joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48adf0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x64bd30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0x6d3b34
lea eax, [esp + 0x18]
push 0x73aaac
push eax
call fcn.00644050
xor ebp, ebp
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebp
call fcn.00643d62
mov ecx, dword [esp + 0x14]
mov edi, dword [fcn.0065e168]
push ecx
push 1
push 0x6a2340
push 0x6a2338
mov byte [esp + 0x34], 1
call edi
cmp ax, bp
jge 0x48ae57
xor ax, ax
jmp 0x48ae61
cmp ax, 0x1e
jle 0x48ae61
mov ax, 0x1e
cmp ax, bp
mov word [0x6dd7a0], ax
jle 0x48af2a
mov esi, 1
mov dword [esp + 0x18], 0x6dd7de
mov ebx, 0x6dd7a2
push esi
lea edx, [esp + 0x14]
push 0x6a2328
push edx
call fcn.00643d50
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push eax
push 0
push ecx
push 0x6a2338
call edi
push esi
lea edx, [esp + 0x14]
push 0x6a2318
push edx
mov word [ebx], ax
call fcn.00643d50
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
add esp, 0xc
push eax
push 0x1c
push ecx
push 0x6a2314
push edx
push 0x6a2338
call dword [fcn.0065e164]
push esi
lea eax, [esp + 0x14]
push 0x6a2308
push eax
call fcn.00643d50
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
add esp, 0xc
push ecx
push 0
push edx
push 0x6a2338
call edi
mov byte [esi + 0x6ddb61], al
mov eax, dword [esp + 0x18]
add eax, 0x1e
inc ebp
mov dword [esp + 0x18], eax
add ebx, 2
movsx eax, word [0x6dd7a0]
inc esi
cmp ebp, eax
jl 0x48ae82
mov ecx, dword [esp + 0x14]
push ecx
push 1
push 0x6a22fc
push 0x6a22f4
call edi
test ax, ax
jge 0x48af47
xor ax, ax
jmp 0x48af51
cmp ax, 0x1e
jle 0x48af51
mov ax, 0x1e
test ax, ax
mov word [0x6ddb80], ax
jle 0x48afd9
mov esi, 1
mov ebp, 0x6ddbbe
mov ebx, 0x6ddb82
push esi
lea edx, [esp + 0x14]
push 0x6a22e4
push edx
call fcn.00643d50
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push eax
push 0
push ecx
push 0x6a22f4
call edi
push esi
lea edx, [esp + 0x14]
push 0x6a22d4
push edx
mov word [ebx], ax
call fcn.00643d50
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push eax
push 0x1c
push ebp
push 0x6a2314
push ecx
push 0x6a22f4
call dword [fcn.0065e164]
movsx eax, word [0x6ddb80]
add ebx, 2
inc esi
add ebp, 0x1e
lea edx, [esi - 1]
cmp edx, eax
jl 0x48af6b
mov ecx, dword [esp + 0x14]
push ecx
push 1
push 0x6a22c4
push 0x6a22c0
call edi
mov word [0x6ddf42], ax
xor esi, esi
test esi, esi
jne 0x48b008
push 0x6a22b0
lea ecx, [esp + 0x14]
call fcn.006440b6
jmp 0x48b01e
lea edx, [esi + 1]
lea eax, [esp + 0x10]
push edx
push 0x6a22a0
push eax
call fcn.00643d50
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push 0
push edx
push 0x6a22c0
call edi
mov word [esi*2 + 0x6ddf44], ax
inc esi
cmp esi, 5
jl 0x48aff4
mov eax, dword [esp + 0x14]
push eax
push 0xc6
push 0x6ddf4e
push 0x6c7010
push 0x6a2290
push 0x6a228c
call dword [fcn.0065e164]
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call fcn.00643d26
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
call fcn.00643d26
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x48d000
Capabilities:
Read .ini file

Disassembly:
push ecx
push esi
push edi
push 0x69dbe4
lea eax, [esp + 0xc]
push 0x73a890
push eax
call fcn.00643ea6
mov ecx, dword [esp + 8]
push ecx
push 0x30
push 0x6e5c68
push 0x6a2614
push 0x6a2608
push 0x6a2604
call dword [fcn.0065e164]
mov edi, 0x6e5c68
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x6e5c9a
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x6e5c68
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 6
jae 0x48d09a
mov edi, 0x6a25fc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x6e5c9a
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 8]
mov esi, dword [fcn.0065e168]
push eax
push 0
push 0x6a25f0
push 0x6a2604
call esi
mov ecx, dword [esp + 8]
mov dword [0x6e5ccc], eax
push ecx
push 0
push 0x6a25e4
push 0x6a2604
call esi
mov edx, dword [esp + 8]
mov dword [0x6e5cd0], eax
push edx
push 0
push 0x6a25d4
push 0x6a2604
call esi
mov dword [0x6e5cd4], eax
mov eax, dword [esp + 8]
push eax
push 0
push 0x6a25c8
push 0x6a2604
call esi
lea ecx, [esp + 8]
mov dword [0x6e5cd8], eax
call fcn.00643d26
pop edi
pop esi
pop ecx
ret
Function at 0x48dbf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push 0x6a26b0
push 0x80000001
call dword [fcn.0065e008]
test eax, eax
jne 0x48dcc0
push ebx
push esi
push 0x14
mov dword [esp + 0xc], 0x13
mov dword [esp + 0x14], 1
call fcn.00643b70
mov ecx, dword [esp + 0x1c]
add esp, 4
mov esi, eax
lea edx, [esp + 0x18]
push 0x826774
push ecx
push edx
mov byte [esi], 0
call fcn.0064409e
mov eax, dword [eax]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push esi
push edx
push 0
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [0x65e00c]
test eax, eax
lea ecx, [esp + 0x18]
sete bl
call fcn.00643d26
test bl, bl
je 0x48dcaa
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
test ecx, ecx
mov dword [esp + 8], ecx
jle 0x48dca0
mov bl, byte [eax + esi]
dec bl
mov byte [eax + esi], bl
mov ecx, dword [esp + 8]
inc eax
cmp eax, ecx
jl 0x48dc8f
mov ecx, dword [esp + 0x1c]
push esi
call fcn.006440b6
push esi
call fcn.00643cfc
mov ecx, dword [esp + 0x10]
add esp, 4
push ecx
call dword [fcn.0065e010]
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x48dcd0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x64be38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x6a26b0
push 0x80000001
mov dword [esp + 0x34], 0
call dword [0x65e000]
test eax, eax
jne 0x48dd94
mov edx, dword [esp + 0x1c]
push esi
push edi
mov esi, dword [edx - 8]
lea eax, [esi + 1]
push eax
call fcn.00643b70
mov edi, eax
add esp, 4
xor eax, eax
test esi, esi
jle 0x48dd49
mov ecx, dword [esp + 0x24]
mov cl, byte [eax + ecx]
inc cl
mov byte [eax + edi], cl
inc eax
cmp eax, esi
jl 0x48dd38
mov edx, dword [esp + 0x20]
push 0x826774
lea eax, [esp + 0x24]
push edx
push eax
mov byte [edi + esi], 0
call fcn.0064409e
mov eax, dword [eax]
mov ecx, dword [esp + 8]
push esi
push edi
push 1
push 0
push eax
push ecx
call dword [0x65e004]
lea ecx, [esp + 0x20]
call fcn.00643d26
push edi
call fcn.00643cfc
mov edx, dword [esp + 0xc]
add esp, 4
push edx
call dword [fcn.0065e010]
pop edi
pop esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 0xffffffff
call fcn.00643d26
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x48ddc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
push ebx
push ebp
mov ebp, dword [esp + 0x420]
push esi
push edi
push 0x6c7010
mov ecx, ebp
call fcn.006440b6
mov esi, dword [esp + 0x420]
mov edi, dword [fcn.0065f1fc]
push 0x6a26e0
push esi
mov ebx, 0x80000001
call edi
add esp, 8
test eax, eax
je 0x48de08
mov ebx, 0x80000002
add eax, 0x13
jmp 0x48de1a
push 0x6a26cc
push esi
call edi
add esp, 8
test eax, eax
je 0x48de93
add eax, 0x12
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push eax
push ebx
call dword [fcn.0065e008]
test eax, eax
jne 0x48de93
mov ecx, 0xff
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], al
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x428]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x2c], 0x3ff
mov dword [esp + 0x30], 1
call dword [0x65e00c]
test eax, eax
jne 0x48de88
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebp
call fcn.006440b6
mov edx, dword [esp + 0x10]
push edx
call dword [fcn.0065e010]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret

Function at 0x48def0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
push 0
call dword [fcn.0065f718]
lea eax, [esp]
push eax
push 0x679d8c
push 1
push 0
push 0x679d9c
call dword [fcn.0065f714]
test eax, eax
jge 0x48df2a
call dword [fcn.0065f71c]
xor eax, eax
add esp, 0x210
ret
mov eax, dword [esp]
push esi
mov esi, dword [esp + 0x218]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
push esi
call dword [fcn.0065e184]
mov cl, byte [eax + esi - 1]
lea eax, [eax + esi - 1]
cmp cl, 0x5c
je 0x48df5a
mov cl, byte [eax - 1]
dec eax
cmp cl, 0x5c
jne 0x48df51
mov byte [eax], 0
mov eax, dword [esp + 4]
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x24]
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x679dac
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
pop esi
jge 0x48df8f
call dword [fcn.0065f71c]
xor eax, eax
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
lea eax, [esp + 8]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [fcn.0065e1a0]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push 2
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [fcn.0065f71c]
mov eax, 1
add esp, 0x210
ret
Function at 0x48dff0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x64be5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push 0
lea eax, [esp + 8]
push 0x10
push eax
push 0
call dword [fcn.0065f2d8]
lea ecx, [esp]
call fcn.00643d62
mov ecx, dword [esp + 0x118]
lea edx, [esp + 4]
push ecx
push edx
lea eax, [esp + 8]
push 0x6a26f4
push eax
mov dword [esp + 0x120], 0
call fcn.00643d50
mov ecx, dword [esp + 0x10]
push ecx
call dword [fcn.0065f1a0]
add esp, 0x14
lea ecx, [esp]
mov dword [esp + 0x110], 0xffffffff
call fcn.00643d26
mov ecx, dword [esp + 0x108]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x495d80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64c390
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x661a40
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
push eax
push ecx
push edx
call dword [fcn.0065e0c4]
push eax
lea ecx, [esp + 0xc]
call fcn.006440f8
mov esi, dword [esp + 0x28]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.0064407a
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov edi, eax
push ecx
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, esi
call fcn.00644110
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push ecx
push edx
mov ecx, esi
call fcn.0064410a
push edi
mov ecx, esi
call fcn.0064407a
lea ecx, [esp + 8]
call fcn.0064406e
mov dword [esp + 8], 0x661578
lea ecx, [esp + 8]
mov dword [esp + 0x20], 1
call fcn.0064406e
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x20

Function at 0x495fa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64c3b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
xor eax, eax
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x661a40
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x38]
push eax
push ecx
push edx
call dword [fcn.0065e0c4]
push eax
lea ecx, [esp + 0x10]
call fcn.006440f8
mov esi, dword [esp + 0x24]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0064407a
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ebx, eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ecx
push esi
mov ecx, edi
call fcn.00495f40
push ebx
mov ecx, esi
call fcn.0064407a
lea ecx, [esp + 0xc]
call fcn.0064406e
mov dword [esp + 0xc], 0x661578
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 1
call fcn.0064406e
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x20

Function at 0x496080
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64c3d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
xor eax, eax
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x661a40
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
push edx
call dword [fcn.0065e0c4]
push eax
lea ecx, [esp + 0x10]
call fcn.006440f8
mov esi, dword [esp + 0x24]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0064407a
mov ecx, dword [esp + 0x28]
mov ebx, eax
push ecx
push esi
mov ecx, edi
call fcn.00496060
push ebx
mov ecx, esi
call fcn.0064407a
lea ecx, [esp + 0xc]
call fcn.0064406e
mov dword [esp + 0xc], 0x661578
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 1
call fcn.0064406e
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
Function at 0x498cd0
Capabilities:
Create process on windows
Get number of processors

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x64c81f
push eax
mov eax, 0x2aa0
mov dword fs:[0], esp
call fcn.00645130
push ebx
push ebp
push esi
lea eax, [esp + 0x3c]
push edi
push eax
call dword [fcn.0065e194]
mov eax, dword [esp + 0x48]
and al, 0x48

Function at 0x49a150
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
xor ecx, ecx
mov cx, word [0x6f35fe]
xor eax, eax
push ebx
push ebp
push esi
xor esi, esi
cmp ecx, esi
push edi
jle 0x49a181
mov dl, byte [0x6e5bcf]
mov bl, byte [eax + 0x6fb624]
xor bl, dl
mov byte [eax + 0x6fb624], bl
inc eax
cmp eax, ecx
jl 0x49a16e
push 2
lea eax, [esp + 0x14]
push 0x6fb624
push eax
call dword [fcn.0065f1b0]
movsx eax, word [esp + 0x1c]
mov edx, dword [esp + 0x34]
add esp, 0xc
cmp eax, edx
jl 0x49a1a5
mov eax, edx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
lea ebx, [ecx + 8]
movsx ecx, ax
cmp edx, ecx
jge 0x49a1c9
mov ecx, edx
cmp dword [esp + 0x14], ecx
jge 0x49a2c0
movsx eax, word [esp + 0x1c]
lea edx, [esp + 0x1c]
lea esi, [ebx - 8]
push edx
add eax, 0x6fb624
push esi
push eax
call fcn.00555880
movsx cx, byte [esi]
lea edi, [ebx + 0x96]
add esp, 0xc
lea edx, [edi - 0x9d]
push ecx
mov ecx, dword [0x826818]
push edx
call fcn.004467b0
mov ebp, eax
test ebp, ebp
je 0x49a2a4
movsx cx, byte [ebp + 0xec]
mov ax, word [ebp + 0xa]
push edi
push ebx
push eax
push ecx
mov ecx, dword [0x826818]
call fcn.00445660
mov dl, byte [ebp + 0xec]
mov al, byte [0x6e7cc0]
cmp dl, al
jne 0x49a28f
mov esi, ebp
mov eax, 0x6e7cc1
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x49a26b
test cl, cl
je 0x49a267
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x49a26b
add eax, 2
add esi, 2
test cl, cl
jne 0x49a247
xor eax, eax
jmp 0x49a270
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x49a28f
mov eax, dword [0x6e7cca]
test eax, eax
je 0x49a288
push ebx
push ebp
push eax
call fcn.0047a6f0
add esp, 0xc
mov byte [0x6e7cc8], 1
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x49a2a4
push ebp
call fcn.0047f3d0
add esp, 4
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
inc ecx
mov dword [esp + 0x14], ecx
add ebx, 0xfe
jmp 0x49a1c0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
test ecx, ecx
pop ebx
je 0x49a2fc
call fcn.00643ee2
test eax, eax
je 0x49a2ee
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
mov ecx, eax
call fcn.004f0410
mov ax, word [esp]
add esp, 0x10
ret 8
xor eax, eax
mov ecx, eax
call fcn.004f0410
mov ax, word [esp]
add esp, 0x10
ret 8
Function at 0x49a390
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
xor ecx, ecx
mov cx, word [0x6f35fe]
xor eax, eax
push ebx
push ebp
push esi
push edi
test ecx, ecx
jle 0x49a3bf
mov dl, byte [0x6e5bcc]
mov bl, byte [eax + 0x6fb624]
xor bl, dl
mov byte [eax + 0x6fb624], bl
inc eax
cmp eax, ecx
jl 0x49a3ac
push 2
lea eax, [esp + 0x16]
push 0x6fb624
push eax
call dword [fcn.0065f1b0]
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
add esp, 0xc
mov dword [esp + 0x14], 2
xor ebx, ebx
mov ax, word [esp + 0x12]
movsx ecx, ax
cmp ebp, ecx
jge 0x49a3f4
mov ecx, ebp
cmp ebx, ecx
jge 0x49a450
movsx edx, word [esp + 0x14]
lea ecx, [esp + 0x14]
add edx, 0x6fb624
push ecx
push esi
push edx
call fcn.00555da0
movsx ax, byte [esi]
lea edi, [esi + 8]
add esp, 0xc
lea ecx, [edi - 7]
push eax
push ecx
mov ecx, dword [0x826818]
call fcn.004467b0
test eax, eax
je 0x49a447
mov dx, word [eax + 0xa]
mov ecx, dword [0x826818]
movsx ax, byte [eax + 0xec]
push edi
push edx
push eax
call fcn.00445730
inc ebx
add esi, 0xe0
jmp 0x49a3e6
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x49a4d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xd0
xor ecx, ecx
mov cx, word [0x6f35fe]
xor eax, eax
push ebx
push ebp
push esi
xor esi, esi
cmp ecx, esi
jle 0x49a4ff
mov dl, 0x77
mov bl, byte [eax + 0x6fb624]
xor bl, dl
mov byte [eax + 0x6fb624], bl
inc eax
cmp eax, ecx
jl 0x49a4ec
push 2
lea eax, [esp + 0x12]
push 0x6fb624
push eax
call dword [fcn.0065f1b0]
add esp, 0xc
mov ebp, 2
mov dword [esp + 0x10], esi
call fcn.00473cf0
mov dword [esp + 0x18], eax
mov ax, word [esp + 0xe]
cmp ax, si
mov dword [esp + 0x1c], esi
jle 0x49a681
mov ecx, dword [esp + 0xe4]
push edi
mov dword [esp + 0x18], ecx
movsx eax, bp
mov byte [esp + 0x2a], 0
add ebp, 7
mov cl, byte [eax + 0x6fb624]
lea edx, [eax + 0x6fb625]
movsx bx, cl
mov eax, dword [edx]
mov ecx, dword [0x826818]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
mov dx, word [edx + 4]
push ebx
push eax
mov word [esp + 0x30], dx
call fcn.004467b0
mov ecx, dword [esp + 0xe4]
test ecx, ecx
movsx esi, bp
je 0x49a5c9
add esi, 0x6fb624
mov ecx, 0xd
lea edi, [esp + 0x2c]
add ebp, 0x34
test eax, eax
rep movsd dword es:[edi], dword [esi]
je 0x49a61e
mov ecx, dword [esp + 0x1c]
xor edx, edx
add ecx, 0xffffaba0
push 0
test ecx, ecx
setl dl
dec edx
and ecx, edx
mov word [eax + 0xd4], cx
lea ecx, [esp + 0x30]
push ecx
jmp 0x49a605
add esi, 0x6fb624
mov ecx, 0x1f
lea edi, [esp + 0x60]
add ebp, 0x7e
rep movsd dword es:[edi], dword [esi]
test eax, eax
movsw word es:[edi], word [esi]
je 0x49a61e
mov ecx, dword [esp + 0x1c]
xor edx, edx
add ecx, 0xffffaba0
test ecx, ecx
setl dl
dec edx
and ecx, edx
mov word [eax + 0xd6], cx
lea ecx, [esp + 0x60]
push ecx
push 0
mov dx, word [eax + 0xa]
mov ecx, dword [0x826818]
movsx ax, byte [eax + 0xec]
push edx
push eax
call fcn.00445780
mov eax, dword [esp + 0xe8]
test eax, eax
je 0x49a667
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xec]
cmp ecx, eax
jge 0x49a667
mov ecx, dword [0x826818]
lea edx, [esp + 0x24]
push ebx
push edx
call fcn.00446d60
movsx eax, ax
test eax, eax
jl 0x49a667
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
inc edx
mov word [ecx], ax
add ecx, 2
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
mov ax, word [esp + 0x12]
mov ecx, dword [esp + 0x20]
movsx edx, ax
inc ecx
cmp ecx, edx
mov dword [esp + 0x20], ecx
jl 0x49a544
pop edi
mov ecx, dword [esp + 0xe4]
pop esi
pop ebp
pop ebx
test ecx, ecx
je 0x49a694
mov ax, word [esp + 4]
add esp, 0xd0
ret 0xc
Function at 0x49a830
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x64c838
push eax
mov dword fs:[0], esp
sub esp, 0x10
push edi
mov edi, dword [esp + 0x24]
test edi, edi
jne 0x49a866
xor ax, ax
pop edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
push ebx
push esi
push 2
lea eax, [esp + 0x14]
push 0x6fb624
push eax
call dword [fcn.0065f1b0]
mov esi, dword [esp + 0x40]
add esp, 0xc
test esi, esi
mov dword [esp + 0x2c], 4
je 0x49a8c0
push 0
lea ecx, [esp + 0x30]
push 0
push ecx
push esi
push 0x6fb628
call fcn.005551b0
movsx ax, byte [edi + 0xec]
mov dx, word [edi + 0xa]
mov ecx, dword [0x826818]
add esp, 0x14
push 0
push esi
push edx
push eax
call fcn.00445660
movsx cx, byte [edi + 0xec]
push ecx
push edi
call fcn.00555190
push edi
mov byte [esp + 0x40], al
call fcn.0047c830
movsx cx, byte [edi + 0xec]
mov ebx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esp + 0x48]
push eax
push ecx
movsx eax, word [esp + 0x48]
push edi
push edx
add eax, 0x6fb624
push ebx
push eax
call fcn.005560e0
add esp, 0x2c
mov word [ebx], 0x23a
lea eax, [ebx + 0x1a]
mov ecx, 0x77
mov dx, word [eax - 0x1a]
add eax, 0x1a
inc dx
dec ecx
mov word [eax - 0x1a], dx
jne 0x49a918
mov word [ebx + 0xc30], 0x30c
lea eax, [ebx + 0xc4a]
mov ecx, 0x77
mov dx, word [eax - 0x1a]
add eax, 0x1a
inc dx
dec ecx
mov word [eax - 0x1a], dx
jne 0x49a93c
lea ecx, [esp + 0xc]
call fcn.00643d62
movsx eax, byte [edi + 0xec]
push eax
mov dword [esp + 0x28], 0
call fcn.00476a10
mov ecx, dword [0x73aaac]
add esp, 4
lea edx, [esp + 0xc]
push eax
push ecx
push 0x6a1530
push edx
call fcn.00643d50
mov eax, dword [esp + 0x1c]
push 0x6a0008
push eax
call dword [fcn.0065f1b8]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x49aa44
movsx eax, word [edi + 0xa]
push ebp
mov ebp, dword [fcn.0065f1d4]
lea ecx, [eax + eax*4]
push 0
push ecx
push esi
call ebp
push esi
push 5
lea edx, [esp + 0x2c]
push 1
push edx
call dword [fcn.0065f1bc]
mov al, byte [esp + 0x34]
add esp, 0x1c
cmp al, 1
jne 0x49a9ee
mov eax, dword [esp + 0x19]
push 0
push eax
push esi
call ebp
push esi
push 0x1860
push 1
push ebx
call dword [fcn.0065f1b4]
add esp, 0x1c
jmp 0x49aa39
push 2
push 0
push esi
call ebp
push esi
call fcn.00476080
push esi
push 0x1860
push 1
push ebx
mov ebx, dword [fcn.0065f1b4]
mov dword [esp + 0x58], eax
call ebx
movsx eax, word [edi + 0xa]
push 0
lea ecx, [eax + eax*4]
push ecx
push esi
call ebp
mov edx, dword [esp + 0x64]
push esi
push 5
lea eax, [esp + 0x4c]
push 1
push eax
mov byte [esp + 0x54], 1
mov dword [esp + 0x55], edx
call ebx
add esp, 0x3c
push esi
call dword [fcn.0065f1c0]
add esp, 4
pop ebp
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.00643d26
mov ecx, dword [esp + 0x1c]
mov ax, si
pop esi
pop ebx
pop edi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc