joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4976cc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, 0xe
mov eax, 0x4fa728
xor edx, edx
mov dl, byte [eax]
mov ecx, 0x1f
sub ecx, edx
mov edx, 1
shl edx, cl
or esi, edx
inc eax
dec ebx
jne 0x4976da
xor ebx, ebx
mov ecx, 0x4fa328
mov eax, ebx
mov edx, 8
test al, 1
je 0x49770a
shr eax, 1
xor eax, esi
jmp 0x49770c
shr eax, 1
dec edx
jne 0x497700
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x4976f9
pop esi
pop ebx
ret

Function at 0x497720
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
mov ebp, 0x4fa328
mov ebx, 0xedb88200
test esi, esi
jne 0x49773d
xor eax, eax
jmp 0x497840
cmp dword [0x4fa324], 0
je 0x49774b
call fcn.004976cc
xor ebx, 0xffffffff
cmp edi, 8
jl 0x49781b
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jge 0x497757
test edi, edi
je 0x49783b
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
jne 0x49781f
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ab644
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4ab64c
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4ab7e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 8]
mov edx, 0x4ab800
mov eax, esi
call fcn.004a94cc
mov edx, dword [ebp - 8]
lea eax, [ebx + 0xc]
call fcn.00405010
lea ecx, [ebp - 0xc]
mov edx, 0x4ab814
mov eax, esi
call fcn.004a94cc
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x28]
call fcn.00405010
lea ecx, [ebp - 0x10]
mov edx, 0x4ab82c
mov eax, esi
call fcn.004a94cc
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x10]
call fcn.00405010
lea ecx, [ebp - 0x14]
mov edx, 0x4ab848
mov eax, esi
call fcn.004a94cc
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x14]
call fcn.00405010
lea ecx, [ebp - 0x18]
mov edx, 0x4ab864
mov eax, esi
call fcn.004a94cc
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x24]
call fcn.00405010
lea ecx, [ebp - 0x20]
mov edx, 0x4ab87c
mov eax, esi
call fcn.004a94cc
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040bc08
mov eax, dword [ebp - 0x1c]
or edx, 0xffffffff
call fcn.0040bffc
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x24]
mov edx, 0x4ab894
mov eax, esi
call fcn.004a94cc
mov eax, dword [ebp - 0x24]
call fcn.004a2bec
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x28]
mov edx, 0x4ab8a4
mov eax, esi
call fcn.004a94cc
mov eax, dword [ebp - 0x28]
call fcn.004a2bec
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 4]
mov edx, 0x4ab8bc
mov eax, esi
call fcn.004a94cc
mov eax, dword [ebp - 4]
call fcn.004a27a0
test al, al
je 0x4ab79f
mov eax, dword [ebp - 4]
call fcn.0040bfc0
mov edi, eax
test edi, edi
jl 0x4ab795
call fcn.0040e344
mov dword [ebp - 0x2c], edi
fild dword [ebp - 0x2c]
fdiv dword [0x4ab8c4]
faddp st(1)
fstp qword [ebx + 0x38]
wait
jmp 0x4ab7ab
xor eax, eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
jmp 0x4ab7ab
mov eax, dword [ebp - 4]
call fcn.004a2bec
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4ab8d0
mov eax, esi
call fcn.004a94cc
mov edx, dword [ebp - 0x30]
lea eax, [ebx + 0x48]
call fcn.00405010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab7ef
lea eax, [ebp - 0x30]
call fcn.00404fbc
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.00404fe0
ret

Function at 0x4b2a38
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4b2a92
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.004b2a28
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004a16a0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004a12a0
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2a99
lea eax, [ebp - 4]
call fcn.00404fbc
ret
Function at 0x4b9210
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x4fb544
mov ecx, dword [esp]
lea edx, [esp + 0xc]
xor ebx, ebx
mov bl, byte [edi]
mov bl, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x4b922f
mov esi, 1
mov edx, 0x4fb64c
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
shl ecx, 2
xor ebx, ebx
mov bl, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
xor ebx, ebx
mov bl, byte [esp + eax + 0x11]
add edi, ebx
xor ebx, ebx
mov bl, byte [esp + eax + 0xd]
shl ebx, 3
movzx ebp, byte [esp + eax + 0xe]
shl ebp, 2
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x4b92a9
dec ebx
je 0x4b92cd
dec ebx
je 0x4b92f1
dec ebx
je 0x4b9314
jmp 0x4b932d
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 8
and ebx, 0xff
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4b932d
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 4
and ebx, 0xff
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4b932d
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 2
and ebx, 0xff
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4b932d
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x4b9296
inc esi
add edx, 0x40
cmp esi, 9
jne 0x4b924b
mov esi, 0x20
mov eax, 0x4fb574
mov edx, dword [esp + 4]
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x4b9352
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b938c
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
xor eax, eax
mov al, dl
mov bl, byte [eax + 0x4fb5fb]
test bl, bl
jbe 0x4b93bd
lea eax, [esi + 0x3e0]
call fcn.004b936c
lea eax, [esi + 0x3fc]
call fcn.004b936c
dec bl
jne 0x4b93a3
mov cl, 0x30
mov edi, 0x4fb5cc
mov eax, dword [esp]
mov dl, byte [edi]
cmp dl, 0x1c
ja 0x4b93df
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x4b93ee
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x4b93c7
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4b93fc
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.004b91a4
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x4b9418
mov bl, 0x1c
mov esi, 0x4fb594
lea edi, [ebp - 0x41]
mov dl, byte [esi]
mov eax, dword [ebp - 8]
call fcn.004b91a4
mov byte [edi], al
mov dl, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.004b91a4
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x4b9434
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.004b938c
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x4b945c
mov bl, 1
mov eax, 0x4fb4c4
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x4b9495
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x4b94a2
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x4b9481
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x4b94cc
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.004b9210
jmp 0x4b94f4
xor eax, eax
mov al, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.004b9210
mov bl, 0x20
lea eax, [ebp - 0xa1]
mov dl, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x4b94fc
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x4b94b4
mov bl, 0x40
mov esi, 0x4fb504
lea eax, [ebp - 0x3e1]
mov dl, byte [esi]
cmp dl, 0x20
ja 0x4b9562
and edx, 0xff
mov dl, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x4b9571
and edx, 0xff
mov dl, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x4b954a
mov bl, 1
lea esi, [ebp - 0x3e1]
mov cl, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.004b91cc
inc ebx
inc esi
cmp bl, 0x41
jne 0x4b957f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ba3c8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
mov dl, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
mov al, byte [esi + 1]
xor ecx, ecx
mov cl, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
mov dl, byte [esi + 2]
xor ecx, ecx
mov cl, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
mov al, byte [esi + 3]
xor ecx, ecx
mov cl, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
xor edx, edx
mov dl, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
mov al, byte [esi + 4]
shl eax, 3
and al, 0xff
xor edx, edx
mov dl, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
mov al, byte [esi + 5]
shl eax, 2
and al, 0xff
xor edx, edx
mov dl, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
mov al, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
xor ebx, ebx
mov bl, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x4ba474
mov dl, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x4ba46f
mov eax, ebp
mov edx, 8
call fcn.00405608
push 1
mov eax, ebp
call fcn.004054d4
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.004b93fc
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bbfac
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4bbfb5
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4bc159
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004bc2f4
xor eax, eax
push ebp
push 0x4bc137
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x4bc004
call fcn.004049f8
jmp 0x4bc13e
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x4bc0c6
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4bc054
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4bc054
lea eax, [ebp - 0x10]
call fcn.004bbd7c
push dword [ebp - 0x10]
push 0x4bc174
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040533c
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4bc089
lea eax, [ebp - 0x18]
call fcn.004bbd7c
push dword [ebp - 0x18]
push 0x4bc174
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040533c
mov eax, dword [ebp - 0x14]
call fcn.0040547c
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4bc121
lea eax, [ebp - 0x20]
call fcn.004bbd7c
push dword [ebp - 0x20]
push 0x4bc174
push ebx
push 0x4bc180
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.0040533c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004bbf7c
jmp 0x4bc121
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x4bc0e8
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x4bc0e8
push ebx
mov edi, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x4bc0fe
mov eax, ebx
call fcn.0040547c
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x4bc121
lea eax, [ebp - 0x24]
mov ecx, 0x4bc180
mov edx, ebx
call fcn.004052c8
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004bbf7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc13e
mov eax, dword [ebp - 4]
call fcn.004bc300
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bc160
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00404fe0
ret
Function at 0x4cd9e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 2
mov ecx, 3
cdq
idiv ecx
mov ebx, eax
mov edx, ebx
add edx, 4
mov eax, esi
call fcn.00405608
mov eax, esi
call fcn.004054d4
push eax
mov edx, ebx
add edx, 2
xor ecx, ecx
pop eax
call fcn.00403a2c
cmp byte [ebp - 1], 0
jne 0x4cda53
mov eax, esi
call fcn.004054d4
mov dl, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov al, byte [ebp - 1]
sub al, 1
jb 0x4cda6c
sub al, 2
jb 0x4cda73
jmp 0x4cda78
mov ebx, 2
jmp 0x4cda78
mov ebx, 1
mov eax, esi
call fcn.004054d4
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x4cdb5a
test edi, edi
jle 0x4cdad4
mov eax, esi
call fcn.004054d4
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.004054d4
mov byte [eax + ebx - 1], 0
jmp 0x4cdb4e
test edi, edi
jge 0x4cdb1a
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.004054d4
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x4cdb4e
mov eax, esi
call fcn.004054d4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dl, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
mov cl, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.004054d4
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4cda90
mov al, byte [ebp - 1]
sub al, 1
jb 0x4cdb6a
sub al, 2
jb 0x4cdba3
jmp 0x4cdbea
cmp edi, 2
jne 0x4cdb70
dec ebx
mov eax, ebx
sub eax, 2
jl 0x4cdbea
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.004054d4
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x4fb960]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4cdb80
jmp 0x4cdbea
cmp edi, 2
jne 0x4cdba9
dec ebx
test ebx, ebx
jle 0x4cdbe5
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.004054d4
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x4fb964]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4cdbb5
jmp 0x4cdbe5
inc ebx
mov eax, esi
call fcn.004054d4
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x4cdbd8
mov eax, esi
mov edx, ebx
call fcn.00405608
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ce77c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.0040817c
ret

Function at 0x4ce8a4
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040546c
xor eax, eax
push ebp
push 0x4ce9f2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.004ce77c
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040547c
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4ce9d1
xor eax, eax
push ebp
push 0x4ce9ca
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4ce9b3
xor eax, eax
push ebp
push 0x4ce9ac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4ce995
xor eax, eax
push ebp
push 0x4ce98e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.004ce7b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce995
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce9b3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce9d1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.004ce830
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce9f9
lea eax, [ebp - 4]
call fcn.00404fbc
ret
Function at 0x4d0d90
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d0f01
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d0edc
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.004051a4
lea eax, [ebp - 0x118]
mov edx, 0x4d0f18
call fcn.00405284
mov eax, dword [ebp - 0x118]
call fcn.0040547c
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4d0e4e
lea eax, [ebp - 0x111]
call fcn.0040cbf8
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.004050ac
jmp 0x4d0e55
mov eax, esi
call fcn.00404fbc
cmp bl, 0x61
jae 0x4d0e76
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.004110bc
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.00405010
jmp 0x4d0e90
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.00411030
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.00405010
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x4d0f24
call fcn.0040d340
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.00405010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0ee3
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x4d626c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040546c
xor eax, eax
push ebp
push 0x4d6365
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.004d7c90
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040ca34
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004d6c58
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040c918
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004d6ccc
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d636c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404fe0
ret