joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4489d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edi, dword [esi + 0x40]
xor edi, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0044a910
add esp, 0xc
mfence
nop word cs:[eax + eax]
nop dword [eax + eax]
mov eax, dword [esi + 0xb8]
test eax, 0x10000
jne 0x448a2c
mov ecx, eax
or ecx, 0x10000
lock cmpxchg dword [esi + 0xb8], ecx
jne 0x448a00
mov eax, ecx
and eax, 0xff
jne 0x448a37
pop esi
pop edi
pop ebp
ret
mov ecx, eax
mov eax, ecx
and eax, 0xff
je 0x448a28
cmp edi, 1
ja 0x448a43
movzx ecx, ch
cmp ecx, eax
jne 0x448a28
add esi, 0xac
push 1
push esi
call fcn.00449ee0
add esp, 8
pop esi
pop edi
pop ebp
ret
Function at 0x44ade0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x44ae69
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x44ae61
je 0x44ae16
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x44ae1a
mov edi, dword [eax]
mov dword [eax], 0
test edi, edi
je 0x44ae1c
mov edi, dword [eax + 4]
jmp 0x44ae1c
xor eax, eax
jmp 0x44ae61
xor edi, edi
mov eax, dword [0x59fb24]
movzx eax, byte [eax]
push 4
push 8
call fcn.0040cd10
add esp, 8
test eax, eax
je 0x44ae85
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x44ae5e
push 4
push 8
push edi
call fcn.0040cd20
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.004acae0
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x44adfc
jmp 0x44ae61
push 8
push 4
call fcn.004cf360
nop

Function at 0x44ae90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x44af4c
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x44af44
je 0x44af42
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x44aecf
mov edi, dword [eax + 4]
test byte [eax], 1
mov dword [eax], 0
jne 0x44aedf
call fcn.004505d0
push eax
call fcn.0044eb50
add esp, 4
mov edi, eax
mov eax, dword [0x59fb24]
movzx eax, byte [eax]
push 4
push 8
call fcn.0040cd10
add esp, 8
test eax, eax
je 0x44af73
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x44af3d
mov eax, dword [edi]
mov ecx, dword [eax + 0x410]
lea edx, [ecx - 1]
xor ecx, 1
mov dword [eax + 0x410], edx
or ecx, dword [eax + 0x40c]
je 0x44af68
push 4
push 8
push edi
call fcn.0040cd20
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x44af44
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.004acae0
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x44aeb4
jmp 0x44af44
push eax
call fcn.004502c0
add esp, 4
jmp 0x44af30
push 8
push 4
call fcn.004cf360
nop dword [eax]
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov esi, dword [edi + 8]
cmp eax, esi
jbe 0x44afbc
mov ecx, dword [edi + 4]
shl eax, 3
test esi, esi
je 0x44afc1
lea ebx, [esi*8]
push ebx
push 4
push eax
push ecx
call fcn.0040cd40
add esp, 0x10
test eax, eax
jne 0x44afd2
push ebx
push 4
call fcn.004cf340
mov eax, dword [edi + 4]
jmp 0x44afd7
push 4
push eax
push ecx
call fcn.0040cd20
add esp, 0xc
mov eax, 4
mov dword [edi + 4], eax
mov dword [edi], esi
mov edx, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44f400
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x418
mov esi, dword [ebp + 8]
nop
mov ecx, dword [esi]
mov edx, ecx
and edx, 0xfffffffc
mov ebx, dword [edx + 0x408]
mov edi, ebx
and edi, 0xfffffffc
je 0x44f4d2
mov eax, ecx
lock cmpxchg dword [esi], ebx
jne 0x44f410
mov eax, dword [esi + 0x40]
cmp ecx, eax
jne 0x44f43e
mov eax, ecx
lock cmpxchg dword [esi + 0x40], ebx
push 4
push 0x40c
push edx
call fcn.0040cd20
add esp, 0xc
mov ebx, dword [edi]
add edi, 4
mov dword [ebp - 0x424], ebx
push 0x404
push edi
lea eax, [ebp - 0x420]
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
test ebx, ebx
je 0x44f4d2
mov edi, dword [ebp - 0x24]
cmp edi, 0x41
jae 0x44f4ef
test edi, edi
lea esi, [ebp - 0x18]
je 0x44f40c
shl edi, 4
lea eax, [ebp - 0x424]
nop word [eax + eax]
movsd xmm1, qword [eax + 8]
movsd xmm0, qword [eax]
movsd xmm2, qword [0x582080]
lea ebx, [eax + 0x10]
movsd qword [ebp - 0x14], xmm1
movsd xmm1, qword [0x582088]
movsd qword [ebp - 0x1c], xmm0
movsd qword [eax], xmm2
movsd qword [eax + 8], xmm1
push esi
call dword [ebp - 0x1c]
add esp, 4
add edi, 0xfffffff0
mov eax, ebx
jne 0x44f490
jmp 0x44f40c
mov eax, dword [esi]
and eax, 0xfffffffc
push 4
push 0x40c
push eax
call fcn.0040cd20
add esp, 0x424
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x582070
push 0x40
push edi
call fcn.004e0750
nop
nop
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 4]
push 1
push esi
call sub.kernel32.dll_TlsSetValue
mov eax, dword [edi]
mov ecx, dword [eax + 0x410]
lea edx, [ecx - 1]
xor ecx, 1
mov dword [eax + 0x410], edx
or ecx, dword [eax + 0x40c]
je 0x44f548
push 4
push 8
push edi
call fcn.0040cd20
add esp, 0xc
push 0
push esi
call sub.kernel32.dll_TlsSetValue
pop esi
pop edi
pop ebp
ret
push eax
call fcn.004502c0
add esp, 4
jmp 0x44f52f
Function at 0x453940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
vmovdqa ymm0, ymmword [edx]
vpslld ymm0, ymm0, 2
vmovdqa ymmword [ecx], ymm0
pop ebp
vzeroupper
ret

Function at 0x453960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
vmovdqa ymm0, ymmword [edx]
vpsrld ymm0, ymm0, 0x1a
vmovdqa ymmword [ecx], ymm0
pop ebp
vzeroupper
ret

Function at 0x453980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
vmovdqa ymm0, ymmword [edx]
vpsrlq ymm0, ymm0, 0x20
vmovdqa ymmword [ecx], ymm0
pop ebp
vzeroupper
ret

Function at 0x4539c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
vmovaps ymm0, ymmword [edx]
vblendps ymm0, ymm0, ymmword [eax], 0xe0
vmovaps ymmword [ecx], ymm0
pop ebp
vzeroupper
ret

Function at 0x453a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
vpermpd ymm0, ymmword [edx], 0x93
vmovaps ymmword [ecx], ymm0
pop ebp
vzeroupper
ret

Function at 0x453ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
vbroadcastf128 ymm0, xmmword [edx]
vmovaps ymmword [ecx], ymm0
pop ebp
vzeroupper
ret

Function at 0x453ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
vmovaps ymm0, ymmword [eax]
vpermps ymm0, ymm0, ymmword [edx]
vmovaps ymmword [ecx], ymm0
pop ebp
vzeroupper
ret
Function at 0x453b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, dword [ebp + 8]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
movaps xmm0, xmmword [0x582aa0]
mov dword [esp + 0x5c], 2
mov dword [esp + 0x44], 0x582fd4
mov dword [esp + 0x48], 2
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov edi, dword [esi + 8]
movups xmmword [esp + 0x64], xmm0
movaps xmm0, xmmword [0x582ab0]
mov dword [esp + 0x74], 8
mov byte [esp + 0x78], 3
mov dword [esp + 0x7c], 2
mov ebx, ecx
shl ecx, 0x1a
movups xmmword [esp + 0x84], xmm0
mov dword [esp + 0x94], 8
mov byte [esp + 0x98], 3
shr ebx, 6
mov eax, ecx
add eax, edx
mov eax, ebx
adc eax, 0
mov eax, edi
setb byte [esp + 7]
shr eax, 0xc
shl edi, 0x14
add ecx, edx
movzx edx, byte [esp + 7]
adc edi, ebx
mov ebx, dword [esi + 0xc]
mov esi, dword [esi + 0x10]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
adc edx, eax
mov eax, ebx
setb byte [esp + 7]
shl ebx, 0xe
shr eax, 0x12
add ebx, edx
movzx edx, byte [esp + 7]
mov dword [esp + 0x18], ebx
adc eax, edx
mov edx, esi
shr esi, 0x18
shl edx, 8
add edx, eax
lea eax, [esp + 0x20]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x38], 0x4eac20
adc esi, 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x40], 0x4eac20
mov dword [esp + 0x54], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x58], 2
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x50], 2
push eax
push dword [esp + 0xc]
push dword [esp + 0x14]
call fcn.004de290
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x456bd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x456d86
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x456d7e
je 0x456d7c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x456c16
mov edi, dword [eax]
mov dword [eax], 0
test edi, edi
jne 0x456d18
xorps xmm0, xmm0
lea edi, [esp + 0x30]
lea ebx, [esp + 0x18]
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x30], xmm0
push 0x20
push edi
push ebx
call fcn.0045c8a0
add esp, 0xc
test eax, eax
jne 0x456dab
movups xmm0, xmmword [esp + 0x30]
movups xmm1, xmmword [esp + 0x40]
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x50], xmm1
push 4
push 0x583118
call fcn.004583d0
add esp, 8
mov dword [esp + 0xc], eax
lea eax, [0x58311c]
push 4
push eax
call fcn.004583d0
add esp, 8
mov ebx, eax
mov eax, dword [0x59fb24]
movzx eax, byte [eax]
push 8
push 0x158
call fcn.0040cd10
add esp, 8
test eax, eax
je 0x456df2
mov edi, eax
mov dword [eax], 1
mov dword [eax + 4], 1
add eax, 8
push 0x100
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
movaps xmm0, xmmword [esp + 0x20]
movaps xmm2, xmmword [esp + 0x50]
mov eax, dword [esp + 0xc]
movaps xmm1, xmmword [0x583210]
mov dword [edi + 0x108], 0x40
movups xmmword [edi + 0x110], xmm0
movups xmmword [edi + 0x120], xmm2
mov dword [edi + 0x130], 0
mov dword [edi + 0x134], 0
mov dword [edi + 0x138], eax
mov dword [edi + 0x13c], ebx
movups xmmword [edi + 0x140], xmm1
mov dword [edi + 0x150], 0
mov eax, dword [0x59fb24]
movzx eax, byte [eax]
push 4
push 8
call fcn.0040cd10
add esp, 8
test eax, eax
je 0x456da2
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [esp + 0x20], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x456d76
mov eax, dword [edi]
dec dword [eax]
jne 0x456d69
dec dword [eax + 4]
jne 0x456d69
push 8
push 0x158
push eax
call fcn.0040cd20
add esp, 0xc
push 4
push 8
push edi
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x20]
jmp 0x456d7e
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.004acae0
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x456bf9
jmp 0x456d7e
push 8
push 4
call fcn.004cf360
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], 0x583320
mov dword [esp + 0x34], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x45c550
push 0x583390
push edi
call fcn.004daa80
push 0x158
push 8
call fcn.004cf360
nop
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x14]
jne 0x456e24
shl eax, 2
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x45cd50
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0xc]
xor esi, esi
test ebx, ebx
je 0x45cd8b
push 2
push ebx
push dword [ebp + 8]
push 0
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x45cd8b
mov edi, eax
push ebx
push dword [ebp + 8]
call sub.advapi32.dll_SystemFunction036
and edi, 0x7fffffff
xor esi, esi
test al, al
cmove esi, edi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x472e80
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x430
call fcn.00472e94
Function at 0x481950
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x18], xmm0
movups xmmword [ebp - 0x28], xmm0
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x481984
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x481994
mov eax, dword [0x587ac0]
mov ecx, dword [0x587ac4]
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, esi
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x482e60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x428
mov esi, 0x200
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 2
cmp esi, 0x201
jae 0x482ec0
jmp 0x482eae
jbe 0x482f38
cmp esi, 0x201
jae 0x482ec0
mov dword [ebp - 0x20], 0x200
lea edi, [ebp - 0x434]
mov ebx, esi
jmp 0x482eee
mov ebx, dword [ebp - 0x24]
sub esi, ebx
je 0x482ee2
mov edx, ebx
lea ecx, [ebp - 0x18]
push 2
push 2
push esi
call fcn.0046e310
add esp, 0xc
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
push 0
call sub.kernel32.dll_SetLastError
push edi
push ebx
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
test eax, eax
jne 0x482f0b
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x482f88
cmp esi, ebx
jne 0x482ea0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x482fa6
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x482eae
jmp 0x482ec0
mov eax, dword [ebp - 0x20]
cmp esi, eax
ja 0x482fbc
lea eax, [ebp - 0x34]
push esi
push edi
push eax
call fcn.0048fe20
add esp, 0xc
movsd xmm0, qword [ebp - 0x34]
mov eax, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x2c]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x482f7a
add eax, eax
push 2
push eax
push dword [ebp - 0x14]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [ebp + 8]
add esp, 0x428
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp + 8]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x482f6a
jmp 0x482f7a
push 0x587be0
push 0x28
push str.internal_error:_entered_unreachable_code_fCX
call fcn.004dab10
add esp, 0xc
jmp 0x482fcb
push 0x587bd0
push eax
push esi
call fcn.004e0750
add esp, 0xc
ud2
Function at 0x496ea0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
lea eax, [ebp - 0x20]
push dword [ebp + 8]
push edx
push eax
call fcn.004cfbb0
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov ecx, eax
neg ecx
jno 0x496f16
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x40]
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x38], 1
push eax
push ecx
push 0
push edi
call sub.ws2_32.dll_getaddrinfo
test eax, eax
je 0x496f40
call sub.ws2_32.dll_WSAGetLastError
mov dword [esi + 8], eax
mov eax, 1
mov dword [esi + 4], 0
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
jne 0x496f60
jmp 0x496f6c
mov ecx, dword [0x586418]
mov edx, dword [0x58641c]
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
mov dword [esi], 1
jae 0x496f6c
push 1
push eax
push dword [ebp - 0x1c]
call fcn.0040cd20
add esp, 0x40
jmp 0x496f6f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax]
movzx eax, word [eax]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
je 0x496f6c
push 1
push ebx
push edi
call fcn.0040cd20
add esp, 0xc
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x497a00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1024
call fcn.004f1680
mov esi, edx
mov edi, ecx
lea ebx, [ebp - 0x1030]
push 0x1000
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
push 0x4a1dc0
push eax
push 0x1000
push ebx
mov dword [ebp - 0x10], edi
push edi
call sub.kernel32.dll_ReadFileEx
test eax, eax
je 0x497b25
push 1
push 0xffffffffffffffff
call sub.kernel32.dll_SleepEx
cmp dword [ebp - 0x1c], 1
jne 0x497a5e
cmp dword [ebp - 0x18], 0
jne 0x497b2c
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x497b2c
cmp ebx, 0x1000
ja 0x497b56
xor edi, edi
mov eax, ebx
sub eax, edi
jb 0x497b45
xorps xmm0, xmm0
lea edx, [ebp - 0x1c]
lea ecx, [ebp + edi - 0x1030]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], edx
push 0x4a1dc0
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
push esi
call sub.kernel32.dll_WriteFileEx
test eax, eax
je 0x497b27
nop word [eax + eax]
push 1
push 0xffffffffffffffff
call sub.kernel32.dll_SleepEx
cmp dword [ebp - 0x1c], 1
jne 0x497ad0
cmp dword [ebp - 0x18], 0
jne 0x497b2c
add edi, dword [ebp - 0x14]
cmp edi, ebx
jne 0x497a90
xorps xmm0, xmm0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], eax
push 0x4a1dc0
lea eax, [ebp - 0x30]
push eax
push 0x1000
lea eax, [ebp - 0x1030]
push eax
push dword [ebp - 0x10]
call sub.kernel32.dll_ReadFileEx
test eax, eax
jne 0x497a5e
jmp 0x497b27
call sub.kernel32.dll_GetLastError
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_CloseHandle
add esp, 0x1024
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x587584
push ebx
push edi
call fcn.004e07b0
add esp, 0xc
jmp 0x497b69
push 0x587584
push 0x1000
push ebx
call fcn.004e0750
add esp, 0xc
ud2
Function at 0x49bd70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x25c
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov edi, dword [ebx + 0x258]
cmp edi, 0xffffffff
je 0x49be66
movzx esi, word [ebx + 0x32]
mov eax, dword [ebx]
movzx ecx, word [ebx + 0x30]
mov dword [ebp - 0x14], esi
movzx esi, word [ebx + 0x34]
cmp eax, 1
mov dword [ebx], 0
mov word [ebp - 0xe], si
jne 0x49bdd8
mov esi, dword [ebx + 0x254]
cmp cx, 0x2e
jne 0x49be9a
cmp word [ebp - 0x14], 0
je 0x49bdd8
mov eax, dword [ebp - 0x14]
xor eax, 0x2e
or ax, word [ebp - 0xe]
jne 0x49be9a
lea esi, [ebp - 0x268]
push 0x250
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push edi
call sub.kernel32.dll_FindNextFileW
test eax, eax
je 0x49be71
mov ebx, dword [ebx + 0x254]
jmp 0x49be1b
push esi
push edi
call sub.kernel32.dll_FindNextFileW
test eax, eax
je 0x49be71
cmp word [ebp - 0x23c], 0x2e
jne 0x49be41
movzx eax, word [ebp - 0x23a]
test ax, ax
je 0x49be10
cmp ax, 0x2e
jne 0x49be41
cmp word [ebp - 0x238], 0
je 0x49be10
lock inc dword [ebx]
jle 0x49bf27
mov edi, dword [ebp + 8]
lea eax, [edi + 8]
push 0x250
push esi
push eax
call sub.msvcrt.dll_memcpy
mov edx, edi
add esp, 0xc
mov dword [edi + 4], ebx
jmp 0x49be8e
mov dword [edx], 0
jmp 0x49bf1a
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp + 8]
xor ecx, ecx
cmp eax, 0x12
je 0x49be93
mov dword [edx + 4], 0
mov byte [edx + 8], 0
mov dword [edx + 0xc], eax
mov ecx, 1
mov dword [edx], ecx
jmp 0x49bf1a
mov word [ebp - 0x16], cx
lock inc dword [esi]
jle 0x49bf27
lea eax, [ebx + 4]
add ebx, 0x36
movsd xmm2, qword [eax + 0x18]
movsd xmm1, qword [eax + 0x10]
mov ecx, dword [eax + 0x28]
movsd xmm0, qword [eax + 0x20]
movsd qword [edx + 0x20], xmm2
movsd qword [edx + 0x18], xmm1
movsd xmm2, qword [eax]
movsd xmm1, qword [eax + 8]
mov dword [edx + 0x30], ecx
movsd qword [edx + 0x28], xmm0
lea eax, [edx + 0x3a]
movsd qword [edx + 0x10], xmm1
movsd qword [edx + 8], xmm2
push 0x21e
push ebx
push eax
mov edi, edx
call sub.msvcrt.dll_memcpy
mov edx, edi
add esp, 0xc
movzx eax, word [ebp - 0x16]
mov dword [edi + 4], esi
movzx ecx, word [ebp - 0xe]
mov word [edi + 0x34], ax
mov eax, dword [ebp - 0x14]
mov word [edi + 0x36], ax
mov word [edi + 0x38], cx
mov dword [edi], 1
mov eax, edx
add esp, 0x25c
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x49c890
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [ebp - 0x24]
push dword [ebp + 8]
call fcn.004a9400
add esp, 4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, edx
neg ecx
mov ecx, dword [ebp - 0x1c]
jo 0x49c8e0
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
push 1
call fcn.004ab7b0
add esp, 4
mov edi, dword [ebp - 0x18]
mov eax, edi
neg eax
jno 0x49c8ed
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [esi], eax
mov dword [esi + 4], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp - 0x14]
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
je 0x49c905
mov byte [esi], 4
test edi, edi
jne 0x49c914
jmp 0x49c8e5
call sub.kernel32.dll_GetLastError
mov byte [esi], 0
mov dword [esi + 4], eax
test edi, edi
je 0x49c8e5
add edi, edi
push 2
push edi
push ebx
call fcn.0040cd20
add esp, 0x30
jmp 0x49c8e8

Function at 0x49f540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov edi, edx
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
lea ebx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x20], edx
xor edx, edx
test cl, 1
lea ecx, [esp + 0x20]
cmovne edx, ecx
mov ecx, dword [ebp + 0xc]
push 0
push edx
push ecx
push eax
push ebx
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x49f5b7
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [esp + 8]
cmp eax, 0xc0000011
jne 0x49f5c7
mov dword [esi + 4], 0
jmp 0x49f5d9
cmp eax, 0x103
je 0x49f5f2
test eax, eax
js 0x49f5e4
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov byte [esi], 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x49f5dc
lea eax, [esp + 4]
mov dword [esp + 0x2c], 0x5872c8
mov dword [esp + 0x30], 1
mov dword [esp + 0x3c], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea esi, [esp + 0x44]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x38], 0
push eax
push ecx
push esi
call fcn.0048d980
add esp, 0xc
mov ecx, esi
call fcn.00460240
mov ecx, 7
int 0x29
ud2