joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx], 0
je 0x487420
cmp dword [esi + 4], 0xffffffff
je 0x487420
lea ecx, [esi + 8]
cmp byte [esi + 0x13], 0
jns 0x487448
mov edx, SysReAllocString
and edx, dword [esi + 0x10]
dec edx
mov dword [ebp - 0x20], edx
lea eax, [ebp - 0x14]
mov dword [eax], edx
mov ebx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
sub eax, ebx
add eax, 0xfffffffe
lea edi, [esi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [ebp - 0x1c], eax
push edx
push ecx
mov dword [ebp - 0x24], ecx
call fcn.00488600
add esp, 8
mov dword [ebp - 0x28], edi
push edi
push ebx
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x487461
test eax, eax
jne 0x487420
mov eax, dword [esi + 0x20]
inc eax
shr eax, 1
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
sub edx, ecx
sar edx, 1
cmp edx, eax
jbe 0x487452
mov word [ecx + eax*2], 0
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + 8]
cmp byte [esi + 0x13], 0
jns 0x48742b
mov eax, dword [eax]
mov word [eax], 0
mov eax, dword [esi + 0x14]
cmp dword [esi + 0x18], eax
je 0x487452
mov word [eax], 0
mov dword [esi + 0x20], 0
xor ebx, ebx
jmp 0x48740c
mov edx, 4
jmp 0x48739e
push 0x6bd9fd
push 0x6bd0bf
call fcn.0057cbd0
mov eax, dword [esi + 0x20]
inc eax
shr eax, 1
mov edi, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov edx, ecx
mov ebx, edi
sub edx, edi
sar edx, 1
cmp eax, edx
jb 0x487492
lea ecx, [esi + 0x14]
inc eax
lea edx, [ebp - 0x16]
mov word [edx], 0
push edx
push eax
call fcn.00487520
mov ebx, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov edi, ebx
sub ecx, ebx
add ecx, 0xfffffffe
mov dword [esi + 0x20], ecx
mov ebx, dword [ebp - 0x20]
cmp dword [ebp - 0x14], ebx
mov eax, 0x4000
cmovne eax, ebx
mov dword [ebp - 0x14], eax
push eax
push dword [ebp - 0x24]
call fcn.00488600
add esp, 8
push dword [ebp - 0x28]
push edi
push dword [ebp - 0x1c]
push 0
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x4873ec

Function at 0x487500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x48750f
dec eax
mov dword [ecx + 4], eax
pop ebp
jmp fcn.00487360
Function at 0x48a3b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x42
push 0x6d1a64
push 0x6d1aa0
push ebx
call fcn.004f2b50
add esp, 0x10
mov ecx, edi
push 0
push ebx
call fcn.004e8e00
mov ecx, esi
call fcn.004e5c00
xor ebx, ebx
test al, al
je 0x48a4f5
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x48a535
mov edi, 2
mov dword [esp + 4], 4
mov ecx, esi
call fcn.0048a660
xor ecx, ecx
push ecx
push ebx
push ecx
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp dword [esi + 0x24], eax
je 0x48a476
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x24]
inc eax
cmp eax, 2
jae 0x48a519
mov eax, edi
inc eax
cmp eax, 2
jb 0x48a46c
mov dword [esi + 0x24], edi
call fcn.004f2b80
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi + 0x24]
inc edi
cmp edi, 2
jb 0x48a515
mov dword [esp + 0xc], 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edx, dword [0x6d2744]
xor edx, ecx
mov edi, dword [0x6d2740]
xor edi, eax
or edi, edx
mov edx, dword [ebx + 8]
jne 0x48a56c
cmp edx, dword [0x6d2748]
jne 0x48a56c
mov ecx, esi
call fcn.0048a750
mov edi, eax
add eax, 0xffffffff
adc edx, 0xffffffff
xor ebx, ebx
cmp eax, 0xffffffff
sbb edx, 0
jae 0x48a4f5
xor ecx, ecx
xor eax, eax
mov edx, dword [esp + 4]
push eax
push ebx
push ecx
push edx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x48a515
add eax, dword [esp + 0xc]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
mov bl, 1
lea ecx, [esp + 0x20]
call fcn.004e8e70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
jmp 0x48a4f5
call fcn.004f2b80
push dword [esi + 0x24]
call fcn.004e4b30
add esp, 4
mov dword [esi + 0x24], 0
jmp 0x48a45c
dec eax
cmp eax, 3
ja case.default.0x48a53f
jmp dword [eax*4 + 0x6d1ab8]
sub esp, 4
mov ecx, esi
call fcn.0048a260
mov ebx, eax
jmp 0x48a4f5
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 8]
mov edi, 4
mov dword [esp + 4], 2
jmp 0x48a42b
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
lea ebx, [esp + 8]
mov dword [ebx], edi
lea edi, [esp + 0xc]
push edi
push ebx
lea edi, [esp + 0x18]
push edi
push edx
push ecx
push eax
call fcn.004958e0
add esp, 0x18
mov eax, dword [ebp + 8]
mov edi, dword [eax + 8]
lea eax, [esp + 0xc]
mov eax, dword [eax]
mov ecx, eax
sar ecx, 0x1f
add eax, edi
adc ecx, 0
mov edx, ecx
and edx, 1
neg edx
xor ecx, edx
setne bl
mov ecx, dword [esp + 0x14]
test ecx, ecx
js 0x48a515
test bl, bl
jne 0x48a515
test edx, edx
js 0x48a515
test eax, eax
je 0x48a515
mov ebx, dword [esp + 0x10]
jmp 0x48a4d4
mov edi, 8
xor eax, eax
inc eax
mov dword [esp + 4], eax
jmp 0x48a42b
xor eax, eax
dec eax
mov dword [esp + 4], eax
xor edi, edi
jmp 0x48a42b
Function at 0x4948f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00494a70
mov eax, dword [edi]
mov dword [0x7441b4], eax
mov bl, 1
test al, 1
jne 0x49492c
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x748bac]
test eax, eax
je 0x494956
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x748bac], 0
cmp dword [0x748bb0], 0
jne 0x494956
and byte [0x7441b4], 0xfe
mov eax, dword [edi + 0x18]
test eax, eax
je 0x494973
movsx ecx, byte [edi + 0xf]
test ecx, ecx
jns 0x494968
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x4949de
mov dword [0x748bac], eax
jmp 0x494918
movsx eax, byte [edi + 0xf]
test eax, eax
jns 0x49497e
mov eax, dword [edi + 8]
test eax, eax
je 0x494a1f
lea esi, [edi + 4]
mov ecx, dword [0x748bb0]
test ecx, ecx
jne 0x4949b2
push 0xc
call fcn.00540349
add esp, 4
mov ecx, eax
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [0x748bb0], eax
push esi
call fcn.004d3530
cmp dword [edi + 0x14], 0
jne 0x4949d2
mov eax, dword [0x748bb0]
cmp byte [eax + 0xb], 0
jns 0x4949cb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.005bce50
mov ebx, eax
jmp 0x494918
lea eax, [ebp - 0x24]
push 0x231
push 0x6d2600
push 0x6d2616
push eax
call fcn.004f2b50
add esp, 0x10
lea esi, [ebp - 0x14]
lea eax, [ebp - 0x24]
push eax
push 0x7f
push 0x6d263c
push esi
call fcn.005bf620
add esp, 0x10
mov ecx, esi
call fcn.005bf880
mov eax, dword [edi + 0x18]
jmp 0x49496c
lea ebx, [ebp - 0x24]
push 0x237
push 0x6d2600
push 0x6d2616
push ebx
call fcn.004f2b50
add esp, 0x10
lea esi, [ebp - 0x28]
push ebx
push 0x7f
push 0x6d265b
push esi
call fcn.005bf620
add esp, 0x10
mov ecx, esi
push 0x6d267b
call fcn.005bce20
mov ecx, esi
call fcn.005bf880
jmp 0x494986
Function at 0x4969c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
xor eax, eax
mov dword [ecx], eax
mov ebx, dword [ebp + 8]
mov dword [ebp + 8], eax
lea edi, [ebx + 1]
cmp edi, 2
jb 0x4969e0
call fcn.004f2b80
cmp dword [esi], ebx
je 0x496a0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x496a53
cmp edi, 2
jb 0x496a01
mov dword [esi], ebx
call fcn.004f2b80
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
call fcn.004f2e40
lea ecx, [esi + 0x10]
call fcn.00501850
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 0
lea edi, [ebp + 8]
mov al, byte [edi + 4]
mov byte [esi + 0x19], al
mov eax, dword [edi]
inc eax
cmp eax, 2
jae 0x496a42
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.004f2b80
push dword [edi]
call fcn.004e4b30
add esp, 4
jmp 0x496a36
call fcn.004f2b80
push dword [esi]
call fcn.004e4b30
add esp, 4
mov dword [esi], 0
jmp 0x4969f5

Function at 0x496dd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10010
call fcn.005416e0
mov esi, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1001c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
push edx
push ecx
push ebx
call fcn.004eb0d0
add esp, 0xc
test esi, esi
je 0x496e89
lea edi, [ebp - 0x1000e]
push 0xfffe
push 0xff
push edi
call fcn.00544260
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x496e35
mov ebx, dword [ebp - 0x1001c]
push 0x7fff
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x496e5b
cmp eax, 0x7fff
jae 0x496eb2
push esi
push eax
push edi
call fcn.00492ed0
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x496e72
push dword [ebp - 0x1001c]
call fcn.00540380
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0x10010
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp - 0x10011], 0
js 0x496e9a
lea eax, [ebp - 0x1001c]
jmp 0x496ea0
mov eax, dword [ebp - 0x1001c]
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x496e5b
int3
Function at 0x4974c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x748c38]
test ebx, ebx
jne 0x497544
push 0x28
call fcn.00540349
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.00540349
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x49754e
mov dword [eax + 8], edi
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x748c38], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x497555
mov edi, eax
push eax
call fcn.0055b404
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00497570
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6bd165
jmp 0x49755a
push 0x6be6d6
push 0x6bd0bf
call fcn.0057cbd0
int3
Function at 0x4b1a00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x4b19e0
push 0
push eax
push 0x4b1830
push 0x757940
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x4b1ac8
mov esi, dword [ebp + 0xc]
cmp dword [0x757944], 0
jne 0x4b1ad6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x757948]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x4b1a8b
push 0x14
push 1
call fcn.004f7390
add esp, 8
test eax, eax
je 0x4b1ad6
mov edi, eax
push eax
push dword [0x757948]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4b1acd
mov ebx, dword [ebp + 8]
mov esi, 0x75794c
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x757950], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0055487f
push edi
call fcn.004f72a0
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [0x73c768]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x4b1ab4

Function at 0x4b3210
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea edx, [ebp - 0x18]
mov dword [edx], eax
mov dword [edx + 4], eax
push 6
push edx
push ecx
call fcn.004fa320
add esp, 0xc
xor esi, esi
test eax, eax
je 0x4b326d
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
movzx eax, byte [0x6dfd8d]
cmp ebx, eax
jne 0x4b3281
mov esi, 0x6dfd80
test al, al
je 0x4b326d
push ebx
push 0x6dfd84
push edi
call fcn.0054265d
add esp, 0xc
test eax, eax
jne 0x4b3281
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [0x6dfeb5]
cmp ebx, eax
jne 0x4b32a8
mov esi, 0x6dfea8
test al, al
je 0x4b326d
push ebx
push 0x6dfeac
push edi
call fcn.0054265d
add esp, 0xc
test eax, eax
je 0x4b326d
movzx eax, byte [0x6dfe21]
cmp ebx, eax
jne 0x4b32cf
mov esi, 0x6dfe14
test al, al
je 0x4b326d
push ebx
push 0x6dfe18
push edi
call fcn.0054265d
add esp, 0xc
test eax, eax
je 0x4b326d
movzx eax, byte [0x6dffe1]
cmp ebx, eax
jne 0x4b3303
mov esi, 0x6dffd4
test al, al
je 0x4b326d
push ebx
push 0x6dffd8
push edi
call fcn.0054265d
add esp, 0xc
test eax, eax
je 0x4b326d
jmp 0x4b3303
xor esi, esi
jmp 0x4b326d
movzx eax, byte [0x6dff49]
cmp ebx, eax
jne 0x4b32fc
mov esi, 0x6dff3c
test al, al
je 0x4b326d
push ebx
push 0x6dff40
push edi
call fcn.0054265d
add esp, 0xc
test eax, eax
je 0x4b326d
jmp 0x4b32fc
Function at 0x4b6de0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x742040]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, SysReAllocString
cmp edx, 0x7fffffff
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4b6e3f
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x4b6e3c
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005412b6
mov eax, esi
add esp, 8
pop esi
pop ebp
int3
xor esi, esi
dec esi
jmp 0x4b6e2a

Function at 0x4b6e50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x742040]
xor ecx, ebp
mov esi, SysReAllocString
cmp eax, 0x7fffffff
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
mov esi, ecx
call ecx
test eax, eax
je 0x4b6ed3
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4b6ebd
cmp ebx, 0xffffffff
je 0x4b6ed0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x4b6ee5
mov ebx, dword [ebp - 0x14]
jmp 0x4b6ea9
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x4b6ea9
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov ecx, esi
mov esi, dword [ebp - 0x18]
jmp 0x4b6e86

Function at 0x4b7340
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa4
mov esi, dword [ebp + 8]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.004b7230
add esp, 0x10
or edx, eax
jne 0x4b7377
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x4b738d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0xa4
pop esi
pop ebx
pop ebp
ret
push 2
call fcn.004f2410
add esp, 4
test al, al
je 0x4b73d7
call fcn.005bd350
lea esi, [ebp - 0xac]
mov ecx, esi
push eax
push 2
push 0xfc
push 0x6dd330
call fcn.005bd520
lea eax, [ebp - 0xa4]
push 0xc
push 0x6dd37e
push eax
call fcn.004d1fe0
add esp, 0xc
mov ecx, esi
call fcn.005bd580
xor ebx, ebx
jmp 0x4b7377
Function at 0x4e5cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x42
push 0x6d1ac8
push str.Read
push esi
call fcn.004f2b50
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.004e8e00
xor ebx, ebx
dec ebx
cmp dword [ebp + 0xc], 0
js 0x4e5dc2
mov edi, dword [ebp + 0x14]
test edi, edi
js 0x4e5dc2
mov ebx, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.00501820
test al, al
jne 0x4e5df9
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push esi
push eax
push edi
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e5de2
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x4e5df4
lea ecx, [esp + 0x28]
call fcn.005018b0
lea ecx, [esp + 0x30]
call fcn.004e8e70
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x4e5db9
int3
lea ecx, [esp + 0x28]
push 0
push edi
push dword [esp + 0x10]
push str.File::Read
call fcn.0062e360
jmp 0x4e5d74

Function at 0x4e5e20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x742040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x5f
push 0x6d1ac8
push 0x6d1b17
push ebx
call fcn.004f2b50
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.004e8e00
test ebx, ebx
js 0x4e5ee1
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.00501820
test al, al
jne 0x4e5efd
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push 0
push eax
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e5eeb
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x4e5ee6
lea ecx, [esp + 0x10]
call fcn.005018b0
lea ecx, [esp + 0x20]
call fcn.004e8e70
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x4e5ec1
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x4e5eb8
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push 0x6d1b28
call fcn.0062e360
jmp 0x4e5e95
Function at 0x655e80
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 0x10]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
push eax
push esi
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
cmp edi, 0x8007007a
je 0x655ee5
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
dec eax
lea edi, [ebp - 0x24]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x18]
shr eax, 1
mov ecx, edi
push eax
call fcn.0057b750
mov eax, dword [edi]
cmp eax, dword [edi + 4]
je 0x655f78
push 0
push esi
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x655f46
mov ebx, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edi, 0x80004005
cmovne edi, ecx
lea ecx, [ebp - 0x14]
mov dword [ecx], ebx
call fcn.004d5f30
jmp 0x655ed1
mov eax, dword [ebp - 0x18]
test al, 1
jne 0x655f87
mov ebx, edi
mov edi, dword [ebp + 0x14]
shr eax, 1
lea esi, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.0047cb20
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov esi, edx
sub esi, eax
sar esi, 1
mov ecx, edi
push esi
push edx
push eax
call fcn.0057b7c0
xor edi, edi
jmp 0x655f3a
push 0x6c5841
push 0x6bd0bf
call fcn.0057cbd0
int3

Function at 0x655f90
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov esi, dword [0x742040]
xor esi, ebp
mov dword [ebp - 0xc], esi
mov esi, 0x20000000
or esi, dword [ebp + 0xc]
lea edi, [ebp - 0x10]
mov dword [edi], 4
push 0
push edi
push edx
push ecx
push esi
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
xor esi, esi
test eax, eax
jne 0x655fec
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, 0x80004005
cmovne esi, ecx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005412b6
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219