joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cf0e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, edx
mov edx, dword [esp + 0x18]
push ebp
push esi
push edi
movzx esi, word [edx]
mov ebp, ecx
mov edi, dword [esp + 0x28]
mov eax, esi
xor eax, 0x7f0
shr esi, 4
shr eax, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
mov ecx, dword [edi + esi*4]
mov eax, dword [edi + eax*4]
mov dword [esp + 0x28], eax
movzx eax, word [edx + 0x10]
mov esi, dword [esp + 0x28]
shr eax, 4
mov dword [esp + 0x1c], ecx
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x4cf17c
lea ebx, [ebp + 4]
mov esi, edx
mov ebp, dword [esp + 0x14]
nop word [eax + eax]
push edi
push ebx
push ecx
push esi
call fcn.004d3470
push edi
lea eax, [ebx + 0x20]
push eax
push dword [esp + 0x30]
lea eax, [esi + 0x10]
push eax
call fcn.004d3470
mov ecx, dword [esp + 0x3c]
add esp, 0x20
add ebx, 0x440
add esi, 0x20
sub ebp, 1
jne 0x4cf140
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ebx, dword [ebp]
cmp ebx, 0x10
jbe 0x4cf252
lea eax, [ebp + 0x44]
add ebx, 0xfffffff1
mov dword [esp + 0x18], eax
movzx eax, word [edx + 0x10]
xor eax, 0x7f0
shr ebx, 1
shr eax, 4
lea ebp, [ebx + 0x180]
add esi, dword [edi + eax*4]
lea ebp, [edx + ebp*2]
mov dword [esp + 0x28], esi
dec ebx
lea ebp, [ebp - 2]
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0x80]
mov ebx, dword [esp + 0x24]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x200]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
add esi, dword [edi + ecx*4]
cmp eax, 2
jae 0x4cf1c2
movzx ecx, word [ebp]
mov ebx, dword [esp + 0x1c]
mov eax, ecx
mov edx, dword [esp + 0x18]
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [edx + ebx*8], eax
mov eax, dword [edi + ecx*4]
add eax, esi
mov esi, dword [esp + 0x28]
mov dword [edx + ebx*8 + 4], eax
test ebx, ebx
jne 0x4cf1b0
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
lea ebx, [eax*4 - 0x40]
mov eax, dword [esp + 0x14]
cmp eax, 1
jbe 0x4cf252
add esi, 0x484
lea edi, [eax - 1]
push ebx
push edx
push esi
call fcn.004692b0
mov edx, dword [esp + 0x24]
add esp, 0xc
add esi, 0x440
sub edi, 1
jne 0x4cf238
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x4d16d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
xor ebx, ebx
push esi
mov esi, 0x100
push edi
mov edi, dword [esp + 0x1c]
or ecx, esi
nop dword [eax]
add edi, edi
mov edx, esi
and edx, edi
mov eax, ecx
add edx, esi
shr eax, 8
add eax, edx
mov edx, dword [esp + 0x14]
movzx edx, word [edx + eax*2]
mov eax, ecx
shr eax, 7
add ecx, ecx
and eax, 1
shr edx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor edx, eax
add ebx, dword [ebp + edx*4]
mov edx, ecx
xor edx, edi
not edx
and esi, edx
cmp ecx, 0x10000
jb 0x4d16f0
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x4d2a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movaps xmm0, xmmword [0x5c4db0]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, 0x400
push edi
mov edi, 0xc
mov eax, dword [esi + 0x78]
lea edx, [esi + 0x1c50]
mov dword [esi + 0x70], eax
lea eax, [esi + 0x1e18]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x44], 1
mov dword [esi + 0x40], 1
mov dword [esi + 0x3c], 1
mov dword [esi + 0x38], 1
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
movups xmmword [esi + 0x1c18], xmm0
movups xmmword [esi + 0x1c28], xmm0
nop dword [eax]
nop word [eax + eax]
mov ecx, 0x10
nop word [eax + eax]
mov word [eax - 0x180], bx
mov word [eax], bx
add eax, 2
sub ecx, 1
jne 0x4d2ad0
mov word [edx - 0x18], bx
mov word [edx], bx
mov word [edx + 0x18], bx
mov word [edx + 0x30], bx
add edx, 2
sub edi, 1
jne 0x4d2ac0
mov eax, 0x4000400
lea edi, [esi + 0x1f98]
mov ecx, pe_nt_image_headers32
rep stosd dword es:[edi], eax
lea edi, [esi + 0x2198]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x98]
mov eax, 0x300
add ecx, dword [esi + 0x94]
shl eax, cl
test eax, eax
je 0x4d2b42
mov edi, dword [esi + 0x50]
mov ecx, eax
shr ecx, 1
mov eax, 0x4000400
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, 0x4000400
lea edi, [esi + 0x2298]
mov ecx, pe_nt_image_headers32
rep stosd dword es:[edi], eax
lea edi, [esi + 0x2498]
mov ecx, pe_nt_image_headers32
rep stosd dword es:[edi], eax
mov ecx, pe_nt_image_headers32
lea edi, [esi + 0x2698]
rep stosd dword es:[edi], eax
lea edi, [esi + 0x2898]
mov ecx, pe_nt_image_headers32
rep stosd dword es:[edi], eax
mov dword [esi + 0x1c], 0
lea eax, [esi + 0xbaa0]
mov dword [esi + 0x18], 0
mov ecx, 0x800
mov dword [eax], 0x40000000
lea eax, [eax + 0x20]
sub ecx, 1
jne 0x4d2b94
mov dword [esi + 0x34], ecx
mov eax, 1
mov ecx, dword [esi + 0x9c]
mov edx, 0x100
shl eax, cl
mov ecx, dword [esi + 0x94]
dec eax
mov dword [esi + 0x4c], eax
mov eax, edx
shr eax, cl
mov ecx, dword [esi + 0x98]
shl edx, cl
sub edx, eax
pop edi
mov dword [esi + 0x48], edx
pop esi
pop ebx
ret
Function at 0x4d3470
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x18]
xor ebx, ebx
push esi
push edi
nop word [eax + eax]
mov edx, dword [esp + 0x14]
mov edi, ebx
shr edi, 1
mov esi, ebx
shr esi, 2
mov eax, edi
and eax, 1
neg eax
shr eax, 4
movzx ecx, word [edx + esi*2 + 4]
and eax, 0x7f
shr ecx, 4
neg esi
xor ecx, eax
and esi, 0x7f0
movzx eax, word [edx + 2]
xor esi, eax
mov eax, dword [esp + 0x14]
shr esi, 4
mov edx, dword [ebp + ecx*4]
movzx ecx, word [eax + edi*2 + 8]
add edx, dword [ebp + esi*4]
mov eax, ecx
add edx, dword [esp + 0x18]
xor ecx, 0x7f0
mov esi, dword [esp + 0x1c]
shr eax, 4
shr ecx, 4
mov eax, dword [ebp + eax*4]
add eax, edx
mov dword [esi + ebx*4], eax
mov eax, dword [ebp + ecx*4]
add eax, edx
mov dword [esi + ebx*4 + 4], eax
add ebx, 2
cmp ebx, 8
jb 0x4d3480
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4d52a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
push esi
mov dword [eax + 0x34], 0
lea esi, [eax + 0x60]
mov word [eax + 0x1e], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x468], 0xffffffff
mov dword [eax + 0x46c], 0xffffffff
mov dword [eax + 0x30], 0x20
mov byte [eax + 0x1d], 1
mov dword [eax + 0x48], 4
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x4d52e4
pop esi
ret
Function at 0x4e4640
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push edi
mov edi, dword [esp + 8]
push str.__archive_read_register_format
push 1
push 0xdeb0c5
push edi
call fcn.004ecb40
add esp, 0x10
cmp eax, 0xffffffe2
jne 0x4e4661
pop edi
ret
push esi
mov esi, dword [esp + 0x18]
lea ecx, [edi + 0x188]
xor eax, eax
nop
mov edx, dword [ecx]
cmp edx, esi
je 0x4e4716
test edx, edx
je 0x4e469f
inc eax
add ecx, 0x2c
cmp eax, 0x10
jl 0x4e4670
push str.Not_enough_slots_for_format_registration
push 0xc
push edi
call fcn.004e6a00
add esp, 0xc
mov eax, 0xffffffe2
pop esi
pop edi
ret
imul edx, eax, 0x2c
add eax, 9
imul ecx, eax, 0x2c
add edx, edi
mov eax, dword [esp + 0x1c]
mov dword [edx + 0x188], esi
pop esi
mov dword [ecx + edi], eax
mov eax, dword [esp + 0x1c]
mov dword [edx + 0x190], eax
mov eax, dword [esp + 0x20]
mov dword [edx + 0x194], eax
mov eax, dword [esp + 0x24]
mov dword [edx + 0x198], eax
mov eax, dword [esp + 0x28]
mov dword [edx + 0x19c], eax
mov eax, dword [esp + 0x2c]
mov dword [edx + 0x1a0], eax
mov eax, dword [esp + 0xc]
mov dword [edx + 0x180], eax
mov eax, dword [esp + 0x10]
mov dword [edx + 0x184], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 0x1a4], eax
mov eax, dword [esp + 0x34]
mov dword [edx + 0x1a8], eax
xor eax, eax
pop edi
ret
pop esi
mov eax, 0xffffffec
pop edi
ret

Function at 0x4e4a60
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push esi
mov esi, dword [esp + 8]
push str.archive_read_add_callback_data
push 1
push 0xdeb0c5
push esi
call fcn.004ecb40
add esp, 0x10
cmp eax, 0xffffffe2
jne 0x4e4a81
pop esi
ret
mov eax, dword [esi + 0x90]
push ebx
mov ebx, dword [esp + 0x14]
cmp ebx, eax
jbe 0x4e4aa8
push str.Invalid_index_specified.
push 0x16
push esi
call fcn.004e6a00
add esp, 0xc
mov eax, 0xffffffe2
pop ebx
pop esi
ret
inc eax
mov dword [esi + 0x90], eax
lea eax, [eax + eax*2]
shl eax, 3
push eax
push dword [esi + 0xa0]
call fcn.0058007c
add esp, 8
test eax, eax
jne 0x4e4ae0
push str.No_memory.
push 0xc
push esi
call fcn.004e6a00
add esp, 0xc
mov eax, 0xffffffe2
pop ebx
pop esi
ret
push edi
mov edi, dword [esi + 0x90]
dec edi
mov dword [esi + 0xa0], eax
cmp edi, ebx
jbe 0x4e4b42
lea edx, [edi + edi*2]
shl edx, 3
sub edi, ebx
nop word [eax + eax]
mov ecx, dword [esi + 0xa0]
lea edx, [edx - 0x18]
mov eax, dword [ecx + edx + 0x10]
mov dword [ecx + edx + 0x28], eax
mov eax, dword [esi + 0xa0]
mov dword [edx + eax + 0x18], 0xffffffff
mov dword [edx + eax + 0x1c], 0xffffffff
mov eax, dword [esi + 0xa0]
mov dword [edx + eax + 0x20], 0xffffffff
mov dword [edx + eax + 0x24], 0xffffffff
sub edi, 1
jne 0x4e4b00
mov ecx, dword [esi + 0xa0]
lea edx, [ebx + ebx*2]
mov eax, dword [esp + 0x14]
pop edi
pop ebx
mov dword [ecx + edx*8 + 0x10], eax
mov eax, dword [esi + 0xa0]
mov dword [eax + edx*8], 0xffffffff
mov dword [eax + edx*8 + 4], 0xffffffff
mov eax, dword [esi + 0xa0]
pop esi
mov dword [eax + edx*8 + 8], 0xffffffff
mov dword [eax + edx*8 + 0xc], 0xffffffff
xor eax, eax
ret
Function at 0x4e4d20
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push esi
mov esi, dword [esp + 8]
push str.archive_read_extract_set_skip_file
push 0x7fff
push 0xdeb0c5
push esi
call fcn.004ecb40
add esp, 0x10
test eax, eax
jne 0x4e4d64
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x68], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x6c], ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x64], 1
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], ecx
pop esi
ret

Function at 0x4e4d70
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push esi
push 0x460
push 1
call fcn.0055b749
mov esi, eax
add esp, 8
test esi, esi
jne 0x4e4d88
pop esi
ret
push esi
mov dword [esi], 0xdeb0c5
mov dword [esi + 4], 1
call fcn.004e1fd0
mov dword [esi + 0x60], eax
add esp, 4
lea eax, [esi + 0x44c]
mov dword [esi + 8], 0x5c5f20
mov dword [esi + 0x450], eax
mov eax, esi
pop esi
ret
Function at 0x4e5130
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push esi
mov esi, dword [esp + 8]
push str.archive_read_set_callback_data2
push 1
push 0xdeb0c5
push esi
call fcn.004ecb40
add esp, 0x10
cmp eax, 0xffffffe2
jne 0x4e5151
pop esi
ret
cmp dword [esi + 0x90], 0
push edi
jne 0x4e5193
push 0x18
push 1
call fcn.0055b749
add esp, 8
mov dword [esi + 0xa0], eax
test eax, eax
jne 0x4e5189
push str.No_memory.
push 0xc
push esi
call fcn.004e6a00
add esp, 0xc
mov eax, 0xffffffe2
pop edi
pop esi
ret
mov dword [esi + 0x90], 1
mov ecx, dword [esi + 0xa0]
mov eax, dword [esp + 0x10]
pop edi
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0xa0]
mov dword [eax], 0xffffffff
mov dword [eax + 4], 0xffffffff
mov eax, dword [esi + 0xa0]
pop esi
mov dword [eax + 8], 0xffffffff
mov dword [eax + 0xc], 0xffffffff
xor eax, eax
ret

Function at 0x4e51d0
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push esi
mov esi, dword [esp + 8]
push str.archive_read_set_close_callback
push 1
push 0xdeb0c5
push esi
call fcn.004ecb40
add esp, 0x10
cmp eax, 0xffffffe2
jne 0x4e51f1
pop esi
ret
mov eax, dword [esp + 0xc]
mov dword [esi + 0x88], eax
xor eax, eax
pop esi
ret

Function at 0x4e5200
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push esi
mov esi, dword [esp + 8]
push str.archive_read_set_open_callback
push 1
push 0xdeb0c5
push esi
call fcn.004ecb40
add esp, 0x10
cmp eax, 0xffffffe2
jne 0x4e5221
pop esi
ret
mov eax, dword [esp + 0xc]
mov dword [esi + 0x78], eax
xor eax, eax
pop esi
ret

Function at 0x4e5230
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push esi
mov esi, dword [esp + 8]
push str.archive_read_set_read_callback
push 1
push 0xdeb0c5
push esi
call fcn.004ecb40
add esp, 0x10
cmp eax, 0xffffffe2
jne 0x4e5251
pop esi
ret
mov eax, dword [esp + 0xc]
mov dword [esi + 0x7c], eax
xor eax, eax
pop esi
ret

Function at 0x4e5260
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push esi
mov esi, dword [esp + 8]
push str.archive_read_set_seek_callback
push 1
push 0xdeb0c5
push esi
call fcn.004ecb40
add esp, 0x10
cmp eax, 0xffffffe2
jne 0x4e5281
pop esi
ret
mov eax, dword [esp + 0xc]
mov dword [esi + 0x84], eax
xor eax, eax
pop esi
ret

Function at 0x4e5290
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push esi
mov esi, dword [esp + 8]
push str.archive_read_set_skip_callback
push 1
push 0xdeb0c5
push esi
call fcn.004ecb40
add esp, 0x10
cmp eax, 0xffffffe2
jne 0x4e52b1
pop esi
ret
mov eax, dword [esp + 0xc]
mov dword [esi + 0x80], eax
xor eax, eax
pop esi
ret

Function at 0x4e52c0
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push esi
mov esi, dword [esp + 8]
push str.archive_read_set_switch_callback
push 1
push 0xdeb0c5
push esi
call fcn.004ecb40
add esp, 0x10
cmp eax, 0xffffffe2
jne 0x4e52e1
pop esi
ret
mov eax, dword [esp + 0xc]
mov dword [esi + 0x8c], eax
xor eax, eax
pop esi
ret
Function at 0x4e6ed0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x14]
test ebp, 0xffff7fff
jne 0x4e6fab
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4e6f4a
call ebx
cmp eax, 3
jne 0x4e6f31
push edi
call fcn.004e7160
mov esi, eax
add esp, 4
test esi, esi
jne 0x4e6f25
call fcn.00456cd2
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4e6f4a
call ebx
push eax
call fcn.004e6e10
push esi
call fcn.0055b72e
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x4e6fa3
push 0
push 0x2000001
push 3
push 0
push 0
push 0
test esi, esi
je 0x4e6f6a
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x4e6f71
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
call fcn.0055b72e
add esp, 4
cmp edi, 0xffffffff
jne 0x4e6f93
call ebx
push eax
call fcn.004e6e10
add esp, 4
or eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push edi
call fcn.00457343
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
test esi, esi
jne 0x4e703f
push dword [esp + 0x1c]
push ebp
push edi
call fcn.005809e7
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x4e70c6
call fcn.00456cd2
cmp dword [eax], 0xd
jne 0x4e701e
test ebp, 0x100
je 0x4e701e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4e6ff4
call ebx
push eax
call fcn.004e6e10
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x4e700b
call fcn.00456cd2
pop edi
pop esi
pop ebp
mov dword [eax], 0x15
or eax, 0xffffffff
pop ebx
ret
call fcn.00456cd2
pop edi
pop esi
pop ebp
mov dword [eax], 0xd
or eax, 0xffffffff
pop ebx
ret
call fcn.00456cd2
cmp dword [eax], 2
jne 0x4e70c6
push edi
call fcn.004e7160
mov esi, eax
add esp, 4
test esi, esi
je 0x4e6f12
push dword [esp + 0x1c]
push ebp
push esi
call fcn.00580a8d
mov edi, eax
add esp, 0xc
test edi, edi
jns 0x4e70b6
call fcn.00456cd2
cmp dword [eax], 0xd
jne 0x4e70b6
test ebp, 0x100
je 0x4e70b6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4e708c
call ebx
push eax
call fcn.004e6e10
add esp, 4
push esi
call fcn.0055b72e
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x4e70ab
call fcn.00456cd2
push esi
mov dword [eax], 0x15
call fcn.0055b72e
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
call fcn.00456cd2
mov dword [eax], 0xd
push esi
call fcn.0055b72e
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x4e70d0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x4e70e7
call fcn.00456cd2
mov dword [eax], 9
or eax, 0xffffffff
ret
cmp dword [esp + 0xc], 0
je 0x4e7158
push eax
call fcn.004572d9
add esp, 4
lea ecx, [esp + 4]
push 0
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4e7153
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x4e712d
call fcn.00456cd2
mov dword [eax], 0xb
or eax, 0xffffffff
ret
cmp eax, 0x6d
je 0x4e7158
cmp eax, 5
jne 0x4e7146
call fcn.00456cd2
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.004e6e10
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret
xor eax, eax
ret

Function at 0x4e7370
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x4e7387
call fcn.00456cd2
mov dword [eax], 9
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call fcn.004572d9
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4e73d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4e73c4
call fcn.00456cd2
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.004e6e10
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret
Function at 0x4ecb40
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
sub esp, 0x80
push esi
mov esi, dword [esp + 0x88]
mov eax, dword [esi]
cmp eax, 0xcad11c9
ja 0x4ecb80
je 0x4ecb79
cmp eax, 0xdeb0c5
je 0x4ecb72
cmp eax, 0xbadb0c5
jne 0x4ecc3d
mov ecx, str.archive_read_disk
jmp 0x4ecb9e
mov ecx, str.archive_read
jmp 0x4ecb9e
mov ecx, str.archive_match
jmp 0x4ecb9e
cmp eax, 0xb0c5c0de
je 0x4ecb99
cmp eax, 0xc001b0c5
jne 0x4ecc3d
mov ecx, str.archive_write_disk
jmp 0x4ecb9e
mov ecx, str.archive_write
cmp eax, dword [esp + 0x8c]
je 0x4ecbd3
push ecx
push dword [esp + 0x98]
push str.PROGRAMMER_ERROR:_Function__s_invoked_on__s_archive_object__which_is_not_supported.
push 0xffffffffffffffff
push esi
call fcn.004e6a00
add esp, 0x14
mov dword [esi + 4], 0x8000
mov eax, 0xffffffe2
pop esi
add esp, 0x80
ret
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x90]
test ecx, eax
jne 0x4ecc33
cmp eax, 0x8000
je 0x4ecc1f
push ecx
lea eax, [esp + 8]
push eax
call fcn.004ecd80
add esp, 8
push eax
push dword [esi + 4]
lea eax, [esp + 0x4c]
push eax
call fcn.004ecd80
add esp, 8
push eax
push dword [esp + 0x9c]
push str.INTERNAL_ERROR:_Function__s_invoked_with_archive_structure_in_state__s__should_be_in_state__s
push 0xffffffffffffffff
push esi
call fcn.004e6a00
add esp, 0x18
mov dword [esi + 4], 0x8000
mov eax, 0xffffffe2
pop esi
add esp, 0x80
ret
xor eax, eax
pop esi
add esp, 0x80
ret
push str.PROGRAMMER_ERROR:_Function
call fcn.004ecce0
push dword [esp + 0x98]
call fcn.004ecce0
push str._invoked_with_invalid_archive_handle._n
call fcn.004ecce0
add esp, 0xc
call fcn.004eccd0
int3
Function at 0x4fe480
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [eax + 0x38]
mov bl, byte [eax + 0x34]
test esi, esi
jle 0x4fe4bd
mov edx, dword [eax + 0x260]
push edi
movzx edi, bl
nop word [eax + eax]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, edi
xor edx, dword [ecx*4 + 0xf7d298]
mov dword [eax + 0x260], edx
sub esi, 1
jne 0x4fe4a0
pop edi
mov ecx, dword [eax + 0x34]
mov byte [ecx + eax + 0x58], 1
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, 1
je 0x4fe56c
sub ecx, 1
je 0x4fe550
sub ecx, 1
je 0x4fe528
mov byte [edx + eax + 0x54], 1
mov edx, dword [eax + 0x24]
mov ecx, dword [eax + 0x44]
mov byte [edx + ecx], bl
mov edx, dword [eax + 0x44]
inc edx
mov dword [eax + 0x44], edx
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov esi, dword [eax + 0x44]
mov dl, byte [eax + 0x38]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
inc dword [eax + 0x44]
pop esi
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
inc edx
mov dword [eax + 0x44], edx
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
inc edx
mov dword [eax + 0x44], edx
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret