joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009bb9
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x10042958
call fcn.1000aecb
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10009c47
call fcn.1000ae99
test eax, eax
jne 0x10009bdd
xor eax, eax
jmp 0x10009d13
call fcn.1000a293
test eax, eax
jne 0x10009bed
call fcn.1000aeb7
jmp 0x10009bd6
call fcn.1000ae4d
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x10049d38], eax
call fcn.1001d956
mov dword [0x10048aa4], eax
call fcn.1001d956
test eax, eax
jns 0x10009c17
call fcn.10009f6a
jmp 0x10009be6
call fcn.1001d956
test eax, eax
js 0x10009c40
call fcn.1000aa85
test eax, eax
js 0x10009c40
push 0
call fcn.1001d956
pop ecx
test eax, eax
jne 0x10009c40
inc dword [0x10048aa0]
jmp 0x10009d10
call fcn.1000aa32
jmp 0x10009c10
xor edi, edi
cmp eax, edi
jne 0x10009ca6
cmp dword [0x10048aa0], edi
jle 0x10009bd6
dec dword [0x10048aa0]
mov dword [ebp - 4], edi
cmp dword [0x10048ad8], edi
jne 0x10009c6b
call fcn.1000a7c0
cmp dword [ebp + 0x10], edi
jne 0x10009c7f
call fcn.1000aa32
call fcn.10009f6a
call fcn.1000aeb7
mov dword [ebp - 4], 0xfffffffe
call fcn.10009c92
jmp 0x10009d10
cmp eax, 2
jne 0x10009d04
call fcn.10009f36
push 0x214
push 1
call fcn.1001d956
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x10009bd6
push esi
push dword [0x10046048]
push dword [0x10048ab8]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x10009cf8
push edi
push esi
call fcn.10009fad
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x10009d10
push esi
call fcn.1001d956
pop ecx
jmp 0x10009bd6
cmp eax, 3
jne 0x10009d10
push edi
call fcn.1001d956
pop ecx
xor eax, eax
inc eax
call fcn.1000af10
ret 0xc

Function at 0x10009f00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10046040]
jne 0x1000b4a0
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10048cf8], eax
mov dword [0x10048cf4], ecx
mov dword [0x10048cf0], edx
mov dword [0x10048cec], ebx
mov dword [0x10048ce8], esi
mov dword [0x10048ce4], edi
mov word [0x10048d10], ss
mov word [0x10048d04], cs
mov word [0x10048ce0], ds
mov word [0x10048cdc], es
mov word [0x10048cd8], fs
mov word [0x10048cd4], gs
pushfd
pop dword [0x10048d08]
mov eax, dword [ebp]
mov dword [0x10048cfc], eax
mov eax, dword [ebp + 4]
mov dword [0x10048d00], eax
lea eax, [ebp + 8]
mov dword [0x10048d0c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10048c48], 0x10001
mov eax, dword [0x10048d00]
mov dword [0x10048bfc], eax
mov dword [0x10048bf0], 0xc0000409
mov dword [0x10048bf4], 1
mov eax, dword [0x10046040]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10046044]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10048c40], eax
push 1
call fcn.1000ce11
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10001564
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10048c40], 0
jne 0x1000b58c
push 1
call fcn.1000ce11
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x1001100d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100418d8
call fcn.10037358
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1001106e
call fcn.1000e3e2
mov esi, eax
jmp 0x10011146
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1001108c
call fcn.1000e3e2
jmp 0x1001113d
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x10011082
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x100110bf
mov esi, 0x8007000e
jmp 0x1001113f
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1001d956
mov dword [ebp - 4], 1
jmp 0x100110f3
cmp dword [ebp - 0x418], 0
je 0x100110b5
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10011082
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.1001d956
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1001115f
lea ecx, [ebp - 0x418]
call fcn.10011269
mov eax, esi
call fcn.100373b1
ret 0x10
Function at 0x1001d956
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1001d965
pop dword [ebp - 0x18]
mov eax, 0x31ec7d0f
sub eax, 0x21eaa3aa
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x4432d6f4
sub dword [ebp - 0x28], 0xf5e091a9
mov dword [ebp - 0x24], 0xee8ba413
add dword [ebp - 0x24], 0x43a7a832
mov dword [ebp - 0x20], 0x61a66e73
add dword [ebp - 0x20], 0xeaa5d5bb
mov dword [ebp - 0x1c], 0x24856a8a
add dword [ebp - 0x1c], 0xdb7a9576
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xd846436
sub dword [ebp - 0x28], 0x9911fae0
mov dword [ebp - 0x24], 0x1a79a169
sub dword [ebp - 0x24], 0xd90d3ff4
mov dword [ebp - 0x20], 0x9b94fbc4
sub dword [ebp - 0x20], 0x38258f58
mov dword [ebp - 0x1c], 0x48cd72c2
sub dword [ebp - 0x1c], 0x48cd72c2
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x6a3f7ca1
add eax, 0xa5c0935f
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x45920
push 0
call eax
mov ecx, 0x4ea3
mov esi, eax
mov edi, 0x10051800
add edi, dword [ebp - 0x18]
mov ebx, 0xad182ae
xor dword [ebp - 0x10], 0xc63c9f98
mov edx, dword [edi]
add dword [ebp - 8], ebx
add edx, ebx
xor dword [ebp - 8], 0x39fece65
mov dword [esi], edx
add dword [ebp - 0x10], 0x4a6ab13b
add esi, 4
add edi, 4
loop 0x1001da70
add eax, 0x3fd9f957
add eax, 0xc0273408
xor ebx, ebx
add ebx, eax
add eax, 0x9a22b155
add eax, 0x65dd4eb0
mov ecx, 0x6047a230
add ecx, 0xafb85dd0
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4333d3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x4333e2
pop dword [ebp - 0x4c]
mov eax, 0x474d5449
sub eax, 0x470a2067
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x40b594d4
sub dword [ebp - 0x5c], 0xf2634f89
mov dword [ebp - 0x58], 0x27d8a9c4
add dword [ebp - 0x58], 0xa5aa281
mov dword [ebp - 0x54], 0x8478c802
sub dword [ebp - 0x54], 0x382c83d4
mov dword [ebp - 0x50], 0xbed1f75d
sub dword [ebp - 0x50], 0xbed1f75d
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xf9ae3
sub eax, 0xffcbe8cf
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x6c915252
sub dword [ebp - 0x5c], 0xf81ee8fc
mov dword [ebp - 0x58], 0x33500ead
add dword [ebp - 0x58], 0xe1c52c8
mov dword [ebp - 0x54], 0xaed980c
sub dword [ebp - 0x54], 0xa77e2ba0
mov dword [ebp - 0x50], 0x73c84143
sub dword [ebp - 0x50], 0x73c84143
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x47eb4
push 0
call eax
mov ecx, 0x7b632eb8
add ecx, 0x849d26f8
mov esi, eax
mov edi, 0x6d05fc4d
add edi, 0x934051b3
add edi, dword [ebp - 0x4c]
mov ebx, 0xde6f89e4
sub dword [ebp - 0x28], esi
mov edx, dword [edi]
xor dword [ebp - 0x28], 0xb54a30b4
add edx, ebx
mov dword [esi], edx
xor dword [ebp - 0x14], 0xd94c0848
add esi, 0x5d302e37
add esi, 0xa2cfd1cd
add edi, 0xc0aaa7a1
add edi, 0x3f555863
loop 0x4334f9
add eax, 0x2eaa84cf
sub eax, 0x2ea93b3c
xor ebx, ebx
add ebx, eax
add eax, 0x3b7a04aa
sub eax, 0x3b7a04a5
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x4013cf
Capabilities:
Encode data using xor

Disassembly:
jmp 0x417260
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
je 0x4172bc
push ebx
mov ebx, edi
and ebx, 1
nop word [eax + eax]
movzx eax, byte [esi + ebp]
mov ecx, 0x526158
xor al, 0x73
sub al, 0x58
push ebx
mov byte [esi + ebp], al
call fcn.004061bd
push eax
call fcn.0040605a
movzx eax, byte [esi + ebp]
add esp, 4
sub al, 0x14
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [esi + ebp], al
inc esi
cmp esi, edi
jb 0x417280
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4035b2
Capabilities:
Terminate process

Disassembly:
jmp 0x455259
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45526a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405853
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x4036cf
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b563
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b574
pop esi
ret
push ebx
push edi
push esi
call fcn.0049b44a
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403f53
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b59c
push ebx
push esi
push edi
call fcn.00405641
add esp, 0xc
push 0
call fcn.00406195
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x40488b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
jmp 0x4149a0
sub esp, 0x220
mov eax, dword [0x523e00]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x224]
xor ecx, ecx
push ebp
push esi
mov esi, dword [esp + 0x238]
push edi
mov edi, dword [esp + 0x238]
mov dword [esp + 0x24], eax
mov eax, ecx
mov byte [esp + ecx + 0x28], cl
cdq
idiv esi
mov al, byte [edx + edi]
mov byte [esp + ecx + 0x128], al
inc ecx
cmp ecx, 0x100
jl 0x4149d2
xor esi, esi
xor edi, edi
mov dl, byte [esp + esi + 0x28]
movzx eax, byte [esp + esi + 0x128]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x414a15
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jl 0x4149f2
mov ebp, dword [esp + 0x234]
xor ecx, ecx
xor eax, eax
xor edi, edi
test ebp, ebp
jle 0x414b26
mov dword [esp + 0x20], eax
push ebx
inc ecx
and ecx, 0x800000ff
jns 0x414a55
dec ecx
or ecx, 0xffffff00
inc ecx
mov bl, byte [esp + ecx + 0x2c]
movzx esi, bl
add eax, esi
mov dword [esp + 0x10], ecx
and eax, 0x800000ff
jns 0x414a70
dec eax
or eax, 0xffffff00
inc eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0
push eax
push 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.00405fe2
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
movzx eax, byte [esp + edx + 0x2c]
mov byte [esp + ecx + 0x2c], al
mov byte [esp + edx + 0x2c], bl
movzx eax, byte [esp + ecx + 0x2c]
mov edx, dword [esp + 0x28]
add eax, esi
movzx eax, al
movzx eax, byte [esp + eax + 0x2c]
xor byte [edx + edi], al
mov edx, dword [esp + 0x18]
test edx, edx
je 0x414b17
mov eax, dword [esp + 0x20]
mov ecx, edx
sub eax, edx
and eax, 0xfffffffc
cmp eax, 0x1000
jb 0x414af1
mov edx, dword [ecx - 4]
add eax, 0x23
sub ecx, edx
add ecx, 0xfffffffc
cmp ecx, 0x1f
ja 0x414b3e
push eax
push edx
call fcn.00401a28
mov ecx, dword [esp + 0x18]
add esp, 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
inc edi
cmp edi, ebp
jge 0x414b25
mov eax, dword [esp + 0x14]
jmp 0x414a44
pop ebx
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040303a
add esp, 0x220
ret
call fcn.0040472d
int3

Function at 0x405709
Capabilities:
Parse pe header

Disassembly:
jmp 0x443f59
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x443f98
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x443f98
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x443f98
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x443f98
cmp dword [ecx + 0x74], 0xe
jbe 0x443f98
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x415aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x4159e0
sub esp, 0x6c
mov eax, dword [0x523e00]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.0040134d
mov ebx, eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x18], ebx
call fcn.004026bc
add esp, 4
mov edi, 0x4b7203
cmp byte [esp + 0x84], 0
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x4c], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esp + 0x5c], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esp + 0x6c], xmm0
mov eax, dword [eax + 0x28]
mov dword [esp + 0x74], eax
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
jne 0x415a56
mov edi, dword [ebx + 8]
lea eax, [esp + 0x20]
push eax
call fcn.004026bc
mov ecx, edi
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415a68
sub ecx, edx
push 1
lea ebx, [ecx + 1]
push ebx
call fcn.0040332d
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x415b72
test ebx, ebx
je 0x415a98
push ebx
push edi
push ebp
call fcn.00405641
add esp, 0xc
lea eax, [esp + 0x4c]
mov dword [esi + 8], ebp
push eax
push 0
push str.false
call fcn.00403157
mov dword [esi + 0x10], eax
lea eax, [esp + 0x58]
push eax
push 0
push str.true
call fcn.00403157
add esp, 0x18
mov dword [esi + 0x14], eax
cmp byte [esp + 0x84], 0
je 0x415b45
lea eax, [esp + 0x4c]
mov byte [esp + 0x10], 0x2e
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0
push eax
push 1
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
push eax
lea eax, [esp + 0x24]
movlpd qword [esp + 0x28], xmm0
push eax
call fcn.00403c2e
movzx eax, word [esp + 0x28]
xorps xmm0, xmm0
mov word [esi + 0xc], ax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x30]
mov byte [esp + 0x28], 0x2c
push eax
push 1
lea eax, [esp + 0x30]
mov dword [esp + 0x34], 0
push eax
lea eax, [esp + 0x38]
movlpd qword [esp + 0x3c], xmm0
push eax
call fcn.00403c2e
movzx eax, word [esp + 0x3c]
add esp, 0x28
jmp 0x415b59
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
movzx eax, word [eax]
mov word [esi + 0xc], ax
mov eax, dword [ecx + 0x34]
movzx eax, word [eax]
mov ecx, dword [esp + 0x78]
pop edi
mov word [esi + 0xe], ax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040303a
add esp, 0x6c
ret 8
call fcn.004010aa
int3

Function at 0x4425c2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.00403738
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x442601
sub eax, 1
je 0x4425fc
sub eax, 1
je 0x4425f8
xor eax, eax
leave
ret
push 3
jmp 0x442603
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret
Function at 0x4965d9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401dac
mov eax, dword [0x523e00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00405da8
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x49661b
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x496777
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00405efc
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x527628]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0040324c
mov ecx, dword [esi*4 + 0x527628]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x496770
cmp eax, dword [edi + ecx + 0x24]
jne 0x496770
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x496770
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0040324c
add esp, 0x14
test edx, edx
jl 0x496770
jg 0x4966e6
test eax, eax
jb 0x496770
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x496770
jl 0x496700
cmp dword [ebp - 0x1008], eax
ja 0x496770
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x49671e
test ebx, ebx
je 0x496757
cmp ecx, edi
jae 0x496757
mov al, byte [ecx]
cmp al, 0xd
jne 0x496738
lea eax, [edi - 1]
cmp ecx, eax
jae 0x496744
cmp byte [ecx + 1], 0xa
jne 0x496744
inc ecx
jmp 0x496744
movzx eax, al
movsx eax, byte [eax + 0x5249a0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x49671e
cmp edx, ebx
jne 0x49671e
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x496775
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040303a
leave
ret
Function at 0x499b02
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x523e00]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x499b4d
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00499fc4
test al, al
jne 0x499b47
sub edx, 2
cmp edx, edi
jne 0x499b2d
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x499b6f
lea eax, [edi + 2]
cmp edx, eax
je 0x499b6f
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004996fb
add esp, 0x10
jmp 0x499c69
push esi
lea ecx, [ebp - 0x255]
call fcn.00499fc4
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x499bb2
push dword [ebp - 0x25c]
jmp 0x499b5f
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x499bef
cmp word [ebp - 0x226], 0
je 0x499c10
cmp word [ebp - 0x226], ax
jne 0x499bef
cmp word [ebp - 0x224], 0
je 0x499c10
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004996fb
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x499c5c
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x499bc9
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x499c44
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x499c69
push 0x4990e3
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004054a2
add esp, 0x10
jmp 0x499c39
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040303a
leave
ret
Function at 0x4a6a50
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x527628]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a6a90
cmp byte [ebx], 0xa
jne 0x4a6a90
or byte [eax + edi + 0x28], 4
jmp 0x4a6a95
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4a6b93
mov al, byte [edx]
cmp al, 0x1a
je 0x4a6b75
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4a6ac4
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4a6ae9
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4a6af3
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4a6aa6
jmp 0x4a6b93
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a6b70
cmp dword [ebp - 0xc], 0
je 0x4a6b70
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x527628]
test byte [eax + edi + 0x28], 0x48
je 0x4a6b4a
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4a6b35
mov byte [esi], dl
jmp 0x4a6b46
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x527628]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4a6b93
cmp byte [ebp - 1], 0xa
jne 0x4a6b59
cmp esi, ebx
jne 0x4a6b59
mov byte [esi], 0xa
jmp 0x4a6b92
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401938
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4a6b93
mov byte [esi], 0xd
jmp 0x4a6b92
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x527628]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a6b8f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a6b93
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret