c42be
jmp 0x4c43ab
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c4388
cmp dword [ebp - 0xc], 0
je 0x4c4388
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x527858]
test byte [eax + edi + 0x28], 0x48
je 0x4c4362
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4c434d
mov byte [esi], dl
jmp 0x4c435e
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x527858]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4c43ab
cmp byte [ebp - 1], 0xa
jne 0x4c4371
cmp esi, ebx
jne 0x4c4371
mov byte [esi], 0xa
jmp 0x4c43aa
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004c420a
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4c43ab
mov byte [esi], 0xd
jmp 0x4c43aa
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x527858]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4c43a7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4c43ab
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4c43b4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x527858]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4c43f7
cmp word [esi], dx
jne 0x4c43f7
or byte [edi + eax + 0x28], 4
jmp 0x4c43fc
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4c454f
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4c452f
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4c443e
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4c4474
cmp eax, edx
jae 0x4c4480
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4c4416
jmp 0x4c454f
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c452b
cmp dword [ebp - 0x14], 0
je 0x4c452b
mov eax, dword [ebx*4 + 0x527858]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4c4503
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4c44cc
mov word [esi], cx
jmp 0x4c44ff
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x527858]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x527858]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x527858]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4c454f
pop ebx
cmp word [ebp - 4], bx
jne 0x4c4514
cmp esi, dword [ebp + 0xc]
jne 0x4c4514
mov word [esi], bx
jmp 0x4c454c
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004c420a
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4c454f
push 0xd
jmp 0x4c4548
mov ecx, dword [ebx*4 + 0x527858]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4c4546
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4c454f
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret