joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495090
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov dword [esp + 0x18], edx
mov edi, ecx
cmp dword [ebx], 0
mov dword [esp + 0x10], 0
jne 0x495237
cmp byte [edi + 1], 0
jne 0x4951e3
mov esi, dword [ebp + 0xc]
movzx eax, word [edi + 0x10]
lea ecx, [esi + 2]
cmp ecx, eax
jg 0x4951e3
mov ecx, dword [edi + 0x44]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x4950ed
call fcn.0048b240
jmp 0x4950f2
call fcn.0048b090
test eax, eax
je 0x4950ff
mov dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x38]
mov edx, esi
movzx ecx, word [edi + 0xe]
mov dword [esp + 0x14], eax
movzx eax, word [edi + 0x12]
lea eax, [ecx + eax*2]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
lea eax, [ecx + eax*2]
mov ecx, edi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
call fcn.0048fd80
add esp, 4
test eax, eax
jne 0x4950f6
mov ecx, dword [esp + 0x10]
mov eax, 0xfffe
mov edx, dword [esp + 0x14]
sub eax, esi
inc word [edi + 0x12]
add word [edi + 0x10], ax
push esi
push dword [ebp + 8]
lea esi, [edx + ecx]
push esi
call fcn.0052e420
mov ecx, dword [ebp + 0x14]
add esp, 0xc
test ecx, ecx
je 0x49517d
mov eax, ecx
mov byte [esi + 3], cl
shr eax, 0x18
mov byte [esi], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 1], al
mov eax, ecx
shr eax, 8
mov byte [esi + 2], al
mov esi, dword [esp + 0x14]
add esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
push eax
lea eax, [esi + 2]
push esi
push eax
call fcn.0052ac20
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov edx, dword [esp + 0x14]
mov eax, ecx
mov byte [esi + 1], cl
sar eax, 8
mov byte [esi], al
movzx ecx, byte [edi + 6]
movzx eax, byte [edi + 0x13]
mov byte [ecx + edx + 3], al
movzx ecx, byte [edi + 6]
movzx eax, byte [edi + 0x12]
mov byte [ecx + edx + 4], al
mov eax, dword [edi + 0x34]
cmp byte [eax + 0x11], 0
je 0x495237
mov edx, dword [ebp + 8]
mov ecx, edi
push ebx
call fcn.0048fa00
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4951ff
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.0052e420
mov edx, dword [esp + 0x24]
add esp, 0xc
jmp 0x495202
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x495223
mov eax, ecx
mov byte [esi + 3], cl
shr eax, 0x18
mov byte [esi], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 1], al
mov eax, ecx
shr eax, 8
mov byte [esi + 2], al
mov al, byte [edi + 1]
movzx ecx, al
inc al
mov byte [edi + 1], al
mov dword [edi + ecx*4 + 0x20], esi
mov word [edi + ecx*2 + 0x16], dx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x496ff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x5c2b80]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov ebx, ecx
push esi
push edi
xor edi, edi
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0x24]
mov eax, 0xaaaaaaab
add edx, edx
mul edx
shr edx, 1
xor ecx, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
jmp 0x497030
movsx ecx, word [ebx + 0x4c]
mov dword [esp + 0x20], ecx
mov esi, dword [ebx + ecx*4 + 0x78]
test ecx, ecx
jne 0x49706e
cmp byte [esi + 1], cl
je 0x4971c8
lea edx, [ebx + 0x7c]
mov ecx, esi
call fcn.00496eb0
mov edi, eax
test edi, edi
jne 0x4971c8
mov edx, dword [esp + 0x18]
mov dword [ebx + 0x4c], 1
mov word [ebx + 0x50], ax
jmp 0x497030
cmp byte [esi + 1], 0
jne 0x497080
movzx eax, word [esi + 0x10]
cmp eax, edx
jle 0x4971c8
mov edi, dword [ebx + ecx*4 + 0x74]
movzx eax, word [ebx + ecx*2 + 0x4c]
mov dword [esp + 0xc], eax
mov ecx, dword [edi + 0x44]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x4970a8
call fcn.0048b240
jmp 0x4970ad
call fcn.0048b090
mov dword [esp + 0x10], eax
test eax, eax
jne 0x49713e
cmp byte [esi + 3], al
je 0x4970f5
cmp byte [esi + 1], 1
jne 0x4970f5
mov ax, word [esi + 0x16]
cmp ax, word [esi + 0x12]
jne 0x4970f5
cmp dword [edi + 0x48], 1
je 0x4970f5
movzx eax, word [edi + 0x12]
cmp eax, dword [esp + 0xc]
jne 0x4970f5
lea eax, [esp + 0x24]
mov edx, esi
push eax
mov ecx, edi
call fcn.00495b30
add esp, 4
mov dword [esp + 0x10], eax
jmp 0x49713e
mov eax, dword [ebx + 4]
mov ecx, dword [eax + 0x20]
call fcn.00485b00
movzx ecx, byte [ebx + 0x4a]
mov edx, dword [esp + 0xc]
push ecx
xor ecx, ecx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x24], 1
sete cl
push ecx
push eax
mov ecx, edi
call fcn.00495db0
mov dword [esp + 0x1c], eax
add esp, 0xc
mov eax, dword [esp + 0x14]
test eax, eax
je 0x497136
mov ecx, eax
call fcn.00485c20
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov ecx, dword [esi + 0x44]
mov byte [esi + 1], 0
test byte [ecx + 0x18], 0x40
mov esi, dword [ecx + 0x10]
mov dword [esp + 0xc], esi
je 0x497196
dec dword [esi + 0x78]
mov eax, dword [esi + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x14]
mov eax, dword [eax + 0x98]
dec ecx
mov esi, dword [esi + 0x3c]
cdq
push edx
push eax
mov edi, dword [esi]
push 0
push ecx
call fcn.00530230
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
mov esi, dword [esp + 0x1c]
add esp, 0x10
jmp 0x49719b
call fcn.00485670
cmp dword [esi + 0x78], 0
jne 0x4971b4
mov eax, dword [esi + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x4971b4
mov ecx, esi
call fcn.00488090
dec word [ebx + 0x4c]
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
test edi, edi
je 0x497030
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4971d5
call fcn.00485c20
mov ecx, dword [esp + 0x34]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052ab62
mov esp, ebp
pop ebp
ret
Function at 0x4979d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x18], ebx
cmp edx, dword [ebx + 0x2c]
jbe 0x497a0c
push 0x599054
push 0xecb9
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.0047f120
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00490560
add esp, 8
test eax, eax
jne 0x497b87
mov esi, dword [esp + 0x14]
xor ecx, ecx
mov dword [esp + 0x14], ecx
movzx edi, byte [esi + 6]
mov dword [esp + 0x1c], edi
cmp ax, word [esi + 0x12]
jae 0x497acf
nop
mov eax, dword [esi + 0x40]
movzx edi, byte [eax + ecx*2]
movzx eax, byte [eax + ecx*2 + 1]
shl edi, 8
or edi, eax
movzx eax, word [esi + 0x14]
and edi, eax
add edi, dword [esi + 0x38]
cmp byte [esi + 5], 0
jne 0x497a97
movzx edx, byte [edi]
mov ecx, ebx
movzx eax, byte [edi + 1]
push dword [ebp + 0xc]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 3]
shl edx, 8
or edx, eax
push 1
call fcn.004979d0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x497b7d
lea eax, [esp + 0x10]
mov edx, edi
push eax
mov ecx, esi
call fcn.004949e0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x497b7d
mov ecx, dword [esp + 0x14]
movzx eax, word [esi + 0x12]
inc ecx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
cmp ecx, eax
jl 0x497a40
mov edi, dword [esp + 0x1c]
cmp byte [esi + 5], 0
jne 0x497b10
mov ecx, dword [esi + 0x38]
push dword [ebp + 0xc]
add ecx, edi
push 1
movzx edx, byte [ecx + 8]
movzx eax, byte [ecx + 9]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xa]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xb]
shl edx, 8
mov ecx, ebx
or edx, eax
call fcn.004979d0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x497b7d
jmp 0x497b1d
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x497b1d
movzx eax, word [esi + 0x12]
add dword [ecx], eax
cmp dword [ebp + 8], 0
je 0x497b46
push dword [esi + 0x48]
mov ecx, dword [esi + 0x34]
mov edx, esi
call fcn.00494640
mov ecx, dword [esi + 0x44]
add esp, 4
mov ebx, eax
call fcn.0048ae10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x44]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x497b61
call fcn.0048b240
jmp 0x497b66
call fcn.0048b090
mov ebx, eax
test ebx, ebx
jne 0x497b7d
mov eax, dword [esi + 0x38]
mov ecx, esi
movzx edx, byte [eax + edi]
or edx, 8
call fcn.00490440
mov ecx, dword [esi + 0x44]
call fcn.0048ae10
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497fb0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov eax, edx
xorps xmm0, xmm0
mov dword [esp + 0x20], eax
push edi
movlpd qword [esp + 0x18], xmm0
cmp dword [esi + 0x3c], 0
jne 0x497fe9
mov dword [eax], 0
mov dword [eax + 4], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004932f0
test eax, eax
jne 0x498196
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jmp 0x498010
movsx ecx, word [esi + 0x4c]
mov edi, dword [esi + ecx*4 + 0x78]
mov bl, byte [edi + 5]
test bl, bl
jne 0x498024
cmp byte [edi + 2], bl
jne 0x498031
movzx eax, word [edi + 0x12]
cdq
add dword [esp + 0x10], eax
adc dword [esp + 0x14], edx
test bl, bl
je 0x498100
lea esp, [esp]
movzx eax, word [esi + 0x4c]
test ax, ax
je 0x49817e
cwde
mov ecx, dword [esi + eax*4 + 0x78]
test ecx, ecx
je 0x4980c8
mov ecx, dword [ecx + 0x44]
test byte [ecx + 0x18], 0x40
mov ebx, dword [ecx + 0x10]
mov dword [esp + 0x18], ebx
je 0x4980aa
dec dword [ebx + 0x78]
mov eax, dword [ebx + 0x88]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x18]
mov edi, dword [ebx + 0x3c]
mov dword [ebx + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.00530230
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
mov ebx, dword [esp + 0x28]
add esp, 0x10
jmp 0x4980af
call fcn.00485670
cmp dword [ebx + 0x78], 0
jne 0x4980c8
mov eax, dword [ebx + 0xcc]
cmp dword [eax + 0xc], 0
jne 0x4980c8
mov ecx, ebx
call fcn.00488090
dec word [esi + 0x4c]
xor eax, eax
mov dx, word [esi + 0x4c]
and byte [esi + 0x48], 0xf9
mov word [esi + 0x2c], ax
movsx eax, dx
mov ecx, dword [esi + eax*4 + 0x78]
mov ax, word [esi + eax*2 + 0x4e]
cmp ax, word [ecx + 0x12]
jae 0x498040
movsx eax, dx
inc word [esi + eax*2 + 0x4e]
movsx ecx, word [esi + 0x4c]
mov edi, dword [esi + ecx*4 + 0x78]
movzx edx, word [esi + ecx*2 + 0x4e]
movzx eax, word [edi + 0x12]
cmp edx, eax
jne 0x498130
movzx ecx, byte [edi + 6]
add ecx, dword [edi + 0x38]
movzx edx, byte [ecx + 8]
movzx eax, byte [ecx + 9]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xa]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xb]
jmp 0x498163
mov eax, dword [edi + 0x40]
movzx ecx, byte [eax + edx*2]
movzx eax, byte [eax + edx*2 + 1]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x14]
and ecx, eax
add ecx, dword [edi + 0x38]
movzx edx, byte [ecx]
movzx eax, byte [ecx + 1]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 3]
shl edx, 8
mov ecx, esi
or edx, eax
call fcn.00493250
test eax, eax
je 0x498010
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 4], eax
mov ecx, esi
call fcn.004932f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f17c0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5503b0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5c2b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov edi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0
push 0
mov byte [ebp - 0x15], 0
call edi
mov esi, eax
test esi, esi
je 0x4f194f
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0052a1cf
add esp, 4
mov ebx, eax
mov dword [ebp - 0x1c], ebx
push ebx
push esi
call edi
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4f1942
xor edi, edi
test eax, eax
je 0x4f1942
or ebx, 0xffffffff
call fcn.00456bd0
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x4f1992
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 1
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x4f188e
push 0x104
lea ecx, [ebp - 0x14]
call fcn.00456e30
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
push 0x104
push esi
push 0x1001
movzx eax, word [eax + edi*4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push dword [esi - 8]
push esi
call fcn.0052b6eb
add esp, 8
test eax, eax
js 0x4f199c
cmp eax, dword [esi - 8]
jg 0x4f199c
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
setne cl
test ecx, ecx
je 0x4f1992
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4f1907
test dx, dx
je 0x4f1903
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4f1907
add ecx, 4
add eax, 4
test dx, dx
jne 0x4f18e1
xor eax, eax
jmp 0x4f190c
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x4f196e
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f1935
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
inc edi
cmp edi, dword [ebp - 0x24]
jb 0x4f1842
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4f194f
push ebx
call fcn.0052ac0d
add esp, 4
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ab62
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x15], 1
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4f193f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4f193f
push 0x80004005
call fcn.00456ea0
push 0x80070057
call fcn.00456ea0
int3
Function at 0x4f5490
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x551099
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5c2b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
shr eax, 8
movzx eax, al
movzx ebx, cl
mov dword [ebp - 0x1c], eax
cmp ecx, 0x80000000
jae 0x4f54ea
mov edi, ecx
shr edi, 0x10
cmp ebx, 6
jb 0x4f550e
cmp eax, 2
jb 0x4f550e
mov ecx, esi
call fcn.004f5a00
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
jmp 0x4f558f
call fcn.00456bd0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4f552a
push 0x80004005
call fcn.00456ea0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 2
lea eax, [ebp - 0x14]
push edi
push dword [ebp - 0x1c]
push ebx
push 0x59a474
push eax
call fcn.00457480
mov edi, dword [ebp - 0x14]
add esp, 0x14
add edi, 0xfffffff0
mov ecx, edi
call fcn.00456280
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f558f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ab62
mov esp, ebp
pop ebp
ret
Function at 0x4f7fb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5c2b80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push edi
push 0
push eax
mov edi, ecx
lea eax, [ebp - 5]
push 1
push eax
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 6]
push eax
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx ecx, byte [ebp - 6]
movzx eax, byte [ebp - 5]
shl ecx, 8
add ecx, eax
mov dword [ebx], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0052ab62
mov esp, ebp
pop ebp
ret 4

Function at 0x4f8020
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5c2b80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push 0
push eax
mov edi, ecx
lea eax, [ebp - 7]
push 1
push eax
push dword [edi + 0x20]
call esi
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 5]
push eax
push dword [edi + 0x20]
call esi
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 8]
push eax
push dword [edi + 0x20]
call esi
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 6]
push eax
push dword [edi + 0x20]
call esi
movzx ecx, byte [ebp - 6]
movzx eax, byte [ebp - 8]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebp - 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebp - 7]
shl ecx, 8
add ecx, eax
mov dword [ebx], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052ab62
mov esp, ebp
pop ebp
ret 4
Function at 0x4f80c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5517d0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5c2b80]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x20], ebx
push 0
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x2c], esi
push 0x404
call fcn.0052a1cf
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, 4
xor edi, edi
mov dword [ebp - 4], edi
lea ecx, [ecx]
cmp ecx, esi
jae 0x4f81ba
test edi, edi
jne 0x4f81ba
lea eax, [ecx + 0x400]
mov ecx, eax
cmp eax, esi
cmova ecx, esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], ecx
mov ebx, esi
sub ebx, ecx
sub esi, ebx
cmp esi, 0x404
mov eax, 0x404
cmova esi, eax
push edi
push edi
push ebx
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
push dword [eax + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esi, 0xfffffffd
mov dword [ebp - 0x28], esi
mov eax, esi
dec esi
mov dword [ebp - 0x28], esi
test eax, eax
mov eax, dword [ebp - 0x1c]
jle 0x4f81af
cmp byte [esi + eax], 0x50
jne 0x4f8181
cmp byte [esi + eax + 1], 0x4b
jne 0x4f8181
cmp byte [esi + eax + 2], 5
jne 0x4f8181
cmp byte [esi + eax + 3], 6
jne 0x4f8181
lea edi, [esi + ebx]
mov dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
jmp 0x4f8120
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.0052ac0d
add esp, 4
test edi, edi
jne 0x4f81d8
push 0xffffffffffffff99
mov ecx, dword [ebp - 0x20]
call fcn.004f8b00
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052ab62
mov esp, ebp
pop ebp
ret
Function at 0x4f8590
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5c2b80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [ebx + 0x10], 0xffffffff
jne 0x4f8735
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4f85c2
push eax
call fcn.0052be09
add esp, 4
mov dword [ebx + 0x18], 0
test esi, esi
je 0x4f85d9
push esi
call fcn.0052db22
add esp, 4
mov dword [ebx + 0x18], eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x10], eax
cmp eax, 0xffffffff
je 0x4f8748
mov ecx, ebx
call fcn.004f80c0
push 0
push 0
push eax
push dword [ebx + 0x20]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0xc]
mov ecx, ebx
push eax
call fcn.004f8020
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0xc]
push 0
push eax
push 1
lea eax, [ebp - 0xe]
push eax
push dword [ebx + 0x20]
call esi
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0x20]
call esi
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0xd]
push eax
push dword [ebx + 0x20]
call esi
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0xf]
push eax
push dword [ebx + 0x20]
call esi
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 5]
push eax
push dword [ebx + 0x20]
call esi
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 6]
push eax
push dword [ebx + 0x20]
call esi
movzx ecx, byte [ebp - 6]
movzx eax, byte [ebp - 5]
shl ecx, 8
add ecx, eax
lea eax, [ebp - 0xc]
push 0
push eax
push 1
lea eax, [ebp - 6]
mov dword [ebx + 0x24], ecx
push eax
push dword [ebx + 0x20]
call esi
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 5]
push eax
push dword [ebx + 0x20]
call esi
movzx ecx, byte [ebp - 5]
movzx eax, byte [ebp - 6]
shl ecx, 8
add ecx, eax
cmp ecx, dword [ebx + 0x24]
jne 0x4f8756
movzx ecx, byte [ebp - 0xf]
movzx eax, byte [ebp - 0xd]
shl ecx, 8
add ecx, eax
jne 0x4f8756
movzx ecx, byte [ebp - 0x10]
movzx eax, byte [ebp - 0xe]
shl ecx, 8
add ecx, eax
jne 0x4f8756
lea edi, [ebx + 0x40]
mov ecx, ebx
push edi
call fcn.004f8020
lea esi, [ebx + 0x44]
mov ecx, ebx
push esi
call fcn.004f8020
lea eax, [ebx + 0x28]
mov ecx, ebx
push eax
call fcn.004f7fb0
mov edx, dword [esi]
mov esi, dword [edi]
mov ecx, dword [ebp - 0x14]
lea eax, [esi + edx]
cmp ecx, eax
jb 0x4f8756
mov eax, ecx
mov dword [ebx + 0x3c], ecx
sub eax, esi
mov ecx, ebx
sub eax, edx
mov dword [ebx + 0x2c], eax
call fcn.004f7800
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052ab62
mov esp, ebp
pop ebp
ret 4
push 1
mov edx, esi
mov ecx, 1
call fcn.004f87c0
push 0xffffffffffffff99
mov ecx, ebx
call fcn.004f8b00
int3
Function at 0x4f9760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x551ca9
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5c2b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x40], 0x5f005f
mov dword [ebp - 0x3c], 0x520042
mov dword [ebp - 0x38], 0x40005f
mov dword [ebp - 0x34], 0x410046
mov dword [ebp - 0x30], 0x4c0049
mov dword [ebp - 0x2c], 0x440045
mov dword [ebp - 0x28], 0x52005f
mov dword [ebp - 0x24], 0x410045
mov dword [ebp - 0x20], 0x400044
mov dword [ebp - 0x1c], 0x42005f
mov dword [ebp - 0x18], 0x5f0052
mov dword [ebp - 0x14], 0x5f
call fcn.00457210
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ab62
mov esp, ebp
pop ebp
ret