joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d06d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x672560
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x46c
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x478], ecx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x474], edx
mov esi, dword [ebp + 0x24]
mov ebx, dword [ebp + 0x28]
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x470], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x468], 0
push 0x103
push 0
lea ecx, [ebp - 0x467]
push ecx
call fcn.005dfd60
push 0x348
push 0
lea edx, [ebp - 0x364]
push edx
call fcn.005dfd60
add esp, 0x18
mov edi, 5
mov dword [ebp - 0x46c], edi
cmp dword [ebp + 0x2c], 0
je 0x4d078a
push str._StartGDRThread__Into_StartGDRThread_1...
push 0
call fcn.004f0f30
add esp, 8
cmp dword [0x74a030], 0
jne 0x4d079d
push 0
call fcn.004cec60
add esp, 4
test esi, esi
je 0x4d07a9
mov eax, dword [esi]
mov dword [ebp - 0x14c], eax
test ebx, ebx
je 0x4d07b3
mov dword [ebp - 0x148], ebx
cmp dword [ebp + 0x2c], 0
je 0x4d07c8
push str._StartGDRThread__Into_StartGDRThread_2...
push 0
call fcn.004f0f30
add esp, 8
mov ecx, dword [ebp - 0x47c]
push ecx
lea edx, [ebp - 0x468]
push edx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
mov eax, dword [ebp - 0x470]
test eax, eax
je 0x4d07f2
push eax
lea eax, [ebp - 0x364]
push eax
call esi
mov ecx, dword [ebp - 0x478]
push ecx
lea edx, [ebp - 0x260]
push edx
call esi
mov eax, dword [ebp - 0x474]
push eax
lea ecx, [ebp - 0x144]
push ecx
call esi
mov edx, dword [ebp + 0x20]
mov dword [ebp - 0x150], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x15c], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x74a034
mov dword [ebp - 0x3c], 0x74a038
mov dword [ebp - 0x40], 0x74a050
mov dword [ebp - 0x38], 0x74a03c
mov dword [ebp - 0x34], 0x74a040
mov dword [ebp - 0x30], 0x74a044
mov dword [ebp - 0x2c], 0x74a048
mov esi, dword [ebp + 0x2c]
mov dword [ebp - 0x20], esi
test esi, esi
je 0x4d0887
push str._StartGDRThread__Into_StartGDRThread_3...
push 0
call fcn.004f0f30
add esp, 8
lea eax, [ebp - 0x468]
push eax
push 0
push 0x4d0530
call fcn.005e07ac
add esp, 0xc
test esi, esi
je 0x4d08b1
push eax
push str._StartGDRThread__Into_StartGDRThread_3a__hThrd___u_...
push 0
call fcn.004f0f30
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x24], 0
jne 0x4d08dd
push edi
call ebx
cmp edi, 0x64
jl 0x4d08d2
mov edi, 0x64
mov dword [ebp - 0x46c], edi
jmp 0x4d08b7
add edi, 5
mov dword [ebp - 0x46c], edi
jmp 0x4d08b7
test esi, esi
je 0x4d0900
push str._StartGDRThread__Into_StartGDRThread_4...
jmp 0x4d08f6
push 0
call fcn.004f0f30
add esp, 8
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x4d0930
Capabilities:
Get disk size

Disassembly:
sub esp, 0xc
push ebx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov ebx, eax
test ebx, ebx
je 0x4d09ad
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 4]
push esi
cdq
push edi
mov esi, eax
mov eax, dword [esp + 0x10]
mov edi, edx
push edi
cdq
push esi
push edx
push eax
call fcn.005e5510
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
mov eax, dword [esp + 0x28]
mov dword [ecx + 4], edx
test eax, eax
je 0x4d0992
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x14]
push edi
cdq
push esi
push edx
push eax
call fcn.005e5510
mov ecx, dword [esp + 0x24]
pop edi
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, ebx
pop esi
pop ebx
add esp, 0xc
ret 0x10
Function at 0x4d0a50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x320
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x31c], eax
push ebx
mov ebx, dword [esp + 0x32c]
push esi
mov esi, dword [esp + 0x32c]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4d0a87
xor eax, eax
jmp 0x4d0c02
push 0
lea eax, [esp + 0x1c]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov esi, eax
test esi, esi
je 0x4d0c00
cmp esi, 0x104
jb 0x4d0abb
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x4d0c00
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x4d0c00
push 0x104
lea edx, [esp + 0x120]
push edx
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4d0b14
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4d0b0d
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x4d0bf4
mov eax, dword [esp + 8]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x128]
push edx
push 0
push 0
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jge 0x4d0b6c
mov ecx, eax
and ecx, 0x1fff0000
cmp ecx, 0x70000
jne 0x4d0b5d
movzx edx, ax
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x4d0bf4
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x4d0bf4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov esi, eax
test esi, esi
jne 0x4d0b92
cmp byte [esp + 0x18], al
je 0x4d0b92
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4d0bc8
push edi
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, dword [esp + 0x338]
lea edi, [esi + 1]
cmp edi, eax
jbe 0x4d0bba
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, edi
jmp 0x4d0bc7
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
pop edi
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x4d0bf4
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push ecx
push eax
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0x324]
pop esi
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x320
ret 0xc
Function at 0x4d0ca0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x144
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x140], eax
cmp dword [esp + 0x14c], 0
push esi
mov esi, dword [esp + 0x154]
push edi
mov edi, dword [esp + 0x150]
jne 0x4d0d37
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4d0d3f
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4d0d3f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esi], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x18]
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x10], edx
mov edx, dword [esp + 0x24]
mov dword [esi + 0x20], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edx
mov eax, 1
jmp 0x4d0d41
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [esp + 0x148]
pop edi
pop esi
xor ecx, esp
call fcn.005dfbbe
add esp, 0x144
ret 0xc
Function at 0x4d1100
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x4c
push esi
mov esi, dword [esp + 0x54]
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x4d1122
mov eax, 0x200
pop esi
add esp, 0x4c
ret
mov eax, dword [esp + 0x1c]
push ebp
mov edx, eax
xor ebp, ebp
and edx, 1
je 0x4d1135
mov ebp, 1
test al, 2
je 0x4d113c
or ebp, 2
test al, 4
je 0x4d1143
or ebp, 4
mov ecx, eax
and ecx, 0x10
je 0x4d114d
or ebp, 0x10
test al, 0x20
je 0x4d1154
or ebp, 0x20
test ecx, ecx
je 0x4d1160
or ebp, 0x40000000
jmp 0x4d1166
or ebp, 0x80000000
or ebp, 0x1000000
test edx, edx
jne 0x4d1176
or ebp, 0x800000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0xc], eax
cmp eax, 0x28
jbe 0x4d1228
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push esi
call ebx
mov edx, 0x54ad
cmp word [esp + 0x10], dx
jne 0x4d1226
mov eax, dword [esp + 0x1c]
lea ecx, [eax + 0x34]
cmp dword [esp + 0x14], ecx
jbe 0x4d1226
push 0
push 0
push eax
push esi
call edi
push 0
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x2c]
push eax
push esi
call ebx
mov eax, dword [esp + 0x20]
cmp eax, 0x5a4d
je 0x4d1220
cmp eax, 0x454e
je 0x4d1220
cmp eax, 0x454c
je 0x4d1220
cmp eax, 0x4550
jne 0x4d1226
or ebp, 0x400000
pop edi
pop ebx
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x4d1232
mov dword [eax], ebp
mov eax, dword [esp + 0x60]
pop ebp
test eax, eax
je 0x4d1241
mov ecx, dword [esp + 8]
mov dword [eax], ecx
mov esi, dword [esp + 0x60]
test esi, esi
je 0x4d127c
push 0
mov eax, 0x8edc2e80
sub eax, 0xd53e8000
mov ecx, 0x1cad4a4
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
mov dword [esp + 0x28], 0
call fcn.005e5550
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov esi, dword [esp + 0x64]
test esi, esi
je 0x4d12b1
mov ecx, dword [esp + 0x34]
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 0x34]
lea eax, [esp + 8]
push eax
push ecx
push edx
call fcn.004d1000
movzx eax, word [esp + 0x14]
movzx ecx, word [esp + 0x18]
shl eax, 0x10
add esp, 0x10
or eax, ecx
mov dword [esi], eax
xor eax, eax
pop esi
add esp, 0x4c
ret
Function at 0x4d28e0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx]
movsx ecx, byte [esp + 8]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x645458]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x645458]
mov dword [edx + 8], ecx
ret

Function at 0x4d2930
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
push ebx
movsx ebx, byte [esp + 0xc]
push esi
push edi
mov edi, dword [edx]
mov eax, dword [edx + 8]
mov ecx, edi
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x645458]
shr edi, 8
xor ecx, edi
mov dword [edx], ecx
movzx ecx, cl
add ecx, dword [edx + 4]
mov esi, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x645458]
and esi, 0xfffd
mov dword [edx + 8], eax
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
pop edi
shr eax, 8
pop esi
xor eax, ebx
pop ebx
ret

Function at 0x4d2b40
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
cmp byte [esi + 0x2d], 0
mov eax, edi
je 0x4d2bc1
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4d2b71
cmp dword [esi + 0x40], ebx
jae 0x4d2b71
push eax
call fcn.005e132a
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x4d2b89
lea eax, [ebx + ebx]
push eax
call fcn.005ddec6
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
mov ecx, dword [esi + 0x3c]
push ebx
push edi
push ecx
call fcn.005e13c0
add esp, 0xc
xor edi, edi
test ebx, ebx
jbe 0x4d2bbe
push ebp
lea ebp, [esi + 0x30]
mov edx, dword [esi + 0x3c]
movzx eax, byte [edi + edx]
push eax
push ebp
call fcn.004d2930
mov ecx, dword [esi + 0x3c]
mov byte [edi + ecx], al
inc edi
add esp, 8
cmp edi, ebx
jb 0x4d2ba1
pop ebp
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x4d2bfa
mov ecx, dword [esi + 0x24]
lea edi, [ecx + ebx]
cmp edi, dword [esi + 0x28]
jb 0x4d2be2
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push ebx
push eax
add ecx, edx
push ecx
call fcn.005e13c0
add esp, 0xc
add dword [esi + 0x24], ebx
pop edi
pop esi
mov eax, ebx
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4d2c1b
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x4d2e80
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x78]
push edi
test ecx, ecx
je 0x4d2ed9
mov eax, dword [esi + 0x80]
mov edi, dword [esi + 0x7c]
cmp eax, edi
jae 0x4d2f23
mov edx, dword [esp + 0x14]
sub edi, eax
cmp edi, edx
jbe 0x4d2ea9
mov edi, edx
mov ebx, dword [esp + 0x10]
push edi
add eax, ecx
push eax
push ebx
call fcn.005e13c0
mov eax, dword [esi + 0x6c]
add dword [esi + 0x80], edi
add dword [esi + 0x68], edi
push edi
push ebx
push eax
call fcn.004d3ff0
add esp, 0x18
mov dword [esi + 0x6c], eax
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov eax, dword [esi + 0x70]
test eax, eax
je 0x4d2f1c
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4d2f23
mov edi, dword [esp + 0x14]
mov eax, dword [esi + 0x6c]
add dword [esi + 0x68], edi
push edi
push ebx
push eax
call fcn.004d3ff0
add esp, 0xc
mov dword [esi + 0x6c], eax
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov dword [esi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x4d3ff0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4d3ffb
xor eax, eax
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
push esi
not eax
cmp edx, 8
jb 0x4d40d9
mov esi, edx
shr esi, 3
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x645458]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x645458]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x645458]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x645458]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x645458]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x645458]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x645458]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x645458]
inc ecx
sub edx, 8
sub esi, 1
jne 0x4d4015
pop edi
test edx, edx
je 0x4d40fb
lea ecx, [ecx]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x645458]
inc ecx
sub edx, 1
jne 0x4d40e0
not eax
pop esi
ret

Function at 0x4d4100
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 8]
mov eax, ecx
and eax, 0xfffd
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
mov al, byte [esp + 0x10]
shr edx, 8
xor al, dl
mov edx, dword [esi]
push edi
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x645458]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x645458]
pop edi
mov dword [esi + 8], ecx
pop esi
pop ebx
ret

Function at 0x4d4580
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ebx
imul esi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x4d45c2
mov ecx, dword [esp + 0x10]
mov edx, dword [edi + 4]
push 0
lea eax, [esp + 0x18]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4d45b6
mov byte [edi + 8], 1
mov eax, dword [esp + 0x14]
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
lea edx, [ecx + esi]
cmp edx, eax
jbe 0x4d45d3
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
add eax, ecx
mov ecx, dword [esp + 0x10]
push esi
push eax
push ecx
call fcn.005e13c0
add dword [edi + 0x1c], esi
add esp, 0xc
pop edi
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
ret
Function at 0x4d5590
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
mov ebp, dword [esp + 0x218]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x220]
cmp ebp, ebx
je 0x4d5620
push 0x104
lea eax, [esp + 0x114]
push ebp
push eax
call fcn.005e2f3c
lea eax, [esp + 0x11c]
add esp, 0xc
lea edx, [eax + 1]
jmp 0x4d55e0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4d55e0
sub eax, edx
je 0x4d55fe
lea ecx, [esp + eax + 0x10f]
mov al, byte [ecx]
cmp al, 0x2f
je 0x4d55fc
cmp al, 0x5c
jne 0x4d55fe
mov byte [ecx], bl
lea ecx, [esp + 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4d5620
push ebx
lea edx, [esp + 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [edi]
cmp al, bl
je 0x4d56e2
push esi
mov esi, edi
mov ecx, edi
nop
cmp al, 0x2f
je 0x4d5638
cmp al, 0x5c
jne 0x4d563a
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
cmp al, bl
jne 0x4d5630
cmp esi, edi
je 0x4d566f
sub esi, edi
push esi
lea eax, [esp + 0x118]
push edi
push eax
call fcn.005e13c0
lea ecx, [esp + 0x120]
push ecx
push ebp
mov byte [esp + esi + 0x128], bl
call fcn.004d5590
add esp, 0x14
mov byte [esp + 0x10], bl
pop esi
cmp ebp, ebx
je 0x4d568b
push 0x104
lea edx, [esp + 0x10]
push ebp
push edx
call fcn.005e2f3c
add esp, 0xc
lea eax, [esp + 0xc]
mov byte [esp + 0x10f], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4d56a0
sub eax, edx
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x10]
push edi
push edx
call fcn.005e2f3c
add esp, 0xc
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x113], bl
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4d56e2
push ebx
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [esp + 0x214]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x20c
ret

Function at 0x4d5770
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 8], 0
test esi, esi
je 0x4d5793
cmp dword [esi], 0
jbe 0x4d5793
test edi, edi
je 0x4d5793
mov byte [edi], 0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 8]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4d57bf
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor al, al
pop esi
pop ecx
ret 0x14
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 8]
push esi
push edi
lea eax, [esp + 0x28]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 8]
test esi, esi
je 0x4d5804
test eax, eax
je 0x4d57f5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor al, al
pop esi
pop ecx
ret 0x14
test eax, eax
je 0x4d580f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov al, 1
pop esi
pop ecx
ret 0x14
Function at 0x4d5820
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
push 1
push 0
push ecx
push edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4d585e
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
add esp, 8
ret 0x10
mov ecx, dword [esp + 0x18]
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 4]
test esi, esi
je 0x4d58ad
test eax, eax
je 0x4d589d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop esi
add esp, 8
ret 0x10
test eax, eax
je 0x4d58b8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
add esp, 8
ret 0x10

Function at 0x4d58d0
Capabilities:
Delete registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp]
push eax
push 2
push 0
push ecx
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4d5902
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop ecx
ret 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp]
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
mov eax, dword [esp + 4]
test esi, esi
je 0x4d593d
test eax, eax
je 0x4d592f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop esi
pop ecx
ret 0xc
test eax, eax
je 0x4d5948
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
pop ecx
ret 0xc