joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4534d1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
test eax, eax
jns 0x4534f1
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
jmp 0x4535d1
test edx, edx
jne 0x453506
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xe
jmp 0x4535d1
mov eax, ecx
cmp dword [0x48fd04], ecx
jae 0x453521
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 7
jmp 0x4535d1
mov ecx, dword [0x528920]
test ecx, ecx
je 0x453541
cmp dword [ecx], 0
je 0x453541
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
jmp 0x4535d1
cmp dword [0x48fd08], esi
jne 0x453574
mov esi, dword [0x5288c0]
mov ecx, dword [0x5288c4]
lea ebx, [esi + eax]
cmp ecx, ebx
jae 0x453560
mov eax, ecx
sub eax, esi
add esi, dword [0x5288c8]
mov edi, edx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add dword [0x5288c0], eax
jmp 0x453593
mov ecx, dword [0x528930]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], esi
test ecx, ecx
je 0x45358d
call ecx
jmp 0x453593
call dword [sym.imp.msvcrt.dll__read]
test eax, eax
jle 0x4535d4
mov ebx, eax
mov edx, dword [0x528928]
mov ecx, eax
sar ebx, 0x1f
add ecx, dword [0x528938]
adc ebx, dword [0x52893c]
mov dword [0x528938], ecx
mov dword [0x52893c], ebx
test edx, edx
je 0x4535d4
mov dword [ebp - 0x1c], eax
mov dword [esp], ecx
mov dword [esp + 4], ebx
call edx
mov eax, dword [ebp - 0x1c]
jmp 0x4535d4
or eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x454b34
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
test eax, eax
jns 0x454b54
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
jmp 0x454c34
test edx, edx
jne 0x454b69
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xe
jmp 0x454c34
mov eax, ecx
cmp dword [0x48fd04], ecx
jae 0x454b84
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 7
jmp 0x454c34
mov ecx, dword [0x528920]
test ecx, ecx
je 0x454ba4
cmp dword [ecx], 0
je 0x454ba4
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
jmp 0x454c34
cmp dword [0x48fd08], esi
jne 0x454bd7
mov esi, dword [0x5288c0]
mov ecx, dword [0x5288c4]
lea ebx, [esi + eax]
cmp ecx, ebx
jae 0x454bc3
mov eax, ecx
sub eax, esi
add esi, dword [0x5288c8]
mov edi, edx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add dword [0x5288c0], eax
jmp 0x454bf6
mov ecx, dword [0x528930]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], esi
test ecx, ecx
je 0x454bf0
call ecx
jmp 0x454bf6
call dword [sym.imp.msvcrt.dll__read]
test eax, eax
jle 0x454c37
mov ebx, eax
mov edx, dword [0x528928]
mov ecx, eax
sar ebx, 0x1f
add ecx, dword [0x528938]
adc ebx, dword [0x52893c]
mov dword [0x528938], ecx
mov dword [0x52893c], ebx
test edx, edx
je 0x454c37
mov dword [ebp - 0x1c], eax
mov dword [esp], ecx
mov dword [esp + 4], ebx
call edx
mov eax, dword [ebp - 0x1c]
jmp 0x454c37
or eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4551b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
test eax, eax
jns 0x4551d0
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
jmp 0x4552b0
test edx, edx
jne 0x4551e5
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xe
jmp 0x4552b0
mov eax, ecx
cmp dword [0x48fd04], ecx
jae 0x455200
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 7
jmp 0x4552b0
mov ecx, dword [0x528920]
test ecx, ecx
je 0x455220
cmp dword [ecx], 0
je 0x455220
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
jmp 0x4552b0
cmp dword [0x48fd08], esi
jne 0x455253
mov esi, dword [0x5288c0]
mov ecx, dword [0x5288c4]
lea ebx, [esi + eax]
cmp ecx, ebx
jae 0x45523f
mov eax, ecx
sub eax, esi
add esi, dword [0x5288c8]
mov edi, edx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add dword [0x5288c0], eax
jmp 0x455272
mov ecx, dword [0x528930]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], esi
test ecx, ecx
je 0x45526c
call ecx
jmp 0x455272
call dword [sym.imp.msvcrt.dll__read]
test eax, eax
jle 0x4552b3
mov ebx, eax
mov edx, dword [0x528928]
mov ecx, eax
sar ebx, 0x1f
add ecx, dword [0x528938]
adc ebx, dword [0x52893c]
mov dword [0x528938], ecx
mov dword [0x52893c], ebx
test edx, edx
je 0x4552b3
mov dword [ebp - 0x1c], eax
mov dword [esp], ecx
mov dword [esp + 4], ebx
call edx
mov eax, dword [ebp - 0x1c]
jmp 0x4552b3
or eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x457da4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
test eax, eax
jns 0x457dc4
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
jmp 0x457ea4
test edx, edx
jne 0x457dd9
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xe
jmp 0x457ea4
mov eax, ecx
cmp dword [0x48fd04], ecx
jae 0x457df4
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 7
jmp 0x457ea4
mov ecx, dword [0x528920]
test ecx, ecx
je 0x457e14
cmp dword [ecx], 0
je 0x457e14
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
jmp 0x457ea4
cmp dword [0x48fd08], esi
jne 0x457e47
mov esi, dword [0x5288c0]
mov ecx, dword [0x5288c4]
lea ebx, [esi + eax]
cmp ecx, ebx
jae 0x457e33
mov eax, ecx
sub eax, esi
add esi, dword [0x5288c8]
mov edi, edx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add dword [0x5288c0], eax
jmp 0x457e66
mov ecx, dword [0x528930]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], esi
test ecx, ecx
je 0x457e60
call ecx
jmp 0x457e66
call dword [sym.imp.msvcrt.dll__read]
test eax, eax
jle 0x457ea7
mov ebx, eax
mov edx, dword [0x528928]
mov ecx, eax
sar ebx, 0x1f
add ecx, dword [0x528938]
adc ebx, dword [0x52893c]
mov dword [0x528938], ecx
mov dword [0x52893c], ebx
test edx, edx
je 0x457ea7
mov dword [ebp - 0x1c], eax
mov dword [esp], ecx
mov dword [esp + 4], ebx
call edx
mov eax, dword [ebp - 0x1c]
jmp 0x457ea7
or eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x458aac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x1c
test eax, eax
jns 0x458acc
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
jmp 0x458b9d
test edx, edx
jne 0x458ae1
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xe
jmp 0x458b9d
mov eax, ecx
cmp dword [0x48fd04], ecx
jae 0x458afc
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 7
jmp 0x458b9d
mov ecx, dword [0x528920]
test ecx, ecx
je 0x458b1c
cmp dword [ecx], 0
je 0x458b1c
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
jmp 0x458b9d
cmp esi, dword [0x48fd08]
jne 0x458b4f
mov esi, dword [0x5288c0]
mov ecx, dword [0x5288c4]
lea ebx, [eax + esi]
cmp ecx, ebx
jae 0x458b3b
mov eax, ecx
sub eax, esi
add esi, dword [0x5288c8]
mov edi, edx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add dword [0x5288c0], eax
jmp 0x458b6e
mov ecx, dword [0x528930]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], esi
test ecx, ecx
je 0x458b68
call ecx
jmp 0x458b6e
call dword [sym.imp.msvcrt.dll__read]
test eax, eax
jle 0x458b9d
mov ecx, dword [0x528928]
cdq
add eax, dword [0x528938]
adc edx, dword [0x52893c]
mov dword [0x528938], eax
mov dword [0x52893c], edx
test ecx, ecx
je 0x458b9d
mov dword [esp], eax
mov dword [esp + 4], edx
call ecx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x458fa7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x458fbf
xor eax, eax
jmp 0x4590e0
mov eax, dword [eax + 8]
test eax, eax
jns 0x458fd7
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
jmp 0x4590b8
cmp dword [0x48fd04], 1
ja 0x458ff1
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 7
jmp 0x4590b8
mov edx, dword [0x528920]
test edx, edx
je 0x459011
cmp dword [edx], 0
je 0x459011
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
jmp 0x4590b8
cmp eax, dword [0x48fd08]
lea ebx, [ebp - 0x1a]
jne 0x459050
mov eax, dword [0x5288c0]
mov ecx, dword [0x5288c4]
mov edx, 2
lea esi, [eax + 2]
cmp ecx, esi
jae 0x459037
sub ecx, eax
mov edx, ecx
mov esi, dword [0x5288c8]
mov edi, ebx
mov ecx, edx
mov ebx, edx
add esi, eax
add eax, edx
rep movsb byte es:[edi], byte [esi]
mov dword [0x5288c0], eax
jmp 0x459075
mov edx, dword [0x528930]
mov dword [esp + 8], 2
mov dword [esp + 4], ebx
mov dword [esp], eax
test edx, edx
je 0x45906d
call edx
jmp 0x459073
call dword [sym.imp.msvcrt.dll__read]
mov ebx, eax
test ebx, ebx
jle 0x4590b8
mov eax, ebx
mov ecx, dword [0x528928]
cdq
add eax, dword [0x528938]
adc edx, dword [0x52893c]
mov dword [0x528938], eax
mov dword [0x52893c], edx
test ecx, ecx
je 0x4590a6
mov dword [esp], eax
mov dword [esp + 4], edx
call ecx
cmp ebx, 2
jne 0x4590b8
movzx eax, word [ebp - 0x1a]
cmp eax, dword [ebp + 0xc]
je 0x458fb8
mov eax, dword [0x528934]
mov dword [esp], str._nError:_invalid_magic
test eax, eax
je 0x4590cc
call eax
jmp 0x4590dd
call sub.msvcrt.dll_printf
mov dword [esp], 0xa
call sub.msvcrt.dll_putchar
or eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x459fd0
Capabilities:
Print debug messages

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [edi - 1]
div dword [ecx + 0x28]
cmp dword [ecx], edi
jae 0x45a01e
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x10], 0x80d44900
mov dword [ebp + 0xc], str.ext2fs_inode_alloc_stats2
mov dword [ebp + 8], str._s:___08X___Illegal_inode_number:__lu_
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0043d9e0
mov ecx, dword [ebx + 0x2c]
xor edx, edx
cmp dword [ebp - 0x1c], 0
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov esi, eax
mov dword [esp], ecx
jle 0x45a03d
call fcn.0046359c
jmp 0x45a042
call fcn.00463652
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0045bf28
mov edx, dword [ebp - 0x1c]
mov dword [esp + 4], esi
mov dword [esp], ebx
sub eax, edx
mov dword [esp + 8], eax
call fcn.0045bf6b
cmp dword [ebp - 0x20], 0
je 0x45a08a
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0045bfaa
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 4], esi
mov dword [esp], ebx
add eax, ecx
mov dword [esp + 8], eax
call fcn.0045bfed
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0045c157
mov eax, dword [ebx + 0x10]
test dword [eax + 0x64], 0x410
je 0x45a100
mov edx, dword [eax + 0x28]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [ebp - 0x28], edx
call fcn.0045c02c
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + 0x28]
mov eax, ecx
imul eax, esi
lea edx, [edx + eax + 1]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
sub edx, eax
cmp edi, edx
jb 0x45a0f4
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], esi
mov dword [esp], ebx
add eax, ecx
sub eax, edi
mov dword [esp + 8], eax
call fcn.0045c06f
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0045eb5b
mov eax, dword [ebx + 0x10]
mov edi, dword [ebp - 0x1c]
sub dword [eax + 0x10], edi
or dword [ebx + 8], 0x16
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x45a13c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [ebp - 0x20], eax
call fcn.0045b868
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call fcn.0045b976
cmp esi, eax
mov eax, edi
sbb eax, edx
jb 0x45a19e
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x10], 0x80d44900
mov dword [ebp + 0xc], str.ext2fs_block_alloc_stats
mov dword [ebp + 8], str._s:___08X___Illegal_block_number:__lu_
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0043d9e0
mov eax, dword [ebx + 0x30]
cmp dword [ebp - 0x20], 0
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], eax
jle 0x45a1b9
call fcn.0046359c
jmp 0x45a1be
call fcn.00463652
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045bea6
mov ecx, dword [ebp - 0x20]
mov dword [esp], ebx
sub eax, ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
call fcn.0045bee9
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], 2
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045c157
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045eb5b
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebx + 0x64]
neg eax
cdq
shld edx, eax, cl
shl eax, cl
test cl, 0x20
je 0x45a222
mov edx, eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call fcn.0045bb33
mov eax, dword [ebx + 0x94]
or dword [ebx + 8], 0x26
test eax, eax
je 0x45a25b
mov ecx, dword [ebp - 0x20]
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x10], edi
mov dword [ebp + 8], ebx
mov dword [ebp + 0x14], ecx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x45d30c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push esi
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
push ebx
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x14]
test eax, eax
je 0x45d342
cmp dword [eax], 0x7f2bb701
jne 0x45d342
mov dword [ebp + 0x10], edi
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0045c834
pop ebx
mov eax, 0x7f2bb701
pop esi
pop edi
pop ebp
ret
Function at 0x46b936
Capabilities:
Get file size

Disassembly:
push ebp
xor ecx, ecx
mov edx, 1
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0xf0]
push ebx
sub esp, 0x11c
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xdc], ecx
lea ecx, [ebp - 0xec]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xf1]
mov dword [esp + 8], eax
lea eax, [ebp - 0xe0]
mov dword [esp + 4], eax
lea eax, [ebp - 0xe8]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call fcn.0046b3c0
test al, al
jne 0x46b99f
mov eax, dword [ebp - 0xf0]
jmp 0x46bb39
cmp dword [ebp - 0xdc], 0
jne 0x46bafe
cmp dword [ebp - 0xe0], 0
jne 0x46bafe
cmp dword [0x528984], 0
mov ebx, dword [ebp - 0xec]
jne 0x46b9ea
mov eax, str.NtDll
call fcn.0046a9bc
mov dword [esp + 4], str.NtDeviceIoControlFile
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push edx
push edx
mov dword [0x528984], eax
mov edx, dword [0x528984]
test edx, edx
je 0x46bafe
lea esi, [ebp - 0xa8]
xor eax, eax
mov ecx, 0x24
mov edi, esi
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], esi
lea esi, [ebp - 0xd8]
mov dword [esp + 0x24], 0x90
mov dword [esp + 0x1c], 0x90
mov dword [esp + 0x14], 0x70048
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], ebx
call edx
sub esp, 0x28
test eax, eax
js 0x46ba5e
mov eax, dword [ebp - 0x98]
mov edx, dword [ebp - 0x94]
jmp 0x46baf2
cmp eax, 0xc0000010
jne 0x46bac6
lea edx, [ebp - 0xd0]
xor eax, eax
mov ecx, 0xa
mov edi, edx
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0x28
mov dword [esp + 0x1c], 0x28
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0x700a0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], ebx
call dword [0x528984]
sub esp, 0x28
test eax, eax
js 0x46bafe
mov eax, dword [ebp - 0xb8]
mov edx, dword [ebp - 0xb4]
jmp 0x46baf2
cmp eax, 0xc000000d
jne 0x46bafe
lea eax, [ebp - 0xd0]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
push edx
push edx
test eax, eax
je 0x46bafe
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0xcc]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], edx
mov eax, dword [ebp - 0xec]
call fcn.0046b4f2
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
sar eax, 0x1f
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe0]
mov edx, dword [ebp - 0xdc]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00485080
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], edx
mov dword [ecx], eax
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4725cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 8], 0x4b5740
mov edx, dword [ebp + 0xc]
pop ebp
jmp fcn.004724e0
Function at 0x472d29
Capabilities:
Encode data using xor
Encrypt data using tea
Hash data using murmur3
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x20]
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], eax
mov eax, dword [ebp + 0x14]
test ebx, ebx
je 0x472dd0
test eax, eax
je 0x472dd0
bt edx, 0x1e
jae 0x472dd0
lea edx, [ebp - 0x11c]
mov ecx, dword [eax + 4]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x130]
mov dword [esp + 0x10], 0x104
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [ecx]
lea edx, [ebp - 0x11c]
test eax, eax
jns 0x472da6
cmp eax, 0xffffffea
jne 0x472e03
jmp 0x472dd0
mov dword [esp + 0x10], esi
mov esi, dword [ebp - 0x134]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00472876
jmp 0x472e03
mov eax, dword [ebp - 0x134]
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp + 8], eax
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00472876
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x477a4f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x1c2
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x1e5]
lea edi, [ebp - 0x1da]
mov esi, 0x4b97d1
push ebx
sub esp, 0x20c
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x1ec], 0x20454d41
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0xc], eax
lea esi, [ebp - 0x1da]
mov dword [ebp - 0x1e1], 0x4e495753
mov dword [ebp - 0x1f0], 0x4e204f4e
mov dword [ebp - 0x1e9], 0x20202020
mov dword [ebp - 0x1e5], 0x4d903ceb
mov dword [ebp - 0x1de], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x477af2
call fcn.0047a5e2
test eax, eax
jne 0x477b26
xor eax, eax
jmp 0x477b56
call fcn.0047a5e2
test eax, eax
je 0x477aee
xor ecx, ecx
lea eax, [ebp - 0x1f0]
xor edi, edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x2b
mov dword [esp + 8], edi
jmp 0x477ae5
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x1c2
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x3e
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
setne al
movzx eax, al
add esp, 0x20c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x477c0f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x1c2
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x1e5]
lea edi, [ebp - 0x1da]
mov esi, 0x4b9993
push ebx
sub esp, 0x20c
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x1ec], 0x20454d41
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0xc], eax
lea esi, [ebp - 0x1da]
mov dword [ebp - 0x1e1], 0x4e495753
mov dword [ebp - 0x1f0], 0x4e204f4e
mov dword [ebp - 0x1e9], 0x20202020
mov dword [ebp - 0x1e5], 0x4d903ceb
mov dword [ebp - 0x1de], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x477cb2
call fcn.0047a5e2
test eax, eax
jne 0x477ce6
xor eax, eax
jmp 0x477d16
call fcn.0047a5e2
test eax, eax
je 0x477cae
xor ecx, ecx
lea eax, [ebp - 0x1f0]
xor edi, edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x2b
mov dword [esp + 8], edi
jmp 0x477ca5
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x1c2
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x3e
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
setne al
movzx eax, al
add esp, 0x20c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x477dcf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x1c2
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x1e5]
lea edi, [ebp - 0x1da]
mov esi, str.FREELDR_SYSLoad_failed__r_n
push ebx
sub esp, 0x20c
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x1ec], 0x20454d41
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0xc], eax
lea esi, [ebp - 0x1da]
mov dword [ebp - 0x1e1], 0x72644c72
mov dword [ebp - 0x1f0], 0x4e204f4e
mov dword [ebp - 0x1e9], 0x20202020
mov dword [ebp - 0x1e5], 0x469071eb
mov dword [ebp - 0x1de], 0x302e3172
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x477e72
call fcn.0047a5e2
test eax, eax
jne 0x477ea6
xor eax, eax
jmp 0x477ed6
call fcn.0047a5e2
test eax, eax
je 0x477e6e
xor ecx, ecx
lea eax, [ebp - 0x1f0]
xor edi, edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x2b
mov dword [esp + 8], edi
jmp 0x477e65
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x1c2
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x3e
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
setne al
movzx eax, al
add esp, 0x20c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4780b1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x396
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x5c9]
lea edi, [ebp - 0x3ae]
mov esi, 0x48fec0
push ebx
sub esp, 0x5ec
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x5d0], 0x20454d41
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5be]
mov dword [ebp - 0x5c5], 0x4e495753
mov esi, 0x4b9d29
mov dword [ebp - 0x5d4], 0x4e204f4e
mov ecx, 0x84
mov dword [ebp - 0x5cd], 0x20202020
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], eax
lea edi, [ebp - 0x3ae]
lea esi, [ebp - 0x5be]
mov dword [ebp - 0x5c9], 0x4d9058eb
mov dword [ebp - 0x5c2], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x47816f
call fcn.0047a5e2
test eax, eax
jne 0x4781a3
xor eax, eax
jmp 0x4781ff
call fcn.0047a5e2
test eax, eax
je 0x478168
xor eax, eax
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x5d4]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], 0x47
mov dword [esp + 8], eax
mov dword [esp], ebx
jmp 0x47815f
xor ecx, ecx
mov dword [esp + 0xc], edi
xor edi, edi
mov dword [esp + 0x10], 0x396
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x52
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
je 0x478168
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x210
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x3f0
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
setne al
movzx eax, al
add esp, 0x5ec
pop ebx
pop esi
pop edi
pop ebp
ret