joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002af30
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push edi
push 0
call fcn.10001f10
mov edi, eax
test edi, edi
jne 0x1002af44
xor al, al
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x20]
lea eax, [ebx + 0x10]
push eax
push 1
call fcn.10058137
mov edx, eax
add esp, 8
test edx, edx
jne 0x1002af83
call fcn.10058124
push dword [eax]
push str.Unable_to_allocate_buffer_for_libusb_control_transfer._Error:__d.
push dword [esp + 0x18]
push 2
call fcn.1002a970
add esp, 0x10
push edi
call fcn.10001f60
pop ebx
xor al, al
pop edi
pop ecx
ret
mov eax, dword [esp + 0x24]
push esi
lea esi, [ebx + 8]
add esi, edx
test eax, eax
je 0x1002af93
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov al, byte [esp + 0x18]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0xd], al
mov byte [esp + 0xc], cl
movzx eax, word [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov word [edx + 2], ax
mov eax, ecx
shr eax, 8
mov byte [esp + 0xd], al
mov byte [esp + 0xc], cl
movzx eax, word [esp + 0xc]
mov word [edx + 4], ax
mov eax, ebx
shr eax, 8
mov byte [esp + 0xd], al
mov byte [edx], 0xc0
mov byte [esp + 0xc], bl
movzx eax, word [esp + 0xc]
mov word [edx + 6], ax
mov eax, dword [esp + 0x14]
push edi
mov eax, dword [eax + 8]
mov dword [edi], eax
mov word [edi + 5], 0
mov dword [edi + 8], 0
mov dword [edi + 0x20], edx
movzx eax, word [edx + 6]
mov ecx, eax
mov dword [edi + 0x1c], esi
and ecx, 0xffffff00
movzx eax, al
or ecx, eax
mov dword [edi + 0x18], 0x1002ad20
add ecx, 8
mov byte [edi + 4], 2
mov dword [edi + 0x10], ecx
call fcn.100022e0
mov esi, eax
call fcn.10058124
test esi, esi
mov dword [eax], esi
pop esi
jne 0x1002af77
pop ebx
mov al, 1
pop edi
pop ecx
ret
Function at 0x1002be60
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push 0
push esi
push 0x1002bdf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
call fcn.10058124
pop esi
mov dword [eax], 0
mov al, 1
ret
Function at 0x1003ba50
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x1009de80]
xor eax, esp
mov dword [esp + 0x190], eax
cmp byte [0x1009ef0d], 0
jne 0x1003baa5
lea eax, [esp]
mov byte [0x1009ef0d], 1
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1003baa5
mov dx, word [esp]
movzx eax, dl
lea ecx, [eax + eax*4]
movzx eax, dx
shr eax, 8
lea eax, [eax + ecx*2]
cmp eax, 0x16
jae 0x1003baa5
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.100503ce
add esp, 0x194
ret
Function at 0x1003ee60
Capabilities:
Get remote cert context via schannel

Disassembly:
mov eax, dword [esp + 4]
lea ecx, [esp + 4]
push ecx
push 0x53
mov dword [esp + 0xc], 0
mov eax, dword [eax + 8]
add eax, 0x24
push eax
call sub.Secur32.dll_QueryContextAttributesA
test eax, eax
je 0x1003ee86
xor eax, eax
ret
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
push 3
push dword [esp + 0x10]
call dword [sym.imp.CRYPT32.dll_CertGetCertificateContextProperty]
push dword [esp + 4]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov eax, dword [esp + 0xc]
ret

Function at 0x10040c50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x204
mov eax, dword [0x1009de80]
xor eax, esp
mov dword [esp + 0x200], eax
push 0x1c
push 1
call fcn.10058137
add esp, 8
mov dword [0x1009ef64], eax
test eax, eax
je 0x10040d83
push 0x200
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
je 0x10040d81
lea eax, [esp]
push eax
push dword [0x1009ef64]
call fcn.10040be0
add esp, 8
test eax, eax
jne 0x10040d81
push 0x200
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x10040d81
lea eax, [esp]
push eax
push dword [0x1009ef64]
call fcn.10040be0
add esp, 8
test eax, eax
jne 0x10040d81
push 0x10081570
push dword [0x1009ef64]
call fcn.10040be0
add esp, 8
test eax, eax
jne 0x10040d81
push 0x200
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10040d32
lea eax, [esp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp]
push eax
push dword [0x1009ef64]
call fcn.10040be0
add esp, 8
test eax, eax
jne 0x10040d81
push str.MARIADB_HOME
call fcn.10059b58
add esp, 4
test eax, eax
jne 0x10040d54
push str.MYSQL_HOME
call fcn.10059b58
add esp, 4
test eax, eax
je 0x10040d67
push eax
push dword [0x1009ef64]
call fcn.10040be0
add esp, 8
test eax, eax
jne 0x10040d81
mov eax, dword [0x1009ef64]
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.100503ce
add esp, 0x204
ret
xor eax, eax
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.100503ce
add esp, 0x204
ret
Function at 0x10041f40
Capabilities:
Connect socket

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 0x37c]
mov edi, dword [eax + 0x14]
lea eax, [esp + 8]
push eax
push esi
call fcn.1003f4a0
push 0
push 0
push esi
call fcn.1003f320
add esp, 0x14
mov dword [edi], 0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_connect]
mov dword [esp + 0x14], eax
test eax, eax
je 0x1004203d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10042039
mov eax, dword [edi]
mov ecx, dword [esp + 0x20]
or eax, 6
mov dword [edi], eax
test ecx, ecx
js 0x10041fb8
or eax, 8
mov dword [edi], eax
jmp 0x10041fba
xor ecx, ecx
mov dword [edi + 0xc], ecx
mov eax, dword [edi + 0x18]
test eax, eax
je 0x10041fce
push dword [edi + 0x1c]
push 1
call eax
add esp, 8
lea eax, [edi + 0x20]
push eax
call fcn.10040500
mov eax, dword [edi + 0x18]
add esp, 4
test eax, eax
je 0x10041feb
push dword [edi + 0x1c]
push 0
call eax
add esp, 8
test byte [edi + 4], 8
jne 0x10042030
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 4
push eax
lea eax, [esp + 0x18]
push eax
push 0x1007
push 0xffff
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x10042030
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1004203d
call fcn.10058124
mov ecx, eax
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x14]
pop edi
pop esi
add esp, 8
ret
Function at 0x10044a80
Capabilities:
Get socket status

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1009de80]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
mov dword [esp + 4], 0
mov dword [esp + 8], 0
push ebx
mov bl, byte [esp + 0x228]
mov byte [esp + 4], bl
push esi
push edi
mov edi, dword [esp + 0x234]
test eax, eax
je 0x10044c59
mov esi, dword [eax]
test esi, esi
je 0x10044c59
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x37c]
test eax, eax
je 0x10044b0d
mov eax, dword [eax + 0xc8]
test eax, eax
je 0x10044b0d
push edi
push dword [esp + 0x10]
push dword [esi]
call eax
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.100503ce
add esp, 0x21c
ret
mov eax, dword [esi]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
mov eax, dword [esi]
mov dword [esp + 0x124], eax
mov dword [esp + 0x120], 1
test edi, edi
js 0x10044b55
mov eax, 0x10624dd3
mov ecx, edi
mul edi
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 0x10], edx
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [esp + 0x14], eax
xor ecx, ecx
lea eax, [esp + 0x10]
test edi, edi
cmovs eax, ecx
test bl, bl
push eax
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x24]
cmovne eax, ecx
test bl, bl
push eax
lea eax, [esp + 0x28]
cmove eax, ecx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_select]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10044bb4
call fcn.10058124
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.100503ce
add esp, 0x21c
ret
test edi, edi
jne 0x10044beb
push 0x274c
or edi, 0xffffffff
call dword [sym.imp.WS2_32.dll_WSASetLastError]
call fcn.10058124
mov dword [eax], 0x8a
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.100503ce
add esp, 0x21c
ret
lea eax, [esp + 0x120]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x10044c3f
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x10]
push eax
push 0x1007
push 0xffff
push dword [esi]
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x10044c3c
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_WSASetLastError]
call fcn.10058124
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
or edi, 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.100503ce
add esp, 0x21c
ret
mov ecx, dword [esp + 0x224]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100503ce
add esp, 0x21c
ret
Function at 0x10045e50
Capabilities:
Get remote cert context via schannel

Disassembly:
sub esp, 0x114
mov eax, dword [0x1009de80]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x118]
push ebx
push ebp
push esi
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov esi, dword [ecx + 0x28]
push edi
mov eax, dword [esi + 0x37c]
mov ecx, dword [esi + 0x340]
mov edx, dword [esi + 0x344]
test eax, eax
je 0x10045e9e
mov ebp, dword [eax + 8]
mov edi, dword [eax + 0xc]
jmp 0x10045ea2
xor ebp, ebp
xor edi, edi
push 0x100
lea eax, [esp + 0x24]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push edi
push ebp
push edx
push ecx
xor ebx, ebx
call fcn.10046e10
add esp, 0x1c
test eax, eax
jne 0x10045f09
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x1c]
push 0x53
add eax, 0x24
push eax
call sub.Secur32.dll_QueryContextAttributesA
test eax, eax
je 0x10045f66
push str.QueryContextAttributes_SECPKG_ATTR_REMOTE_CERT_CONTEXT__failed.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x28]
push 0x100
push eax
call fcn.10047860
add esp, 0x10
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push str.SSL_connection_error:__s
push dword [0x1009d94c]
mov eax, dword [eax + 0x30]
push 0x7ea
push esi
call eax
add esp, 0x14
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10045f3a
push eax
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10045f4b
push ecx
call fcn.10047100
add esp, 4
mov ecx, dword [esp + 0x120]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100503ce
add esp, 0x114
ret
test ebp, ebp
jne 0x10045f72
test edi, edi
jne 0x10045f72
xor eax, eax
jmp 0x10045f77
mov eax, 1
push 0x100
lea ecx, [esp + 0x24]
push ecx
push dword [esp + 0x134]
push dword [esi + 0x270]
push eax
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.10047120
add esp, 0x1c
test eax, eax
jne 0x10045f09
lea ebx, [eax + 1]
jmp 0x10045f2b
Function at 0x10045fb0
Capabilities:
Encrypt data via sspi

Disassembly:
sub esp, 0x40
mov eax, dword [0x1009de80]
xor eax, esp
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x48]
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push edi
mov eax, dword [ebp + 0x24]
mov edi, dword [eax + 8]
mov ebx, dword [edi + 0x18]
cmp dword [esp + 0x58], ebx
mov eax, dword [edi + 8]
cmovb ebx, dword [esp + 0x58]
add eax, dword [edi + 0x10]
push ebx
push ecx
push eax
call fcn.10051cc0
mov eax, dword [edi + 8]
add esp, 0xc
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 7
mov eax, dword [edi + 8]
add eax, dword [edi + 0x10]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 1
mov eax, dword [edi + 8]
add eax, dword [edi + 0x10]
add eax, ebx
mov dword [esp + 0x38], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push 0
push eax
push 0
lea eax, [edi + 0x24]
mov dword [esp + 0x40], 6
push eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 4
call sub.Secur32.dll_EncryptMessage
test eax, eax
je 0x1004608e
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.100503ce
add esp, 0x40
ret
mov eax, dword [ebp + 0x2c]
push esi
mov esi, dword [esp + 0x34]
add esi, dword [esp + 0x28]
add esi, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
push esi
push dword [edi + 8]
push ebp
call eax
add esp, 0xc
or ecx, 0xffffffff
cmp eax, esi
cmove ecx, ebx
pop esi
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x44]
pop ebp
pop ebx
xor ecx, esp
call fcn.100503ce
add esp, 0x40
ret
Function at 0x100465e0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
sub esp, 0x350
mov eax, dword [0x1009de80]
xor eax, esp
mov dword [esp + 0x34c], eax
mov eax, dword [esp + 0x354]
push ebx
mov ebx, dword [esp + 0x364]
push esi
push edi
mov edi, dword [esp + 0x364]
push edi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10046668
push 0x8009035d
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
test eax, eax
mov esi, 0x54f
push str.directory__s_does_not_exist
cmovne esi, eax
push esi
push dword [esp + 0x37c]
push ebx
call fcn.10047860
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x34c]
xor ecx, esp
call fcn.100503ce
add esp, 0x350
ret
test al, 0x10
jne 0x100466b8
push 0x8009035d
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
test eax, eax
mov esi, 0x54f
push str._s_is_not_a_directory
cmovne esi, eax
push esi
push dword [esp + 0x37c]
push ebx
call fcn.10047860
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x34c]
xor ecx, esp
call fcn.100503ce
add esp, 0x350
ret
push edi
push 0x10081c84
lea eax, [esp + 0x158]
push 0x104
push eax
call fcn.10047220
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10046735
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov esi, 0x54f
cmovne esi, eax
lea eax, [esp + 0x150]
push eax
push str.FindFirstFile__s__failed
push esi
push dword [esp + 0x37c]
push ebx
call fcn.10047860
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x34c]
xor ecx, esp
call fcn.100503ce
add esp, 0x350
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
nop dword [eax]
test byte [esp + 0x14], 0x10
jne 0x10046787
lea eax, [esp + 0x40]
push eax
push edi
push str._s_s
lea eax, [esp + 0x264]
push 0x104
push eax
call fcn.10047220
push dword [esp + 0x388]
lea eax, [esp + 0x270]
push ebx
push dword [esp + 0x388]
push eax
push dword [esp + 0x34]
call fcn.100463b0
add esp, 0x28
lea eax, [esp + 0x14]
push eax
push esi
call ebp
test eax, eax
jne 0x10046740
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x358]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100503ce
add esp, 0x350
ret
Function at 0x10046b40
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebp, ebp
push ebp
push 0x80
push 3
push ebp
push 1
push connect
push edi
xor esi, esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x10046ba9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
test eax, eax
mov ecx, 0x54f
push str.failed_to_open_file__s
cmovne ecx, eax
push ecx
push dword [esp + 0x38]
push dword [esp + 0x38]
call fcn.10047860
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10046be5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
test eax, eax
mov ebp, 0x54f
push str.GetFileSizeEx_failed_on__s
cmovne ebp, eax
push ebp
push dword [esp + 0x38]
push dword [esp + 0x38]
call fcn.10047860
add esp, 0x14
jmp 0x10046ca8
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x1c], ebx
jl 0x10046c2e
jg 0x10046bf6
cmp edi, 0xfffffffe
jbe 0x10046c2e
push 0x8009035d
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebp, 0x54f
cmovne ebp, eax
mov eax, dword [esp + 0x24]
push eax
push str.file__s_too_large
push ebp
push dword [esp + 0x38]
push dword [esp + 0x38]
call fcn.10047860
add esp, 0x14
jmp 0x10046ca8
lea eax, [edi + 1]
push eax
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x10046c70
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 0x10]
test eax, eax
mov ebp, 0x54f
push str.LocalAlloc_0__zu__failed
cmovne ebp, eax
push ebp
push dword [esp + 0x38]
push dword [esp + 0x38]
call fcn.10047860
add esp, 0x14
jmp 0x10046ca8
test edi, edi
je 0x10046ca4
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [ebx + esi]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10046ccb
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10046cc7
add esi, eax
cmp esi, edi
jb 0x10046c74
mov byte [ebx + edi], 0
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x10046cf8
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov edi, esi
jmp 0x10046ca4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebp, 0x54f
cmovne ebp, eax
mov eax, dword [esp + 0x24]
push eax
push str.ReadFile___failed_to_read__file__s
push ebp
push dword [esp + 0x38]
push dword [esp + 0x38]
call fcn.10047860
add esp, 0x14
jmp 0x10046ca8
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x100474b0
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x100474d7
mov eax, dword [ecx]
sub eax, 1
jne 0x100474d7
push dword [ecx + 4]
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.1005ea92
add esp, 0x10
ret
or eax, 0xffffffff
ret

Function at 0x10047560
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
sub esp, 0x10
test edx, edx
je 0x10047743
cmp byte [edx], 0
je 0x10047743
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ecx, edx
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, edi
mov dword [esp + 0x2c], esi
lea ebx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10047590
sub ecx, ebx
lea eax, [esp + 0x10]
push ecx
push edx
push eax
call fcn.100474e0
push 8
lea eax, [esp + 0x28]
push ebp
push eax
call fcn.100474e0
mov eax, dword [esp + 0x28]
xor edx, edx
xor eax, dword [esp + 0x30]
mov ecx, 0x3fffffff
div ecx
mov eax, dword [esp + 0x2c]
add esp, 0x18
xor eax, dword [esp + 0x1c]
mov ebx, edx
movsd xmm1, qword [0x10082040]
xor edx, edx
movsd xmm2, qword [0x10082030]
div ecx
lea eax, [ebp + 8]
cmp ebp, eax
jae 0x10047681
mov ebp, 8
mov esi, edx
lea eax, [esi + ebx*2]
xor edx, edx
add eax, ebx
sub esp, 8
div ecx
lea eax, [esi + 0x21]
mov ebx, edx
xor edx, edx
add eax, ebx
div ecx
movd xmm0, ebx
mov eax, ebx
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mov esi, edx
addsd xmm0, qword [eax*8 + 0x10076610]
divsd xmm0, xmm1
mulsd xmm0, xmm2
movsd qword [esp + 0x20], xmm0
fld qword [esp + 0x20]
fstp qword [esp]
call fcn.1005e260
movsd xmm1, qword [0x10082040]
add esp, 8
movsd xmm2, qword [0x10082030]
mov ecx, 0x3fffffff
fstp qword [esp + 0x18]
movsd xmm0, qword [esp + 0x18]
addsd xmm0, qword [0x10082038]
cvttsd2si eax, xmm0
mov byte [edi], al
inc edi
sub ebp, 1
jne 0x100475f6
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
lea eax, [edx + ebx*2]
sub esp, 8
xor edx, edx
add eax, ebx
div ecx
movd xmm0, edx
cvtdq2pd xmm0, xmm0
shr edx, 0x1f
addsd xmm0, qword [edx*8 + 0x10076610]
divsd xmm0, xmm1
mulsd xmm0, xmm2
movsd qword [esp + 0x20], xmm0
fld qword [esp + 0x20]
fstp qword [esp]
call fcn.1005e260
fstp qword [esp + 0x20]
cvttsd2si edx, qword [esp + 0x20]
mov ecx, edi
xor ebx, ebx
sub ecx, esi
add esp, 8
movsx eax, dl
movd xmm0, eax
xor eax, eax
cmp esi, edi
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
cmova ecx, ebx
pshufd xmm1, xmm0, 0
test ecx, ecx
je 0x10047729
cmp ecx, 0x40
jb 0x10047729
and ecx, 0xffffffc0
movups xmm0, xmmword [esi]
add eax, 0x40
xorps xmm0, xmm1
movups xmmword [esi], xmm0
movups xmm0, xmmword [esi + 0x10]
xorps xmm0, xmm1
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [esi + 0x20]
xorps xmm0, xmm1
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [esi + 0x30]
xorps xmm0, xmm1
movups xmmword [esi + 0x30], xmm0
add esi, 0x40
cmp eax, ecx
jne 0x100476f5
cmp esi, edi
je 0x10047737
nop dword [eax]
xor byte [esi], dl
inc esi
cmp esi, edi
jne 0x10047730
mov byte [edi], bl
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov byte [eax], 0
add esp, 0x10
ret
Function at 0x10047750
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x88
mov eax, dword [0x1009de80]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x94]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x94]
push edi
mov edi, dword [esp + 0xa0]
push eax
call fcn.10047a60
mov ecx, edi
add esp, 4
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10047790
sub ecx, edx
lea eax, [esp + 0xc]
push ecx
push edi
push eax
call fcn.10049090
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x78]
push eax
call fcn.10047990
lea eax, [esp + 0x20]
push eax
call fcn.10047a60
push 0x14
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.10049090
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0xa4]
push eax
call fcn.10047990
lea eax, [esp + 0x38]
push eax
call fcn.10047a60
push 0x14
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.10049090
push 0x14
lea eax, [esp + 0xbc]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.10049090
add esp, 0x48
lea eax, [esp + 0xc]
push eax
push esi
call fcn.10047990
lea edx, [esi + 0x14]
add esp, 8
cmp esi, edx
jae 0x1004783a
lea ecx, [esp + 0x68]
sub ecx, esi
nop dword [eax]
mov al, byte [ecx + esi]
xor byte [esi], al
inc esi
cmp esi, edx
jb 0x10047830
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100503ce
add esp, 0x88
ret

Function at 0x10047a60
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret