joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c750
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, esi
push edi
xor edi, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x49c760
sub eax, edx
add eax, 1
push eax
call fcn.00443680
mov bl, byte [esi]
add esp, 4
test bl, bl
mov ebp, eax
mov edx, esi
mov ecx, ebp
je 0x49c868
mov al, 0x53
lea esp, [esp]
add edx, 1
cmp bl, 0x25
jne 0x49c7e4
cmp byte [edx], bl
jne 0x49c808
mov bl, byte [edx + 1]
cmp bl, 0x5a
jne 0x49c7ac
add edx, 2
jmp 0x49c845
cmp bl, 0x76
mov byte [ecx], 0x25
jne 0x49c7c2
add edx, 2
add ecx, 1
mov byte [ecx], 0x7c
jmp 0x49c842
add ecx, 1
cmp bl, al
jne 0x49c845
mov byte [ecx], 0x31
add ecx, 1
mov byte [ecx], al
mov bl, byte [edx + 2]
add edx, 2
add ecx, 1
mov byte [ecx], bl
add ecx, 1
add edx, 1
jmp 0x49c845
cmp bl, 0x5c
jne 0x49c808
cmp byte [edx], bl
jne 0x49c808
cmp byte [edx + 1], al
jne 0x49c808
mov byte [ecx], 0x25
add ecx, 1
mov byte [ecx], 0x2b
add ecx, 1
mov edi, 1
add edx, 2
jmp 0x49c845
cmp edi, 1
jne 0x49c821
cmp bl, 0x5e
jne 0x49c840
mov byte [ecx], 0x25
add ecx, edi
mov byte [ecx], 0x2d
mov edi, 2
jmp 0x49c842
cmp edi, 2
jne 0x49c840
cmp bl, 0x3b
je 0x49c830
cmp bl, 0xa
jne 0x49c840
mov byte [ecx], 0x25
add ecx, 1
mov byte [ecx], 0x23
add ecx, 1
xor edi, edi
jmp 0x49c845
mov byte [ecx], bl
add ecx, 1
mov bl, byte [edx]
test bl, bl
jne 0x49c790
test edi, edi
mov eax, ebp
je 0x49c86a
mov byte [ecx], 0x25
pop edi
add ecx, 1
mov byte [ecx], 0x23
pop esi
add ecx, 1
pop ebp
mov byte [ecx], bl
pop ebx
ret
mov eax, ebp
pop edi
pop esi
pop ebp
mov byte [ecx], 0
pop ebx
ret
Function at 0x4abbf0
Capabilities:
Write file on windows

Disassembly:
mov dword [esp + 0xc], str.Support_of_ASCII_PVG_not_yet_implemented_n
mov dword [esp + 8], 1
mov dword [esp + 4], 1
jmp fcn.00442f20

Function at 0x4abcc0
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
je 0x4abd6c
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x14]
push 0
push eax
push ecx
call fcn.00501924
or dword [esi + 4], 0x40
add esp, 0xc
cmp dword [esi + 0x30], 0
jne 0x4abcfe
push 0x2000
call fcn.00443680
add esp, 4
mov dword [esi + 0x30], eax
cmp dword [esi + 0x34], 0
jne 0x4abd14
push 0x2000
call fcn.00443680
add esp, 4
mov dword [esi + 0x34], eax
push 0x38
push 1
call fcn.004436f0
push 0x38
push 0x54eef8
push eax
mov dword [esi + 0x1c], eax
call fcn.004f9b40
add esp, 0x14
test eax, eax
je 0x4abd5f
mov edx, dword [esi + 0x1c]
push edx
call fcn.00418550
mov eax, dword [esi]
push eax
push str.Failed_to_initialize_compress_for_file___s__n
push 1
push 0x7d0
mov dword [esi + 0x1c], 0
call fcn.00442f20
add esp, 0x14
pop edi
pop esi
pop ebx
ret
mov ecx, dword [esp + 0x18]
pop edi
mov dword [esi + 0x2c], ecx
pop esi
xor eax, eax
pop ebx
ret
mov edx, dword [esi + 0x14]
push edx
push 2
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.00501672
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x14]
push 0
push ecx
push edx
call fcn.00501924
mov eax, dword [esp + 0x30]
add esp, 0x1c
cmp al, 0x1f
jne 0x4abe9c
cmp ah, 0x8b
jne 0x4abe9c
mov eax, dword [esi + 4]
test al, 0x10
mov ebx, 0x54ef30
jne 0x4abdb6
mov ebx, 0x54ef34
and eax, 0x10000
jne 0x4abde1
cmp dword [esi + 8], 0
jne 0x4abde1
mov eax, dword [esi + 0x14]
push eax
call fcn.0042d717
mov ecx, dword [esi]
push ebx
push ecx
mov dword [esi + 0x14], 0
call fcn.004fb9b0
add esp, 0xc
jmp 0x4abe5a
test eax, eax
je 0x4abdf9
mov edx, dword [esi + 0x14]
push edx
call fcn.00423fbb
push eax
call fcn.00503a98
add esp, 8
jmp 0x4abe23
mov eax, dword [esi + 0x14]
push eax
call fcn.0042d717
mov ecx, dword [esi + 4]
mov edx, dword [esi]
shl ecx, 0xb
not ecx
and ecx, 0x8000
push ecx
push edx
mov dword [esi + 0x14], 0
call fcn.005037a2
add esp, 0xc
mov edi, eax
test edi, edi
jge 0x4abe44
mov eax, dword [esi]
push eax
push 0x54ef38
push 1
push 0x7d1
call fcn.00442f20
add esp, 0x10
pop edi
pop esi
pop ebx
ret
mov ecx, dword [esi + 8]
push 0
push ecx
push edi
call fcn.00502fa7
push ebx
push edi
call fcn.004fb9d0
add esp, 0x14
test eax, eax
mov dword [esi + 0x18], eax
jne 0x4abe7c
mov edx, dword [esi]
push edx
push 0x54ef54
push 1
push 0x7d2
call fcn.00442f20
add esp, 0x10
pop edi
pop esi
pop ebx
ret
or dword [esi + 4], 0x40
cmp dword [esi + 0x30], 0
jne 0x4abea0
push 0x2000
call fcn.00443680
add esp, 4
pop edi
mov dword [esi + 0x30], eax
pop esi
xor eax, eax
pop ebx
ret
and dword [esi + 4], 0xffffffbf
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4ac0e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
sub esp, 0x80
test byte [eax + 4], 0x40
je 0x4ac107
push 1
push ecx
push eax
call fcn.004abeb0
add esp, 0xc
add esp, 0x80
ret
test ecx, 0xffffff80
je 0x4ac125
mov edx, dword [eax + 0x14]
push 1
push ecx
push edx
call fcn.00501924
add esp, 0xc
add esp, 0x80
ret
mov eax, dword [eax + 0x14]
push eax
push 1
push ecx
lea ecx, [esp + 0xc]
push ecx
call fcn.00501672
sub eax, 1
add esp, 0x10
neg eax
sbb eax, eax
add esp, 0x80
ret
Function at 0x4b0c30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
lea ebx, [ebx]
mov eax, dword [esi + 8]
push eax
call fcn.004c2c50
add eax, 0xffffffff
add esp, 4
cmp eax, 3
ja case.default.0x4b0c58
jmp dword [eax*4 + 0x4b0d78]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x5c]
cmp ecx, 0x29
je 0x4b0d00
cmp ecx, 0x2d
je 0x4b0ce1
cmp ecx, 0x30
je 0x4b0c94
push 0
push 0
push eax
call fcn.004c26b0
push esi
call fcn.004b05a0
add esp, 0x10
test eax, eax
jg 0x4b0c40
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 0x78]
lea ecx, [esp + 8]
push ecx
push esi
mov ebx, 6
call fcn.004b0630
add esp, 8
test eax, eax
jle 0x4b0d72
fld qword [esp + 8]
fstp dword [edi + 0x2c]
fld qword [esp + 0x10]
fstp dword [edi + 0x30]
fld qword [esp + 0x18]
fstp dword [edi + 0x34]
fld qword [esp + 0x20]
fstp dword [edi + 0x38]
fld qword [esp + 0x28]
fstp dword [edi + 0x3c]
fld qword [esp + 0x30]
fstp dword [edi + 0x40]
jmp 0x4b0c40
mov eax, dword [eax + 0x78]
mov edx, dword [0x5426d0]
push 0
push eax
push 2
push edx
call fcn.0046f880
add esp, 0x10
mov dword [edi + 0x24], eax
jmp 0x4b0c40
mov eax, dword [eax + 0x78]
push eax
call fcn.004185f4
add esp, 4
cmp eax, 0xffff
ja 0x4b0d1c
mov word [edi + 0x22], ax
jmp 0x4b0c40
push eax
push str.Shape_source_index_out_of_range___d__n
push 1
push 0x2be2
call fcn.00442f20
add esp, 0x10
jmp 0x4b0c40
mov ecx, dword [esi + 8]
push 0
push 0
push ecx
jmp 0x4b0c7d
mov edx, dword [esi + 8]
cmp dword [edx + 0x5c], 8
je 0x4b0d58
mov eax, dword [esi + 8]
push 8
push 2
jmp 0x4b0c7c
mov eax, dword [esi + 0x24]
test al, 2
je 0x4b0d6d
mov ecx, dword [esi + 4]
push eax
push edi
push ecx
call fcn.00442790
add esp, 0xc
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b22a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push esi
push 0x64
lea eax, [esp + 8]
push 0
push eax
call fcn.00418060
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x84]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x20], eax
mov eax, dword [eax + 0xfc]
push 2
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x20], eax
call fcn.0046e350
push 0x551118
push 0
push 0
push esi
call fcn.004c30e0
add esp, 0x20
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4b231f
push esi
push str.Failed_to_open_ascii_PVS_file___s__n
push 1
push 0x2bca
call fcn.00442f20
add esp, 0x10
xor eax, eax
pop esi
add esp, 0x64
ret
push edi
push eax
call fcn.004c2c50
add esp, 4
cmp eax, 1
mov eax, dword [esp + 0x10]
jne 0x4b23a0
cmp dword [eax + 0x5c], 0x1d
jne 0x4b23a0
lea eax, [esp + 8]
call fcn.004b20d0
mov esi, dword [esp + 0x30]
add esi, 0xffffffff
mov edi, eax
mov eax, dword [esp + 0x3c]
js 0x4b236b
cmp dword [eax + esi*4], 0
je 0x4b2366
mov ecx, dword [eax + esi*4]
push ecx
call fcn.00418550
mov eax, dword [esp + 0x40]
add esp, 4
sub esi, 1
jns 0x4b2350
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x4b2380
push ecx
call fcn.00418550
mov eax, dword [esp + 0x40]
add esp, 4
test eax, eax
je 0x4b238d
push eax
call fcn.00418550
add esp, 4
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4b23af
push eax
call fcn.00418550
add esp, 4
jmp 0x4b23af
push 0x1d
push 1
push eax
call fcn.004c26b0
add esp, 0xc
xor edi, edi
mov edx, dword [esp + 0x10]
push edx
call fcn.004ac150
add esp, 4
mov eax, edi
pop edi
pop esi
add esp, 0x64
ret
Function at 0x4c3440
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
mov ebx, edi
imul ebx, ebp
test ebx, ebx
jl 0x4c35b6
je 0x4c35bd
cmp ebp, 1
jle 0x4c3578
mov eax, dword [esp + 0x10]
test dword [eax + 4], 0x20000
je 0x4c3578
cmp ebx, dword [0x56ec48]
mov eax, dword [0x56ec4c]
push esi
mov esi, dword [esp + 0x20]
jle 0x4c34ab
test eax, eax
je 0x4c3497
push eax
call fcn.00418550
add esp, 4
push ebx
mov dword [0x56ec48], ebx
call fcn.00443680
add esp, 4
mov dword [0x56ec4c], eax
cmp ebp, 2
mov ecx, eax
jne 0x4c34df
sub edi, 1
js 0x4c3575
jmp 0x4c34c0
movzx edx, byte [esi]
add esi, 1
mov byte [ecx + 1], dl
movzx edx, byte [esi]
mov byte [ecx], dl
add esi, 1
add ecx, 2
sub edi, 1
jns 0x4c34c0
pop esi
jmp 0x4c357c
cmp ebp, 4
jne 0x4c351e
sub edi, 1
js 0x4c3575
lea ecx, [eax + 2]
movzx edx, byte [esi]
add esi, 1
mov byte [ecx + 1], dl
movzx edx, byte [esi]
add esi, 1
mov byte [ecx], dl
movzx edx, byte [esi]
add esi, 1
mov byte [ecx - 1], dl
movzx edx, byte [esi]
mov byte [ecx - 2], dl
add esi, 1
add ecx, 4
sub edi, 1
jns 0x4c34f0
pop esi
jmp 0x4c357c
sub edi, 1
js 0x4c3575
lea ecx, [eax + 6]
movzx edx, byte [esi]
add esi, 1
mov byte [ecx + 1], dl
movzx edx, byte [esi]
add esi, 1
mov byte [ecx], dl
movzx edx, byte [esi]
add esi, 1
mov byte [ecx - 1], dl
movzx edx, byte [esi]
add esi, 1
mov byte [ecx - 2], dl
movzx edx, byte [esi]
add esi, 1
mov byte [ecx - 3], dl
movzx edx, byte [esi]
add esi, 1
mov byte [ecx - 4], dl
movzx edx, byte [esi]
add esi, 1
mov byte [ecx - 5], dl
movzx edx, byte [esi]
mov byte [ecx - 6], dl
add esi, 1
add ecx, 8
sub edi, 1
jns 0x4c3526
pop esi
jmp 0x4c357c
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
add dword [ecx + 0x28], ebx
test byte [ecx + 4], 0x40
je 0x4c3599
push ebx
push eax
mov eax, dword [ecx + 0x18]
push eax
call fcn.004fb520
add esp, 0xc
jmp 0x4c35a9
mov ecx, dword [ecx + 0x14]
push ecx
push ebx
push 1
push eax
call fcn.00500e5f
add esp, 0x10
sub ebx, eax
test ebx, ebx
je 0x4c35bd
mov eax, dword [esp + 0x10]
sub dword [eax + 0x28], ebx
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
ret
pop edi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4cf460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x48
mov eax, dword [esp + 0x50]
fld dword [0x55f460]
xor ecx, ecx
fstp dword [esp + 4]
cmp dword [eax + 0x14], ecx
mov dword [esp], ecx
je 0x4cf481
xor eax, eax
add esp, 0x48
ret
push ebx
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x4cf58d
push ebp
push esi
push edi
mov ebp, 1
mov eax, dword [ebx + 8]
push ebp
push eax
call fcn.004b3f30
mov edi, eax
add esp, 8
test edi, edi
je 0x4cf564
lea esp, [esp]
fld dword [0x5110c8]
mov esi, dword [edi + 4]
fld dword [esp + 0x5c]
fucom st(1)
fnstsw ax
fstp st(1)
test ah, 0x44
jnp 0x4cf4dc
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx + 4]
fld dword [edx + 8]
fucompp
fnstsw ax
test ah, 0x44
jp 0x4cf550
jmp 0x4cf4de
fstp st(0)
cmp dword [esi + 0x2c], 0
jne 0x4cf550
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esi + 0x18]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [eax + 4]
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esi + 0x14]
mov eax, dword [edx + 4]
add ecx, 8
push ecx
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 4]
add eax, 8
push eax
add edx, 8
push edx
call fcn.004cefc0
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
add esp, 0x18
fld dword [0x55f460]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x4cf54b
fld dword [esp + 0x14]
add dword [esp + 0x10], ebp
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x4cf54b
fstp dword [esp + 0x14]
mov dword [esp + 0x18], esi
jmp 0x4cf54d
fstp st(0)
mov dword [esi + 0x2c], ebp
push ebp
push edi
call fcn.004b3f50
mov edi, eax
add esp, 8
test edi, edi
jne 0x4cf4b0
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4cf495
mov ecx, dword [esp + 0x10]
test ecx, ecx
pop edi
pop esi
pop ebp
je 0x4cf58d
mov eax, dword [esp + 0x58]
fld dword [esp + 8]
mov edx, dword [esp + 0x5c]
fstp dword [eax]
mov eax, dword [esp + 0xc]
mov dword [edx], eax
mov eax, ecx
pop ebx
add esp, 0x48
ret
Function at 0x4d5cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [edi + 0x2c]
add esi, 1
cmp esi, 4
jge 0x4d5cd7
pop esi
or eax, 0xffffffff
pop ebp
ret
mov eax, esi
shl eax, 4
push ebx
push eax
call fcn.00443680
mov ebx, dword [esp + 0x14]
mov ecx, dword [ebx + 0x24]
mov dword [ecx + ebp*4], esi
mov edx, dword [ebx + 0x28]
mov dword [edx + ebp*4], eax
mov cl, byte [edi + 0x34]
mov esi, dword [edi + 0x28]
movzx edx, cl
shl edx, 4
add edx, esi
xor cl, 1
add esp, 4
fld qword [edx + 8]
fstp qword [eax]
fld qword [edx + 0x10]
movzx edx, cl
fstp qword [eax + 8]
mov ecx, edx
shl ecx, 4
add ecx, esi
fld qword [ecx + 8]
fstp qword [eax + 0x10]
fld qword [ecx + 0x10]
fstp qword [eax + 0x18]
mov ecx, dword [esi + edx*4 + 0x28]
cmp ecx, dword [edi + 0x28]
je 0x4d5d63
add eax, 0x20
mov dl, byte [edx + esi + 0x34]
xor dl, 1
movzx edx, dl
mov ebx, edx
shl ebx, 4
add ebx, ecx
mov esi, ecx
add eax, 0x10
fld qword [ebx + 8]
fstp qword [eax - 0x10]
fld qword [ebx + 0x10]
fstp qword [eax - 8]
mov ecx, dword [ecx + edx*4 + 0x28]
cmp ecx, dword [edi + 0x28]
jne 0x4d5d34
mov ebx, dword [esp + 0x10]
fld qword [edi + 8]
mov edx, dword [ebx + 0x20]
shl ebp, 5
fstp qword [edx + ebp]
mov eax, dword [ebx + 0x20]
fld qword [edi + 0x10]
add eax, ebp
fstp qword [eax + 0x10]
pop ebx
fld qword [edi + 0x18]
pop esi
fstp qword [eax + 8]
pop ebp
fld qword [edi + 0x20]
fstp qword [eax + 0x18]
xor eax, eax
ret
Function at 0x4ddd90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [0x56ef6c]
add eax, 1
push esi
push eax
mov dword [esp + 8], 1
call fcn.004edc60
mov dword [esp + 0x10], eax
call fcn.004da510
push 0
mov dword [0x56f45c], eax
mov dword [0x56f464], eax
mov dword [0x56f458], eax
call fcn.004dc3a0
mov dword [0x56f484], eax
mov dword [0x56f488], eax
mov dword [0x56f480], eax
mov eax, dword [esp + 0x1c]
add esp, 8
test eax, eax
je 0x4dde6e
push ebx
push ebp
mov ebp, dword [eax + 4]
push edi
lea esi, [eax + 4]
push eax
xor edi, edi
call fcn.004ed330
mov ebx, eax
add esp, 4
test ebx, ebx
jle 0x4dde6b
mov dword [esp + 0x14], esi
call fcn.004da510
mov ecx, dword [esp + 0x20]
push 0
push edi
push ebx
push ecx
mov esi, eax
call fcn.004ed8a0
mov edx, dword [esp + 0x20]
shl edx, 0xb
xor edx, dword [esi + 0x3c]
push esi
and edx, 0x800
xor dword [esi + 0x3c], edx
mov dword [esi + 0x20], eax
call fcn.004d9d60
or dword [esi + 0x3c], 0x200
push ebp
call fcn.004d9dd0
lea eax, [esp + 0x30]
push esi
push eax
call fcn.004edb10
mov eax, dword [esp + 0x34]
xor dword [esp + 0x30], 1
mov ebp, dword [eax + 4]
add eax, 4
add edi, 1
add esp, 0x20
cmp edi, ebx
mov dword [esp + 0x14], eax
jl 0x4dde05
pop edi
pop ebp
pop ebx
mov eax, dword [0x56f464]
mov esi, eax
test esi, esi
je 0x4ddec5
jmp 0x4dde85
mov eax, dword [0x56f464]
cmp dword [esi + 0x1c], 0
je 0x4ddec5
test eax, eax
je 0x4ddeac
xor ecx, ecx
cmp dword [eax + 0x1c], 0
je 0x4ddeac
cmp eax, esi
je 0x4ddea5
mov edx, dword [esi + 0x28]
mov dword [edx + ecx + 4], eax
add ecx, 4
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x4dde91
mov eax, dword [0x56ef6c]
mov ecx, dword [esi + 0x28]
push eax
push ecx
call fcn.004ed4b0
mov esi, dword [esi + 0x1c]
add esp, 8
test esi, esi
jne 0x4dde80
lea edx, [esp + 0xc]
push edx
call fcn.004eddc0
add esp, 4
cmp dword [0x56ede8], 1
pop esi
jl 0x4ddeef
mov eax, dword [0x56f444]
push str.qh_createsimplex:_created_simplex_n
push eax
call fcn.005012b6
add esp, 8
add esp, 0xc
ret
Function at 0x4f7eb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov dword [edx], 0x12345678
mov dword [edx + 4], 0x23456789
mov dword [edx + 8], 0x34567890
movzx ecx, byte [esi]
test cl, cl
je 0x4f7f15
mov edi, edi
mov eax, dword [edx]
xor ecx, eax
and ecx, 0xff
mov ecx, dword [edi + ecx*4]
shr eax, 8
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [edi + eax*4]
add esi, 1
mov dword [edx + 8], ecx
mov cl, byte [esi]
test cl, cl
jne 0x4f7ed0
pop esi
ret
Function at 0x4f8ae0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esi + 0x4090], 0
je 0x4f8b99
cmp dword [esi + 0x6c], 0
jbe 0x4f8b99
push ebx
push ebp
mov ebx, 0xffffff78
push edi
lea edi, [esi + 0x88]
sub ebx, esi
jmp 0x4f8b10
movzx ecx, byte [edi]
mov eax, dword [esi + 0x4094]
mov ebp, dword [esi + 0x40a0]
xor ecx, eax
mov edx, dword [esi + 0x409c]
shr eax, 8
and ecx, 0xff
mov ecx, dword [ebp + ecx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 0x4098]
mov dword [esi + 0x4094], ecx
mov ecx, dword [esi + 0x409c]
imul eax, eax, 0x8088405
add eax, 1
mov dword [esi + 0x4098], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
and edx, 0xfffd
shr ecx, 8
xor ecx, dword [ebp + eax*4]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
mov dword [esi + 0x409c], ecx
shr eax, 8
xor byte [edi], al
add edi, 1
lea ecx, [ebx + edi]
cmp ecx, dword [esi + 0x6c]
jb 0x4f8b10
pop edi
pop ebp
pop ebx
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x20]
push edx
mov edx, dword [esi + 0x1c]
lea eax, [esi + 0x88]
push eax
mov eax, dword [esi + 8]
push ecx
push edx
call eax
add esp, 0x10
cmp eax, dword [esi + 0x6c]
mov dword [esi + 0x6c], 0
je 0x4f8bc4
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x4fb2a0
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
jne 0x4fb2f3
cmp dword [esi + 4], 0
jne 0x4fb2fc
call fcn.0041d95a
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call fcn.00501672
add esp, 0x10
test eax, eax
mov dword [esi + 4], eax
jne 0x4fb2f7
mov edx, dword [esi + 0x40]
push edx
mov dword [esi + 0x3c], 1
call fcn.0050283c
add esp, 4
test eax, eax
je 0x4fb2f3
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
add dword [esi + 4], 0xffffffff
mov cl, byte [eax]
add eax, 1
mov dword [esi], eax
movzx eax, cl
ret

Function at 0x4fb310
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, eax
push edi
mov edi, dword [esi + 4]
cmp edi, 2
jae 0x4fb385
test edi, edi
je 0x4fb329
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov dl, byte [eax]
mov byte [ecx], dl
call fcn.0041d95a
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, edi
push eax
mov eax, dword [esi + 0x44]
mov edx, 0x4000
sar edx, cl
add eax, edi
push edx
push 1
push eax
call fcn.00501672
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4fb36f
mov ecx, dword [esi + 0x40]
push ecx
call fcn.0050283c
add esp, 4
test eax, eax
je 0x4fb36f
mov dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
cmp eax, 2
mov edx, dword [esi + 0x44]
mov dword [esi], edx
jae 0x4fb385
pop edi
mov dword [esi + 0x58], eax
pop esi
ret
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x4fb45e
cmp byte [eax + 1], 0x8b
jne 0x4fb45e
add dword [esi + 4], 0xfffffffe
add eax, 2
push ebx
mov dword [esi], eax
call fcn.004fb2a0
mov edi, eax
call fcn.004fb2a0
cmp edi, 8
mov ebx, eax
jne 0x4fb453
test bl, 0xe0
jne 0x4fb453
mov edi, 6
lea esp, [esp]
call fcn.004fb2a0
sub edi, 1
jne 0x4fb3d0
test bl, 4
je 0x4fb403
call fcn.004fb2a0
mov edi, eax
call fcn.004fb2a0
shl eax, 8
add edi, eax
mov eax, edi
sub edi, 1
test eax, eax
je 0x4fb403
call fcn.004fb2a0
cmp eax, 0xffffffff
jne 0x4fb3f0
test bl, 8
je 0x4fb416
call fcn.004fb2a0
test eax, eax
je 0x4fb416
cmp eax, 0xffffffff
jne 0x4fb408
test bl, 0x10
je 0x4fb42e
jmp 0x4fb420
call fcn.004fb2a0
test eax, eax
je 0x4fb42e
cmp eax, 0xffffffff
jne 0x4fb420
test bl, 2
je 0x4fb442
mov edi, 2
call fcn.004fb2a0
sub edi, 1
jne 0x4fb438
mov ecx, dword [esi + 0x3c]
neg ecx
sbb ecx, ecx
pop ebx
and ecx, 0xfffffffd
pop edi
mov dword [esi + 0x38], ecx
pop esi
ret
pop ebx
pop edi
mov dword [esi + 0x38], 0xfffffffd
pop esi
ret
pop edi
mov dword [esi + 0x58], 1
pop esi
ret
Function at 0x4fb520
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4fb5cb
cmp byte [esi + 0x5c], 0x77
jne 0x4fb5cb
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
test edi, edi
mov dword [esi], ebp
mov dword [esi + 4], edi
je 0x4fb5b1
lea ebx, [ebx]
cmp dword [esi + 0x10], 0
jne 0x4fb57a
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call fcn.00500e5f
add esp, 0x10
cmp eax, 0x4000
jne 0x4fb5aa
mov dword [esi + 0x10], eax
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x10]
add dword [esi + 0x64], edx
add dword [esi + 0x68], eax
push 0
push esi
call fcn.004fbe90
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
sub dword [esi + 0x64], ecx
sub dword [esi + 0x68], edx
add esp, 8
test eax, eax
mov dword [esi + 0x38], eax
jne 0x4fb5b1
test ecx, ecx
jne 0x4fb550
jmp 0x4fb5b1
mov dword [esi + 0x38], 0xffffffff
mov eax, dword [esi + 0x4c]
push edi
push ebp
push eax
call fcn.004fdac0
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, edi
sub eax, dword [esi + 4]
pop edi
pop ebp
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret

Function at 0x4fb5e0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x4fb696
cmp byte [esi + 0x5c], 0x77
jne 0x4fb696
mov dword [esi + 4], ebx
push edi
lea esp, [esp]
mov edi, 0x4000
sub edi, dword [esi + 0x10]
je 0x4fb62e
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call fcn.00500e5f
add esp, 0x10
cmp eax, edi
jne 0x4fb68c
mov edx, dword [esi + 0x48]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x4000
test ebx, ebx
jne 0x4fb67a
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push ecx
push esi
call fcn.004fbe90
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
add esp, 8
test edi, edi
mov dword [esi + 0x38], eax
jne 0x4fb65b
cmp eax, 0xfffffffb
jne 0x4fb65b
mov dword [esi + 0x38], edi
test ecx, ecx
jne 0x4fb669
cmp dword [esi + 0x38], 1
je 0x4fb669
xor ebx, ebx
jmp 0x4fb66e
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x4fb600
cmp eax, 1
je 0x4fb600
mov esi, dword [esi + 0x38]
mov eax, esi
sub eax, 1
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x502d59
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x502d8a
call fcn.0041d96d
mov dword [eax], esi
call fcn.0041d95a
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0041be53
add esp, 0x14
push 0x16
pop eax
jmp 0x502ddf
test dword [ebp + 0xc], 0xfffffff9
jne 0x502d66
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x502db7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041d980
pop ecx
call fcn.0041d95a
mov eax, dword [eax]
jmp 0x502ddf
test al, 0x10
jne 0x502ddd
test al, 1
je 0x502ddd
test byte [ebp + 0xc], 2
je 0x502ddd
call fcn.0041d96d
mov dword [eax], 5
call fcn.0041d95a
mov dword [eax], 0xd
jmp 0x502dae
xor eax, eax
pop esi
pop ebp
ret