joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a9f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp edx, eax
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebp - 0x14], edx
cmovb ebx, edx
xor eax, eax
test ebx, ebx
je 0x47aa55
xor esi, esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov edx, dword [edi + esi*4]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + esi*4]
mov ebx, ecx
xor ebx, edx
mov edi, ecx
sub edi, edx
lea edx, [ebx - 1]
xor edi, ecx
or edi, ebx
not ebx
and edx, ebx
mov ebx, dword [ebp - 0x1c]
xor edi, ecx
mov ecx, dword [ebp - 0x18]
sar edx, 0x1f
sar edi, 0x1f
or edi, 1
xor eax, edi
and eax, edx
xor eax, edi
mov edi, dword [ebp + 8]
inc esi
cmp ebx, esi
jne 0x47aa1a
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
cmp edx, esi
jb 0x47aa69
ja 0x47aa83
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
or ecx, dword [edi + edx*4]
inc edx
cmp esi, edx
jne 0x47aa6b
mov edx, ecx
not edx
dec ecx
and ecx, edx
sar ecx, 0x1f
not ecx
or eax, ecx
jmp 0x47aa61
mov edx, ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
or esi, dword [edx + ecx*4]
inc ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], ecx
jne 0x47aa87
mov ecx, esi
not ecx
dec esi
and esi, ecx
sar esi, 0x1f
xor eax, 1
and eax, esi
xor eax, 1
jmp 0x47aa61
Function at 0x47ad80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [edx + 4]
test eax, eax
je 0x47aed8
mov edi, edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [edx]
xor edx, edx
xor esi, esi
or esi, dword [ecx + edx*4]
inc edx
cmp eax, edx
jne 0x47ad9f
test esi, esi
mov esi, dword [ebp - 0x10]
je 0x47aed8
test eax, eax
jle 0x47af02
mov ecx, dword [edi]
test byte [ecx], 1
je 0x47af02
cmp dword [edi + 0xc], 0
jne 0x47af25
cmp eax, 0x801
jae 0x47af33
lea ebx, [esi + 0x14]
cmp ebx, edi
je 0x47ae1c
push eax
push ebx
call fcn.0043dbb0
add esp, 8
test eax, eax
je 0x47aef4
mov eax, dword [edi + 4]
lea ecx, [eax*4]
test ecx, ecx
je 0x47ae11
push ecx
push dword [edi]
push dword [ebx]
call fcn.004ac560
add esp, 0xc
mov eax, dword [edi + 4]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x20], eax
mov edi, ebx
test edi, edi
je 0x47aef4
mov eax, dword [esi + 0x18]
mov ecx, eax
sar ecx, 0x1f
and ecx, eax
mov edx, eax
test edx, edx
jle 0x47af10
mov edi, dword [ebx]
lea esi, [edx - 1]
cmp dword [edi + edx*4 - 4], 0
mov edx, esi
je 0x47ae30
inc esi
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], esi
mov eax, dword [eax + 0x14]
mov ecx, dword [eax]
cmp esi, 2
jb 0x47af1e
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
xor eax, eax
xor esi, esi
inc esi
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x18], 0
xor ebx, ebx
mov dword [ebp - 0x14], esi
and esi, 1
neg esi
mov edi, 0
sbb edi, edi
mov edx, dword [ebp - 0x1c]
and edx, edi
and esi, dword [ebp - 0x20]
mov ecx, edx
xor ecx, eax
and edx, eax
mov eax, esi
xor eax, dword [ebp - 0x14]
and esi, dword [ebp - 0x14]
shrd eax, ecx, 1
shr ecx, 1
add esi, eax
adc edx, ecx
and edi, 0x80000000
shrd dword [ebp - 0x18], ebx, 1
shr ebx, 1
or ebx, edi
mov dword [ebp - 0x14], esi
mov eax, edx
dec dword [ebp - 0x24]
jne 0x47ae7c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ebx
xor eax, eax
inc eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xaa
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x69
push 0
push 3
call fcn.00517980
add esp, 0x14
xor eax, eax
jmp 0x47aed0
push 0xbc
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x44
jmp 0x47aee4
push 0xae
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x68
jmp 0x47aee4
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x18], ecx
test eax, eax
jns 0x47af5b
mov eax, dword [ebx]
mov ecx, dword [eax]
xor eax, eax
jmp 0x47ae5e
push 0xb2
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x6d
jmp 0x47aee4
xor edx, edx
mov esi, 0x800
or edx, dword [ecx + esi*4]
inc esi
cmp eax, esi
jne 0x47af3a
test edx, edx
mov esi, dword [ebp - 0x10]
je 0x47adda
push 0xb6
push str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
push 0x66
jmp 0x47aee4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x20], 0
jmp 0x47af1a
Function at 0x47bcf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x557008]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x47be1d
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [section..00cfg]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [section..00cfg]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x47bdc1
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x47bdb5
lea edi, [esi + 0xf4]
mov eax, dword [0x56b78c]
bt eax, 0x19
jae 0x47be21
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403380
add esp, 0xc
mov ecx, section..text
mov eax, 0x401b90
test edi, edi
je 0x47bdf4
mov dword [edi], ecx
mov dword [esi + 0xf8], eax
lea eax, [ebp - 0x20]
movups xmm0, xmmword [eax]
mov eax, dword [ebp - 0x44]
movups xmmword [eax], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a927c
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x47be09
bt eax, 9
jae 0x47be42
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00403ea0
add esp, 0xc
xor eax, eax
mov ecx, 0x403f50
jmp 0x47bdee
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.004f98d0
add esp, 0xc
mov ecx, 0x4f97d0
mov eax, 0x4fa070
jmp 0x47bdee
Function at 0x47d3d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x47d406
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
nop word [eax + eax]
movzx eax, byte [ecx + esi]
xor al, byte [edx + esi]
or bl, al
inc esi
cmp edi, esi
jne 0x47d3f0
movzx eax, bl
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x47d401
Function at 0x482990
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x557008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x4497a0
lea eax, [ebp - 0x14]
push 0
push eax
push 0x449600
push 0x56c100
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x482a0a
xor esi, esi
cmp dword [0x56c104], 0
jne 0x4829f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x56c108]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x4829f6
mov eax, dword [ebp + 8]
mov esi, dword [edi + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a927c
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004babff
int3
Function at 0x4883a0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.0047fee0
test eax, eax
je 0x4883b9
mov ecx, eax
call fcn.0047fef0
mov ecx, dword [0x56c15c]
cmp ecx, 1
jbe 0x488567
mov dword [ebp - 0x1c], ecx
call fcn.0045c6b0
mov ecx, dword [0x56c164]
mov dword [ebp - 0x10], 0
test ecx, ecx
je 0x4884f1
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, edi
mov esi, edi
cmp edi, 4
jb 0x488426
mov eax, dword [ebp + 0xc]
mov esi, eax
nop dword [eax]
imul edi, dword [edx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add edx, 4
add esi, 0xfffffffc
cmp esi, 3
ja 0x488400
cmp esi, 3
je 0x488504
cmp esi, 2
je 0x48850d
cmp esi, 1
je 0x488516
mov edi, dword [ecx + 4]
test edi, edi
je 0x4884f1
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ebx, eax
shr ebx, 0xf
xor ebx, eax
mov edx, edi
shr edx, 1
and edx, 0x55555555
mov eax, edi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x18], eax
cmp eax, 1
jbe 0x48855d
mov edx, ebx
cmp ebx, edi
jb 0x4884ae
mov eax, ebx
xor edx, edx
div edi
mov eax, dword [ecx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4884f1
mov esi, dword [eax]
test esi, esi
je 0x4884f1
mov dword [ebp - 0x10], edx
lea eax, [edi - 1]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 4]
cmp ebx, eax
jne 0x488530
cmp dword [esi + 0xc], ecx
jne 0x488545
push ecx
push dword [ebp + 8]
push dword [esi + 8]
call fcn.004aaedd
mov ecx, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
jne 0x488545
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
call fcn.0045c710
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
movzx esi, byte [edx + 2]
shl esi, 0x10
xor eax, esi
movzx esi, byte [edx + 1]
shl esi, 8
xor eax, esi
movzx edx, byte [edx]
xor edx, eax
imul eax, edx, 0x5bd1e995
jmp 0x488441
cmp dword [ebp - 0x18], 1
jbe 0x488558
cmp eax, edi
jb 0x488540
xor edx, edx
div edi
mov eax, edx
cmp eax, dword [ebp - 0x10]
jne 0x48854f
mov esi, dword [esi]
test esi, esi
jne 0x4884c9
mov dword [ebp - 0x10], 0
jmp 0x4884f1
and eax, dword [ebp - 0x14]
jmp 0x488540
lea edx, [edi - 1]
and edx, ebx
jmp 0x4884ae
push 0x56c15c
call fcn.004470f0
add esp, 4
test al, al
je 0x48859e
xor eax, eax
mov dword [0x56c160], eax
mov ecx, 0x56c15c
push ecx
push eax
push 0x56c160
push ecx
call fcn.004471c0
add esp, 0x10
mov ecx, 0x56c160
jmp 0x4883c8
mov ecx, dword [0x56c15c]
jmp 0x4883c8
Function at 0x48a800
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2010
call fcn.004aa000
mov eax, dword [0x557008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x55adb0]
cmp eax, 0xffffffff
je 0x48a9dc
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x48a9dc
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.004ac560
add esp, 0xc
mov ecx, dword [0x55adb0]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x2014], ecx
push ecx
call fcn.00458540
add esp, 8
test ebx, ebx
je 0x48a87b
push ebx
call fcn.004a8b4c
add esp, 4
mov ecx, 0x101
lea esi, [ebp - 0x2010]
jmp 0x48a90b
mov ecx, edx
shl ecx, 4
cmp dword [ebp + ecx - 0x1810], 0
je 0x48a8d0
mov esi, dword [ebp + edx*8 - 0x80c]
cmp esi, dword [ebp + ecx - 0x1808]
jne 0x48a8d0
mov ecx, dword [ebp + ecx - 0x180c]
test ecx, ecx
je 0x48a8d0
mov dword [ebp + edx*8 - 0x810], 0
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov al, 1
nop
add ebx, 8
cmp ebx, 0x804
je 0x48a8f0
movzx edx, word [ebp + ebx - 0x2010]
mov edi, dword [ebp + edx*8 - 0x810]
test edi, edi
je 0x48a8d0
jmp 0x48a88b
mov ecx, dword [ebp - 0x2018]
dec ecx
je 0x48aa36
test al, 1
lea esi, [ebp - 0x2010]
je 0x48a9cc
mov dword [ebp - 0x2018], ecx
mov eax, dword [0x56d1c4]
mov ecx, dword [0x55ae20]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x48a9f1
mov ebx, dword [0x56d1c0]
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x48aa3d
push 0x1000
push 0x56c1bc
lea eax, [ebp - 0x1810]
push eax
call fcn.004ac560
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0x800
push 0xff
push esi
call fcn.004acae0
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x1804]
nop word cs:[eax + eax]
mov edx, dword [ecx]
mov dword [ebp + eax*8 - 0x2010], edx
mov word [ebp + eax*8 - 0x200c], ax
inc eax
add ecx, 0x10
cmp eax, 0x100
jne 0x48a990
mov ecx, esi
lea edx, [ebp - 0x1810]
push 1
push 0x10
call fcn.0048aa80
add esp, 8
mov ebx, 4
xor eax, eax
jmp 0x48a8db
push 2
push dword [ebp - 0x2014]
call fcn.00458540
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a927c
add esp, 0x2010
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x56d1c4
call fcn.004a8b87
add esp, 4
cmp dword [0x56d1c4], 0xffffffff
jne 0x48a932
push 4
call fcn.004a8ae0
add esp, 4
mov ebx, eax
mov ecx, eax
call fcn.00475010
mov dword [0x56d1c0], ebx
push 0x56d1c4
call fcn.004a8bfd
add esp, 4
jmp 0x48a932
call fcn.004f1650
jmp 0x48a9cc
mov ecx, ebx
call fcn.00475020
jmp 0x48a947
Function at 0x4a7d70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x4a7da8
mov edx, dword [ebp + 0xc]
xor esi, esi
nop word cs:[eax + eax]
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x54f1a8]
inc esi
cmp ecx, esi
jne 0x4a7d90
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4a92d1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4a9310
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4a9310
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4a9310
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4a9310
cmp dword [ecx + 0x74], 0xe
jbe 0x4a9310
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4b5a67
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004b5bfe
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4b5bd6
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4b5bd6
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4b5b8b
jg 0x4b5ac3
test eax, eax
je 0x4b5b81
push 1
push 0x1000
call fcn.004602f0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4b5ae6
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4b5b78
push 0x8000
push ebx
call fcn.004bacc2
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4b5b0f
jg 0x4b5b0a
cmp ecx, 0x1000
jb 0x4b5b0f
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004bdee5
add esp, 0x10
cmp eax, 0xffffffff
je 0x4b5b54
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4b5b0a
jl 0x4b5b3b
test ecx, ecx
jne 0x4b5afc
push dword [ebp - 0xc]
push ebx
call fcn.004bacc2
push esi
call fcn.00460250
add esp, 0xc
xor ebx, ebx
jmp 0x4b5be4
cmp byte [edi + 0x24], 0
je 0x4b5b6b
cmp dword [edi + 0x20], 5
jne 0x4b5b6b
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4b5b76
mov ebx, dword [edi + 0x18]
jmp 0x4b5b78
xor ebx, ebx
push esi
call fcn.00460250
pop ecx
jmp 0x4b5be4
test ecx, ecx
jg 0x4b5b4d
jl 0x4b5b8b
test eax, eax
jae 0x4b5b4d
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c6e8d
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4b5bab
cmp byte [edi + 0x1c], 0
je 0x4b5b4d
jmp 0x4b5bdc
push ebx
call fcn.004b91fa
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4b5b4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4b5be4
cmp byte [edi + 0x1c], 0
je 0x4b5be1
mov ebx, dword [edi + 0x18]
jmp 0x4b5be4
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004c6e8d
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b8c1b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004aa000
mov eax, dword [0x557008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004b883f
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4b8c5d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4b8db9
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004ca950
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x55b920]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.004c6eeb
mov ecx, dword [esi*4 + 0x55b920]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x4b8db2
cmp eax, dword [ecx + edi + 0x24]
jne 0x4b8db2
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b8db2
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c6eeb
add esp, 0x14
test edx, edx
jl 0x4b8db2
jg 0x4b8d28
test eax, eax
jb 0x4b8db2
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4b8db2
jl 0x4b8d42
cmp dword [ebp - 0x1008], eax
ja 0x4b8db2
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4b8d60
test ebx, ebx
je 0x4b8d99
cmp ecx, edi
jae 0x4b8d99
mov al, byte [ecx]
cmp al, 0xd
jne 0x4b8d7a
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4b8d86
cmp byte [ecx + 1], 0xa
jne 0x4b8d86
inc ecx
jmp 0x4b8d86
movzx eax, al
movsx eax, byte [eax + 0x557280]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4b8d60
cmp edx, ebx
jne 0x4b8d60
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4b8db7
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004a927c
leave
ret
Function at 0x4ba7b2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x55b920]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4ba7f2
cmp byte [ebx], 0xa
jne 0x4ba7f2
or byte [edi + eax + 0x28], 4
jmp 0x4ba7f7
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x4ba8f6
mov dl, byte [eax]
cmp dl, 0x1a
je 0x4ba8d9
inc eax
cmp dl, 0xd
je 0x4ba823
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x4ba849
cmp eax, ecx
jae 0x4ba857
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x4ba80b
jmp 0x4ba8f6
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ba8d4
cmp dword [ebp - 0x10], 0
je 0x4ba8d4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x55b920]
test byte [eax + edi + 0x28], 0x48
je 0x4ba8ae
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4ba899
mov byte [esi], dl
jmp 0x4ba8aa
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x55b920]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4ba8f6
cmp byte [ebp - 1], 0xa
jne 0x4ba8bd
cmp esi, ebx
jne 0x4ba8bd
mov byte [esi], 0xa
jmp 0x4ba8f5
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004c6e8d
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4ba8f6
mov byte [esi], 0xd
jmp 0x4ba8f5
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x55b920]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4ba8f3
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4ba8f6
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4ba8ff
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x55b920]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4ba945
cmp word [ebx], dx
jne 0x4ba945
or byte [eax + edi + 0x28], 4
jmp 0x4ba94a
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x4baaad
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x4baa8d
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4ba98b
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4ba9c1
cmp eax, edx
jae 0x4ba9cf
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x4ba966
jmp 0x4baaad
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4baa88
cmp dword [ebp - 0x18], 0
je 0x4baa88
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x55b920]
test byte [eax + edi + 0x28], 0x48
je 0x4baa5e
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x4baa22
mov word [esi], cx
jmp 0x4baa59
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x55b920]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x55b920]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x55b920]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x4baaad
pop eax
cmp word [ebp - 4], ax
jne 0x4baa6e
cmp esi, ebx
jne 0x4baa6e
mov word [esi], ax
jmp 0x4baaaa
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004c6e8d
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4baaad
push 0xd
pop eax
jmp 0x4baa69
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x55b920]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x4baaa7
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x4baaad
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret