joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455150
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6aa400
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x75a1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0067bcb2
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0067a8d8
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00454aa0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x455220
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6aa400
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x75a1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0067bcb2
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0067a8d8
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00454aa0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45cc10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
mov eax, dword [0x75a1c0]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x10]
mov edi, edx
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
test edx, edx
je 0x45cca4
cmp edx, 0x104
jae 0x45cca4
mov ecx, edi
lea ebx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45cc50
sub ecx, ebx
lea eax, [edx + 6]
add eax, ecx
cmp eax, 0x104
jb 0x45cc6c
push str.program_assertion_failed___library_path_buffer_overflow
jmp 0x45cca9
push edi
lea eax, [esp + 0x10]
add eax, edx
push str._s.dll
push eax
call fcn.0045cae0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0067bc9f
add esp, 0x110
ret
push str.program_assertion_failed___could_not_get_system_directory
push str.load_system_library
push 1
push esi
call fcn.0045c870
mov ecx, dword [esp + 0x128]
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0067bc9f
add esp, 0x110
ret
Function at 0x45cd30
Capabilities:
Hash data using djb2

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov edx, 0x1505
mov dword [esp + 4], ebx
push esi
mov esi, ebx
test ebx, ebx
jne 0x45cd4e
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
movsx ecx, byte [ebx]
test ecx, ecx
je 0x45cd68
mov eax, edx
lea esi, [esi + 1]
shl edx, 5
add edx, ecx
movsx ecx, byte [esi]
add edx, eax
test ecx, ecx
jne 0x45cd55
push ebp
test edx, edx
mov ebp, 1
mov ecx, ebp
mov eax, 0xc0906d
cmovne ecx, edx
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3fd
push edi
push 0x75ebe0
sub ecx, eax
cmovne ebp, ecx
mov esi, ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x75ebc4]
mov ecx, dword [eax + esi*8]
test ecx, ecx
je 0x45ce90
lea edi, [eax + esi*8]
cmp ecx, ebp
jne 0x45cded
mov ecx, dword [edi + 4]
mov eax, ebx
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x45cde0
test dl, dl
je 0x45cddc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x45cde0
add eax, 2
add ecx, 2
test dl, dl
jne 0x45cdc0
xor eax, eax
jmp 0x45cde5
sbb eax, eax
or eax, 1
test eax, eax
je 0x45cef7
push dword [edi + 4]
push ebx
push str.hash_collision___s_vs__s_
push str.htab_hash
push 4
push 0
call fcn.0045c870
mov eax, 0x14191f7
add esp, 0x18
mul ebp
mov eax, ebp
sub eax, edx
shr eax, 1
add eax, edx
mov edx, ebp
shr eax, 9
imul eax, eax, 0x3fb
sub edx, eax
inc edx
mov dword [esp + 0x14], edx
mov ecx, esi
sub ecx, edx
cmp esi, edx
lea eax, [ecx + 0x3fd]
cmova eax, ecx
mov esi, eax
mov edi, esi
cmp edi, ebp
je 0x45ce8c
mov eax, dword [0x75ebc4]
mov ebx, dword [eax + edi*8]
cmp ebx, ebp
jne 0x45ce80
mov eax, dword [eax + edi*8 + 4]
mov ecx, dword [esp + 0x10]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x45ce73
test dl, dl
je 0x45ce6f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x45ce73
add ecx, 2
add eax, 2
test dl, dl
jne 0x45ce53
xor eax, eax
jmp 0x45ce78
sbb eax, eax
or eax, 1
test eax, eax
je 0x45ce88
mov edx, dword [esp + 0x14]
mov esi, edi
test ebx, ebx
je 0x45ce8c
jmp 0x45ce28
mov esi, edi
jmp 0x45cef7
mov ebx, dword [esp + 0x10]
cmp dword [0x75ebc0], 0x3fd
jb 0x45cebb
push 0x3fd
push str.hash_table_is_full___lu_entries_
push str.htab_hash
push 1
push 0
call fcn.0045c870
add esp, 0x14
xor esi, esi
jmp 0x45cef7
push ebx
call fcn.0068a62a
mov ecx, eax
add esp, 4
mov eax, dword [0x75ebc4]
mov dword [eax + esi*8 + 4], ecx
lea eax, [eax + esi*8]
test ecx, ecx
jne 0x45ceef
push str.could_not_duplicate_string_for_hash_table
push str.htab_hash
push 1
push ecx
call fcn.0045c870
add esp, 0x10
xor esi, esi
jmp 0x45cef7
inc dword [0x75ebc0]
mov dword [eax], ebp
push 0x75ebe0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4724a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
shr edi, 2
test edi, edi
je 0x4724ea
mov ecx, dword [esp + 0xc]
add ecx, 2
push esi
nop dword [eax]
movzx esi, byte [ecx + 1]
lea ecx, [ecx + 4]
movzx eax, byte [ecx - 4]
movzx edx, byte [ecx - 6]
shl esi, 8
or esi, eax
movzx eax, byte [ecx - 5]
shl esi, 8
or esi, eax
shl esi, 8
or esi, edx
xor ebx, esi
sub edi, 1
jne 0x4724c0
pop esi
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x47bbe0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x47bbf0
mov ax, word [esp + 8]
pop esi
ret
push ebx
mov ebx, dword [esp + 0x10]
test bl, 1
je 0x47bc1d
movzx eax, byte [ebx]
inc ebx
mov ecx, dword [esp + 0xc]
xor eax, ecx
movzx eax, al
shr cx, 8
mov dword [esp + 0x10], ebx
xor cx, word [eax*2 + 0x75b520]
dec esi
movzx eax, cx
jmp 0x47bc21
mov eax, dword [esp + 0xc]
cmp esi, 8
jb 0x47bcd9
push edi
mov edi, esi
shr edi, 3
movzx edx, word [ebx]
sub esi, 8
movzx ecx, word [ebx + 2]
movzx eax, ax
xor edx, eax
mov eax, edx
shr eax, 8
movzx ebx, word [eax*2 + 0x75b520]
movzx eax, dl
movzx eax, word [eax*2 + 0x75b720]
xor ebx, eax
mov eax, dword [esp + 0x14]
xor ebx, ecx
lea edx, [eax + 6]
movzx ecx, word [eax + 4]
mov eax, ebx
shr eax, 8
movzx eax, word [eax*2 + 0x75b520]
mov dword [esp + 0x14], eax
movzx eax, bl
mov ebx, dword [esp + 0x14]
movzx eax, word [eax*2 + 0x75b720]
xor ebx, eax
lea eax, [edx + 2]
xor ebx, ecx
mov dword [esp + 0x14], eax
movzx ecx, word [edx]
mov eax, ebx
shr eax, 8
movzx edx, word [eax*2 + 0x75b520]
movzx eax, bl
mov ebx, dword [esp + 0x14]
movzx eax, word [eax*2 + 0x75b720]
xor edx, eax
xor edx, ecx
mov ecx, edx
movzx eax, dl
shr ecx, 8
mov cx, word [ecx*2 + 0x75b520]
xor cx, word [eax*2 + 0x75b720]
movzx eax, cx
sub edi, 1
jne 0x47bc30
pop edi
test esi, esi
je 0x47bcff
nop dword [eax]
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
xor ecx, eax
shr ax, 8
movzx ecx, cl
xor ax, word [ecx*2 + 0x75b520]
movzx eax, ax
sub esi, 1
jne 0x47bce0
pop ebx
pop esi
ret
Function at 0x482c00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x2c]
xorps xmm0, xmm0
push esi
mov eax, 1
movlpd qword [esp + 0x14], xmm0
xor cl, cl
movlpd qword [esp + 0x1c], xmm0
mov dword [esp + 0x24], 0
lea edx, [ebx - 1]
push edi
mov edi, dword [esp + 0x30]
cmp ebx, eax
jbe 0x482caa
cmp edx, 0x20
jb 0x482ca0
and edx, 0x1f
mov ecx, ebx
sub ecx, edx
xorps xmm2, xmm2
xorps xmm1, xmm1
nop word [eax + eax]
movups xmm0, xmmword [eax + edi]
xorps xmm2, xmm0
movups xmm0, xmmword [edi + eax + 0x10]
add eax, 0x20
xorps xmm1, xmm0
cmp eax, ecx
jb 0x482c50
xorps xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 1
xorps xmm1, xmm0
movd ecx, xmm1
cmp eax, ebx
jae 0x482cb4
nop dword [eax]
xor cl, byte [edi + eax]
inc eax
cmp eax, ebx
jb 0x482ca0
jmp 0x482cb4
xor cl, cl
test ebx, ebx
je 0x482d42
cmp cl, byte [edi]
jne 0x482d42
push 0x28
push 1
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 1
call fcn.00681a00
mov esi, eax
add esp, 8
test esi, esi
je 0x482d42
push ebx
push edi
push 0
call fcn.006792e0
xor ecx, ecx
mov dword [esi + 0x10], eax
lea eax, [esp + 0x18]
or ecx, ebx
push 1
push eax
mov dword [esi + 0x14], ecx
call fcn.00483fb0
add esp, 0x14
test eax, eax
je 0x482d6c
lea eax, [esp + 0xc]
push eax
call fcn.00484050
inc eax
push eax
mov dword [esi + 4], eax
call fcn.006883b5
add esp, 8
mov dword [esi], eax
test eax, eax
jne 0x482d4b
push dword [esi]
mov edi, dword [esi + 0x20]
call fcn.00687807
push dword [esi + 8]
call fcn.00687807
push esi
call fcn.00687807
add esp, 0xc
mov esi, edi
test edi, edi
jne 0x482d21
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
xor edi, edi
cmp dword [esi + 4], edi
jbe 0x482d6c
lea eax, [esp + 0xc]
push 8
push eax
call fcn.00483fb0
mov ecx, dword [esi]
add esp, 8
mov byte [edi + ecx], al
inc edi
cmp edi, dword [esi + 4]
jb 0x482d52
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x488d90
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 0x440]
mov esi, dword [eax]
lea eax, [esp + 0xc]
push eax
push ebp
push esi
push edi
call fcn.00488fa0
add esp, 0x10
test eax, eax
jne 0x488ea0
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push edi
call fcn.00488fa0
add esp, 0x10
test eax, eax
jne 0x488ea0
lea eax, [esp + 0x24]
push eax
push ebp
push esi
push edi
call fcn.0048b1c0
add esp, 0x10
test eax, eax
jne 0x488ea0
mov ax, word [esp + 0x24]
movsx ecx, byte [esi + 0x5268]
shr ax, 0xd
add ecx, 3
movzx edx, ax
movzx eax, ax
mov dword [esp + 0x1c], eax
mov eax, ecx
sar eax, 3
and cl, 7
add dword [esi + 0x526c], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffffc
mov byte [esi + 0x5268], cl
push ebx
cmp eax, 0x3ffffc
ja 0x488e8a
cmp edx, 3
ja 0x488e8a
mov eax, dword [esi + 0x4b30]
or eax, dword [esi + 0x4b34]
je 0x488ea7
mov ebx, dword [esi + 0x4b38]
lea eax, [esi + 0x4b38]
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x488ea7
mov eax, dword [esp + 0x10]
lea edx, [esi + 0x60]
mov dword [esp + 0x14], edx
cdq
mov ecx, edx
mov edx, eax
add edx, dword [esi + 0x60]
mov eax, ebx
mov dword [esp + 0x28], edx
adc ecx, dword [esi + 0x64]
cdq
add eax, dword [esi + 0x4b30]
adc edx, dword [esi + 0x4b34]
cmp ecx, edx
jl 0x488e8a
jg 0x488eb8
cmp dword [esp + 0x28], eax
jae 0x488eb8
push str.Invalid_filter_encountered
push 0x2a
push edi
call fcn.00469db0
mov eax, 0xffffffe2
add esp, 0xc
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
lea ecx, [esi + 0x60]
lea eax, [esi + 0x4b38]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
push 0x20
push 1
call fcn.00681a00
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x488f92
lea edx, [esi + 0x4b24]
test edx, edx
je 0x488f01
movzx ecx, word [edx + 4]
movzx eax, word [edx + 6]
inc ecx
cmp eax, ecx
je 0x488f01
movzx ecx, word [edx + 2]
mov eax, dword [edx + 8]
mov dword [eax + ecx*4], ebx
mov ax, word [edx + 2]
inc ax
and ax, word [edx + 4]
inc word [edx + 6]
mov word [edx + 2], ax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
movzx eax, ax
mov dword [ebx], eax
mov eax, 0
add ecx, dword [edx]
adc eax, dword [edx + 4]
cmp word [esp + 0x20], 0
mov edx, dword [esp + 0x18]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], edx
mov dword [esi + 0x4b30], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x4b34], eax
mov eax, dword [ebx + 0x18]
mov dword [ecx], eax
jne 0x488f88
lea eax, [esp + 0x28]
push eax
push ebp
push esi
push edi
call fcn.0048b1c0
add esp, 0x10
test eax, eax
jne 0x488e9f
movsx ecx, byte [esi + 0x5268]
add ecx, 5
mov eax, ecx
and cl, 7
sar eax, 3
add dword [esi + 0x526c], eax
movzx eax, word [esp + 0x28]
shr eax, 0xb
inc eax
mov byte [esi + 0x5268], cl
mov dword [ebx + 4], eax
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x14
ret
push str.Cant_allocate_memory_for_a_filter_descriptor.
push 0xc
jmp 0x488e91
Function at 0x48f360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dl, byte [esi]
test dl, dl
jns 0x48f43f
mov al, dl
push ebx
mov ebx, dword [esp + 0x1c]
and al, 0x40
push edi
mov byte [esp + 0x1c], al
je 0x48f38a
or ecx, 0xffffffff
or edi, 0xffffffff
jmp 0x48f39b
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
neg al
sbb al, al
mov byte [esp + 0xf], al
mov al, dl
and al, 0x7f
or dl, 0x80
cmp byte [esp + 0x1c], 0
movzx eax, al
movzx edx, dl
cmove edx, eax
mov al, byte [esp + 0xf]
cmp ebx, 8
jbe 0x48f3cf
dec ebx
cmp dl, al
jne 0x48f413
mov dl, byte [esi + 1]
inc esi
cmp ebx, 8
ja 0x48f3c1
xor al, dl
jl 0x48f413
sub ebx, 1
je 0x48f3f9
nop dword [eax + eax]
shld edi, ecx, 8
movzx eax, dl
lea esi, [esi + 1]
cdq
shl ecx, 8
or edi, edx
mov dl, byte [esi]
or ecx, eax
sub ebx, 1
jne 0x48f3e0
shld edi, ecx, 8
movzx eax, dl
cdq
shl ecx, 8
or ecx, eax
or edi, edx
mov edx, edi
mov eax, ecx
pop edi
pop ebx
pop esi
add esp, 0xc
ret
cmp byte [esp + 0x1c], 0
je 0x48f42c
mov edi, connect
xor ecx, ecx
mov edx, edi
mov eax, ecx
pop edi
pop ebx
pop esi
add esp, 0xc
ret
mov edi, closesocket
or ecx, 0xffffffff
mov edx, edi
mov eax, ecx
pop edi
pop ebx
pop esi
add esp, 0xc
ret
push 8
push dword [esp + 0x1c]
push esi
call fcn.0048f460
add esp, 0xc
pop esi
add esp, 0xc
ret

Function at 0x490770
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, dword [esp + 0x14]
mov ecx, 0xa
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
cmp ebp, ecx
cmovg ecx, ebp
test ebp, ebp
js 0x4907f0
push ebx
nop dword [eax]
test ecx, ecx
je 0x4907c4
mov bl, byte [esi]
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x4907c4
movsx eax, bl
lea edx, [edi - 6]
lea edx, [edi + edx*4]
inc esi
lea edi, [eax + edx*2]
mov eax, 0x66666667
imul ecx
lea eax, [edi + edi*4]
sar edx, 2
add eax, eax
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp eax, ebp
jle 0x490790
pop ebx
cmp esi, dword [esp + 0x10]
je 0x4907f0
cmp edi, dword [esp + 0x18]
jl 0x4907e1
cmp edi, ebp
jg 0x4907e1
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
mov dword [ecx], esi
pop esi
pop ebp
ret
mov ecx, dword [esp + 0x14]
mov eax, 0xfffffffe
pop edi
mov dword [ecx], esi
pop esi
pop ebp
ret
mov ecx, dword [esp + 0x14]
or eax, 0xffffffff
pop edi
mov dword [ecx], esi
pop esi
pop ebp
ret
Function at 0x493940
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x10], esi
cmovb esi, dword [esp + 0x10]
test esi, esi
je 0x4939ce
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
sub ebp, ebx
mov eax, dword [edi + 8]
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
lea eax, [esp + 0x24]
push 1
push eax
shr ecx, 8
xor cl, byte [ebx + ebp]
mov byte [ebx], cl
mov eax, dword [edi]
not eax
mov byte [esp + 0x2c], cl
push eax
call fcn.006792e0
not eax
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
mov byte [esp + 0x2c], al
lea eax, [esp + 0x2c]
push eax
mov eax, dword [edi + 8]
not eax
push eax
call fcn.006792e0
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [edi + 8], eax
sub esi, 1
jne 0x493963
pop edi
pop ebp
pop ebx
pop esi
ret
Function at 0x49ea50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x14]
test ebp, 0xffff7fff
jne 0x49eb2b
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x49eaca
call ebx
cmp eax, 3
jne 0x49eab1
push edi
call fcn.0049ef70
mov esi, eax
add esp, 4
test esi, esi
jne 0x49eaa5
call fcn.00688468
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49eaca
call ebx
push eax
call fcn.0049e990
push esi
call fcn.00687807
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x49eb23
push 0
push 0x2000001
push 3
push 0
push 0
push 0
test esi, esi
je 0x49eaea
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x49eaf1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
call fcn.00687807
add esp, 4
cmp edi, 0xffffffff
jne 0x49eb13
call ebx
push eax
call fcn.0049e990
add esp, 4
or eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push edi
call fcn.006888af
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
test esi, esi
jne 0x49ebbf
push dword [esp + 0x1c]
push ebp
push edi
call fcn.00689492
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x49ec46
call fcn.00688468
cmp dword [eax], 0xd
jne 0x49eb9e
test ebp, 0x100
je 0x49eb9e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x49eb74
call ebx
push eax
call fcn.0049e990
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x49eb8b
call fcn.00688468
pop edi
pop esi
pop ebp
mov dword [eax], 0x15
or eax, 0xffffffff
pop ebx
ret
call fcn.00688468
pop edi
pop esi
pop ebp
mov dword [eax], 0xd
or eax, 0xffffffff
pop ebx
ret
call fcn.00688468
cmp dword [eax], 2
jne 0x49ec46
push edi
call fcn.0049ef70
mov esi, eax
add esp, 4
test esi, esi
je 0x49ea92
push dword [esp + 0x1c]
push ebp
push esi
call fcn.00689538
mov edi, eax
add esp, 0xc
test edi, edi
jns 0x49ec36
call fcn.00688468
cmp dword [eax], 0xd
jne 0x49ec36
test ebp, 0x100
je 0x49ec36
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49ec0c
call ebx
push eax
call fcn.0049e990
add esp, 4
push esi
call fcn.00687807
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x49ec2b
call fcn.00688468
push esi
mov dword [eax], 0x15
call fcn.00687807
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
call fcn.00688468
mov dword [eax], 0xd
push esi
call fcn.00687807
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x49ec50
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x49ec67
call fcn.00688468
mov dword [eax], 9
or eax, 0xffffffff
ret
cmp dword [esp + 0xc], 0
je 0x49ecd8
push eax
call fcn.00688845
add esp, 4
lea ecx, [esp + 4]
push 0
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x49ecd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x49ecad
call fcn.00688468
mov dword [eax], 0xb
or eax, 0xffffffff
ret
cmp eax, 0x6d
je 0x49ecd8
cmp eax, 5
jne 0x49ecc6
call fcn.00688468
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.0049e990
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret
xor eax, eax
ret

Function at 0x49f1b0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x49f1c7
call fcn.00688468
mov dword [eax], 9
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call fcn.00688845
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x49f211
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x49f204
call fcn.00688468
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.0049e990
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret
Function at 0x4a8870
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
lea eax, [esi + 0x20]
push eax
call fcn.0067ddd0
mov edx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
movzx ecx, byte [edx + 3]
shl ecx, 8
movzx eax, byte [edx + 2]
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
xor ecx, 0x6a09e667
mov dword [esi], ecx
movzx ecx, byte [edx + 7]
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
xor ecx, 0xbb67ae85
mov dword [esi + 4], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
xor ecx, 0x3c6ef372
mov dword [esi + 8], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
xor ecx, 0xa54ff53a
mov dword [esi + 0xc], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
xor ecx, 0x510e527f
mov dword [esi + 0x10], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
xor ecx, 0x9b05688c
mov dword [esi + 0x14], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x18]
shl ecx, 8
or ecx, eax
xor ecx, 0x1f83d9ab
mov dword [esi + 0x18], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
shl ecx, 8
or ecx, eax
xor ecx, 0x5be0cd19
mov dword [esi + 0x1c], ecx
movzx eax, byte [edx]
mov dword [esi + 0x74], eax
xor eax, eax
pop esi
ret