joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4829f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov edx, dword [esi + 0x3c]
or edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x30]
mov ebx, dword [esi + 0x34]
jne 0x482a25
mov eax, edi
xor edx, edx
add eax, ecx
adc edx, ebx
cmp edx, 0x20000000
jbe 0x482a2d
xor eax, eax
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
jae 0x482b23
mov dword [esi + 0x34], edx
mov edx, dword [esi + 0x15c]
mov dword [esi + 0x30], eax
test edx, edx
je 0x482a93
test edi, edi
jne 0x482a54
jmp 0x482a6e
test edi, edi
je 0x482a6a
add ebp, 1
movzx eax, byte [ebp - 1]
sub edi, 1
xor byte [esi + edx + 0x40], al
add edx, 1
and edx, 0xf
jne 0x482a50
test edx, edx
je 0x482a81
mov dword [esi + 0x15c], edx
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + 0x50]
mov dword [esp + 4], eax
lea eax, [esi + 0x40]
mov dword [esp], eax
call fcn.004821a0
cmp edi, 0xf
jbe 0x482af6
lea ecx, [esi + 0x40]
mov ebx, ebp
lea eax, [esi + 0x50]
mov dword [esp + 0xc], ecx
mov ecx, edi
mov dword [esp + 0x2c], ebp
mov ebp, eax
mov dword [esp + 0x30], edi
mov edi, ebx
mov ebx, ecx
xor eax, eax
movzx edx, byte [edi + eax]
xor byte [esi + eax + 0x40], dl
add eax, 1
cmp eax, 0x10
jne 0x482ab6
mov eax, dword [esp + 0xc]
sub ebx, 0x10
add edi, 0x10
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.004821a0
cmp ebx, 0xf
ja 0x482ab4
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
lea eax, [edi - 0x10]
and edi, 0xf
and eax, 0xfffffff0
lea ebp, [ebp + eax + 0x10]
test edi, edi
je 0x482b10
xor edx, edx
lea esi, [esi]
movzx eax, byte [ebp + edx]
xor byte [esi + edx + 0x40], al
add edx, 1
cmp edx, edi
jne 0x482b00
mov dword [esi + 0x15c], edi
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0
jbe 0x482a33
xor eax, eax
jmp 0x482a25
Function at 0x483640
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x40]
mov ebx, dword [eax]
test ebx, ebx
je 0x48368a
test edx, edx
je 0x48368a
mov edi, dword [esp + 0x30]
jmp 0x48366b
test edx, edx
je 0x483686
movzx eax, byte [esi + ebx]
add edi, 1
add ebx, 1
xor al, byte [edi - 1]
add ecx, 1
sub edx, 1
and ebx, 0xf
mov byte [ecx - 1], al
jne 0x483667
mov dword [esp + 0x30], edi
cmp edx, 0xf
jbe 0x483772
mov edi, dword [esp + 0x30]
mov eax, edx
mov ebp, ecx
mov dword [esp + 0x38], edx
mov edx, esi
mov dword [esp + 0x34], ecx
mov esi, edi
mov edi, eax
lea esi, [esi]
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], edx
mov dword [esp], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call dword [esp + 0x48]
cmp ebx, 0xf
mov edx, dword [esp + 0xc]
ja 0x4836e2
mov eax, dword [edx + ebx]
xor eax, dword [esi + ebx]
mov dword [ebp + ebx], eax
add ebx, 4
cmp ebx, 0xf
jbe 0x4836d0
sub edi, 0x10
add ebp, 0x10
add esi, 0x10
cmp edi, 0xf
jbe 0x4836f4
xor ebx, ebx
jmp 0x4836b0
mov esi, edx
mov edx, dword [esp + 0x38]
xor ebx, ebx
mov ecx, dword [esp + 0x34]
mov edi, edx
sub edx, 0x10
and edx, 0xfffffff0
and edi, 0xf
lea eax, [edx + 0x10]
add dword [esp + 0x30], eax
add ecx, eax
test edi, edi
jne 0x483726
mov eax, dword [esp + 0x44]
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], esi
mov dword [esp], esi
add esi, ebx
mov dword [esp + 8], eax
call dword [esp + 0x48]
mov ecx, dword [esp + 0xc]
xor eax, eax
mov edx, dword [esp + 0x30]
add ecx, ebx
lea ebp, [edx + ebx]
nop
movzx edx, byte [esi + eax]
xor dl, byte [ebp + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, edi
jne 0x483750
add ebx, eax
mov eax, dword [esp + 0x44]
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, edx
jmp 0x483714

Function at 0x486310
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov eax, dword [esp + 0x18]
mov ebx, dword [eax]
lea esi, [eax + 8]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x48636f
xor eax, eax
lea esi, [esi]
add ebx, 1
movzx ebx, bl
lea edi, [esi + ebx*4]
mov edx, dword [edi]
add ecx, edx
movzx ecx, cl
lea ebp, [esi + ecx*4]
mov dword [esp], ebp
mov ebp, dword [ebp]
mov dword [edi], ebp
mov edi, dword [esp]
mov dword [edi], edx
mov edi, dword [esp + 0x20]
add edx, ebp
movzx edx, dl
mov edx, dword [esi + edx*4]
xor dl, byte [edi + eax]
mov edi, dword [esp + 0x24]
mov byte [edi + eax], dl
add eax, 1
cmp eax, dword [esp + 0x1c]
jne 0x486330
mov eax, dword [esp + 0x18]
mov dword [eax], ebx
mov dword [eax + 4], ecx
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x487ca0
Capabilities:
Hash data using sha1

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x60
test dl, 1
mov edi, edx
jne 0x487d03
test edi, 2
jne 0x487d13
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x487cd1
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x487cd9
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5f
test edi, 2
mov byte [edx], 0
je 0x487cba
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x487cba

Function at 0x487e90
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 1
mov eax, dword [esp + 4]
jmp fcn.00486740

Function at 0x4880b0
Capabilities:
Hash data using sha1

Disassembly:
push edi
mov eax, 0x57b5a0
push esi
mov ecx, 0x18
push ebx
sub esp, 0x70
mov ebx, dword [esp + 0x88]
lea esi, [esp + 0x10]
mov edi, esi
test ebx, ebx
cmove ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x84]
mov dword [esp], esi
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
mov dword [esp + 0x20], 0xc3d2e1f0
mov dword [esp + 4], eax
call sym.adb.exe_SHA1_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_SHA1_Final
mov dword [esp], esi
mov dword [esp + 4], 0x60
call sym.adb.exe_OPENSSL_cleanse
add esp, 0x70
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x494b40
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], edi
mov dword [esp], eax
call sym.adb.exe_AES_set_encrypt_key
test eax, eax
js 0x494d5e
mov edx, dword [edi + 0xf0]
mov eax, edi
lea ebp, [edx*4]
test ebp, ebp
jle 0x494bd9
shl edx, 4
mov ecx, edi
add edx, edi
xor ebx, ebx
mov dword [esp + 0xc], edi
nop
lea esi, [esi]
mov esi, dword [ecx]
add ebx, 4
add ecx, 0x10
mov eax, dword [edx]
sub edx, 0x10
mov dword [ecx - 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [edx + 0x10], esi
mov esi, dword [ecx - 0xc]
mov dword [ecx - 0xc], eax
mov eax, dword [edx + 0x18]
mov dword [edx + 0x14], esi
mov esi, dword [ecx - 8]
mov dword [ecx - 8], eax
mov eax, dword [edx + 0x1c]
mov dword [edx + 0x18], esi
mov esi, dword [ecx - 4]
mov dword [ecx - 4], eax
mov dword [edx + 0x1c], esi
mov esi, ebp
sub esi, ebx
cmp ebx, esi
jl 0x494b90
mov eax, dword [esp + 0xc]
mov edx, dword [edi + 0xf0]
mov ecx, 1
cmp edx, 1
mov ebp, ecx
jle 0x494d5c
lea esi, [esi]
add eax, 0x10
mov ebx, dword [eax]
add ebp, 1
movzx edx, bl
mov esi, ebx
movzx edx, byte [edx*4 + 0x553420]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x553420]
mov edx, dword [edx*4 + 0x551c20]
xor edx, dword [esi*4 + 0x552820]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x553420]
movzx esi, cl
movzx esi, byte [esi*4 + 0x553420]
xor edx, dword [esi*4 + 0x552420]
xor edx, dword [ebx*4 + 0x552020]
mov ebx, dword [eax + 4]
mov dword [eax], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x553420]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x553420]
mov edx, dword [edx*4 + 0x551c20]
xor edx, dword [esi*4 + 0x552820]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x553420]
movzx esi, cl
movzx esi, byte [esi*4 + 0x553420]
xor edx, dword [esi*4 + 0x552420]
xor edx, dword [ebx*4 + 0x552020]
mov ebx, dword [eax + 8]
mov dword [eax + 4], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x553420]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x553420]
mov edx, dword [edx*4 + 0x551c20]
xor edx, dword [esi*4 + 0x552820]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x553420]
movzx esi, cl
movzx esi, byte [esi*4 + 0x553420]
xor edx, dword [esi*4 + 0x552420]
xor edx, dword [ebx*4 + 0x552020]
mov ebx, dword [eax + 0xc]
mov dword [eax + 8], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x553420]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x553420]
mov edx, dword [edx*4 + 0x551c20]
xor edx, dword [esi*4 + 0x552820]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x553420]
movzx esi, cl
movzx esi, byte [esi*4 + 0x553420]
xor edx, dword [esi*4 + 0x552420]
xor edx, dword [ebx*4 + 0x552020]
mov dword [eax + 0xc], edx
cmp dword [edi + 0xf0], ebp
jg 0x494bf0
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4956f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmp dword [esp + 0x10], 1
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
je 0x495714
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
jmp sym.adb.exe_AES_decrypt
jmp sym.adb.exe_AES_encrypt

Function at 0x495720
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x20], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
jne 0x495760
mov dword [esp + 0x20], sym.adb.exe_AES_decrypt
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
pop ebx
pop esi
jmp fcn.00481ab0
mov dword [esp + 0x20], sym.adb.exe_AES_encrypt
pop ebx
pop esi
jmp fcn.00481990
Function at 0x498ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xdc
mov esi, dword [esp + 0x104]
mov ebx, dword [esp + 0x10c]
mov dword [esp], esi
call sym.adb.exe_EVP_MD_size
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_CTX_init
mov eax, dword [esp + 0xf4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xf0]
mov dword [esp + 4], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_Init_ex
test eax, eax
je 0x498f08
mov ecx, dword [esp + 0x108]
test ecx, ecx
je 0x498ecb
mov dword [esp + 0x1c], 1
lea esi, [esp + 0x5c]
lea ebp, [esp + 0x90]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x108], eax
cmovbe eax, dword [esp + 0x108]
mov dword [esp], esi
mov byte [esp + 0x27], cl
mov edi, eax
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x24], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x25], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x26], al
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
call sym.adb.exe_HMAC_CTX_copy
test eax, eax
je 0x498f08
mov eax, dword [esp + 0xfc]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xf8]
mov dword [esp + 4], eax
call sym.adb.exe_HMAC_Update
test eax, eax
je 0x498ee7
lea eax, [esp + 0x24]
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.adb.exe_HMAC_Update
test eax, eax
je 0x498ee7
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call sym.adb.exe_HMAC_Final
test eax, eax
je 0x498ee7
mov dword [esp], esi
call sym.adb.exe_HMAC_CTX_cleanup
test edi, edi
jne 0x498f21
cmp dword [esp + 0x100], 1
mov dword [esp + 0x14], 1
jbe 0x498eb7
lea esi, [esi]
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.adb.exe_HMAC_CTX_copy
test eax, eax
je 0x498f08
mov eax, dword [esp + 0x18]
mov dword [esp + 4], ebp
mov dword [esp], esi
mov dword [esp + 8], eax
call sym.adb.exe_HMAC_Update
test eax, eax
je 0x498ee7
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call sym.adb.exe_HMAC_Final
test eax, eax
je 0x498ee7
mov dword [esp], esi
call sym.adb.exe_HMAC_CTX_cleanup
test edi, edi
je 0x498ea5
xor eax, eax
movzx edx, byte [ebp + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, edi
jne 0x498e96
add dword [esp + 0x14], 1
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x100]
jne 0x498e40
add dword [esp + 0x1c], 1
add ebx, edi
sub dword [esp + 0x108], edi
jne 0x498d68
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_CTX_cleanup
mov edx, dword [esp + 0x100]
xor eax, eax
test edx, edx
setne al
jmp 0x498efd
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_CTX_cleanup
mov dword [esp], esi
call sym.adb.exe_HMAC_CTX_cleanup
xor eax, eax
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_CTX_cleanup
add esp, 0xdc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
jmp 0x498e2a
Function at 0x4a03bc
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x4a0231
mov dword [esp], 0x57b5d4
call fcn.0049f997
mov eax, dword [0x5262e8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4a0403
mov eax, dword [ebp - 0x20]
jmp 0x4a0542
call fcn.0049f3e2
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x4a041a
cmp dword [ebp - 0x20], 0
jne 0x4a0424
mov eax, 0
jmp 0x4a0542
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x34], edx
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x60], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x4a04ea
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x68], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x5262e8]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4a053f
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a0606
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.004a03bc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb0]
mov dword [esp], eax
call fcn.004a0254
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x4a065f
mov eax, dword [ebp - 0x14]
add eax, 0x6c
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_longjmp
mov eax, dword [0x5262e8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4a0789
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x4a06f1
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4a06ae
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0049f316
mov dword [ebp - 0x10], 0
mov eax, dword [0x5262e8]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x4a0789
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x64], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4a0721
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x4a0789
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0049f316
mov dword [ebp - 0x10], 0
mov eax, dword [0x5262e8]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__endthreadex]
call eax
Function at 0x4ab130
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.004ab190

Function at 0x4ab190
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x57b980]
test eax, eax
jle 0x4ab293
mov edx, dword [0x57b984]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x4ab1c1
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x4ab236
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x4ab1b0
mov dword [esp], esi
call fcn.004aba70
test eax, eax
mov edi, eax
je 0x4ab2ba
lea esi, [ebx + ebx*2]
mov ebx, dword [0x57b984]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.004abb60
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x57b984]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4ab29a
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x4ab240
add dword [0x57b980], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x4ab22f
cmp eax, 0x80
je 0x4ab22f
cmp eax, 8
je 0x4ab22f
mov eax, dword [ebp - 0x28]
add esi, dword [0x57b984]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4ab22f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004ab130
xor ebx, ebx
jmp 0x4ab1cb
mov eax, dword [0x57b984]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004ab130
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004ab130
lea esi, [esi]

Function at 0x4ab990
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4ab9c8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4ab9be
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4ab9ca
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4ab9b0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x4adb20
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
jmp fcn.004ad520
Function at 0x4af000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x22c
mov ebx, dword [ebp + 8]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x4af193
cmp word [ebx], 0
je 0x4af160
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x4af175
test al, 0x10
je 0x4af160
lea esi, [ebp - 0x220]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], esi
call sub.msvcrt.dll__wfullpath
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
mov dword [esp], 0x5587a0
mov edi, eax
call sub.msvcrt.dll_wcslen
mov dword [esp], 0x5587a4
mov ebx, eax
call sub.msvcrt.dll_wcslen
lea edx, [edi + ebx + 0x21d]
add eax, edx
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x4af184
lea edi, [eax + 0x434]
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_wcscpy
cmp word [ebx + 0x434], 0
jne 0x4af120
mov dword [esp], edi
mov dword [esp + 4], 0x5587a4
call sub.msvcrt.dll_wcscat
xor edx, edx
xor eax, eax
mov word [ebx + 0x222], dx
lea edx, [ebx + 0x224]
mov ecx, 0x41
mov word [ebx + 0x220], ax
mov edi, edx
xor eax, eax
mov dword [ebx + 0x42c], 0xffffffff
mov dword [ebx + 0x430], 0
mov dword [ebx + 0x21c], 0
rep stosd dword es:[edi], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sub.msvcrt.dll_wcslen
cmp word [ebx + eax*2 + 0x432], 0x2f
je 0x4af0c0
mov dword [esp], edi
call sub.msvcrt.dll_wcslen
cmp word [ebx + eax*2 + 0x432], 0x5c
je 0x4af0c0
mov dword [esp + 4], 0x5587a0
mov dword [esp], edi
call sub.msvcrt.dll_wcscat
jmp 0x4af0c0
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x4af113
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x4af113
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x4af113