joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0820
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xa4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test eax, eax
je 0x4b0852
mov byte [eax], 0
xor bl, bl
mov ecx, dword [0x7e8a20]
cmp ecx, 0xffffffff
jne 0x4b0890
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x9c]
mov dword [0x7e8a20], ecx
mov dword [0x80abac], edx
jmp 0x4b0896
mov edx, dword [0x80abac]
xor eax, eax
cmp ecx, 2
cmove eax, edx
test eax, eax
je 0x4b08b5
test esi, esi
je 0x4b08b5
cmp word [esi], 0
je 0x4b08b5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x4b08bc
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
test al, al
je 0x4b0903
test bl, bl
jne 0x4b08dd
mov edx, esi
mov ecx, edi
mov bl, 1
call fcn.004b0990
test al, al
jne 0x4b0854
cmp dword [ebp + 0x10], 2
jne 0x4b0903
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x4b08f0
mov byte [eax], 1
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0xa8]
test ebx, ebx
je 0x4b092d
push esi
push edi
mov ecx, ebx
call fcn.004a58d0
test al, al
je 0x4b092d
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
push 0
mov edx, esi
mov ecx, edi
call fcn.004ae0a0
mov edx, esi
mov ecx, edi
call fcn.004ada40
add esp, 4
test ebx, ebx
je 0x4b0962
push esi
push edi
mov ecx, ebx
call fcn.004a58d0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
push edi
call fcn.006c036d
mov ecx, dword [ebp - 4]
add esp, 4
test eax, eax
sete al
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.006b3266
mov esp, ebp
pop ebp
ret
Function at 0x4b0990
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24f4
call fcn.006b59e0
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
lea eax, [ebp - 0x18d0]
mov dword [ebp - 0xcb8], 0
push eax
mov edi, ecx
mov dword [ebp - 0xc88], 0
mov dword [ebp - 0xc58], 0
call fcn.004ad3a0
add esp, 8
test al, al
je 0x4b0b69
cmp byte [ebp - 0x18d0], 0
je 0x4b0b69
cmp byte [ebp - 0xc28], 0
je 0x4b0b69
lea ecx, [ebp - 0x18d0]
call fcn.004a8bc0
lea edx, [ebp - 0xc28]
mov ecx, eax
call fcn.004a2f00
test eax, eax
je 0x4b0b69
mov ecx, edi
call fcn.004a8bc0
lea edx, [ebp - 0xc28]
mov ecx, eax
call fcn.004a2f00
test eax, eax
jne 0x4b0b69
xor esi, esi
lea ebx, [ebx]
push 0x400
lea eax, [ebp - 0x408]
push edi
push eax
call fcn.006b8fd0
add esp, 0xc
lea ecx, [ebp - 0x408]
push esi
push str.rtmp_d
call fcn.004a8bc0
push eax
call fcn.006b6c88
add esp, 0xc
lea ecx, [ebp - 0x408]
xor edx, edx
call fcn.004adf60
test al, al
je 0x4b0a8b
add esi, 0x7b
cmp esi, 0x2710
jl 0x4b0a40
xor edx, edx
lea ecx, [ebp - 0x408]
call fcn.004adf60
test al, al
jne 0x4b0b69
push 0x400
lea eax, [ebp - 0x808]
push edi
push eax
call fcn.006b8fd0
add esp, 0xc
lea ecx, [ebp - 0x18d0]
call fcn.004a8bc0
lea ecx, [ebp - 0x808]
mov esi, eax
call fcn.004a8bc0
sub eax, esi
nop
mov cl, byte [esi]
lea esi, [esi + 1]
mov byte [eax + esi - 1], cl
test cl, cl
jne 0x4b0ad0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x808]
push eax
call esi
test eax, eax
je 0x4b0b69
lea ecx, [ebp - 0x24f0]
call fcn.004a5600
xor edx, edx
mov ecx, edi
xor bl, bl
call fcn.004adf60
test al, al
jne 0x4b0b21
push 0
push edi
lea ecx, [ebp - 0x24f0]
call fcn.004a58d0
mov bl, al
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x408]
push eax
call esi
test bl, bl
je 0x4b0b4b
lea ecx, [ebp - 0x24f0]
call fcn.004a5a60
lea ecx, [ebp - 0x24f0]
call fcn.004a5af0
lea ecx, [ebp - 0x24f0]
call fcn.004a5680
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006b3266
mov esp, ebp
pop ebp
ret
Function at 0x4b6f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x805454], 0
push ebx
push esi
mov ebx, edx
mov edx, ecx
push edi
jne 0x4b6f68
call fcn.004b6ec0
mov esi, dword [ebp + 8]
test esi, esi
je 0x4b6f8b
nop
test bl, 7
je 0x4b6f8b
movzx ecx, byte [ebx]
inc ebx
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x805450]
dec esi
jne 0x4b6f70
cmp esi, 8
jb 0x4b700f
mov ecx, esi
shr ecx, 3
xor edx, dword [ebx]
sub esi, 8
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x805450]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x805450]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x805450]
mov eax, edx
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + 0x805450]
xor edx, dword [ebx + 4]
add ebx, 8
xor edx, eax
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x805450]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x805450]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x805450]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x805450]
dec ecx
jne 0x4b6f95
xor edi, edi
test esi, esi
jle 0x4b702d
movzx ecx, byte [edi + ebx]
inc edi
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x805450]
cmp edi, esi
jl 0x4b7015
pop edi
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x4b7040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], ecx
test esi, esi
je 0x4b70ca
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x4b70ca
movdqu xmm1, xmmword [ecx + 4]
cdq
and edx, 0xf
push edi
lea edi, [edx + eax]
sar edi, 4
mov dword [ebp + 0xc], edi
mov dword [ebp + 8], edi
test edi, edi
jle 0x4b70b8
push ebx
mov ebx, dword [ebp + 0x10]
mov edi, ecx
sub ebx, esi
lea ebx, [ebx]
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
push esi
call fcn.004b7390
movdqu xmm0, xmmword [ebp - 0x14]
mov eax, dword [ebp + 8]
dec eax
pxor xmm0, xmm1
mov dword [ebp + 8], eax
movdqu xmm1, xmmword [esi]
movdqu xmmword [ebx + esi], xmm0
add esi, 0x10
movdqu xmmword [ebp - 0x14], xmm0
test eax, eax
jg 0x4b7080
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
pop ebx
shl edi, 4
mov eax, edi
pop edi
movdqu xmmword [ecx + 4], xmm1
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b70e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
movdqu xmm0, xmmword [eax]
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x2c], ebx
movdqu xmmword [ebp - 0x24], xmm0
movdqu xmm0, xmmword [eax + 0x10]
xor eax, eax
xor esi, esi
movdqu xmmword [ebp - 0x14], xmm0
cmp edi, 0xa
jg 0x4b723f
cmp esi, 4
jge 0x4b7158
cmp eax, 4
jge 0x4b715b
movzx ecx, byte [ebp + esi*4 - 0x24]
lea edx, [eax + edi*4]
mov byte [ebx + edx*4 + 0x14], cl
lea ecx, [eax + edi*4]
lea edx, [ebx + ecx*4]
inc eax
movzx ecx, byte [ebp + esi*4 - 0x23]
mov byte [edx + 0x15], cl
movzx ecx, byte [ebp + esi*4 - 0x22]
mov byte [edx + 0x16], cl
movzx ecx, byte [ebp + esi*4 - 0x21]
inc esi
mov byte [edx + 0x17], cl
cmp esi, 4
jl 0x4b7122
cmp eax, 4
jne 0x4b7160
inc edi
xor eax, eax
cmp esi, 4
jl 0x4b7114
cmp edi, 0xa
jg 0x4b723f
mov esi, 0x8090d0
movzx ecx, byte [ebp - 0x17]
mov ebx, 3
mov dl, byte [ebp - 0x24]
xor dl, byte [ecx + 0x806ad0]
movzx ecx, byte [ebp - 0x16]
xor dl, byte [esi]
mov byte [ebp - 0x24], dl
movzx ecx, byte [ecx + 0x806ad0]
xor byte [ebp - 0x23], cl
movzx ecx, byte [ebp - 0x15]
movzx ecx, byte [ecx + 0x806ad0]
xor byte [ebp - 0x22], cl
movzx ecx, byte [ebp - 0x18]
movzx ecx, byte [ecx + 0x806ad0]
xor byte [ebp - 0x21], cl
inc esi
mov dword [ebp - 0x28], esi
lea esi, [ebp - 0x23]
jmp 0x4b71c0
movzx ecx, byte [esi - 1]
lea esi, [esi + 4]
xor byte [esi - 1], cl
movzx ecx, byte [esi - 4]
xor byte [esi], cl
movzx ecx, byte [esi - 3]
xor byte [esi + 1], cl
movzx ecx, byte [esi - 2]
xor byte [esi + 2], cl
dec ebx
jne 0x4b71c0
mov ebx, dword [ebp - 0x2c]
xor esi, esi
cmp edi, 0xa
jg 0x4b723f
cmp esi, 4
jge 0x4b7226
cmp eax, 4
jge 0x4b7229
movzx ecx, byte [ebp + esi*4 - 0x24]
lea edx, [eax + edi*4]
mov byte [ebx + edx*4 + 0x14], cl
lea ecx, [eax + edi*4]
lea edx, [ebx + ecx*4]
inc eax
movzx ecx, byte [ebp + esi*4 - 0x23]
mov byte [edx + 0x15], cl
movzx ecx, byte [ebp + esi*4 - 0x22]
mov byte [edx + 0x16], cl
movzx ecx, byte [ebp + esi*4 - 0x21]
inc esi
mov byte [edx + 0x17], cl
cmp esi, 4
jl 0x4b71f0
cmp eax, 4
jne 0x4b722e
inc edi
xor eax, eax
cmp esi, 4
jl 0x4b71e6
mov esi, dword [ebp - 0x28]
cmp edi, 0xa
jle 0x4b7173
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006b3266
mov esp, ebp
pop ebp
ret 4
Function at 0x4b7260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea edi, [ecx + 0x24]
mov dword [ebp - 0x18], 9
lea esi, [ecx + 0x28]
xor eax, eax
jmp 0x4b7290
movzx ecx, byte [esi - 1]
movzx edx, byte [esi - 2]
movzx ebx, byte [eax + ecx*4 + 0x807fd0]
xor bl, byte [eax + edx*4 + 0x8083d0]
movzx ecx, byte [esi - 3]
movzx edx, byte [esi + 2]
xor bl, byte [eax + ecx*4 + 0x8077d0]
movzx ecx, byte [esi - 4]
xor bl, byte [eax + ecx*4 + 0x8062d0]
movzx ecx, byte [esi + 3]
mov byte [ebp + eax - 0x14], bl
movzx ebx, byte [eax + ecx*4 + 0x807fd0]
xor bl, byte [eax + edx*4 + 0x8083d0]
movzx ecx, byte [esi + 1]
movzx edx, byte [esi + 6]
xor bl, byte [eax + ecx*4 + 0x8077d0]
movzx ecx, byte [esi]
xor bl, byte [eax + ecx*4 + 0x8062d0]
movzx ecx, byte [esi + 7]
mov byte [ebp + eax - 0x10], bl
movzx ebx, byte [eax + ecx*4 + 0x807fd0]
xor bl, byte [eax + edx*4 + 0x8083d0]
movzx ecx, byte [esi + 5]
movzx edx, byte [esi + 0xa]
xor bl, byte [eax + ecx*4 + 0x8077d0]
movzx ecx, byte [esi + 4]
xor bl, byte [eax + ecx*4 + 0x8062d0]
movzx ecx, byte [esi + 0xb]
mov byte [ebp + eax - 0xc], bl
movzx ebx, byte [eax + ecx*4 + 0x807fd0]
movzx ecx, byte [esi + 9]
xor bl, byte [eax + edx*4 + 0x8083d0]
xor bl, byte [eax + ecx*4 + 0x8077d0]
movzx ecx, byte [esi + 8]
xor bl, byte [eax + ecx*4 + 0x8062d0]
mov byte [ebp + eax - 8], bl
inc eax
cmp eax, 4
jl 0x4b7290
movdqu xmm0, xmmword [ebp - 0x14]
add esi, 0x10
movdqu xmmword [edi], xmm0
add edi, 0x10
dec dword [ebp - 0x18]
jne 0x4b7280
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006b3266
mov esp, ebp
pop ebp
ret
Function at 0x4b7dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
xor eax, dword [ecx + 0x204]
mov edx, dword [edi + 0xc]
xor edx, dword [ecx + 0x210]
mov dword [ebp - 8], eax
mov eax, dword [edi + 4]
xor eax, dword [ecx + 0x208]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x20c]
xor eax, dword [edi + 8]
mov dword [ebp - 0x14], eax
xor eax, eax
mov edi, dword [ebp - 0x14]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], eax
and eax, 3
rol edx, 0xb
add edx, edi
mov esi, dword [ecx + eax*4 + 0x204]
xor edx, esi
mov eax, edx
shr eax, 0x10
and eax, 0xff
movzx ebx, byte [eax + ecx + 0x104]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0x104]
shl eax, 8
or ebx, eax
mov eax, edx
shr eax, 8
and eax, 0xff
shl ebx, 8
movzx eax, byte [eax + ecx + 0x104]
or ebx, eax
movzx eax, dl
mov edx, edi
shl ebx, 8
ror edx, 0xf
xor edx, dword [ebp - 4]
movzx eax, byte [eax + ecx + 0x104]
add edx, esi
or ebx, eax
mov eax, edx
shr eax, 0x10
and eax, 0xff
xor ebx, dword [ebp - 8]
mov dword [ebp - 8], edi
mov edi, ebx
movzx esi, byte [eax + ecx + 0x104]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0x104]
shl eax, 8
or esi, eax
mov eax, edx
shr eax, 8
and eax, 0xff
shl esi, 8
movzx eax, byte [eax + ecx + 0x104]
or esi, eax
movzx eax, dl
shl esi, 8
movzx eax, byte [eax + ecx + 0x104]
or esi, eax
mov eax, dword [ebp - 4]
xor esi, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov edx, esi
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], eax
cmp eax, 0x20
jl 0x4b7e13
mov eax, dword [ecx + 0x204]
mov edi, dword [ebp + 8]
xor eax, ebx
push edi
mov dword [edi], eax
mov eax, dword [ecx + 0x208]
xor eax, esi
mov dword [edi + 4], eax
mov eax, dword [ecx + 0x20c]
xor eax, dword [ebp - 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x210]
xor eax, dword [ebp - 0xc]
mov dword [edi + 0xc], eax
call fcn.004b80b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b7f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x28], ebx
push edi
mov eax, dword [ebx]
xor eax, dword [ecx + 0x204]
mov edx, dword [ebx + 0xc]
movdqu xmm0, xmmword [ebx]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
xor eax, dword [ecx + 0x208]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0x20c]
xor eax, dword [ebx + 8]
xor edx, dword [ecx + 0x210]
mov dword [ebp - 0x30], eax
mov eax, 0x1f
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x20], edx
movdqu xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x24], eax
lea esp, [esp]
and eax, 3
rol edx, 0xb
add edx, ebx
mov esi, dword [ecx + eax*4 + 0x204]
xor edx, esi
mov eax, edx
shr eax, 0x10
and eax, 0xff
movzx edi, byte [eax + ecx + 0x104]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0x104]
shl eax, 8
or edi, eax
mov eax, edx
shr eax, 8
and eax, 0xff
shl edi, 8
movzx eax, byte [eax + ecx + 0x104]
or edi, eax
movzx eax, dl
mov edx, ebx
shl edi, 8
ror edx, 0xf
xor edx, dword [ebp - 0x20]
movzx eax, byte [eax + ecx + 0x104]
add edx, esi
or edi, eax
mov eax, edx
shr eax, 0x10
and eax, 0xff
xor edi, dword [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov ebx, edi
movzx esi, byte [eax + ecx + 0x104]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0x104]
shl eax, 8
or esi, eax
mov eax, edx
shr eax, 8
and eax, 0xff
shl esi, 8
movzx eax, byte [eax + ecx + 0x104]
or esi, eax
movzx eax, dl
shl esi, 8
movzx eax, byte [eax + ecx + 0x104]
or esi, eax
mov eax, dword [ebp - 0x20]
xor esi, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov edx, esi
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
jns 0x4b7f90
mov eax, dword [ecx + 0x204]
mov ebx, dword [ebp - 0x28]
xor eax, edi
mov dword [ebx], eax
mov eax, dword [ecx + 0x208]
xor eax, esi
mov dword [ebx + 4], eax
mov eax, dword [ecx + 0x20c]
xor eax, dword [ebp - 0x18]
mov dword [ebx + 8], eax
mov eax, dword [ecx + 0x210]
xor eax, dword [ebp - 0x1c]
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x14]
push eax
call fcn.004b80b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006b3266
mov esp, ebp
pop ebp
ret 4
Function at 0x4b80b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 4
lea eax, [edx + 1]
mov dword [ebp - 0x18], esi
push edi
mov ecx, dword [esi + 0x210]
mov edi, dword [esi + 0x204]
mov ebx, dword [esi + 0x208]
mov dword [ebp + 8], ecx
mov ecx, edx
sub ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, edx
sub ecx, eax
add ecx, 2
sub edx, eax
mov dword [ebp - 0x10], ecx
lea ecx, [edx + 3]
mov edx, dword [esi + 0x20c]
mov dword [ebp - 0x14], ecx
nop
mov ecx, dword [ebp - 0xc]
lea eax, [eax + 4]
movzx ecx, byte [ecx + eax - 4]
xor edi, dword [ecx*4 + 0x805450]
mov dword [esi + 0x204], edi
movzx ecx, byte [eax - 4]
xor ebx, dword [ecx*4 + 0x805450]
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x208], ebx
movzx ecx, byte [ecx + eax - 4]
xor edx, dword [ecx*4 + 0x805450]
mov ecx, dword [ebp - 0x14]
mov dword [esi + 0x20c], edx
mov esi, dword [ebp + 8]
movzx ecx, byte [ecx + eax - 4]
xor esi, dword [ecx*4 + 0x805450]
dec dword [ebp - 4]
mov dword [ebp + 8], esi
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [esi + 0x210], ecx
jne 0x4b8100
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b86a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b86b2
sub eax, edx
or ecx, 0xffffffff
push eax
mov edx, edi
call fcn.004b6f50
mov word [esi + 0x214], ax
add esp, 4
shr eax, 0x10
mov word [esi + 0x216], ax
xor eax, eax
mov dword [esi + 0x218], eax
mov word [esi + 0x21d], ax
mov byte [esi + 0x21c], al
mov al, byte [edi]
test al, al
je 0x4b8774
push ebx
mov bl, byte [esi + 0x21e]
xor bh, bh
mov dword [ebp - 8], 0
xor cl, cl
mov dword [ebp - 4], 0
mov edi, edi
add cl, al
movzx edx, al
xor bh, al
mov byte [esi + 0x21c], cl
add bl, al
mov byte [ebp + 0xb], cl
movzx ecx, al
lea edi, [edi + 1]
movzx eax, word [edx*4 + 0x805450]
xor ax, cx
rol bl, 1
xor word [ebp - 4], ax
mov eax, dword [ebp - 4]
mov word [esi + 0x218], ax
movzx eax, word [edx*4 + 0x805452]
add ax, cx
mov byte [esi + 0x21d], bh
mov ecx, dword [ebp - 8]
add cx, ax
mov byte [esi + 0x21e], bl
mov word [esi + 0x21a], cx
mov al, byte [edi]
mov dword [ebp - 8], ecx
mov cl, byte [ebp + 0xb]
test al, al
jne 0x4b8710
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4b8800
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
test ebx, ebx
je 0x4b88ab
push esi
mov edx, 0x1234
push edi
jmp 0x4b8820
movzx edi, word [eax + 0x214]
add di, dx
mov dx, word [eax + 0x21a]
mov ecx, edi
shr ecx, 1
and ecx, 0xff
movzx ecx, word [ecx*4 + 0x805450]
xor word [eax + 0x216], cx
mov ecx, edi
shr ecx, 1
and ecx, 0xff
movzx ecx, word [ecx*4 + 0x805452]
sub word [eax + 0x218], cx
mov ecx, 1
movzx esi, word [eax + 0x218]
ror dx, cl
xor dx, word [eax + 0x216]
ror dx, cl
movzx ecx, dx
mov edx, dword [ebp + 8]
mov word [eax + 0x21a], cx
xor ecx, esi
xor ecx, edi
mov word [eax + 0x214], cx
shr ecx, 8
xor byte [edx], cl
inc edx
mov dword [ebp + 8], edx
mov edx, 0x1234
dec ebx
jne 0x4b8820
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4b9420
Capabilities:
Terminate process

Disassembly:
push str.1.0.2__30_Dec_2001
push ecx
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_acm.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__30_December_2001._n_n
call fcn.006bae0b
add eax, 0x40
push eax
call fcn.006b8207
add esp, 0x10
push 3
call fcn.006c0359
int3

Function at 0x4ba250
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
mov edx, 0x400000
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebx], 0
lea ebx, [ebx]
cmp esi, 0x400000
mov dword [ebp - 8], 0
push 0
mov eax, esi
cmova eax, edx
lea edx, [ebp - 8]
push edx
push eax
push edi
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
add dword [ebx], ecx
test eax, eax
je 0x4ba2d2
test ecx, ecx
je 0x4ba2bd
add edi, ecx
mov edx, 0x400000
sub esi, ecx
mov ecx, dword [ebp - 0xc]
jne 0x4ba280
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006b3266
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4bad80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x7e6410]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4bae54
add dword [esi + 0x50], 1
adc dword [esi + 0x54], 0
call fcn.006bae0b
add eax, 0x20
push eax
push 0x78bcf8
call fcn.006b94a6
lea eax, [edi - 1]
add esp, 8
cmp eax, 7
ja case.default.0x4badc6
jmp dword [eax*4 + 0x4baf28]
mov edi, str.Unsupported_Method
jmp 0x4bae03
mov edi, str.CRC_Failed
jmp 0x4bae03
mov edi, str.Data_Error
jmp 0x4bae03
mov edi, str.Unavailable_data
jmp 0x4bae03
mov edi, str.Unexpected_end_of_data
jmp 0x4bae03
mov edi, str.There_are_some_data_after_the_end_of_the_payload_data
jmp 0x4bae03
mov edi, str.Is_not_archive
jmp 0x4bae03
mov edi, str.Headers_Error
call fcn.006bae0b
add eax, 0x20
push eax
push str.Error_:
call fcn.006b94a6
call fcn.006bae0b
add eax, 0x20
push eax
push edi
jmp 0x4bae4c
lea edx, [ebp - 0x14]
mov ecx, edi
call fcn.004c2030
call fcn.006bae0b
add eax, 0x20
push eax
push str.Error_
call fcn.006b94a6
call fcn.006bae0b
add eax, 0x20
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.006b94a6
add esp, 0x10
cmp dword [esi + 0x4c], 0
je 0x4baec2
cmp byte [esi + 0x46], 0
je 0x4bae74
lea eax, [esi + 0x38]
push eax
mov eax, dword [esi + 0x48]
push 0
push 0
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 8]
cmp eax, 0xffffffff
je 0x4baec2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4bae93
mov dword [edi + 8], 0xffffffff
jmp 0x4baec2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4baeb4
pop edi
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006b3266
mov esp, ebp
pop ebp
ret 8
jle 0x4baebe
movzx eax, ax
or eax, 0x80070000
test eax, eax
jne 0x4baf13
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x4baed6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x4c], 0
cmp byte [esi + 0x34], 0
je 0x4baefb
cmp byte [esi + 0x45], 0
je 0x4baefb
mov eax, dword [esi + 0x40]
test eax, 0xf0000000
je 0x4baef1
and eax, 0x3fff
push eax
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call fcn.006bae0b
add eax, 0x20
push eax
push 0x78b35c
call fcn.006b94a6
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006b3266
mov esp, ebp
pop ebp
ret 8