joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, esi
call fcn.00464e40
test al, al
jne 0x464e16
pop esi
pop ebp
ret 8
mov ecx, dword [esi + 0x30]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ecx
push 1
push edx
push eax
call fcn.004d3a09
dec eax
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop esi
pop ebp
ret 8

Function at 0x466c40
Capabilities:
Set file attributes

Disassembly:
cmp dword [esi + 0x3c], 8
push ebx
lea ebx, [esi + 0x28]
jb 0x466c4e
mov eax, dword [ebx]
jmp 0x466c50
mov eax, ebx
push edi
push 0
push 0x2000000
push 3
push 0
push 7
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
lea eax, [esi + 0x5c]
push eax
lea ecx, [esi + 0x54]
push ecx
lea edx, [esi + 0x4c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x45], 0
pop edi
je 0x466ca9
cmp byte [esi + 0x44], 0
mov eax, dword [esi + 0x48]
je 0x466c99
and eax, 0xffffffef
cmp dword [ebx + 0x14], 8
jb 0x466ca1
mov ebx, dword [ebx]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebx
ret

Function at 0x469e3f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x469e65
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x469e65
xor al, al
jmp 0x469e85
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.004d6880
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x46a2da
Capabilities:
Get common file path

Disassembly:
push 0x34
mov eax, 0x508e74
call fcn.004d6c98
mov dword [ebp - 0x10], edx
mov esi, ecx
and dword [edx + 4], 0
mov eax, dword [edx]
xor ecx, ecx
mov word [eax], cx
movzx eax, word [esi]
xor edi, edi
test ax, ax
je 0x46a307
inc edi
cmp word [esi + edi*2], cx
jne 0x46a300
cmp edi, 1
movzx ebx, ax
jl 0x46a41c
cmp bx, 0x5c
je 0x46a41c
cmp bx, 0x2e
jne 0x46a33b
cmp edi, 1
je 0x46a41c
cmp edi, 2
jne 0x46a33b
cmp word [esi + 2], bx
je 0x46a41c
lea ecx, [ebp - 0x1c]
call fcn.0046a15e
and dword [ebp - 4], 0
cmp edi, 3
jle 0x46a36f
cmp word [esi + 2], 0x3a
jne 0x46a36f
cmp word [esi + 4], 0x5c
jne 0x46a36f
cmp bx, 0x61
jb 0x46a366
cmp bx, 0x7a
jbe 0x46a3be
add ebx, 0xffffffbf
cmp bx, 0x19
jbe 0x46a3be
mov edi, 0x105
cmp dword [ebp - 0x14], edi
jg 0x46a382
push edi
lea ecx, [ebp - 0x1c]
call fcn.00469ffe
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.0046a1d1
test edi, edi
je 0x46a424
cmp edi, 0x104
ja 0x46a424
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x46a3be
push 0x5c
lea ecx, [ebp - 0x1c]
call fcn.0046a232
push 0x52585c
lea ecx, [ebp - 0x40]
call fcn.0046a176
lea ecx, [ebp - 0x1c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.0046a25e
push esi
mov edx, eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0046a29c
mov ecx, dword [ebp - 0x10]
push eax
mov byte [ebp - 4], 3
call fcn.0046a1f1
push dword [ebp - 0x28]
call fcn.00469e1a
push dword [ebp - 0x34]
call fcn.00469e1a
push dword [ebp - 0x40]
call fcn.00469e1a
push dword [ebp - 0x1c]
call fcn.00469e1a
add esp, 0x10
mov al, 1
call fcn.004d6d70
ret
push dword [ebp - 0x1c]
call fcn.00469e1a
pop ecx
xor al, al
jmp 0x46a41e

Function at 0x46ad20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x58c5e0], ecx
inc edx
cmp edx, 0x100
jb 0x46ad22
cmp edx, 0x800
jae 0x46adf9
lea esp, [esp]
mov eax, dword [edx*4 + 0x58c1e0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x58c5e0]
inc edx
mov dword [edx*4 + 0x58c5dc], eax
cmp edx, 0x800
jb 0x46add0
mov dword [0x58a824], 0x508d40
call fcn.00470230
test eax, eax
jne 0x46ae16
mov dword [0x58a824], 0x508c60
ret
Function at 0x478400
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x478410
pop edi
pop ebx
ret

Function at 0x478440
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x478450
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4785c0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
xor eax, eax
lea edx, [eax + 1]
test edi, edi
je 0x478602
push ebx
push ebp
mov ebx, dword [esp + 0x14]
movzx ebx, word [ebx + edx*2]
mov ecx, esi
and ecx, 1
mov ebp, ecx
neg ebp
sar ebp, 4
and ebp, 0x7f
shr ebx, 4
xor ebx, ebp
mov ebp, dword [esp + 0x18]
add eax, dword [ebp + ebx*4]
add edx, edx
shr esi, 1
or edx, ecx
sub edi, 1
jne 0x4785d1
pop ebp
pop ebx
pop edi
pop esi
ret 8
Function at 0x478750
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x4788c3
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x4787da
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x4787b0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x20]
add edi, eax
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x478794
cmp edx, 0x10
jae 0x47885d
lea eax, [edx - 8]
mov dword [esp + 8], eax
lea esp, [esp]
cmp edx, dword [esp + 0x1c]
jae 0x4788c3
or eax, 8
xor edi, edi
cmp eax, 1
je 0x478841
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x478814
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, 0x10
jb 0x478800
cmp edx, dword [esp + 0x1c]
jae 0x4788c3
lea eax, [edx - 0x10]
mov dword [esp + 0x18], eax
lea ebx, [ebx]
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x4788a6
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x478880
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 0x18], eax
cmp edx, dword [esp + 0x1c]
jb 0x478870
pop edi
pop ebp
add esp, 0xc
ret 0xc
Function at 0x47a3a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x47a3c0
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
sub dword [esp + 0xc], 1
jne 0x47a3d0
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
cmp esi, 0x10
jb 0x47a3c0
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret

Function at 0x47a430
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push edi
mov edi, 4
lea ebp, [esi + 0x30ea0]
movzx ebx, byte [esi + edi + 0x306a0]
mov ecx, ebx
mov edx, ebx
and edx, 1
shr ecx, 1
or edx, 2
dec ecx
shl edx, cl
mov eax, edi
push ebp
sub eax, edx
sub edx, ebx
lea edx, [esi + edx*2 + 0x32b0e]
push edx
call fcn.004785c0
mov dword [esp + edi*4 + 0x1c], eax
inc edi
cmp edi, 0x80
jb 0x47a444
lea ebp, [esp + 0x1c]
sub ebp, esi
lea eax, [esi + 0x32910]
lea ecx, [esi + 0x31d58]
sub ebp, 0x31d50
lea edi, [esi + 0x31950]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 4
jmp 0x47a4b4
mov ecx, dword [esp + 0xc]
xor ebx, ebx
cmp dword [esi + 0x32594], ebx
jbe 0x47a50f
mov edi, edi
mov eax, ebx
or eax, 0x40
xor edx, edx
cmp eax, 1
je 0x47a503
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edx, dword [esi + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x47a4d0
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [edi + ebx*4], edx
inc ebx
cmp ebx, dword [esi + 0x32594]
jb 0x47a4c0
mov eax, 0xe
cmp dword [esi + 0x32594], eax
jbe 0x47a536
lea esp, [esp]
mov edx, eax
shr edx, 1
sub edx, 5
shl edx, 4
add dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi + 0x32594]
jb 0x47a520
mov eax, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi + 4]
mov dword [ecx - 4], edx
mov eax, dword [edi + 8]
mov dword [ecx], eax
mov edx, dword [edi + 0xc]
mov dword [ecx + 4], edx
mov eax, 4
add ecx, 8
jmp 0x47a560
movzx edx, byte [esi + eax + 0x306a0]
mov edx, dword [edi + edx*4]
add edx, dword [ecx + ebp]
inc eax
mov dword [ecx], edx
add ecx, 4
cmp eax, 0x80
jb 0x47a560
sub dword [esp + 0x10], 0xffffff80
add dword [esp + 0xc], 0x200
sub ebp, 0x200
add edi, 0x100
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], ebp
jne 0x47a4b0
pop edi
pop ebp
mov dword [esi + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret
Function at 0x4830e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x4c], edx
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], edx
lea esi, [ecx + 0x70]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x483107
pop esi
ret

Function at 0x484db0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.004d57cb
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x484dd8
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x484de7
mov eax, 1
ret 4
Function at 0x487b29
Capabilities:
Set file attributes

Disassembly:
push 0xc
mov eax, 0x509e68
call fcn.004d6c98
mov edi, edx
mov ebx, ecx
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push ebx
call esi
test eax, eax
je 0x487b4b
mov al, 1
jmp 0x487b87
lea ecx, [ebp - 0x18]
call fcn.0046a15e
and dword [ebp - 4], 0
lea edx, [ebp - 0x18]
mov ecx, ebx
call fcn.0046a431
test al, al
je 0x487b7c
push edi
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
mov esi, eax
call fcn.00469e1a
test esi, esi
setne al
jmp 0x487b86
push dword [ebp - 0x18]
call fcn.00469e1a
xor al, al
pop ecx
call fcn.004d6d70
ret

Function at 0x487c24
Capabilities:
Get common file path

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0xc]
push 0x105
mov esi, edx
call fcn.0046a1b9
push eax
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [esp + 0xc]
mov esi, eax
call fcn.0046a1d1
pop edi
mov eax, esi
pop esi
ret 4

Function at 0x48a3c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, edx
push esi
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48a3d0
sub eax, esi
add eax, edx
mov ecx, 0x811c9dc5
cmp edx, eax
je 0x48a3f4
movsx esi, byte [edx]
imul ecx, ecx, 0x1000193
inc edx
xor ecx, esi
cmp edx, eax
jne 0x48a3e4
and ecx, 0x7fffffff
push 0x1f31d
push ecx
call fcn.004d8b98
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
pop esi
mov eax, edx
jns 0x48a420
add eax, 0x7fffffff
pop ebp
ret 4
Function at 0x4908f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
cmp esi, dword [eax]
jne 0x49091f
cmp ecx, eax
jne 0x49091f
mov ecx, ebx
call fcn.0048fb70
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
cmp esi, ecx
je 0x4909fd
push edi
mov edx, dword [esi]
mov dword [ebp + 0xc], edx
mov edx, dword [esi + 8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x490935
sub eax, edi
add eax, edx
mov ecx, 0x811c9dc5
cmp edx, eax
je 0x490960
lea esp, [esp]
movsx edi, byte [edx]
imul ecx, ecx, 0x1000193
inc edx
xor ecx, edi
cmp edx, eax
jne 0x490950
and ecx, 0x7fffffff
push 0x1f31d
push ecx
call fcn.004d8b98
imul edx, edx, 0x41a7
imul eax, eax, 0xb14
add esp, 8
sub edx, eax
jns 0x49098a
add edx, 0x7fffffff
mov ecx, dword [ebx + 0x20]
mov eax, ecx
and eax, edx
cmp dword [ebx + 0x24], eax
ja 0x49099f
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea ecx, [ecx + eax*8]
jne 0x4909c8
cmp dword [ecx], esi
jne 0x4909c0
mov edx, dword [ebx + 4]
mov dword [ecx], edx
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x4909d0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x4909d0
cmp dword [ecx], esi
jne 0x4909d0
mov edx, dword [esi]
mov dword [ecx], edx
cmp esi, dword [ebx + 4]
je 0x4909f0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
push esi
mov dword [edx + 4], eax
call fcn.00469e1a
add esp, 4
dec dword [ebx + 8]
mov esi, dword [ebp + 0xc]
cmp esi, dword [ebp + 0x10]
jne 0x490928
pop edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4a16c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c3e1
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x580b30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x44], 0
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
mov ecx, esi
call edx
mov dword [ebp - 0x5c], eax
mov eax, dword [esi]
mov edx, dword [eax + 0x34]
mov ecx, esi
call edx
mov ebx, dword [ebp + 0xc]
sub ebx, dword [edi + 8]
xor ecx, ecx
add ebx, dword [edi + 0xc]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x54]
push ecx
push esi
mov ecx, eax
call edx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
sub ecx, eax
sar ecx, 2
mov dword [ebp - 0x40], 0
test ecx, ecx
je 0x4a1776
mov edx, dword [ebp - 0x40]
mov eax, dword [eax + edx*4]
push edi
push esi
push eax
call fcn.004a0480
add esp, 0xc
test al, al
mov eax, dword [ebp - 0x54]
je 0x4a179e
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x40]
sub edx, eax
inc ecx
sar edx, 2
mov dword [ebp - 0x40], ecx
cmp ecx, edx
jb 0x4a174b
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
cmp byte [eax + 0x28], 0
mov eax, dword [edx + 4]
push edi
push esi
je 0x4a17af
call eax
push eax
call fcn.004a02b0
add esp, 8
test al, al
jne 0x4a17b9
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x4a17ab
push eax
call fcn.00469e1a
add esp, 4
xor al, al
jmp 0x4a182e
call eax
push eax
call fcn.0049ffc0
jmp 0x4a1794
mov ecx, dword [edi + 0xc]
sub ecx, dword [edi + 8]
cmp ecx, ebx
je 0x4a1807
push 0x23f
push str..._srcgoogleprotobufwire_format.cc
push 3
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x39], 0
call fcn.00489800
push str.:_Protocol_message_serialized_to_a_size_different_from_what_was_originally_expected.__Perhaps_it_was_modified_by_another_thread_during_serialization_
push str.CHECK_failed:_output__ByteCount____expected_endpoint:
mov ecx, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x44], 1
call fcn.00489880
mov ecx, eax
call fcn.00489880
push eax
lea ecx, [ebp - 0x39]
call fcn.004895d0
test byte [ebp - 0x44], 1
mov dword [ebp - 4], 0
je 0x4a181c
lea ecx, [ebp - 0x38]
call fcn.00489830
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x4a182c
push eax
call fcn.00469e1a
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d31b7
mov esp, ebp
pop ebp
ret
Function at 0x4b8413
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]

Function at 0x4b85c7
Capabilities:
Enumerate pe sections

Disassembly:
cmp eax, ebx
je 0x4b8bcc
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
jne 0x4b859b
call fcn.004b83d3
mov dword [ebx - 0x1c], ebp
push ebp
movzx eax, word [edi + 6]
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.004b83d3
add dword [ebx], 0x8b6661b6
inc edi
push es
cmp ax, bx
jbe 0x4b862d
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x4b8627
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x4b8618
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58

Function at 0x4ba3d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
inc eax
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x4ba41d
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x4ba422
jmp 0x4b9d75
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x4ba469
lea eax, [ebp - 0x714]
push eax
call fcn.004b83e3
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.004b8398
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x4ba474
jmp 0x4ba479
jmp 0x4b9d75
Function at 0x4baae0
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x50d640
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x580b30]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x580b30]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x80]
mov esi, dword [esp + 0x7c]
mov edi, dword [esp + 0x84]
cmp eax, 1
jne 0x4bab42
test edi, edi
je 0x4bab3b
mov dword [edi], 0
call fcn.004be240
mov dword [edi + 4], eax
xor al, al
jmp 0x4bac82
cmp eax, 3
je 0x4babd7
cmp eax, 0xb
je 0x4babd7
push 0x19
push str.boost::filesystem::remove
lea ecx, [esp + 0x38]
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
call fcn.0040a3b0
cmp dword [esi + 0x14], 8
mov dword [esp + 0x74], 1
jb 0x4bab8b
mov eax, dword [esi]
jmp 0x4bab8d
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4baba0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4baba2
xor eax, eax
lea ecx, [esp + 0x30]
push ecx
push edi
push esi
push eax
call fcn.004baa60
add esp, 0x10
cmp dword [esp + 0x44], 0x10
mov bl, al
jb 0x4babc8
mov edx, dword [esp + 0x30]
push edx
call fcn.00469e1a
add esp, 4
test bl, bl
je 0x4bac80
xor al, al
jmp 0x4bac82
push 0x19
xor ebx, ebx
push str.boost::filesystem::remove
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.0040a3b0
cmp dword [esi + 0x14], 8
mov dword [esp + 0x74], ebx
jb 0x4bac07
mov eax, dword [esi]
jmp 0x4bac09
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4bac2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, ebx
jne 0x4bac31
cmp edi, ebx
je 0x4bac5f
mov dword [edi], ebx
call fcn.004be240
jmp 0x4bac5c
xor ebp, ebp
jmp 0x4bac20
call fcn.004be240
cmp edi, ebx
jne 0x4bac5a
push eax
push ebp
push esi
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
call fcn.004ba8b0
push 0x54e8cc
lea ecx, [esp + 0x34]
push ecx
call fcn.004d6828
mov dword [edi], ebp
mov dword [edi + 4], eax
cmp ebp, ebx
setne bl
cmp dword [esp + 0x28], 0x10
jb 0x4bac78
mov edx, dword [esp + 0x14]
push edx
call fcn.00469e1a
add esp, 4
test bl, bl
jne 0x4bab3b
mov al, 1
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.004d31b7
add esp, 0x64
ret
Function at 0x4badd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
cmp dword [ebx + 0x14], 8
push edi
jb 0x4bade3
mov eax, dword [ebx]
jmp 0x4bade5
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4bae0e
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0xc]
push ebx
push ecx
call fcn.004bacb0
mov eax, dword [eax]
add esp, 0xc
pop edi
pop ebx
add esp, 8
ret
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x4bae25
mov dword [esi], 0
call fcn.004be240
mov dword [esi + 4], eax
pop esi
test edi, 0x400
je 0x4bae5e
push ebx
call fcn.004b98b0
add esp, 4
test al, al
je 0x4bae53
mov edx, edi
and dl, 0x10
movzx eax, dl
neg eax
sbb eax, eax
and eax, 7
pop edi
add eax, 4
pop ebx
add esp, 8
ret
pop edi
mov eax, 9
pop ebx
add esp, 8
ret
mov eax, edi
and eax, 0x10
or eax, 0x20
pop edi
shr eax, 4
pop ebx
add esp, 8
ret