joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cab10
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
sub esp, 0x220
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x24], ebp
push dword [ebp + 0x2b4]
mov byte [ebp + 0x2f0], 1
push dword [esp + 0x238]
push dword [ebp + 0x2b8]
call fcn.00505060
add esp, 0xc
mov dword [esp + 0x10], 0x3020100
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x7060504
xor ebx, ebx
mov dword [esp + 0x18], 0xb0a0908
mov dword [esp + 0x1c], 0xf0e0d0c
push dword [ebp + 0x2c0]
push eax
push dword [ebp + 0x2c4]
call fcn.00505060
add esp, 0xc
lea eax, [esp + 0x30]
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x30]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x4cab94
push 0xc
pop ecx
push ebx
push 0x80
push 3
push ebx
push ebx
push accept
lea eax, [esp + 0x48]
mov esi, str.Aeroadmin_settings.bin
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4caccd
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.004edb63
pop ecx
mov ebx, eax
xor ebp, ebp
push ebp
lea eax, [esp + 0x30]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
mov dword [esp + 0x10], ebp
push eax
push edi
mov ecx, eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
call fcn.00448cbd
mov esi, dword [esp + 0x24]
push dword [esi + 0x2c4]
lea ecx, [esi + 0x158]
push dword [esi + 0x2b4]
push dword [esi + 0x2b8]
call fcn.00447cf8
mov eax, dword [esp + 0x14]
lea ecx, [esi + 0x15c]
mov esi, dword [ecx]
add eax, dword [esp + 0x10]
push edi
push ebx
push eax
call dword [esi + 0x1c]
push ebx
call fcn.004ed662
pop ecx
push 4
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.004c810e
mov ecx, ebp
or edx, 0xffffffff
test dl, 1
je 0x4cac77
push 0x1f
pop eax
sub eax, ecx
bts ebp, eax
inc ecx
shr edx, 1
cmp ecx, 0x20
jb 0x4cac6a
mov dword [esp + 0x20], ebp
call fcn.004d067a
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
sub ecx, eax
add eax, dword [esp + 0x10]
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.004cfae3
mov eax, dword [esp + 0x20]
not eax
cmp dword [esp + 0x28], eax
jne 0x4cacc4
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x10]
add edx, 0x408
call fcn.004c8ceb
lea ecx, [esp + 0x14]
call fcn.0043c24c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x220
ret 4
Function at 0x4cc595
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
or ebx, 0xffffffff
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
cmp dword [ebp + 8], ebx
jne 0x4cc5b6
xor eax, eax
jmp 0x4cc733
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4cc5e4
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4cc5e4
mov eax, dword [ebp + 8]
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x4cc733
cmp dword [esi + 0x4c], 0
je 0x4cc731
mov ecx, esi
call fcn.004ccda2
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [esi + 0x38], ecx
jne 0x4cc618
push dword [esi + 0x4c]
movsx eax, al
push eax
call fcn.0051a11b
cmp eax, ebx
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
jmp 0x4cc731
push ecx
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x2c], cl
lea ecx, [esp + 0x2c]
push 8
mov byte [esp + 0x1b], al
mov dword [esp + 0x44], 0xf
call fcn.0043c4fc
lea eax, [esi + 0x40]
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x3c]
mov esi, dword [esi + 0x38]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x2c]
cmp edi, 0x10
lea edx, [esp + 0x2c]
mov edi, dword [esi]
cmovae ecx, dword [esp + 0x2c]
cmovae edx, dword [esp + 0x2c]
add eax, ecx
push eax
push edx
lea eax, [esp + 0x30]
mov ecx, esi
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x27]
push eax
push dword [esp + 0x30]
call dword [edi + 0x1c]
test eax, eax
js 0x4cc728
cmp eax, 1
jg 0x4cc709
mov edi, dword [esp + 0x3c]
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x28]
cmp edi, 0x10
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
cmovae eax, ecx
sub edx, eax
mov dword [esp + 0x20], edx
je 0x4cc6d6
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [esp + 0x2c]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.0051899d
mov edx, dword [esp + 0x30]
add esp, 0x10
cmp edx, eax
jne 0x4cc728
mov edi, dword [esp + 0x3c]
lea eax, [esp + 0x13]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x24], eax
jne 0x4cc704
test edx, edx
jne 0x4cc643
cmp dword [esp + 0x38], 0x20
jae 0x4cc728
push edx
push 8
lea ecx, [esp + 0x30]
call fcn.0043c590
jmp 0x4cc63f
mov ebx, dword [ebp + 8]
jmp 0x4cc728
cmp eax, 3
jne 0x4cc728
mov eax, dword [esp + 0x14]
push dword [eax + 0x4c]
movsx eax, byte [esp + 0x17]
push eax
call fcn.0051a11b
cmp eax, ebx
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
lea ecx, [esp + 0x28]
call fcn.0043c446
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ccdc5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor ebx, ebx
cmp dword [ebp + 0x38], ebx
je 0x4ccecf
cmp byte [ebp + 0x3d], bl
je 0x4ccecf
mov eax, dword [ebp]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4ccdfc
xor al, al
jmp 0x4cced1
push ebx
push 8
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 0xf
mov byte [esp + 0x20], bl
call fcn.0043c4fc
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
cmp ecx, 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebp + 0x38]
lea edi, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x1c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebp + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x4cce5c
sub eax, 1
je 0x4cce5f
dec eax
sub eax, 1
jne 0x4ccec2
inc eax
jmp 0x4ccec0
mov byte [ebp + 0x3d], bl
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x4cce9e
push dword [ebp + 0x4c]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0051899d
add esp, 0x10
cmp esi, eax
jne 0x4ccebe
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
cmp byte [ebp + 0x3d], bl
je 0x4ccebc
test esi, esi
jne 0x4cce20
push ebx
push 8
lea ecx, [esp + 0x20]
call fcn.0043c590
jmp 0x4cce18
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [esp + 0x18]
call fcn.0043c446
mov al, bl
jmp 0x4cced1
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4cfae3
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
push edi
mov edi, ecx
xor ecx, ecx
lea eax, [edx + esi]
cmp edx, eax
cmova esi, ecx
test esi, esi
je 0x4cfb1b
mov ecx, dword [edi]
mov al, byte [edi]
xor al, byte [edx]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x601570]
inc edx
inc ebx
mov dword [edi], ecx
cmp ebx, esi
jb 0x4cfb02
pop edi
pop esi
pop ebx
ret 8

Function at 0x4d067a
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x60155c], 0
jne 0x4d0719
push ebx
xor cl, cl
push esi
mov byte [ebp - 1], cl
push edi
xor ebx, ebx
mov dh, 0x80
mov al, dh
mov dl, dh
and al, cl
mov ecx, ebx
xor ecx, 0x80000000
test al, al
cmove ecx, ebx
lea eax, [ecx + ecx]
mov ebx, eax
xor ebx, 0x4c11db7
test ecx, ecx
mov cl, byte [ebp - 1]
cmovns ebx, eax
shr dh, 1
cmp dl, 2
jae 0x4d0697
xor edx, edx
xor ecx, ecx
test bl, 1
je 0x4d06d5
push 0x1f
pop eax
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x20
jb 0x4d06c8
mov cl, byte [ebp - 1]
xor al, al
push 7
pop esi
push 8
mov bl, cl
pop edi
test bl, 1
je 0x4d06f5
movzx eax, al
bts eax, esi
dec esi
shr bl, 1
sub edi, 1
jne 0x4d06ea
movzx eax, al
add cl, 1
mov byte [ebp - 1], cl
mov dword [eax*4 + 0x601570], edx
jne 0x4d0693
pop edi
pop esi
mov byte [0x60155c], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d1164
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x53682c
call fcn.00535848
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call fcn.004d1974
mov edi, eax
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov word [edi + 0xc], bx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
mov eax, dword [eax]
mov dword [edi + 0x10], eax
lea esi, [edi + 0x14]
push 0x34
push ebx
push esi
call fcn.005055e0
add esp, 0xc
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
push 7
pop ecx
mov dword [esi + 0x14], ecx
xor eax, eax
mov word [esi], ax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ecx
mov word [esi + 0x1c], ax
or dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4d153f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x536854
call fcn.00535848
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call fcn.004d1ab7
mov esi, eax
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov word [esi + 0xc], bx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
push eax
lea ecx, [esi + 0x10]
call fcn.0043c644
mov byte [esi + 0x28], bl
push ebx
lea ecx, [esi + 0x30]
call fcn.004cdb5b
or dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4d1b44
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x536886
call fcn.00535848
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call fcn.004d1ab7
mov edi, eax
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov word [edi + 0xc], bx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
push eax
lea ecx, [edi + 0x10]
call fcn.0043a541
mov byte [edi + 0x28], bl
push ebx
lea ecx, [edi + 0x30]
call fcn.004cdb5b
or dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d27ac
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov ebp, edx
or dword [esp + 0x14], 0xffffffff
lea eax, [esp + 0x18]
push eax
push ecx
push 0
push 1
push 2
mov dword [esp + 0x24], 0x4000
call dword [sym.imp.MPR.dll_WNetOpenEnumW]
test eax, eax
je 0x4d27f2
push eax
push str.WnetOpenEnum_failed_with_error__d_n
call fcn.0043451c
pop ecx
pop ecx
xor eax, eax
jmp 0x4d2916
push dword [esp + 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4d27eb
mov dword [esp + 0x1c], 0x18
push dword [esp + 0x10]
push 0
push esi
call fcn.005055e0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push esi
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x24]
call dword [sym.imp.MPR.dll_WNetEnumResourceW]
test eax, eax
jne 0x4d2900
xor ebx, ebx
cmp dword [esp + 0x14], ebx
jbe 0x4d280c
mov edi, esi
cmp dword [edi], 2
jne 0x4d28db
cmp dword [esi + 4], 1
jne 0x4d28db
push dword [esi + 0x14]
lea ecx, [esp + 0x24]
call fcn.0043a44d
lea eax, [esp + 0x20]
mov ecx, ebp
push eax
call fcn.004401a8
lea ecx, [esp + 0x20]
call fcn.0043c274
push 0x5fffb4
call fcn.004ebd68
pop ecx
test eax, eax
je 0x4d288c
push eax
call fcn.004eb791
pop ecx
mov eax, dword [0x5fffac]
sub eax, dword [0x5fffa8]
cdq
push 0x18
pop ecx
idiv ecx
mov ecx, eax
mov eax, dword [ebp + 4]
sub eax, dword [ebp]
cdq
idiv dword [esp + 0x1c]
cmp eax, ecx
jb 0x4d28c5
cmp ebp, 0x5fffa8
je 0x4d28c5
push dword [esp + 0x1c]
push dword [ebp + 4]
push dword [ebp]
call fcn.004d4633
push 0x5fffb4
call fcn.004ebd8d
pop ecx
test eax, eax
je 0x4d28db
push eax
call fcn.004eb791
pop ecx
test dword [edi + 0xc], 2
je 0x4d28ed
mov edx, ebp
mov ecx, edi
call fcn.004d27ac
inc ebx
add edi, 0x20
cmp ebx, dword [esp + 0x14]
jb 0x4d2842
jmp 0x4d280c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x18]
call dword [sym.imp.MPR.dll_WNetCloseEnum]
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d2f1e
Capabilities:
Get disk information
Get disk size
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc88
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
push dword [edi + 4]
push dword [edi]
call fcn.00496968
mov eax, dword [edi]
lea ecx, [esi + 0x10]
mov dword [edi + 4], eax
call fcn.0047bf0b
lea eax, [esp + 0x498]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ebx, ebx
lea esi, [esp + 0x498]
push 7
pop ebp
cmp word [esp + 0x498], bx
je 0x4d30a0
push 0x20a
lea eax, [esp + 0x28c]
push ebx
push eax
call fcn.005055e0
push 0x20a
lea eax, [esp + 0x88]
push ebx
push eax
call fcn.005055e0
add esp, 0x18
mov dword [esp + 0x1c], ebx
mov ecx, 0x105
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x78]
mov dword [esp + 0x14], ebx
push ecx
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push ecx
lea eax, [esp + 0x2a0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4d307d
mov ecx, esi
mov dword [esp + 0x30], ebx
xor eax, eax
mov dword [esp + 0x34], ebp
mov word [esp + 0x20], ax
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebp
lea edx, [ecx + 2]
mov word [esp + 0x38], ax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4d2fff
sub ecx, edx
sar ecx, 1
dec ecx
lea eax, [esi + ecx*2]
sub eax, esi
lea ecx, [esp + 0x20]
sar eax, 1
push eax
push esi
push ebx
push ebx
call fcn.0048a5c0
push 0x559ab4
lea ecx, [esp + 0x3c]
call fcn.0043c2b9
lea eax, [esp + 0x68]
mov dword [esp + 0x50], ebx
push eax
lea eax, [esp + 0x64]
mov dword [esp + 0x58], ebx
push eax
lea eax, [esp + 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [esp + 0x60]
mov ecx, edi
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x20]
push eax
call fcn.004d41d1
lea ecx, [esp + 0x38]
call fcn.0043c274
lea ecx, [esp + 0x20]
call fcn.0043c274
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4d3082
sub ecx, edx
sar ecx, 1
lea esi, [esi + ecx*2]
add esi, 2
cmp word [esi], bx
jne 0x4d2f77
mov eax, dword [0x5fffa8]
cmp eax, dword [0x5fffac]
je 0x4d3142
xor eax, eax
mov dword [esp + 0x30], ebx
push str.Network
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], ebp
mov word [esp + 0x24], ax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebp
mov word [esp + 0x3c], ax
call fcn.0043c2b9
push 0x55ce5c
lea ecx, [esp + 0x3c]
call fcn.0043c2b9
or dword [esp + 0x58], 0xffffffff
mov esi, 0x5fffb4
or dword [esp + 0x5c], 0xffffffff
push esi
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
call fcn.004ebd68
pop ecx
test eax, eax
je 0x4d3112
push eax
call fcn.004eb791
pop ecx
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call fcn.004d41d1
push esi
call fcn.004ebd8d
pop ecx
test eax, eax
je 0x4d3130
push eax
call fcn.004eb791
pop ecx
lea ecx, [esp + 0x38]
call fcn.0043c274
lea ecx, [esp + 0x20]
call fcn.0043c274
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d3bef
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2bc
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
push 0x55ce48
mov edx, esi
mov dword [esp + 0x48], ebx
lea ecx, [esp + 0x64]
call fcn.0043de19
pop ecx
push 8
pop ebp
cmp dword [esp + 0x74], ebp
lea ecx, [esp + 0x78]
lea eax, [esp + 0x60]
cmovae eax, dword [esp + 0x60]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4d3dd8
and dword [esp + 0x3c], 0
lea ecx, [esp + 0x2c]
xor eax, eax
mov dword [esp + 0x40], 7
mov word [esp + 0x2c], ax
or ebx, 1
lea eax, [esp + 0xa4]
push eax
call fcn.0043c2b9
cmp dword [esp + 0x40], ebp
lea eax, [esp + 0x2c]
cmovae eax, dword [esp + 0x2c]
cmp dword [esp + 0x3c], 1
jne 0x4d3c89
push 1
push 0x54e8f8
push eax
call fcn.0043461b
add esp, 0xc
test eax, eax
je 0x4d3cd9
and dword [esp + 0x24], 0
lea ecx, [esp + 0x14]
xor eax, eax
mov dword [esp + 0x28], 7
mov word [esp + 0x14], ax
or ebx, 2
lea eax, [esp + 0xa4]
push eax
call fcn.0043c2b9
cmp dword [esp + 0x28], ebp
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
cmp dword [esp + 0x24], 2
jne 0x4d3ce0
push 2
push 0x559d00
push eax
call fcn.0043461b
add esp, 0xc
test eax, eax
jne 0x4d3ce0
mov byte [esp + 0x13], 1
jmp 0x4d3ce5
mov byte [esp + 0x13], 0
test bl, 2
je 0x4d3cf6
lea ecx, [esp + 0x14]
and ebx, 0xfffffffd
call fcn.0043c274
lea ecx, [esp + 0x2c]
and ebx, 0xfffffffe
call fcn.0043c274
cmp byte [esp + 0x13], 0
jne 0x4d3d66
lea eax, [esp + 0xa4]
mov edx, esi
push eax
push 0x559268
lea ecx, [esp + 0x34]
call fcn.0043de19
pop ecx
mov edx, eax
lea ecx, [esp + 0x4c]
call fcn.0043de86
pop ecx
lea ecx, [esp + 0x2c]
call fcn.0043c274
test byte [esp + 0x78], 0x10
je 0x4d3d49
lea ecx, [esp + 0x48]
call fcn.004d3bef
jmp 0x4d3d5d
cmp dword [esp + 0x5c], ebp
lea eax, [esp + 0x48]
cmovae eax, dword [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x48]
call fcn.0043c274
lea eax, [esp + 0x78]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4d3c39
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
cmp dword [esi + 0x14], ebp
jb 0x4d3d8a
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
lea ecx, [esp + 0x14]
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call fcn.0044bcf7
sub esp, 0x18
mov ecx, esp
push str.delete
call fcn.0043a56f
sub esp, 0xc
lea eax, [esp + 0x38]
mov ecx, esp
push eax
call fcn.004a4d82
call fcn.004d29fe
add esp, 0x24
lea ecx, [esp + 0x14]
call fcn.0043bc40
lea ecx, [esp + 0x60]
call fcn.0043c274
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2bc
ret
Function at 0x4d63f0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2d4
push ebx
push ebp
mov eax, ecx
mov dword [esp + 0xc], edx
push esi
xor ecx, ecx
mov dword [esp + 0x40], eax
push edi
xor esi, esi
mov word [esp + 0x18], cx
push 0x55ce48
mov edx, eax
mov dword [esp + 0x2c], esi
lea ecx, [esp + 0x4c]
mov dword [esp + 0x30], 7
mov ebp, esi
mov edi, esi
call fcn.0043de19
pop ecx
cmp dword [eax + 0x14], 8
jb 0x4d6436
mov eax, dword [eax]
lea ecx, [esp + 0x90]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [esp + 0x48]
mov ebx, eax
call fcn.0043c274
cmp ebx, 0xffffffff
je 0x4d65cc
mov ecx, 0x54e8f8
lea eax, [esp + 0xbc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4d648b
test dx, dx
je 0x4d6487
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4d648b
add eax, 4
add ecx, 4
test dx, dx
jne 0x4d6465
mov eax, esi
jmp 0x4d6490
sbb eax, eax
or eax, 1
test eax, eax
je 0x4d6595
mov ecx, 0x559d00
lea eax, [esp + 0xbc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4d64ca
test dx, dx
je 0x4d64c6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4d64ca
add eax, 4
add ecx, 4
test dx, dx
jne 0x4d64a4
mov eax, esi
jmp 0x4d64cf
sbb eax, eax
or eax, 1
test eax, eax
je 0x4d6595
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x1c]
call fcn.0043c2b9
test byte [esp + 0x90], 0x10
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x3c], eax
je 0x4d656d
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
or dword [esp + 0x30], 0xffffffff
or dword [esp + 0x34], 0xffffffff
push eax
call fcn.004d67a3
mov edx, dword [esp + 0x44]
lea eax, [esp + 0xbc]
push eax
push 0x559268
lea ecx, [esp + 0x80]
call fcn.0043de19
pop ecx
mov edx, eax
lea ecx, [esp + 0x64]
call fcn.0043de86
mov edx, dword [esp + 0x18]
pop ecx
mov ecx, eax
call fcn.004d63f0
add ebp, eax
lea ecx, [esp + 0x60]
adc edi, edx
call fcn.0043c274
lea ecx, [esp + 0x78]
call fcn.0043c274
jmp 0x4d6595
mov eax, dword [esp + 0xb0]
add ebp, eax
mov ecx, dword [esp + 0xac]
mov dword [esp + 0x30], eax
adc edi, ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x14]
push eax
call fcn.004d67a3
lea eax, [esp + 0x90]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4d6459
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x2c], 8
lea eax, [esp + 0x18]
mov dword [esp + 0x28], esi
mov esi, ebp
cmovae eax, dword [esp + 0x18]
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
or dword [esp + 0x34], 0xffffffff
push eax
mov dword [esp + 0x34], 0xfffffffe
call fcn.004d67a3
lea ecx, [esp + 0x18]
call fcn.0043c274
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2d4
ret
Function at 0x4d65ff
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
push 0x7b
pop esi
mov dword [esp + 0x10], esi
test ebx, ebx
jl 0x4d667a
mov edi, dword [esp + 0x1c]
jg 0x4d661d
test edi, edi
je 0x4d667a
mov ebp, 0x10000
test ebx, ebx
jg 0x4d662e
jl 0x4d662c
cmp edi, ebp
jae 0x4d662e
mov ebp, edi
mov eax, ebp
cdq
push 0
sub edi, eax
lea eax, [esp + 0x20]
push eax
push ebp
push 0x6052f8
push dword [esp + 0x28]
sbb ebx, edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x1c], ebp
jb 0x4d6684
lea eax, [esp + 0x10]
mov edx, ebp
push eax
push esi
mov ecx, 0x6052f8
call fcn.004dca67
pop ecx
pop ecx
test ebx, ebx
jg 0x4d6670
jl 0x4d6676
test edi, edi
je 0x4d6676
mov esi, dword [esp + 0x10]
jmp 0x4d661d
mov esi, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
xor eax, eax
jmp 0x4d667c

Function at 0x4d6688
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, ecx
xor ebx, ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov eax, dword [esi + 0x170]
cmp eax, 0xffffffff
jne 0x4d66bb
cmp dword [esp + 0x24], ebx
jl 0x4d66b7
jg 0x4d66b5
cmp dword [esp + 0x20], ebx
jbe 0x4d66b7
mov bl, 1
mov al, bl
jmp 0x4d6728
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x24]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov edi, dword [esp + 0x20]
mov dword [esp + 0x10], eax
cmp ebp, ecx
jl 0x4d66ea
jg 0x4d66e6
cmp edi, eax
jbe 0x4d66ea
xor al, al
jmp 0x4d6728
push ebp
push edi
push dword [esi + 0x170]
call fcn.004d65ff
cmp dword [esp + 0x28], eax
je 0x4d671a
push ebx
push ebx
push ebx
push dword [esi + 0x170]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
jmp 0x4d66e6
mov dword [esi + 0x140], edi
mov al, 1
mov dword [esi + 0x144], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x4dca67
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, edx
mov eax, ebp
cdq
and edx, 3
push esi
push edi
mov edi, ecx
lea esi, [edx + eax]
mov edx, dword [esp + 0x10]
sar esi, 2
mov ecx, esi
neg ecx
je 0x4dcaaf
push ebx
mov ebx, edi
neg ecx
imul eax, dword [ebx], 0xcc9e2d51
lea ebx, [ebx + 4]
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, edx
rol eax, 0xd
imul edx, eax, 5
sub edx, 0x19ab949c
sub ecx, 1
jne 0x4dca89
pop ebx
mov eax, ebp
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x4dcad7
sub eax, 1
je 0x4dcacd
sub eax, 1
jne 0x4dcaee
movzx ecx, byte [edi + esi*4 + 2]
shl ecx, 0x10
movzx eax, byte [edi + esi*4 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edi + esi*4]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, ebp
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebp
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [esp + 8]
mov dword [eax], ecx
ret