joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push 0
push 0x10b
push 0
push 0
lea edx, [ebp - 0x110]
mov dword [ebp - 0x110], 0xc031fcfa
mov esi, ecx
mov dword [ebp - 0x10c], 0xd88ed08e
mov dword [ebp - 0x108], 0x8d7c00bd
mov dword [ebp - 0x104], 0xb8fbe066
mov dword [ebp - 0x100], 0xc08e1fe0
mov dword [ebp - 0xfc], 0xef89ee89
mov dword [ebp - 0xf8], 0xf30100b9
mov dword [ebp - 0xf4], 0x7c22eaa5
mov dword [ebp - 0xf0], 0xd88e1fe0
mov dword [ebp - 0xec], 0xc031d08e
mov dword [ebp - 0xe8], 0xbe8dc08e
mov dword [ebp - 0xe4], 0x5f601be
mov dword [ebp - 0xe0], 0x836d7580
mov dword [ebp - 0xdc], 0xff8110c7
mov dword [ebp - 0xd8], 0xf2727dfe
mov dword [ebp - 0xd4], 0x6e00c4e8
mov dword [ebp - 0xd0], 0x6361206f
mov dword [ebp - 0xcc], 0x65766974
mov dword [ebp - 0xc8], 0x72617020
mov dword [ebp - 0xc4], 0x69746974
mov dword [ebp - 0xc0], 0x66206e6f
mov dword [ebp - 0xbc], 0x646e756f
mov dword [ebp - 0xb8], 0xe8feeb00
mov dword [ebp - 0xb4], 0x657200a5
mov dword [ebp - 0xb0], 0x65206461
mov dword [ebp - 0xac], 0x726f7272
mov dword [ebp - 0xa8], 0x69687720
mov dword [ebp - 0xa4], 0x7220656c
mov dword [ebp - 0xa0], 0x69646165
mov dword [ebp - 0x9c], 0x6420676e
mov dword [ebp - 0x98], 0x65766972
mov dword [ebp - 0x94], 0xe8daeb00
mov dword [ebp - 0x90], 0x61700081
mov dword [ebp - 0x8c], 0x74697472
mov dword [ebp - 0x88], 0x206e6f69
mov dword [ebp - 0x84], 0x6e676973
mov dword [ebp - 0x80], 0x72757461
mov dword [ebp - 0x7c], 0x3d212065
mov dword [ebp - 0x78], 0x41353520
mov dword [ebp - 0x74], 0xb9eb0041
mov dword [ebp - 0x70], 0x720010e8
mov dword [ebp - 0x6c], 0x3e8126b6
mov dword [ebp - 0x68], 0xaa557dfe
mov dword [ebp - 0x64], 0xead175
mov dword [ebp - 0x60], 0xbb00007c
mov dword [ebp - 0x5c], 0x41b455aa
mov dword [ebp - 0x58], 0x327213cd
mov dword [ebp - 0x54], 0xaa55fb81
mov dword [ebp - 0x50], 0xc1f62c75
mov dword [ebp - 0x4c], 0xeb277401
mov dword [ebp - 0x48], 0x4001010
mov dword [ebp - 0x44], 0x7c0000
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x8458b00
mov dword [ebp - 0x34], 0x8b7cd1a3
mov dword [ebp - 0x30], 0xd3a30a45
mov dword [ebp - 0x2c], 0x4200b87c
mov dword [ebp - 0x28], 0xcd7cc9be
mov dword [ebp - 0x24], 0x4b8c313
mov dword [ebp - 0x20], 0x7c00bb02
mov dword [ebp - 0x1c], 0x8a024d8b
mov dword [ebp - 0x18], 0x13cd0175
mov dword [ebp - 0x14], 0xb4db31c3
mov dword [ebp - 0x10], 0x5e10cd0e
mov dword [ebp - 0xc], 0x3c56ac
mov word [ebp - 8], 0xf375
mov byte [ebp - 6], 0xc3
call fcn.0045d940
add esp, 0x10
test eax, eax
je 0x466df2
mov ecx, esi
call fcn.00465e70
test eax, eax
je 0x466df2
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46d2c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jns 0x46d2da
call fcn.004a4801
mov dword [eax], 9
or eax, 0xffffffff
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x46d2f1
call fcn.004a4801
mov dword [eax], 0xe
or eax, 0xffffffff
pop ebp
ret
push esi
mov esi, dword [ebp + 0x10]
cmp esi, dword [section..data]
jbe 0x46d30e
call fcn.004a4801
pop esi
mov dword [eax], 7
or eax, 0xffffffff
pop ebp
ret
mov edx, dword [0x540a10]
test edx, edx
je 0x46d32e
cmp dword [edx], 0
je 0x46d32e
call fcn.004a4801
pop esi
mov dword [eax], 4
or eax, 0xffffffff
pop ebp
ret
cmp eax, dword [0x4f2004]
jne 0x46d369
mov edx, dword [0x4f9dd0]
lea eax, [edx + esi]
cmp eax, dword [0x4f9dcc]
jbe 0x46d34f
mov esi, dword [0x4f9dcc]
sub esi, edx
mov eax, dword [0x4f9dc8]
push esi
add eax, edx
push eax
push ecx
call fcn.00493080
add esp, 0xc
add dword [0x4f9dd0], esi
jmp 0x46d384
mov edx, dword [0x4f9de0]
push esi
push ecx
push eax
test edx, edx
je 0x46d37a
call edx
jmp 0x46d37f
call fcn.004a6072
mov esi, eax
add esp, 0xc
test esi, esi
jle 0x46d3b6
mov ecx, dword [0x540a08]
mov eax, esi
cdq
add ecx, eax
mov eax, dword [0x540a0c]
mov dword [0x540a08], ecx
adc eax, edx
mov edx, dword [0x4f9dd8]
mov dword [0x540a0c], eax
test edx, edx
je 0x46d3b6
push eax
push ecx
call edx
add esp, 8
mov eax, esi
pop esi
pop ebp
ret
Function at 0x46e950
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
cmp dword [esi], eax
mov eax, dword [ebp + 0xc]
jae 0x46eac8
lea ebx, [edi + 0x24]
mov dword [ebp - 4], eax
mov ecx, ebx
mov edx, dword [edi + 0x30]
cmp edx, dword [edi + 0x34]
jb 0x46eaa2
mov ebx, dword [section..data]
mov edx, dword [edi + 0x2c]
mov eax, dword [edi + 0x28]
lea esi, [ebx - 4]
test edx, edx
jl 0x46e9aa
jg 0x46e998
test eax, eax
jb 0x46e9aa
lea ecx, [edi + 0x24]
test edx, edx
jg 0x46e9aa
jl 0x46e9a5
cmp eax, esi
jae 0x46e9aa
mov esi, eax
lea ecx, [edi + 0x24]
mov ecx, dword [ecx]
mov eax, dword [edi + 0xc]
add ecx, 4
test eax, eax
js 0x46eaf6
test ecx, ecx
je 0x46eae9
cmp esi, ebx
ja 0x46eadc
mov edx, dword [0x540a10]
test edx, edx
je 0x46e9dd
cmp dword [edx], 0
jne 0x46eacf
cmp eax, dword [0x4f2004]
jne 0x46ea16
mov edx, dword [0x4f9dd0]
mov ebx, dword [0x4f9dcc]
lea eax, [edx + esi]
cmp eax, ebx
jbe 0x46e9fc
mov esi, ebx
sub esi, edx
mov eax, dword [0x4f9dc8]
push esi
add eax, edx
push eax
push ecx
call fcn.00493080
add esp, 0xc
add dword [0x4f9dd0], esi
jmp 0x46ea31
mov edx, dword [0x4f9de0]
push esi
push ecx
push eax
test edx, edx
je 0x46ea27
call edx
jmp 0x46ea2c
call fcn.004a6072
mov esi, eax
add esp, 0xc
test esi, esi
jle 0x46ea63
mov ecx, dword [0x540a08]
mov eax, esi
cdq
add ecx, eax
mov eax, dword [0x540a0c]
mov dword [0x540a08], ecx
adc eax, edx
mov edx, dword [0x4f9dd8]
mov dword [0x540a0c], eax
test edx, edx
je 0x46ea63
push eax
push ecx
call edx
add esp, 8
mov dword [edi + 0x34], esi
cmp esi, 1
jl 0x46eb08
mov ecx, dword [edi + 0x2c]
mov eax, dword [edi + 0x28]
test ecx, ecx
jl 0x46ea8a
jg 0x46ea7f
test eax, eax
jb 0x46ea8a
sub eax, esi
mov dword [edi + 0x28], eax
sbb ecx, 0
mov dword [edi + 0x2c], ecx
add esi, 4
mov dword [edi + 0x30], 4
mov dword [edi + 0x34], esi
lea ebx, [edi + 0x24]
mov esi, dword [ebp + 0x10]
mov edx, 4
mov eax, dword [ebx]
mov ecx, dword [esi]
movzx eax, byte [eax + edx]
shl eax, cl
mov ecx, ebx
or dword [ebp - 4], eax
lea eax, [edx + 1]
mov dword [edi + 0x30], eax
add dword [esi], 8
mov eax, dword [ebp + 0x14]
cmp dword [esi], eax
jb 0x46e973
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004a4801
mov dword [eax], 4
jmp 0x46eb01
call fcn.004a4801
mov dword [eax], 7
jmp 0x46eb01
call fcn.004a4801
mov dword [eax], 0xe
jmp 0x46eb01
call fcn.004a4801
mov dword [eax], 9
mov dword [edi + 0x34], 0xffffffff
push edi
mov dword [edi + 0x78], str.unexpected_end_of_file
call fcn.0046e7f0
int3
Function at 0x4702a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ecx, dword [edi]
lea edx, [edi + 4]
mov dword [ebp + 8], ecx
lea esi, [ebx + 1]
cmp ecx, eax
jge 0x470408
lea edx, [edi + 0x18]
mov dword [ebp - 4], edx
lea edx, [edi + 4]
nop dword [eax + eax]
mov esi, dword [edi + 0x14]
cmp esi, dword [edi + 0x10]
jne 0x4703b2
mov edx, dword [ebp - 4]
mov eax, dword [edi + 8]
mov esi, dword [section..data]
mov edx, dword [edx]
test eax, eax
js 0x47043b
test edx, edx
je 0x47042e
mov ecx, dword [0x540a10]
test ecx, ecx
je 0x47030d
cmp dword [ecx], 0
jne 0x470421
cmp eax, dword [0x4f2004]
jne 0x470348
mov ecx, dword [0x4f9dd0]
lea eax, [ecx + esi]
cmp eax, dword [0x4f9dcc]
jbe 0x47032e
mov esi, dword [0x4f9dcc]
sub esi, ecx
mov eax, dword [0x4f9dc8]
push esi
add eax, ecx
push eax
push edx
call fcn.00493080
add esp, 0xc
add dword [0x4f9dd0], esi
jmp 0x470363
mov ecx, dword [0x4f9de0]
push esi
push edx
push eax
test ecx, ecx
je 0x470359
call ecx
jmp 0x47035e
call fcn.004a6072
mov esi, eax
add esp, 0xc
test esi, esi
jle 0x470395
mov ecx, dword [0x540a08]
mov eax, esi
cdq
add ecx, eax
mov eax, dword [0x540a0c]
mov dword [0x540a08], ecx
adc eax, edx
mov edx, dword [0x4f9dd8]
mov dword [0x540a0c], eax
test edx, edx
je 0x470395
push eax
push ecx
call edx
add esp, 8
mov dword [edi + 0x10], esi
test esi, esi
jle 0x47044d
mov ecx, dword [ebp + 8]
lea edx, [edi + 4]
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [edi + 0x14], 0
cmp ecx, 0x18
jl 0x4703d1
mov ebx, 1
mov dword [ebp + 8], 0
shl ebx, cl
sub eax, ecx
dec ebx
mov dword [ebp + 0xc], eax
and ebx, dword [edx]
mov ecx, eax
shl ebx, cl
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx ecx, byte [eax + esi]
mov eax, dword [edx]
shl eax, 8
or ecx, eax
lea eax, [esi + 1]
mov dword [edx], ecx
mov ecx, dword [ebp + 8]
mov dword [edi + 0x14], eax
add ecx, 8
mov eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], ecx
cmp ecx, eax
jl 0x4702d0
mov esi, 1
sub ecx, eax
mov eax, dword [edx]
shr eax, cl
mov dword [edi], ecx
mov ecx, dword [ebp + 0xc]
shl esi, cl
dec esi
pop edi
and eax, esi
pop esi
or eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004a4801
mov dword [eax], 4
jmp 0x470446
call fcn.004a4801
mov dword [eax], 0xe
jmp 0x470446
call fcn.004a4801
mov dword [eax], 9
mov dword [edi + 0x10], 0xffffffff
push 0xfffffffffffffffd
push dword [edi + 0x44]
call fcn.00493065
int3
Function at 0x471ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
or edx, 0xffffffff
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
cmp edi, 4
ja 0x471ae1
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
sub edi, 4
push esi
mov dword [ebp + 0x10], edi
mov esi, 0
je 0x471c3f
mov ebx, dword [ebp + 0xc]
mov cl, byte [esi + ebx]
and cl, 0xfe
cmp cl, 0xe8
jne 0x471c33
mov ecx, esi
sub ecx, edx
cmp ecx, 3
jbe 0x471b35
xor eax, eax
mov dword [ebp - 4], eax
lea ecx, [ebx + 4]
mov edx, esi
add ecx, esi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ecx
mov cl, byte [ecx]
test cl, cl
je 0x471b6d
cmp cl, 0xff
je 0x471b6d
add eax, eax
or eax, 1
jmp 0x471c33
dec ecx
shl eax, cl
and eax, 7
mov dword [ebp - 4], eax
je 0x471b13
movzx ecx, byte [eax + 0x4bcd10]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x4bcd08], 0
mov cl, byte [edx + ebx + 4]
je 0x471b61
test cl, cl
je 0x471b61
cmp cl, 0xff
jne 0x471b13
add eax, eax
mov edx, esi
or eax, 1
jmp 0x471c33
lea edi, [ebx + 3]
add edi, esi
mov dword [ebp - 0xc], edi
lea edi, [ebx + 2]
inc ebx
add edi, esi
add ebx, esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], ebx
movzx ebx, cl
mov ecx, dword [ebp - 0xc]
shl ebx, 8
movzx ecx, byte [ecx]
or ebx, ecx
movzx ecx, byte [edi]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp - 8]
shl ebx, 8
movzx ecx, byte [ecx]
or ebx, ecx
mov ecx, dword [ebp + 8]
sub ebx, dword [ecx + 0xc]
sub ebx, esi
sub ebx, 5
test eax, eax
je 0x471bf7
movzx edi, byte [eax + 0x4bcd10]
mov eax, 0x18
shl edi, 3
sub eax, edi
mov edx, ebx
mov ecx, eax
shr edx, cl
test dl, dl
je 0x471bd3
cmp dl, 0xff
jne 0x471bf1
mov ecx, 0x20
mov edx, 1
sub ecx, edi
shl edx, cl
mov ecx, dword [ebp + 8]
dec edx
xor ebx, edx
sub ebx, dword [ecx + 0xc]
sub ebx, esi
sub ebx, 5
jmp 0x471bc4
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
and ebx, 0x1ffffff
mov ecx, ebx
and ecx, 0x1000000
neg ecx
or ebx, ecx
mov ecx, dword [ebp - 8]
mov byte [ecx], bl
mov ecx, ebx
shr ecx, 8
mov byte [edi], cl
mov ecx, ebx
mov edi, dword [ebp - 0xc]
shr ecx, 0x10
shr ebx, 0x18
add esi, 4
mov byte [edi], cl
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp + 0x10]
mov byte [ecx], bl
mov ebx, dword [ebp + 0xc]
inc esi
cmp esi, edi
jb 0x471af6
mov ebx, dword [ebp + 8]
mov ecx, esi
sub ecx, edx
cmp ecx, 3
jbe 0x471c56
xor eax, eax
mov dword [ebx + 0x10], eax
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov dword [ebx + 0x10], eax
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
cmp byte [eax], 0
jne 0x47454a
mov eax, dword [eax + 8]
mov esi, 2
test eax, eax
jns 0x47443d
call fcn.004a4801
mov dword [eax], 9
jmp 0x474518
cmp dword [section..data], esi
jae 0x474455
call fcn.004a4801
mov dword [eax], 7
jmp 0x474518
mov ecx, dword [0x540a10]
test ecx, ecx
je 0x474474
cmp dword [ecx], 0
je 0x474474
call fcn.004a4801
mov dword [eax], 4
jmp 0x474518
cmp eax, dword [0x4f2004]
jne 0x4744b4
mov ecx, dword [0x4f9dcc]
push edi
mov edi, dword [0x4f9dd0]
lea eax, [edi + 2]
cmp eax, ecx
jbe 0x474494
mov esi, ecx
sub esi, edi
mov eax, dword [0x4f9dc8]
add eax, edi
push esi
push eax
lea eax, [ebp - 4]
push eax
call fcn.00493080
add esp, 0xc
add edi, esi
mov dword [0x4f9dd0], edi
pop edi
jmp 0x4744d8
mov ecx, dword [0x4f9de0]
push 2
test ecx, ecx
je 0x4744c9
lea edx, [ebp - 4]
push edx
push eax
call ecx
jmp 0x4744d3
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.004a6072
mov esi, eax
add esp, 0xc
test esi, esi
jle 0x47450a
mov ecx, dword [0x540a08]
mov eax, esi
cdq
add ecx, eax
mov eax, dword [0x540a0c]
mov dword [0x540a08], ecx
adc eax, edx
mov edx, dword [0x4f9dd8]
mov dword [0x540a0c], eax
test edx, edx
je 0x47450a
push eax
push ecx
call edx
add esp, 8
cmp esi, 2
jne 0x474518
movzx eax, word [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x47454a
mov eax, dword [0x4f9dd4]
push str._nError:_invalid_magic
test eax, eax
je 0x474533
call eax
add esp, 4
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00426280
push 0xa
call fcn.004a4961
add esp, 8
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x474680
Capabilities:
Encode data using xor
Hash data using crc32b
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4746a8
push 4
push 0x100
call fcn.0049570f
mov esi, eax
add esp, 8
mov dword [ebp + 8], esi
test esi, esi
je 0x47475e
cmp dword [ebp + 0xc], 0
push ebx
push edi
mov edi, 1
je 0x4746fb
mov ebx, 0x80000000
nop word [eax + eax]
mov ecx, ebx
xor eax, eax
sar ecx, 0x1f
add ebx, ebx
and ecx, 0x4c11db7
xor ebx, ecx
test edi, edi
je 0x4746e8
lea edx, [esi + edi*4]
mov ecx, dword [esi + eax*4]
lea edx, [edx + 4]
xor ecx, ebx
inc eax
mov dword [edx - 4], ecx
cmp eax, edi
jb 0x4746d8
add edi, edi
cmp edi, 0x100
jb 0x4746c0
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x80
mov dword [esi], 0
mov dword [ebp - 4], edx
nop dword [eax]
mov eax, edi
lea ebx, [edx + edx]
and al, 1
lea edx, [esi + edx*4]
movzx eax, al
neg eax
sbb eax, eax
shr edi, 1
and eax, 0xedb88320
xor edi, eax
xor ecx, ecx
nop dword [eax]
mov eax, dword [esi + ecx*4]
add ecx, ebx
mov esi, dword [ebp - 4]
xor eax, edi
mov dword [edx], eax
lea eax, [esi*8]
mov esi, dword [ebp + 8]
add edx, eax
cmp ecx, 0x100
jb 0x474730
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jne 0x474710
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x474770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test edx, edx
je 0x47479d
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [edi + ecx*4]
sub edx, 1
jne 0x474785
pop edi
pop esi
pop ebp
ret

Function at 0x47ad90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x4f22ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push edi
mov edi, dword [ebp + 0x10]
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x39]
mov dword [ebp - 0x30], edi
push ecx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x40], 0
push ecx
lea ecx, [ebp - 0x58]
movlpd qword [ebp - 0x38], xmm0
push ecx
lea ecx, [ebp - 0x48]
push ecx
push 1
push eax
call fcn.0047a820
add esp, 0x1c
test al, al
jne 0x47adf1
mov eax, dword [ebp - 0x40]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491940
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x38]
or eax, dword [ebp - 0x34]
push esi
jne 0x47aef8
mov esi, dword [0x4f9e04]
xorps xmm0, xmm0
mov edi, dword [ebp - 0x48]
movlpd qword [ebp - 0x38], xmm0
test esi, esi
jne 0x47ae3c
push str.NtDeviceIoControlFile
push str.NtDll
call fcn.0047a380
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x4f9e04], esi
test esi, esi
je 0x47aef5
push 0x90
lea eax, [ebp - 0xe8]
push 0
push eax
call fcn.00493600
add esp, 0xc
lea eax, [ebp - 0xe8]
push 0x90
push eax
push 0x90
push eax
push 0x70048
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0
push edi
call esi
test eax, eax
js 0x47ae88
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd4]
jmp 0x47aeef
cmp eax, 0xc0000010
jne 0x47aed3
push 0x28
lea eax, [ebp - 0x2c]
xorps xmm0, xmm0
push eax
push 0x28
push eax
push 0x700a0
lea eax, [ebp - 0x50]
movq qword [ebp - 0xc], xmm0
push eax
push 0
push 0
push 0
push edi
movups xmmword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x1c], xmm0
call dword [0x4f9e04]
mov edi, dword [ebp - 0x30]
test eax, eax
js 0x47aef8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
jmp 0x47aef8
cmp eax, 0xc000000d
jne 0x47aef5
lea eax, [ebp - 0x44]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x47aef5
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
mov edi, dword [ebp - 0x30]
mov eax, dword [0x4f9e10]
mov esi, dword [ebp - 0x48]
test eax, eax
jne 0x47af26
push str.NtClose
push str.Ntdll
call fcn.0047a380
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4f9e10], eax
test eax, eax
je 0x47af29
push esi
call eax
mov eax, dword [ebp + 0xc]
cdq
push edx
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.00491dc0
mov ecx, dword [ebp - 4]
mov dword [edi], eax
xor ecx, ebp
pop esi
mov dword [edi + 4], edx
xor eax, eax
pop edi
call fcn.00491940
mov esp, ebp
pop ebp
ret
Function at 0x485b20
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x14]
push ebx
call fcn.00499907
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
test esi, esi
jne 0x485b4d
pop edi
pop esi
mov eax, 0x7f2bb746
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0
push esi
call fcn.00493600
mov eax, dword [edi + 0x10]
mov edx, 0xff01
mov ecx, dword [eax + 0x64]
and ecx, 0x400
mov dword [ebp - 0x14], ecx
neg ecx
sbb ebx, ebx
mov ecx, dword [eax + 0x60]
mov eax, dword [ebp + 0xc]
and ecx, 2
mov dword [esi], eax
and ebx, 0xc
mov ax, word [esi + 6]
and ax, dx
shl ecx, 8
or ax, 1
movzx edx, cx
mov ecx, dword [ebp + 0x14]
movzx eax, al
or eax, edx
mov byte [esi + 8], 0x2e
mov word [esi + 6], ax
or edx, 2
mov eax, dword [edi + 0x14]
sub eax, ebx
mov dword [ebp - 0x10], ebx
sub eax, 0xc
mov ebx, 0x18
mov dword [ebp - 4], eax
mov eax, 0xc
mov word [esi + 4], ax
mov word [esi + 0x10], ax
mov eax, dword [ecx]
mov dword [esi + 0xc], eax
mov word [esi + 0x12], dx
lea edx, [esi + 0x18]
mov word [esi + 0x14], 0x2e2e
mov esi, dword [ebp + 0x18]
mov dword [ebp - 8], edx
lea eax, [esi - 4]
push eax
lea eax, [ecx + 4]
push eax
push edx
call fcn.00493080
lea eax, [esi + 0x14]
add esp, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
push ecx
push eax
push edi
call fcn.00487080
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x485d10
mov ecx, dword [ebp - 4]
add ebx, ecx
mov eax, dword [ebp + 8]
add eax, ebx
cmp ebx, dword [ebp - 0xc]
jl 0x485bf2
mov eax, dword [edi + 0x14]
sub eax, dword [ebp - 0x10]
push dword [ebp - 8]
sub eax, ebx
add ecx, eax
push ecx
push edi
mov dword [ebp - 4], ecx
call fcn.00487430
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x485d10
cmp dword [ebp - 0x14], eax
je 0x485c5c
mov eax, dword [edi + 0x14]
mov ebx, dword [ebp + 8]
add eax, 0xfffffff4
add eax, ebx
push eax
push edi
call fcn.0047f500
add esp, 8
jmp 0x485c67
test esi, esi
jne 0x485d10
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push edi
call fcn.00481090
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x485d10
push dword [ebp + 0xc]
push eax
push ebx
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edi
call fcn.00486850
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x485d10
mov eax, dword [edi + 0x10]
mov ebx, dword [ebp + 0x10]
test byte [eax + 0x60], 0x40
je 0x485cb1
or dword [ebx + 0x20], 0x80000
and dword [ebx + 0x20], 0xefffffff
push 0
push 1
push ebx
push edi
call fcn.004849d0
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x485d10
mov eax, dword [edi + 0x14]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
push 2
push esi
push ebx
push dword [ebp + 0xc]
push edi
call fcn.00484f40
mov esi, eax
add esp, 0x24
test esi, esi
jne 0x485d10
push ebx
push dword [ebp + 0xc]
push edi
call fcn.0047ce80
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x485d10
push 1
push dword [ebp - 0x1c]
push edi
call fcn.00477b60
add esp, 0xc
push dword [ebp + 8]
call fcn.004998ec
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4899e0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x4f22ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0x8c], ecx
movlpd qword [ebp - 0xd4], xmm0
mov dword [ebp - 0xcc], 0xf3bcc908
mov dword [ebp - 0xc8], 0x6a09e667
mov dword [ebp - 0xc4], 0x84caa73b
mov dword [ebp - 0xc0], 0xbb67ae85
mov dword [ebp - 0xbc], 0xfe94f82b
mov dword [ebp - 0xb8], 0x3c6ef372
mov dword [ebp - 0xb4], 0x5f1d36f1
mov dword [ebp - 0xb0], 0xa54ff53a
mov dword [ebp - 0xac], 0xade682d1
mov dword [ebp - 0xa8], 0x510e527f
mov dword [ebp - 0xa4], 0x2b3e6c1f
mov dword [ebp - 0xa0], 0x9b05688c
mov dword [ebp - 0x9c], 0xfb41bd6b
mov dword [ebp - 0x98], 0x1f83d9ab
mov dword [ebp - 0x94], 0x137e2179
mov dword [ebp - 0x90], 0x5be0cd19
test esi, esi
je 0x489b74
push edi
test ecx, ecx
jne 0x489afb
cmp esi, 0x80
jb 0x489afb
lea eax, [ebp - 0xd4]
push ebx
push eax
call fcn.00489ba0
mov ecx, dword [ebp - 0x8c]
add esp, 8
add dword [ebp - 0xd4], 0x400
adc dword [ebp - 0xd0], 0
sub ebx, 0xffffff80
add esi, 0xffffff80
jmp 0x489b65
mov eax, 0x80
mov edi, esi
sub eax, ecx
cmp esi, eax
cmovae edi, eax
lea eax, [ebp - 0x88]
push edi
add eax, ecx
push ebx
push eax
call fcn.00493080
mov ecx, dword [ebp - 0x8c]
add esp, 0xc
add ecx, edi
add ebx, edi
sub esi, edi
mov dword [ebp - 0x8c], ecx
cmp ecx, 0x80
jne 0x489b65
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.00489ba0
add esp, 8
add dword [ebp - 0xd4], 0x400
adc dword [ebp - 0xd0], 0
xor ecx, ecx
mov dword [ebp - 0x8c], ecx
test esi, esi
jne 0x489ac0
mov eax, dword [ebp - 0xd8]
pop edi
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.0048ac90
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
pop ebx
call fcn.00491940
mov esp, ebp
pop ebp
ret