joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455330
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x455362
jl 0x455355
test ecx, ecx
jne 0x455362
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x45543f
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x455392
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x455394
xor eax, eax
cdq
mov dword [esp + 0x1c], edx
mov esi, eax
test edx, edx
jl 0x4553e8
jg 0x4553a5
test esi, esi
je 0x4553e8
mov eax, dword [esp + 0x10]
cmp eax, edx
jg 0x4553b9
jl 0x4553b3
cmp ecx, esi
jae 0x4553b9
mov esi, ecx
mov dword [esp + 0x1c], eax
push esi
push dword [esp + 0x1c]
push edi
call fcn.006d8770
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub ecx, esi
mov eax, dword [eax]
sbb edx, dword [esp + 0x1c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x14]
jmp 0x45540c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x455428
mov ecx, dword [esp + 0xc]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
lea eax, [ebx + 0x2c]
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
test edx, edx
jg 0x455377
jl 0x455428
test ecx, ecx
jne 0x455377
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x45547d
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x45547d
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.006d8770
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x4554e7
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x4554a3
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x4554d2
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.006e2c33
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x4554e7
cmp edi, eax
ja 0x4554b0
test edi, edi
je 0x4554e7
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.006e2c33
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x457a80
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x7c2580]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, 1
lock xadd dword [0x7cad50], eax
inc eax
mov ebx, 0x7cad54
cmp eax, 1
jne 0x457ac9
lea eax, [esp + 0x28]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [ebx], eax
cmp byte [ebp + 8], 0
je 0x457b54
xor esi, esi
lock xadd dword [ebx], esi
test esi, esi
je 0x457b54
mov ecx, dword [0x7c30f8]
mov eax, dword [0x7c30fc]
cmp ecx, 0x257edfd1
jne 0x457af7
cmp eax, 0xb2ab117a
je 0x457b06
cmp ecx, 0x257edfd0
jne 0x457b0a
cmp eax, 0xb2ab117a
jne 0x457b0a
mov al, 1
jmp 0x457b1a
mov eax, dword [0x7c30f0]
mov ecx, 0x7c30f0
push esi
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0x7c30f0
mov dword [esp + 0xc], str.F:_vcpkg_2024.05.24installedx86_windows_staticinclude_boost_asiodetailimplwinsock_init.ipp
mov dword [esp + 0x10], str.void___cdecl_boost::asio::detail::winsock_init_base::throw_on_error_struct_boost::asio::detail::winsock_init_base::data__
mov dword [esp + 0x14], 0x48
mov dword [esp + 0x18], 0x1a
test al, 1
jne 0x457b6d
mov ecx, dword [esp + 0x1bc]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.006d66cb
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0xc]
mov edx, str.winsock
push eax
lea ecx, [esp + 0x20]
call fcn.00450a90
int3

Function at 0x45bee0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x706340
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x7c2580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.006d684e
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.006c2823
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.0045ba50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45c2c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x706340
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x7c2580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.006d684e
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.006c2823
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.0045ba50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46d0f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
shr edi, 2
test edi, edi
je 0x46d13a
mov ecx, dword [esp + 0xc]
add ecx, 2
push esi
nop dword [eax]
movzx esi, byte [ecx + 1]
lea ecx, [ecx + 4]
movzx eax, byte [ecx - 4]
movzx edx, byte [ecx - 6]
shl esi, 8
or esi, eax
movzx eax, byte [ecx - 5]
shl esi, 8
or esi, eax
shl esi, 8
or esi, edx
xor ebx, esi
sub edi, 1
jne 0x46d110
pop esi
pop edi
mov eax, ebx
pop ebx
ret
Function at 0x476840
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x476850
mov ax, word [esp + 8]
pop esi
ret
push ebx
mov ebx, dword [esp + 0x10]
test bl, 1
je 0x47687d
movzx eax, byte [ebx]
inc ebx
mov ecx, dword [esp + 0xc]
xor eax, ecx
movzx eax, al
shr cx, 8
mov dword [esp + 0x10], ebx
xor cx, word [eax*2 + 0x7c4a00]
dec esi
movzx eax, cx
jmp 0x476881
mov eax, dword [esp + 0xc]
cmp esi, 8
jb 0x476939
push edi
mov edi, esi
shr edi, 3
movzx edx, word [ebx]
sub esi, 8
movzx ecx, word [ebx + 2]
movzx eax, ax
xor edx, eax
mov eax, edx
shr eax, 8
movzx ebx, word [eax*2 + 0x7c4a00]
movzx eax, dl
movzx eax, word [eax*2 + 0x7c4c00]
xor ebx, eax
mov eax, dword [esp + 0x14]
xor ebx, ecx
lea edx, [eax + 6]
movzx ecx, word [eax + 4]
mov eax, ebx
shr eax, 8
movzx eax, word [eax*2 + 0x7c4a00]
mov dword [esp + 0x14], eax
movzx eax, bl
mov ebx, dword [esp + 0x14]
movzx eax, word [eax*2 + 0x7c4c00]
xor ebx, eax
lea eax, [edx + 2]
xor ebx, ecx
mov dword [esp + 0x14], eax
movzx ecx, word [edx]
mov eax, ebx
shr eax, 8
movzx edx, word [eax*2 + 0x7c4a00]
movzx eax, bl
mov ebx, dword [esp + 0x14]
movzx eax, word [eax*2 + 0x7c4c00]
xor edx, eax
xor edx, ecx
mov ecx, edx
movzx eax, dl
shr ecx, 8
mov cx, word [ecx*2 + 0x7c4a00]
xor cx, word [eax*2 + 0x7c4c00]
movzx eax, cx
sub edi, 1
jne 0x476890
pop edi
test esi, esi
je 0x47695f
nop dword [eax]
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
xor ecx, eax
shr ax, 8
movzx ecx, cl
xor ax, word [ecx*2 + 0x7c4a00]
movzx eax, ax
sub esi, 1
jne 0x476940
pop ebx
pop esi
ret
Function at 0x47d860
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x2c]
xorps xmm0, xmm0
push esi
mov eax, 1
movlpd qword [esp + 0x14], xmm0
xor cl, cl
movlpd qword [esp + 0x1c], xmm0
mov dword [esp + 0x24], 0
lea edx, [ebx - 1]
push edi
mov edi, dword [esp + 0x30]
cmp ebx, eax
jbe 0x47d90a
cmp edx, 0x20
jb 0x47d900
and edx, 0x1f
mov ecx, ebx
sub ecx, edx
xorps xmm2, xmm2
xorps xmm1, xmm1
nop word [eax + eax]
movups xmm0, xmmword [eax + edi]
xorps xmm2, xmm0
movups xmm0, xmmword [edi + eax + 0x10]
add eax, 0x20
xorps xmm1, xmm0
cmp eax, ecx
jb 0x47d8b0
xorps xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 1
xorps xmm1, xmm0
movd ecx, xmm1
cmp eax, ebx
jae 0x47d914
nop dword [eax]
xor cl, byte [edi + eax]
inc eax
cmp eax, ebx
jb 0x47d900
jmp 0x47d914
xor cl, cl
test ebx, ebx
je 0x47d9a2
cmp cl, byte [edi]
jne 0x47d9a2
push 0x28
push 1
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 1
call fcn.006dc77f
mov esi, eax
add esp, 8
test esi, esi
je 0x47d9a2
push ebx
push edi
push 0
call fcn.006be3c0
xor ecx, ecx
mov dword [esi + 0x10], eax
lea eax, [esp + 0x18]
or ecx, ebx
push 1
push eax
mov dword [esi + 0x14], ecx
call fcn.0047ec10
add esp, 0x14
test eax, eax
je 0x47d9cc
lea eax, [esp + 0xc]
push eax
call fcn.0047ecb0
inc eax
push eax
mov dword [esi + 4], eax
call fcn.006e38fe
add esp, 8
mov dword [esi], eax
test eax, eax
jne 0x47d9ab
push dword [esi]
mov edi, dword [esi + 0x20]
call fcn.006e27a3
push dword [esi + 8]
call fcn.006e27a3
push esi
call fcn.006e27a3
add esp, 0xc
mov esi, edi
test edi, edi
jne 0x47d981
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
xor edi, edi
cmp dword [esi + 4], edi
jbe 0x47d9cc
lea eax, [esp + 0xc]
push 8
push eax
call fcn.0047ec10
mov ecx, dword [esi]
add esp, 8
mov byte [edi + ecx], al
inc edi
cmp edi, dword [esi + 4]
jb 0x47d9b2
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x4839f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 0x440]
mov esi, dword [eax]
lea eax, [esp + 0xc]
push eax
push ebp
push esi
push edi
call fcn.00483c00
add esp, 0x10
test eax, eax
jne 0x483b00
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push edi
call fcn.00483c00
add esp, 0x10
test eax, eax
jne 0x483b00
lea eax, [esp + 0x24]
push eax
push ebp
push esi
push edi
call fcn.00485e20
add esp, 0x10
test eax, eax
jne 0x483b00
mov ax, word [esp + 0x24]
movsx ecx, byte [esi + 0x5268]
shr ax, 0xd
add ecx, 3
movzx edx, ax
movzx eax, ax
mov dword [esp + 0x1c], eax
mov eax, ecx
sar eax, 3
and cl, 7
add dword [esi + 0x526c], eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffffc
mov byte [esi + 0x5268], cl
push ebx
cmp eax, 0x3ffffc
ja 0x483aea
cmp edx, 3
ja 0x483aea
mov eax, dword [esi + 0x4b30]
or eax, dword [esi + 0x4b34]
je 0x483b07
mov ebx, dword [esi + 0x4b38]
lea eax, [esi + 0x4b38]
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x483b07
mov eax, dword [esp + 0x10]
lea edx, [esi + 0x60]
mov dword [esp + 0x14], edx
cdq
mov ecx, edx
mov edx, eax
add edx, dword [esi + 0x60]
mov eax, ebx
mov dword [esp + 0x28], edx
adc ecx, dword [esi + 0x64]
cdq
add eax, dword [esi + 0x4b30]
adc edx, dword [esi + 0x4b34]
cmp ecx, edx
jl 0x483aea
jg 0x483b18
cmp dword [esp + 0x28], eax
jae 0x483b18
push str.Invalid_filter_encountered
push 0x2a
push edi
call fcn.004649c0
mov eax, 0xffffffe2
add esp, 0xc
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
lea ecx, [esi + 0x60]
lea eax, [esi + 0x4b38]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
push 0x20
push 1
call fcn.006dc77f
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x483bf2
lea edx, [esi + 0x4b24]
test edx, edx
je 0x483b61
movzx ecx, word [edx + 4]
movzx eax, word [edx + 6]
inc ecx
cmp eax, ecx
je 0x483b61
movzx ecx, word [edx + 2]
mov eax, dword [edx + 8]
mov dword [eax + ecx*4], ebx
mov ax, word [edx + 2]
inc ax
and ax, word [edx + 4]
inc word [edx + 6]
mov word [edx + 2], ax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
movzx eax, ax
mov dword [ebx], eax
mov eax, 0
add ecx, dword [edx]
adc eax, dword [edx + 4]
cmp word [esp + 0x20], 0
mov edx, dword [esp + 0x18]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], edx
mov dword [esi + 0x4b30], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x4b34], eax
mov eax, dword [ebx + 0x18]
mov dword [ecx], eax
jne 0x483be8
lea eax, [esp + 0x28]
push eax
push ebp
push esi
push edi
call fcn.00485e20
add esp, 0x10
test eax, eax
jne 0x483aff
movsx ecx, byte [esi + 0x5268]
add ecx, 5
mov eax, ecx
and cl, 7
sar eax, 3
add dword [esi + 0x526c], eax
movzx eax, word [esp + 0x28]
shr eax, 0xb
inc eax
mov byte [esi + 0x5268], cl
mov dword [ebx + 4], eax
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x14
ret
push str.Cant_allocate_memory_for_a_filter_descriptor.
push 0xc
jmp 0x483af1
Function at 0x489fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dl, byte [esi]
test dl, dl
jns 0x48a09f
mov al, dl
push ebx
mov ebx, dword [esp + 0x1c]
and al, 0x40
push edi
mov byte [esp + 0x1c], al
je 0x489fea
or ecx, 0xffffffff
or edi, 0xffffffff
jmp 0x489ffb
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
neg al
sbb al, al
mov byte [esp + 0xf], al
mov al, dl
and al, 0x7f
or dl, 0x80
cmp byte [esp + 0x1c], 0
movzx eax, al
movzx edx, dl
cmove edx, eax
mov al, byte [esp + 0xf]
cmp ebx, 8
jbe 0x48a02f
dec ebx
cmp dl, al
jne 0x48a073
mov dl, byte [esi + 1]
inc esi
cmp ebx, 8
ja 0x48a021
xor al, dl
jl 0x48a073
sub ebx, 1
je 0x48a059
nop dword [eax + eax]
shld edi, ecx, 8
movzx eax, dl
lea esi, [esi + 1]
cdq
shl ecx, 8
or edi, edx
mov dl, byte [esi]
or ecx, eax
sub ebx, 1
jne 0x48a040
shld edi, ecx, 8
movzx eax, dl
cdq
shl ecx, 8
or ecx, eax
or edi, edx
mov edx, edi
mov eax, ecx
pop edi
pop ebx
pop esi
add esp, 0xc
ret
cmp byte [esp + 0x1c], 0
je 0x48a08c
mov edi, accept
xor ecx, ecx
mov edx, edi
mov eax, ecx
pop edi
pop ebx
pop esi
add esp, 0xc
ret
mov edi, accept
or ecx, 0xffffffff
mov edx, edi
mov eax, ecx
pop edi
pop ebx
pop esi
add esp, 0xc
ret
push 8
push dword [esp + 0x1c]
push esi
call fcn.0048a0c0
add esp, 0xc
pop esi
add esp, 0xc
ret

Function at 0x48b3d0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, dword [esp + 0x14]
mov ecx, 0xa
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
cmp ebp, ecx
cmovg ecx, ebp
test ebp, ebp
js 0x48b450
push ebx
nop dword [eax]
test ecx, ecx
je 0x48b424
mov bl, byte [esi]
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x48b424
movsx eax, bl
lea edx, [edi - 6]
lea edx, [edi + edx*4]
inc esi
lea edi, [eax + edx*2]
mov eax, 0x66666667
imul ecx
lea eax, [edi + edi*4]
sar edx, 2
add eax, eax
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp eax, ebp
jle 0x48b3f0
pop ebx
cmp esi, dword [esp + 0x10]
je 0x48b450
cmp edi, dword [esp + 0x18]
jl 0x48b441
cmp edi, ebp
jg 0x48b441
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
mov dword [ecx], esi
pop esi
pop ebp
ret
mov ecx, dword [esp + 0x14]
mov eax, 0xfffffffe
pop edi
mov dword [ecx], esi
pop esi
pop ebp
ret
mov ecx, dword [esp + 0x14]
or eax, 0xffffffff
pop edi
mov dword [ecx], esi
pop esi
pop ebp
ret
Function at 0x48e5a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x10], esi
cmovb esi, dword [esp + 0x10]
test esi, esi
je 0x48e62e
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
sub ebp, ebx
mov eax, dword [edi + 8]
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
lea eax, [esp + 0x24]
push 1
push eax
shr ecx, 8
xor cl, byte [ebx + ebp]
mov byte [ebx], cl
mov eax, dword [edi]
not eax
mov byte [esp + 0x2c], cl
push eax
call fcn.006be3c0
not eax
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
mov byte [esp + 0x2c], al
lea eax, [esp + 0x2c]
push eax
mov eax, dword [edi + 8]
not eax
push eax
call fcn.006be3c0
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [edi + 8], eax
sub esi, 1
jne 0x48e5c3
pop edi
pop ebp
pop ebx
pop esi
ret
Function at 0x4996b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x14]
test ebp, 0xffff7fff
jne 0x49978b
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x49972a
call ebx
cmp eax, 3
jne 0x499711
push edi
call fcn.00499bd0
mov esi, eax
add esp, 4
test esi, esi
jne 0x499705
call fcn.006e39b1
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49972a
call ebx
push eax
call fcn.004995f0
push esi
call fcn.006e27a3
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x499783
push 0
push 0x2000001
push 3
push 0
push 0
push 0
test esi, esi
je 0x49974a
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x499751
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
call fcn.006e27a3
add esp, 4
cmp edi, 0xffffffff
jne 0x499773
call ebx
push eax
call fcn.004995f0
add esp, 4
or eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push edi
call fcn.006e3df8
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
test esi, esi
jne 0x49981f
push dword [esp + 0x1c]
push ebp
push edi
call fcn.006e49db
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x4998a6
call fcn.006e39b1
cmp dword [eax], 0xd
jne 0x4997fe
test ebp, 0x100
je 0x4997fe
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4997d4
call ebx
push eax
call fcn.004995f0
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x4997eb
call fcn.006e39b1
pop edi
pop esi
pop ebp
mov dword [eax], 0x15
or eax, 0xffffffff
pop ebx
ret
call fcn.006e39b1
pop edi
pop esi
pop ebp
mov dword [eax], 0xd
or eax, 0xffffffff
pop ebx
ret
call fcn.006e39b1
cmp dword [eax], 2
jne 0x4998a6
push edi
call fcn.00499bd0
mov esi, eax
add esp, 4
test esi, esi
je 0x4996f2
push dword [esp + 0x1c]
push ebp
push esi
call fcn.006e4a81
mov edi, eax
add esp, 0xc
test edi, edi
jns 0x499896
call fcn.006e39b1
cmp dword [eax], 0xd
jne 0x499896
test ebp, 0x100
je 0x499896
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x49986c
call ebx
push eax
call fcn.004995f0
add esp, 4
push esi
call fcn.006e27a3
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x49988b
call fcn.006e39b1
push esi
mov dword [eax], 0x15
call fcn.006e27a3
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
call fcn.006e39b1
mov dword [eax], 0xd
push esi
call fcn.006e27a3
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x4998b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x4998c7
call fcn.006e39b1
mov dword [eax], 9
or eax, 0xffffffff
ret
cmp dword [esp + 0xc], 0
je 0x499938
push eax
call fcn.006e3d8e
add esp, 4
lea ecx, [esp + 4]
push 0
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x499933
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x49990d
call fcn.006e39b1
mov dword [eax], 0xb
or eax, 0xffffffff
ret
cmp eax, 0x6d
je 0x499938
cmp eax, 5
jne 0x499926
call fcn.006e39b1
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.004995f0
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret
xor eax, eax
ret

Function at 0x499e10
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x499e27
call fcn.006e39b1
mov dword [eax], 9
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call fcn.006e3d8e
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x499e71
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x499e64
call fcn.006e39b1
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.004995f0
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret
Function at 0x4a34d0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
lea eax, [esi + 0x20]
push eax
call fcn.006d8cf0
mov edx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
movzx ecx, byte [edx + 3]
shl ecx, 8
movzx eax, byte [edx + 2]
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
xor ecx, 0x6a09e667
mov dword [esi], ecx
movzx ecx, byte [edx + 7]
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
xor ecx, 0xbb67ae85
mov dword [esi + 4], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
xor ecx, 0x3c6ef372
mov dword [esi + 8], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
xor ecx, 0xa54ff53a
mov dword [esi + 0xc], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
xor ecx, 0x510e527f
mov dword [esi + 0x10], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
xor ecx, 0x9b05688c
mov dword [esi + 0x14], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x18]
shl ecx, 8
or ecx, eax
xor ecx, 0x1f83d9ab
mov dword [esi + 0x18], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
shl ecx, 8
or ecx, eax
xor ecx, 0x5be0cd19
mov dword [esi + 0x1c], ecx
movzx eax, byte [edx]
mov dword [esi + 0x74], eax
xor eax, eax
pop esi
ret