joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448590
Capabilities:
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov eax, dword [0x4d1698]
xor eax, esp
mov dword [esp + 0xf8], eax
push ebx
push esi
mov ebx, ecx
push edi
mov eax, 0x66
mov dword [esp + 0x18], ebx
call fcn.0043e6f0
test eax, eax
je 0x448623
push 0x62
lea edi, [eax + 4]
push 0
push edi
mov dword [eax], 0x62
call fcn.004953d0
add esp, 0xc
test edi, edi
je 0x448623
mov eax, 0x45
call fcn.0043e6f0
test eax, eax
je 0x448607
push 0x41
lea esi, [eax + 4]
push 0
push esi
mov dword [eax], 0x41
mov dword [esp + 0x28], esi
call fcn.004953d0
add esp, 0xc
test esi, esi
jne 0x44863a
mov eax, dword [edi - 4]
add edi, 0xfffffffc
add eax, 4
push eax
push 0
push edi
call fcn.004953d0
add esp, 0xc
mov eax, edi
call fcn.0043e9d0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf8]
xor ecx, esp
call fcn.0048c97b
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
xor eax, eax
mov cl, 0x23
test edx, edx
jle 0x448655
cmp byte [ebx + eax], 0
jl 0x448652
inc eax
cmp eax, edx
jl 0x448645
jmp 0x448655
mov cl, byte [ebx + eax]
lea eax, [ecx - 4]
imul cl
mov cl, al
movsx edx, cl
mov byte [esp + 0x13], cl
xor esi, esi
mov dword [esp + 0x14], edx
lea ebx, [ecx - 1]
test bl, bl
jne 0x448672
mov bl, 0xee
mov edx, dword [esp + 0x14]
movsx eax, bl
lea ebx, [edx + eax*2 + 8]
cdq
idiv ebx
mov bl, al
test bl, bl
jne 0x448689
lea ebx, [ecx + 0x63]
mov byte [edi + esi], bl
inc esi
cmp esi, 0x62
jl 0x44866c
push 0x40
xor esi, esi
lea eax, [esp + 0x3c]
push 0x4d4ab8
push eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.0048ca30
add esp, 0xc
mov dword [esp + 0xf8], esi
push 0x62
mov eax, edi
lea esi, [esp + 0x24]
mov byte [esp + 0x24], 0
call fcn.0047be60
add esp, 4
xor ecx, ecx
test bl, bl
jne 0x4486dc
mov bl, 0xee
mov edx, dword [esp + 0x14]
movsx eax, bl
lea esi, [edx + eax*2 + 8]
cdq
idiv esi
mov bl, al
test bl, bl
jne 0x4486f7
mov bl, byte [esp + 0x13]
add bl, 0x63
mov byte [edi + ecx], bl
inc ecx
cmp ecx, 0x62
jl 0x4486d6
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esp + 0x1c]
lea esi, [esp + 0x24]
call fcn.0047be60
add esp, 4
push 0x62
mov eax, edi
call fcn.0047be60
mov ebx, dword [esp + 0x20]
add esp, 4
push ebx
mov ecx, esi
call fcn.0047bf10
add esp, 4
push 0x62
push 0
push edi
call fcn.004953d0
mov ecx, dword [edi - 4]
lea esi, [edi - 4]
add esp, 0xc
add ecx, 4
push ecx
push 0
push esi
call fcn.004953d0
add esp, 0xc
mov eax, esi
call fcn.0043e9d0
xor ecx, ecx
lea ebx, [ebx]
cmp byte [ebx + ecx], 0
jne 0x44877b
mov dl, 0xb
mov al, cl
imul dl
mov dl, 0xf5
sub dl, al
mov byte [ebx + ecx], dl
test dl, dl
jne 0x44877b
mov byte [ebx + ecx], 0x83
inc ecx
cmp ecx, 0x40
jl 0x448760
mov ecx, dword [esp + 0x104]
pop edi
pop esi
mov byte [ebx + 0x40], 0
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0048c97b
mov esp, ebp
pop ebp
ret
Function at 0x44a780
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
mov eax, dword [0x4d1698]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
xor eax, eax
push esi
mov esi, ecx
mov word [0x4da978], ax
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
cmp eax, ebx
jne 0x44a7d1
mov edi, 0xfffffffe
call fcn.004503b0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.0048c97b
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x14]
cmp edx, 0x10
jb 0x44a7db
mov ecx, dword [esi]
cmp byte [ecx + eax - 1], 0x2f
je 0x44a7b0
cmp edx, 0x10
jb 0x44a7eb
mov ecx, dword [esi]
jmp 0x44a7ed
mov ecx, esi
cmp byte [ecx + eax - 1], 0x5c
je 0x44a7b0
push 1
mov edi, 0xf
push 0x4b88d8
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
call fcn.00403d10
push 1
lea ecx, [esp + 0x30]
push ecx
push esi
call fcn.0044a570
add esp, 0xc
cmp eax, 0xffffffff
jle 0x44a854
mov edi, 0xfffffffe
call fcn.004503b0
lea ecx, [esp + 0x2c]
call fcn.00403cc0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.0048c97b
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.00403f50
mov eax, dword [esi + 0x10]
mov edi, 0x10
cmp dword [esi + 0x14], edi
jb 0x44a87c
mov esi, dword [esi]
cmp byte [esi + eax - 1], 0x3a
jne 0x44a90d
cmp byte [ebp + 8], bl
jne 0x44a8bf
mov edi, 0xfffffffe
call fcn.004503b0
lea ecx, [esp + 0x10]
call fcn.00403cc0
lea ecx, [esp + 0x2c]
call fcn.00403cc0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.0048c97b
mov esp, ebp
pop ebp
ret
push 0x5c
push 1
lea esi, [esp + 0x18]
call fcn.004042a0
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], edi
jae 0x44a8d8
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea ecx, [esp + 0x10]
cmp eax, 1
je 0x44a89a
call fcn.00403cc0
lea ecx, [esp + 0x2c]
call fcn.00403cc0
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.0048c97b
mov esp, ebp
pop ebp
ret
push 0x140
lea edx, [esp + 0x4c]
push ebx
push edx
call fcn.004953d0
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp dword [esp + 0x24], edi
jae 0x44a92e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x48]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x44a896
test byte [esp + 0x48], 0x10
je 0x44a950
cmp byte [ebp + 8], 1
jmp 0x44a953
cmp byte [ebp + 8], bl
jne 0x44a957
mov bl, 1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x10]
call fcn.00403cc0
lea ecx, [esp + 0x2c]
call fcn.00403cc0
mov ecx, dword [esp + 0x18c]
pop edi
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0048c97b
mov esp, ebp
pop ebp
ret
Function at 0x44e360
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x4d1698]
xor eax, esp
mov dword [esp + 0x8c], eax
push esi
push edi
xor edi, edi
push edi
push 0x4aeeef
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], edi
mov byte [esp + 0x14], 0
call fcn.00403d10
cmp dword [ebp + 0x1c], 0x10
mov eax, dword [ebp + 8]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x84], edi
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], 0x98badcfe
mov dword [esp + 0x34], 0x10325476
mov dword [esp + 0x38], 0xc3d2e1f0
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], edi
jae 0x44e3ef
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0x18]
lea esi, [esp + 0x2c]
call fcn.00447f70
add esp, 4
cmp dword [esp + 0x8c], edi
jne 0x44e431
cmp dword [esp + 0x88], edi
jne 0x44e421
call fcn.004484e0
mov dword [esp + 0x88], 1
push 0x14
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x14]
call fcn.00403d10
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], 0xf
lea edi, [esp + 0xc]
mov esi, ebx
mov byte [ebx], 0
call fcn.00403ee0
mov esi, 0x10
cmp dword [esp + 0x20], esi
jb 0x44e461
mov eax, dword [esp + 0xc]
push eax
call fcn.0048cd91
add esp, 4
mov byte [esp + 0xc], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xf
cmp dword [ebp + 0x1c], esi
jb 0x44e487
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048cd91
add esp, 4
mov ecx, dword [esp + 0x94]
pop edi
pop esi
xor ecx, esp
mov eax, ebx
call fcn.0048c97b
mov esp, ebp
pop ebp
ret
Function at 0x451980
Capabilities:
Log keystrokes via application hook

Disassembly:
push ecx
mov eax, dword [0x4d1698]
xor eax, esp
mov dword [esp], eax
xor eax, eax
cmp byte [0x4da977], 1
push edi
mov word [0x4da978], ax
jne 0x4519b4
lea edi, [eax - 0x19]
call fcn.004503b0
xor al, al
pop edi
mov ecx, dword [esp]
xor ecx, esp
call fcn.0048c97b
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0x451960
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x4db39c], eax
test eax, eax
jne 0x4519ec
or edi, 0xffffffff
call fcn.004503b0
xor al, al
pop edi
mov ecx, dword [esp]
xor ecx, esp
call fcn.0048c97b
pop ecx
ret
mov ecx, dword [esp + 4]
pop edi
xor ecx, esp
mov byte [0x4da976], 1
mov byte [0x4da977], 1
mov al, 1
call fcn.0048c97b
pop ecx
ret

Function at 0x452b60
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
mov dword [ebp], 0
mov dword [eax], 0
test ebx, ebx
jne 0x452b7f
or eax, 0xffffffff
pop ebp
ret
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0
push edx
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x452b7a
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x452c0c
lea eax, [edi + 4]
call fcn.0043e6f0
test eax, eax
je 0x452bcc
push esi
push edi
lea esi, [eax + 4]
push 0
push esi
mov dword [eax], edi
call fcn.004953d0
add esp, 0xc
mov eax, esi
pop esi
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push eax
push 0
push 0
push edx
push ebx
mov dword [ebp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x452c02
mov eax, dword [ebp]
push eax
call fcn.0043f830
add esp, 4
pop edi
mov dword [ebp], 0
or eax, 0xffffffff
pop ebp
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [edx], ecx
pop edi
xor eax, eax
pop ebp
ret
Function at 0x455cc0
Capabilities:
Hash data using sha512

Disassembly:
sub esp, 0xec
mov eax, dword [0x4d1698]
xor eax, esp
mov dword [esp + 0xe4], eax
push ebx
push esi
push 0x40
xor ebx, ebx
lea eax, [esp + 0x24]
push 0x4d4ab8
push eax
mov esi, ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.0048ca30
mov ecx, dword [esi + 0x10]
add esp, 0xc
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0xe0], ebx
mov byte [esp + 8], bl
jb 0x455d16
mov eax, dword [esi]
jmp 0x455d18
mov eax, esi
push ecx
lea esi, [esp + 0xc]
call fcn.0047be60
mov ecx, dword [0x4d5600]
add esp, 4
cmp ecx, ebx
je 0x455d4f
cmp dword [0x4d5604], 0x10
mov eax, dword [0x4d55f0]
jae 0x455d42
mov eax, 0x4d55f0
push ecx
lea esi, [esp + 0xc]
call fcn.0047be60
add esp, 4
push edi
lea ecx, [esp + 0xc]
call fcn.0047bf10
mov ecx, dword [esp + 0xf0]
add esp, 4
pop esi
pop ebx
xor ecx, esp
call fcn.0048c97b
add esp, 0xec
ret
Function at 0x4704a0
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x4db2e4]
push ebx
push ebp
push esi
push edi
mov ebx, 1
test eax, eax
jne 0x4704da
push eax
push eax
push 0x43fc80
call fcn.0048f491
add esp, 0xc
cmp eax, 0xffffffff
je 0x4704da
jmp 0x4704d0
mov ecx, dword [0x4db2e4]
cmp ecx, ebx
jne 0x4704d0
call fcn.00446060
cmp dword [0x4db388], 0
jne 0x4704fa
push 0x400
call fcn.0048d82a
add esp, 4
mov dword [0x4db388], eax
push 0
mov byte [0x4da974], bl
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x470513
mov byte [0x4da974], 0
mov eax, 0xa0
call fcn.0043e6f0
test eax, eax
je 0x470545
push 0x9c
lea esi, [eax + 4]
push 0
push esi
mov dword [eax], 0x9c
call fcn.004953d0
add esp, 0xc
test esi, esi
je 0x470545
call fcn.004422e0
jmp 0x470547
xor eax, eax
mov dword [eax + 0x98], eax
mov dword [0x4db2e8], eax
call fcn.0046f220
cmp dword [0x4d54ec], 0x10
mov edx, dword [0x4d54d8]
mov byte [0x4da958], 0
jae 0x470572
mov edx, 0x4d54d8
xor eax, eax
mov ecx, 0x4aeeef
call fcn.00403be0
test eax, eax
jne 0x470593
cmp dword [0x4d54e8], eax
setne al
test eax, eax
je 0x47061b
mov edx, dword [0x4da960]
push edx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
cmp eax, ebx
jne 0x47061b
mov eax, dword [0x4da95c]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push eax
push 0x4d7610
mov byte [0x4da958], bl
call esi
test eax, eax
je 0x47061b
mov ebx, dword [sym.imp.USER32.dll_IsDialogMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
cmp eax, 0xffffffff
je 0x47061b
mov ecx, dword [0x4da95c]
push 0x4d7610
push ecx
call ebx
test eax, eax
jne 0x4705fc
push 0x4d7610
call edi
push 0x4d7610
call ebp
cmp dword [0x4db3d0], 2
je 0x47061b
mov edx, dword [0x4da95c]
push 0
push 0
push edx
push 0x4d7610
call esi
test eax, eax
jne 0x4705d7
push 0
call fcn.00490ed3
int3
Function at 0x476740
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
xor eax, eax
cmp ecx, edx
je 0x476773
push esi
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [ecx]
lea esi, [esi + edi - 0x61c88647]
inc ecx
xor eax, esi
mov dword [esp + 0xc], ecx
cmp ecx, edx
jne 0x476750
pop edi
pop esi
ret

Function at 0x476b40
Capabilities:
Hash data using crc32b

Disassembly:
cmp byte [0x4db4f0], 0
jne 0x476bf9
push ebx
push esi
push edi
xor bl, bl
xor eax, eax
mov cl, 0x80
test bl, cl
je 0x476b5f
xor eax, 0x80000000
test eax, eax
jns 0x476b6c
add eax, eax
xor eax, 0x4c11db7
jmp 0x476b6e
add eax, eax
shr cl, 1
jne 0x476b56
mov edx, eax
xor esi, esi
xor eax, eax
test dl, 1
je 0x476b8d
mov ecx, 0x1f
sub ecx, eax
mov edi, 1
shl edi, cl
or esi, edi
inc eax
shr edx, 1
cmp eax, 0x20
jb 0x476b78
xor cl, cl
test bl, 1
je 0x476b9e
mov cl, 0x80
mov al, bl
shr al, 1
test al, 1
je 0x476ba9
or cl, 0x40
shr al, 1
test al, 1
je 0x476bb2
or cl, 0x20
shr al, 1
test al, 1
je 0x476bbb
or cl, 0x10
shr al, 1
test al, 1
je 0x476bc4
or cl, 8
shr al, 1
test al, 1
je 0x476bcd
or cl, 4
shr al, 1
test al, 1
je 0x476bd6
or cl, 2
test al, 2
je 0x476bdd
or cl, 1
inc bl
movzx eax, cl
mov dword [eax*4 + 0x4db500], esi
jne 0x476b52
pop edi
pop esi
mov byte [0x4db4f0], 1
pop ebx
ret

Function at 0x47b180
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push 0x20
lea eax, [esi + 0x10]
xor ebx, ebx
push 0x4d47d8
push eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.0048ca30
add esp, 0xc
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov byte [esi], bl
pop ebx
ret
Function at 0x47b8d0
Capabilities:
Hash data using sha512

Disassembly:
push ebx
push 0x40
xor ebx, ebx
lea eax, [esi + 0x18]
push 0x4d4ab8
push eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.0048ca30
add esp, 0xc
mov dword [esi + 0xd8], ebx
mov byte [esi], bl
pop ebx
ret
Function at 0x47c2f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [0x4d1698]
xor eax, esp
mov dword [esp + 0x10], eax
push ebp
push esi
push edi
push 0x20
mov edi, ecx
call fcn.0048d82a
mov esi, eax
xor ebp, ebp
add esp, 4
cmp esi, ebp
je 0x47c3b1
push 0x4bf8cc
push edi
call fcn.0048d0d9
mov edi, eax
add esp, 8
mov dword [esi], edi
cmp edi, ebp
je 0x47c3a8
push edi
push 1
lea eax, [esp + 0x14]
push 0x10
push eax
mov dword [esp + 0x1c], 0x76504653
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call fcn.0048f994
add esp, 0x10
test eax, eax
je 0x47c39f
push edi
call fcn.00495b0f
add esp, 4
test eax, eax
jne 0x47c39f
mov ecx, dword [esp + 0x18]
add ecx, 0x10
mov byte [esi + 4], 1
mov dword [esi + 0x14], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ecx
mov dword [esi + 0x18], 1
mov dword [esi + 0x1c], ebp
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0048c97b
add esp, 0x18
ret
push edi
call fcn.0048d6c3
add esp, 4
push esi
call fcn.0048d7f0
add esp, 4
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0048c97b
add esp, 0x18
ret

Function at 0x47c3d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [0x4d1698]
xor eax, esp
mov dword [esp + 0x10], eax
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push 0x20
mov edi, ecx
call fcn.0048d82a
mov esi, eax
add esp, 4
test esi, esi
je 0x47c49d
push 0x4aeee4
push edi
mov byte [esi + 4], 0
call fcn.0048d0d9
mov edi, eax
add esp, 8
mov dword [esi], edi
test edi, edi
je 0x47c485
push 0
push ebp
push edi
call fcn.0048d5da
add esp, 0xc
test eax, eax
jne 0x47c485
push edi
mov edi, 1
push edi
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.0048d33a
add esp, 0x10
test eax, eax
je 0x47c485
cmp dword [esp + 0xc], 0x76504653
jne 0x47c485
cmp dword [esp + 0x10], edi
jne 0x47c485
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea ecx, [eax + ebp + 0x10]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x14], ebp
mov dword [esi + 0x10], ecx
mov dword [esi + 8], 0
mov dword [esi + 0xc], edx
mov dword [esi + 0x18], edi
mov eax, esi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0048c97b
add esp, 0x14
ret
mov eax, dword [esi]
test eax, eax
je 0x47c494
push eax
call fcn.0048d6c3
add esp, 4
push esi
call fcn.0048d7f0
add esp, 4
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0048c97b
add esp, 0x14
ret
Function at 0x47c4c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4d1698]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [edi + 8]
push ebp
push esi
cmp eax, dword [edi + 0xc]
jae 0x47c5a7
mov ecx, dword [edi + 0x10]
mov edx, dword [edi]
push 0
push ecx
push edx
call fcn.0048d5da
add esp, 0xc
test eax, eax
jne 0x47c5a7
mov eax, dword [edi]
push eax
push 1
lea ecx, [esp + 0x14]
push 0x10
push ecx
call fcn.0048d33a
add esp, 0x10
test eax, eax
je 0x47c5a7
cmp dword [esp + 0xc], 0x76504653
jne 0x47c5a7
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea ebp, [eax + ecx + 0x10]
test ebx, ebx
je 0x47c5d2
lea edx, [eax + ecx + 0x15]
push edx
call fcn.0048d82a
mov esi, eax
add esp, 4
test esi, esi
je 0x47c5a7
lea eax, [esi + 0x14]
mov dword [esi], eax
mov ecx, dword [edi]
mov edx, dword [esp + 0x10]
push ecx
push 1
push edx
push eax
call fcn.0048d33a
add esp, 0x10
cmp eax, 1
jb 0x47c59e
mov eax, dword [esi]
mov ecx, dword [esp + 0x10]
mov byte [ecx + eax], 0
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x47c5bb
mov edx, dword [esi]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x10]
lea eax, [edx + eax + 1]
mov dword [esi + 0x10], eax
mov ecx, dword [edi]
mov edx, dword [esp + 0x14]
push ecx
push 1
push edx
push eax
call fcn.0048d33a
add esp, 0x10
test eax, eax
jne 0x47c5c1
push esi
call fcn.0048d7f0
add esp, 4
or eax, 0xffffffff
pop esi
pop ebp
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0048c97b
add esp, 0x1c
ret
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov eax, dword [edi + 0x10]
add eax, ebp
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x18]
mov dword [esi + 8], ecx
mov dword [ebx], esi
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
inc dword [edi + 8]
add edx, ebp
add dword [edi + 0x10], edx
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0048c97b
add esp, 0x1c
ret
Function at 0x47c600
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x4d1698]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x14]
push ebx
lea edx, [eax + ecx + 0x10]
push esi
mov dword [edi + 8], 0
mov dword [edi + 0x10], edx
lea ebx, [ebx]
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x47c6ff
mov ecx, dword [edi + 0x10]
mov edx, dword [edi]
push 0
push ecx
push edx
call fcn.0048d5da
add esp, 0xc
test eax, eax
jne 0x47c6ff
mov eax, dword [edi]
push eax
push 1
lea ecx, [esp + 0x14]
push 0x10
push ecx
call fcn.0048d33a
add esp, 0x10
test eax, eax
je 0x47c6ff
cmp dword [esp + 0xc], 0x76504653
jne 0x47c6ff
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea edx, [eax + ecx + 0x15]
push edx
lea ebx, [eax + ecx + 0x10]
call fcn.0048d82a
mov esi, eax
add esp, 4
test esi, esi
je 0x47c6ff
lea eax, [esi + 0x14]
mov dword [esi], eax
mov ecx, dword [edi]
mov edx, dword [esp + 0x10]
push ecx
push 1
push edx
push eax
call fcn.0048d33a
add esp, 0x10
cmp eax, 1
jb 0x47c6f6
mov eax, dword [esi]
mov ecx, dword [esp + 0x10]
mov byte [ecx + eax], 0
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x47c712
mov edx, dword [esi]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x10]
lea eax, [edx + eax + 1]
mov dword [esi + 0x10], eax
mov ecx, dword [edi]
mov edx, dword [esp + 0x14]
push ecx
push 1
push edx
push eax
call fcn.0048d33a
add esp, 0x10
test eax, eax
jne 0x47c718
push esi
call fcn.0048d7f0
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0048c97b
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov eax, dword [edi + 0x10]
add eax, ebx
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x18]
mov dword [esi + 8], ecx
mov edx, dword [esp + 0x18]
inc dword [edi + 8]
mov ecx, dword [ebp + 8]
add edx, ebx
add dword [edi + 0x10], edx
mov eax, dword [esi]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47c758
test dl, dl
je 0x47c754
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47c758
add eax, 2
add ecx, 2
test dl, dl
jne 0x47c738
xor eax, eax
jmp 0x47c75d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47c76f
push esi
call fcn.0048d7f0
add esp, 4
jmp 0x47c630
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0048c97b
mov esp, ebp
pop ebp
ret
Function at 0x47cab0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xec
mov eax, dword [0x4d1698]
xor eax, esp
mov dword [esp + 0xe8], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp esi, ebx
je 0x47cc8a
push 0x48c
call fcn.0048d82a
add esp, 4
mov edi, eax
mov eax, dword [ebp + 8]
push 0x20
mov dword [edi], eax
mov dword [edi + 0x464], ebx
lea ecx, [esp + 0x24]
push 0x4d47d8
push ecx
mov dword [esp + 0x18], edi
mov byte [esp + 0xb4], bl
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.0048ca30
mov eax, esi
add esp, 0xc
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov byte [esp + 0x10], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x47cb31
sub eax, edx
push eax
mov eax, esi
lea esi, [esp + 0x14]
call fcn.0047b730
lea edx, [esp + 0x8c]
add esp, 4
push edx
mov ecx, esi
call fcn.0047b7e0
add esp, 4
lea eax, [esp + 0xa8]
lea ecx, [esp + 0x88]
call fcn.0047ca00
lea eax, [esp + 0xa8]
push eax
add edi, 4
mov bl, 1
call fcn.0047e260
mov edi, dword [esp + 0x10]
add esp, 4
add edi, 0x234
je 0x47cc54
push 0x40
lea ecx, [esp + 0xac]
push ecx
lea ebx, [edi + 8]
push ebx
mov byte [edi], 0
mov dword [edi + 4], pe_nt_image_headers32
call fcn.0048dfd0
mov eax, dword [edi + 4]
cdq
and edx, 7
add eax, edx
sar eax, 3
add esp, 0xc
xor esi, esi
test eax, eax
jle 0x47cc30
movsx ecx, byte [ebx]
lea eax, [ecx - 0x30]
cmp eax, 9
jbe 0x47cbe8
lea edx, [ecx - 0x61]
cmp edx, 5
ja 0x47cbdd
lea eax, [ecx - 0x57]
jmp 0x47cbe8
lea eax, [ecx - 0x41]
cmp eax, 5
ja 0x47cc54
lea eax, [ecx - 0x37]
movsx ecx, byte [ebx + 1]
lea edx, [ecx - 0x30]
shl eax, 4
add ebx, 2
cmp edx, 9
ja 0x47cbfe
xor eax, edx
jmp 0x47cc18
lea edx, [ecx - 0x61]
cmp edx, 5
ja 0x47cc0b
add ecx, 0xffffffa9
jmp 0x47cc16
lea edx, [ecx - 0x41]
cmp edx, 5
ja 0x47cc54
add ecx, 0xffffffc9
xor eax, ecx
mov byte [esp + esi + 0x88], al
mov eax, dword [edi + 4]
cdq
and edx, 7
add eax, edx
inc esi
sar eax, 3
cmp esi, eax
jl 0x47cbc5
lea eax, [edi + 0x50]
lea ecx, [esp + 0x88]
call fcn.00480700
mov dword [edi + 0x4c], eax
lea eax, [edi + 0x140]
lea ecx, [esp + 0x88]
call fcn.00480700
cmp dword [ebp + 8], 0
mov esi, dword [esp + 0xc]
setne al
inc al
lea ebx, [esi + 0x478]
lea edi, [esp + 0xa8]
call fcn.0047e3a0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe8]
xor ecx, esp
call fcn.0048c97b
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xf4]
pop edi
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.0048c97b
mov esp, ebp
pop ebp
ret