joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4be870
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x110
push ebp
push esi
mov edx, ecx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea ebp, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov eax, ecx
mov esi, edi
mov edi, ebp
push 0x8002
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x124]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x20]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__open]
mov ebp, eax
add esp, 8
test ebp, ebp
jle 0x4be964
xor ecx, ecx
lea edx, [esp + 0xc]
mov dword [esp + 0x10], ecx
push 0x10
mov dword [esp + 0x18], ecx
push edx
push ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], ecx
call dword [sym.imp.MSVCRT.dll__read]
push 0
push 0
push ebp
mov esi, eax
call dword [sym.imp.MSVCRT.dll__lseek]
add esp, 0x18
cmp esi, 0x10
jne 0x4be94b
mov edi, dword [esp + 0x124]
mov ecx, 4
lea esi, [esp + 0xc]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x4be964
push ebp
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
add esp, 0x110
ret 8
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x110
ret 8

Function at 0x4bf190
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push edi
call fcn.004bf0a0
mov esi, eax
test esi, esi
jle 0x4bf1cf
push 0x10
push edi
push esi
call dword [sym.imp.MSVCRT.dll__write]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push esi
call dword [sym.imp.MSVCRT.dll__read]
push esi
mov edi, eax
call fcn.00472af0
add esp, 0x1c
mov eax, edi
pop edi
pop esi
ret 0xc
pop edi
or eax, 0xffffffff
pop esi
ret 0xc

Function at 0x4bf240
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
call fcn.004bea00
push esi
call fcn.004be380
add esp, 4
test eax, eax
je 0x4bf26c
push eax
call fcn.004be4b0
add esp, 4
mov eax, 1
pop esi
ret 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor ecx, ecx
pop esi
test eax, eax
setge cl
mov eax, ecx
ret 4
Function at 0x4bf9d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x808
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str._proc_bus_input_devices]
push ebx
push eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0x10], esi
jle 0x4bfab2
push ebp
lea ecx, [esp + 0x18]
push 0x800
push ecx
push esi
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
test eax, eax
jle 0x4bfa97
mov ebp, dword [esp + 0x820]
xor edi, edi
test ebp, ebp
jle 0x4bfa97
mov esi, dword [esp + 0x81c]
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
mov edx, dword [esi]
lea eax, [esp + 0x18]
push edx
push eax
call ebx
add esp, 8
test eax, eax
je 0x4bfa5a
cmp byte [eax], 0
jne 0x4bfa64
inc edi
add esi, 4
cmp edi, ebp
jge 0x4bfa93
jmp 0x4bfa44
push str.event
push eax
call ebx
add esp, 8
test eax, eax
je 0x4bfa93
cmp byte [eax], 0
je 0x4bfa93
mov ecx, dword [esp + 0x824]
mov edx, dword [eax]
mov dword [esp + 0x10], 1
mov dword [ecx], edx
mov ax, word [eax + 4]
mov word [ecx + 4], ax
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.MSVCRT.dll__close]
mov eax, dword [esp + 0x14]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x808
ret 0xc
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x808
ret 0xc

Function at 0x4bfae0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1008
call fcn.0051c710
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str._proc_bus_usb_devices]
mov dword [esp + 0x14], str.Driverusb_storage
push eax
mov dword [esp + 0x1c], str.WLAN_Adapter
call dword [sym.imp.MSVCRT.dll__open]
mov ebp, eax
add esp, 8
cmp ebp, ebx
jle 0x4bfb75
lea ecx, [esp + 0x18]
push 0x1000
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
test eax, eax
jle 0x4bfb6b
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
xor esi, esi
mov edx, dword [esp + esi + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
call edi
add esp, 8
test eax, eax
je 0x4bfb63
or ebx, dword [esi + 0x659a34]
add esi, 4
cmp esi, 8
jl 0x4bfb4a
push ebp
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
call fcn.0047de30
mov esi, eax
mov ecx, esi
call fcn.0049d440
test eax, eax
je 0x4bfb95
mov eax, dword [esi + 0xc]
test ah, 8
je 0x4bfb95
or ebx, dword [0x659a38]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x1008
ret
Function at 0x4bfcb0
Capabilities:
Create directory

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
xor edi, edi
call fcn.00487160
mov ecx, eax
call fcn.00485280
cmp eax, dword [esi + 0x1c]
je 0x4bfcd2
mov dword [esi + 0x1c], eax
mov ecx, esi
call fcn.004bf610
mov ebp, eax
mov eax, dword [esi]
cmp ebp, eax
je 0x4bfdfc
push ebx
push ebp
push str.curStatus:_d
call fcn.00402b00
mov eax, dword [esi]
add esp, 8
xor eax, ebp
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
mov esi, 0x659a34
mov ebx, 0x5fdc68
mov edi, 0x56ceb4
jmp 0x4bfd15
mov eax, dword [esp + 0x1c]
test dword [esi], eax
je 0x4bfdc8
call fcn.00487160
mov ecx, eax
call fcn.00485280
mov dword [esp + 0x14], eax
mov eax, dword [esi]
test ebp, eax
je 0x4bfdaf
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp edi, 0x56cf14
jge 0x4bfd6d
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push eax
call fcn.004bfc10
test eax, eax
jne 0x4bfd6d
push edi
push ebp
push str.mount_failed_curStatus:_d__DevName_Usbs:_s
call fcn.00402b00
mov ecx, dword [esi]
add esp, 0xc
not ecx
and ebp, ecx
jmp 0x4bfdc8
push ebx
call fcn.004bfe40
mov edx, dword [esi]
mov eax, dword [esp + 0x18]
or eax, edx
add esp, 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 3
push eax
push 0x23c1
call fcn.00487160
mov ecx, eax
call fcn.00483980
push 1
push 0x2394
call fcn.00487160
mov ecx, eax
call fcn.004838b0
jmp 0x4bfdc8
mov ecx, dword [esp + 0x10]
push 1
add ecx, 0x23c1
push ecx
call fcn.00487160
mov ecx, eax
call fcn.004838e0
mov ecx, dword [esp + 0x10]
add edi, 0x20
inc ecx
add ebx, 0x100
add esi, 4
cmp edi, 0x56cf34
mov dword [esp + 0x10], ecx
jl 0x4bfd11
mov edx, dword [esp + 0x18]
pop ebx
pop edi
pop esi
mov dword [edx], ebp
mov eax, 1
pop ebp
add esp, 0x10
ret
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x10
ret

Function at 0x4bfe40
Capabilities:
Create directory

Disassembly:
sub esp, 0x100
push ebx
mov ebx, dword [esp + 0x108]
push ebp
push esi
push edi
mov ebp, 0x54be00
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add ebp, 4
cmp ebp, 0x54be24
jl 0x4bfe56
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
Function at 0x4bffa0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004c0340
mov ebp, dword [esp + 0x14]
mov eax, dword [0x659a18]
push 0
push ebp
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
lea edx, [esp + 0x20]
push 2
push edx
call edi
mov eax, dword [0x659a18]
lea ecx, [esp + 0x2a]
push eax
push 1
push 2
push ecx
call edi
mov dx, word [esp + 0x38]
mov ax, word [esp + 0x3a]
mov word [esp + 0x40], dx
mov word [esp + 0x42], ax
mov ecx, dword [esp + 0x40]
mov dword [esi + 8], ecx
mov edx, dword [0x659a18]
push edx
push 1
push 4
push esi
call edi
mov eax, dword [esi]
add esp, 0x3c
test eax, eax
jg 0x4c0026
mov dword [esi], 0
pop edi
pop esi
pop ebp
pop ecx
ret 8
shl eax, 2
push ebx
push eax
call fcn.00470b90
mov ecx, dword [esi]
add esp, 4
shl ecx, 2
push ecx
mov ecx, 0x6af5d8
mov dword [esi + 4], eax
call fcn.004a7db0
mov edx, dword [0x659a18]
mov ecx, dword [esi]
push edx
push ecx
push 4
push eax
mov dword [esp + 0x28], eax
call edi
mov eax, dword [esi]
add esp, 0x10
xor ebx, ebx
test eax, eax
jle 0x4c01a3
mov edx, dword [esp + 0x18]
lea edi, [edx + 2]
movsx eax, word [edi - 2]
add eax, 0xfffffeff
cmp eax, 5
ja case.default.0x4c0081
jmp dword [eax*4 + 0x4c01c8]
push 0x1ec
call fcn.00470250
add esp, 4
test eax, eax
je 0x4c0181
movsx ecx, word [edi]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.00468fb0
mov edx, dword [esi + 4]
mov dword [edx + ebx*4], eax
jmp 0x4c0195
push 0x1e4
call fcn.00470250
add esp, 4
test eax, eax
je 0x4c0181
movsx ecx, word [edi]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.0046a130
mov edx, dword [esi + 4]
mov dword [edx + ebx*4], eax
jmp 0x4c0195
push 0x1f0
call fcn.00470250
add esp, 4
test eax, eax
je 0x4c0181
movsx ecx, word [edi]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.004695d0
mov edx, dword [esi + 4]
mov dword [edx + ebx*4], eax
jmp 0x4c0195
push 0x1f4
call fcn.00470250
add esp, 4
test eax, eax
je 0x4c0181
movsx ecx, word [edi]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.00469a00
mov edx, dword [esi + 4]
mov dword [edx + ebx*4], eax
jmp 0x4c0195
push 0x1f0
call fcn.00470250
add esp, 4
test eax, eax
je 0x4c0181
movsx ecx, word [edi]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.0046a2a0
mov edx, dword [esi + 4]
mov dword [edx + ebx*4], eax
jmp 0x4c0195
push 0x1ec
call fcn.00470250
add esp, 4
test eax, eax
je 0x4c0181
movsx ecx, word [edi]
add ecx, ebp
push ecx
mov ecx, eax
call fcn.00469880
mov edx, dword [esi + 4]
mov dword [edx + ebx*4], eax
jmp 0x4c0195
mov edx, dword [esi + 4]
xor eax, eax
mov dword [edx + ebx*4], eax
jmp 0x4c0195
mov eax, dword [esi + 4]
mov dword [eax + ebx*4], 0
mov eax, dword [esi]
inc ebx
add edi, 4
cmp ebx, eax
jl 0x4c006f
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, 0x6af5d8
call fcn.004a7de0
mov edx, dword [esp + 0x1c]
mov ecx, esi
push edx
call fcn.004c02e0
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x4c1050
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop ecx
ret
Function at 0x4c13e0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x114]
push ebp
push esi
xor esi, esi
push edi
test ebx, ebx
jbe 0x4c1464
mov edi, dword [esp + 0x118]
mov ebp, dword [esp + 0x11c]
mov edx, dword [edi + 4]
mov eax, ebx
sub eax, esi
push 0
lea ecx, [esi + ebp]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x4c145e
jge 0x4c1474
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x2733
je 0x4c1436
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb
jne 0x4c1474
mov eax, dword [edi + 4]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], eax
push 0
push ecx
inc eax
push 0
push eax
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x4c1474
xor eax, eax
add esi, eax
cmp esi, ebx
jb 0x4c1405
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x104
ret

Function at 0x4c2cd0
Capabilities:
Read file on windows
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x531d0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
stosw word es:[edi], ax
call sub.MFC42u.DLL_CString::CString_3
lea eax, [esp + 0xc]
push 0x104
push eax
push 0
mov dword [esp + 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::MakeLower
push str.khgui.exe
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::Find
or edi, 0xffffffff
cmp eax, edi
jne 0x4c2d93
push 0
push 0
push str.search_for_a_string_error_GetModuleFileName_
call sub.MFC42u.DLL_AfxMessageBox
lea ecx, [esp + 8]
mov dword [esp + 0x21c], edi
call sub.MFC42u.DLL_CString::CString
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
mov dword fs:[0], ecx
add esp, 0x218
ret
push str.TempComm.dat
push str.khgui.exe
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::Replace
mov edx, dword [esp + 8]
push 0x56a1d4
push edx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4c2dd3
push eax
push eax
push str.open_TempComm.dat_file_fail
call sub.MFC42u.DLL_AfxMessageBox
push 1
call dword [sym.imp.MSVCRT.dll_exit]
push esi
push 0x10
push 1
push 0x6599c0
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov esi, dword [0x6599c0]
add esp, 0x14
lea ecx, [esp + 8]
mov dword [esp + 0x21c], edi
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x214]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret

Function at 0x4c32e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
ret 0xc
Function at 0x4c9e20
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
mov esi, ecx
push eax
call fcn.004caaa0
add esp, 4
test eax, eax
jne 0x4c9e3e
pop esi
add esp, 8
ret 4
push edi
mov dword [esi + 4], eax
mov ecx, dword [0x659a18]
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
lea edi, [esi + 0x70]
push edx
push 1
push 0x24
push edi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
movsx edx, word [esi + 0x16]
movsx eax, word [esi + 0x12]
movsx ecx, word [esi + 0x14]
sub edx, eax
add esp, 0x1c
inc edx
push edx
movsx edx, word [esi + 0x10]
sub ecx, edx
inc ecx
push ecx
push 0
push 0
lea ecx, [esp + 0x18]
call fcn.004b4a60
mov ecx, dword [eax]
mov dword [esi + 0x34], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x38], edx
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
pop edi
pop esi
add esp, 8
ret 4
Function at 0x4caaa0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov edx, dword [0x675ab0]
xor eax, eax
cmp ecx, edx
mov dword [esp], eax
jae 0x4caae8
mov edx, dword [0x659a18]
push eax
mov eax, dword [0x659940]
lea ecx, [eax + ecx*4]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [0x659a18]
lea ecx, [esp + 0xc]
push eax
push 1
push 4
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x1c]
add esp, 0x1c
pop ecx
ret
Function at 0x4cff10
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push esi
push edi
push eax
call fcn.004caaa0
mov ebx, eax
add esp, 4
test ebx, ebx
mov dword [esp + 0x10], 0
jle 0x4cffd7
mov edx, dword [0x659a18]
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
lea ecx, [ebx + 0x19]
push 0
push ecx
push edx
call esi
mov eax, dword [0x659a18]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push eax
push 1
lea ecx, [esp + 0x24]
push 1
push ecx
call edi
mov eax, dword [0x659958]
add esp, 0x1c
cmp eax, 0x19
jl 0x4cffd7
mov edx, dword [0x659a18]
add ebx, 0x22
push 0
push ebx
push edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0
call esi
mov eax, dword [0x659a18]
lea ecx, [esp + 0x24]
push eax
push 1
push 2
push ecx
call edi
mov edx, dword [esp + 0x34]
mov ecx, dword [0x659a18]
push 1
lea eax, [edx*8 + 1]
push eax
push ecx
call esi
mov edx, dword [0x659a18]
lea eax, [esp + 0x34]
push edx
push 1
push 1
push eax
call edi
mov eax, dword [esp + 0x44]
add esp, 0x38
pop edi
pop esi
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
pop edi
sar eax, 4
pop esi
and eax, 3
pop ebx
add esp, 8
ret 4

Function at 0x4d0280
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
mov ebp, ecx
push edi
xor ebx, ebx
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str._var_]
lea ecx, [esp + 0x24]
push eax
push str._stouchpos.dat
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x30]
push 2
push edx
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 0x14
cmp esi, ebx
jle 0x4d036a
xor eax, eax
lea ecx, [esp + 0x18]
push 0xc
mov dword [esp + 0x20], eax
push ecx
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], eax
call dword [sym.imp.MSVCRT.dll__read]
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp eax, ebx
je 0x4d0360
mov dx, word [esp + 0x1c]
mov ax, word [esp + 0x20]
lea ecx, [esp + 0x10]
push 1
push ecx
lea ecx, [ebp + 0x10]
mov word [esp + 0x18], dx
mov word [esp + 0x1a], ax
call fcn.004b4af0
test al, al
je 0x4d033d
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ebx
push ebx
push ebx
push edx
push eax
lea ecx, [esp + 0x24]
call fcn.004b4a60
push eax
push ebx
call fcn.004cab50
add esp, 0xc
push ebx
push ebx
push esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.MSVCRT.dll__lseek]
lea ecx, [esp + 0x24]
push 4
push ecx
push esi
call dword [sym.imp.MSVCRT.dll__write]
add esp, 0x18
mov ebx, 1
push esi
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x4d1360
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x531eee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x448
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], esi
call fcn.00477610
lea ecx, [esp + 0x30]
call fcn.00477630
mov eax, dword [0x659a28]
lea ecx, [esp + 0x58]
push eax
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
mov ecx, esi
call fcn.004c4fa0
mov ecx, dword [esp + 0x44]
lea ebx, [eax*4]
lea eax, [ebx + ecx + 0x36]
push eax
mov dword [esp + 0x20], eax
call fcn.00470c30
mov ebp, eax
mov eax, dword [esp + 0x24]
mov edx, ebp
lea esi, [esp + 0x34]
lea edi, [ebp + 0xe]
add esp, 4
mov dword [edx], eax
mov ecx, dword [esp + 0x24]
mov dword [edx + 4], ecx
mov eax, dword [esp + 0x28]
mov dword [edx + 8], eax
mov cx, word [esp + 0x2c]
lea eax, [ebx + ebp + 0x36]
mov word [edx + 0xc], cx
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea esi, [esp + 0x58]
mov edx, ecx
lea edi, [ebp + 0x36]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x14], eax
and ecx, 3
xor edx, edx
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x10]
div dword [esp + 0x38]
movsx ebx, word [ecx + 0x16]
mov dword [esp + 0x18], eax
mov eax, ecx
movsx edx, word [eax + 0x12]
sub ebx, edx
js 0x4d1479
add eax, 0x1c
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
push ebx
push 0
call fcn.004a8d30
mov edi, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x18]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
dec ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
add ecx, eax
test ebx, ebx
mov dword [esp + 0x14], ecx
jge 0x4d1444
push 0x108
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x460], 0
je 0x4d14b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x468]
push ecx
push ebp
push edx
mov ecx, eax
call fcn.004706a0
jmp 0x4d14b2
xor eax, eax
push 1
push eax
push 0x470710
push 0x5fe438
mov dword [esp + 0x470], 0xffffffff
call fcn.00472a50
mov ecx, dword [esp + 0x468]
add esp, 0x10
mov eax, 1
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x454
ret 4
Function at 0x513a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
push edi
xor eax, eax
mov ecx, dword [esi + 0x14]
mov edi, ebp
mov edx, ecx
mov dword [esp + 0x10], 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esi + 4]
mov edi, dword [esi + 0x24]
mov eax, dword [esi + 0x14]
mov edx, ecx
sub edx, edi
sub edx, eax
test edx, edx
jle 0x513b06
push ebx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
xor edx, edx
mov dl, byte [ebx + edi]
mov edi, dword [esi + 0xc]
xor ebx, ebx
mov bl, byte [ebp]
xor edx, ebx
mov dl, byte [edx + edi]
mov byte [esp + 0x1c], dl
mov ebx, dword [esp + 0x1c]
and ebx, 0xff
cmp ebx, ecx
je 0x513aa1
mov edi, 1
cmp eax, edi
jle 0x513aa1
mov ecx, dword [esi + 0x10]
xor edx, edx
sub ecx, edi
mov dl, byte [ecx + eax]
add edx, ebx
push edx
push esi
call fcn.005139d0
mov ecx, dword [esi + 8]
add esp, 8
mov dl, byte [eax + ecx]
mov al, byte [edi + ebp]
xor al, dl
mov byte [edi + ebp], al
mov eax, dword [esi + 0x14]
inc edi
cmp edi, eax
jl 0x513a75
mov eax, dword [esi + 0x14]
lea ecx, [ebp + 1]
dec eax
push eax
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll_memmove]
mov eax, dword [esi + 4]
add esp, 0xc
cmp ebx, eax
je 0x513add
mov edx, dword [esi + 0x10]
xor eax, eax
mov al, byte [edx]
add eax, ebx
push eax
push esi
call fcn.005139d0
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x14]
add esp, 8
mov al, byte [eax + ecx]
mov byte [edx + ebp - 1], al
jmp 0x513ae5
mov ecx, dword [esi + 0x14]
mov byte [ecx + ebp - 1], 0
mov ecx, dword [esi + 4]
mov ebx, dword [esi + 0x24]
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0x14]
mov edi, ecx
inc edx
sub edi, ebx
mov dword [esp + 0x14], edx
sub edi, eax
cmp edx, edi
jl 0x513a40
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x51ce80
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x51ceb0
push esi
call fcn.00521010
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x51cea9
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x51cf33
mov eax, dword [esi + 0x18c]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x51cf1f
mov eax, dword [esi + 8]
test eax, eax
je 0x51ced4
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x18c]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x51cf1b
cmp eax, 2
je 0x51cf1f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x51cec7
cmp eax, 3
je 0x51cefa
cmp eax, 1
jne 0x51cec7
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x51cec7
mov edx, dword [esi + 0x118]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x51cec7
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0051cf60
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x51cf53
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x12
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0051cf60
add esp, 4
pop esi
ret