joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8980
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x10
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov dword [esp], edx
mov edx, dword [ecx + 4]
mov ecx, dword [ecx + 8]
push esi
push edi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
xor edi, edi
jmp 0x4b89b0
mov ecx, dword [eax + 0xc]
and ecx, 0xfffd
or ecx, 2
mov esi, ecx
mov edx, dword [eax + 4]
xor esi, 1
imul esi, ecx
movzx ecx, byte [esp + edi + 8]
sar esi, 8
xor esi, ecx
xor esi, edx
and esi, 0xff
mov ecx, dword [esi*4 + 0x5e3798]
shr edx, 8
xor ecx, edx
mov dword [eax + 4], ecx
movzx ecx, cl
add ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
imul ecx, ecx, 0x8088405
add ecx, 1
mov dword [eax + 8], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5e3798]
shr edx, 8
xor ecx, edx
mov dword [eax + 0xc], ecx
and ecx, 0xfffd
or ecx, 2
mov esi, ecx
mov edx, dword [eax + 4]
xor esi, 1
imul esi, ecx
movzx ecx, byte [esp + edi + 9]
sar esi, 8
xor esi, ecx
xor esi, edx
and esi, 0xff
mov ecx, dword [esi*4 + 0x5e3798]
shr edx, 8
xor ecx, edx
mov dword [eax + 4], ecx
movzx ecx, cl
add ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
imul ecx, ecx, 0x8088405
add ecx, 1
mov dword [eax + 8], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5e3798]
shr edx, 8
xor ecx, edx
mov dword [eax + 0xc], ecx
mov edx, dword [eax + 4]
and ecx, 0xfffd
or ecx, 2
mov esi, ecx
xor esi, 1
imul esi, ecx
movzx ecx, byte [esp + edi + 0xa]
sar esi, 8
xor esi, ecx
xor esi, edx
and esi, 0xff
mov ecx, dword [esi*4 + 0x5e3798]
shr edx, 8
xor ecx, edx
mov edx, dword [eax + 0xc]
mov dword [eax + 4], ecx
movzx ecx, cl
add ecx, dword [eax + 8]
imul ecx, ecx, 0x8088405
add ecx, 1
mov dword [eax + 8], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5e3798]
shr edx, 8
xor ecx, edx
mov dword [eax + 0xc], ecx
mov esi, dword [eax + 4]
and ecx, 0xfffd
or ecx, 2
mov edx, ecx
xor ecx, 1
imul ecx, edx
sar ecx, 8
xor cl, byte [esp + edi + 0xb]
add edi, 4
movzx edx, cl
xor edx, esi
and edx, 0xff
mov edx, dword [edx*4 + 0x5e3798]
shr esi, 8
xor edx, esi
mov esi, dword [eax + 0xc]
mov dword [eax + 4], edx
movzx edx, dl
add edx, dword [eax + 8]
imul edx, edx, 0x8088405
add edx, 1
mov dword [eax + 8], edx
shr edx, 0x18
xor edx, esi
and edx, 0xff
shr esi, 8
xor esi, dword [edx*4 + 0x5e3798]
cmp edi, 0xc
mov dword [eax + 0xc], esi
jl 0x4b89b0
xor edx, edx
cmp byte [esp + 0x28], dl
pop edi
pop esi
je 0x4b8b60
mov eax, dword [esp + 0x18]
shr eax, 8
jmp 0x4b8b67
mov eax, dword [esp + 0x1c]
shr eax, 0x18
cmp al, cl
mov ecx, dword [esp + 0xc]
sete dl
xor ecx, esp
mov al, dl
call fcn.004d99c4
add esp, 0x10
ret 0x10
Function at 0x4b8ba0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
xor edi, edi
cmp dword [esp + 0xc], edi
jbe 0x4b8c20
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
movzx edx, byte [edi + ebx]
mov ebp, dword [ecx + 4]
xor edx, ebp
and edx, 0xff
mov edx, dword [edx*4 + 0x5e3798]
mov eax, dword [ecx + 0xc]
shr ebp, 8
xor edx, ebp
mov dword [ecx + 4], edx
movzx edx, dl
add edx, dword [ecx + 8]
mov esi, eax
imul edx, edx, 0x8088405
add edx, 1
mov dword [ecx + 8], edx
shr edx, 0x18
xor edx, eax
shr eax, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x5e3798]
and esi, 0xfffd
mov dword [ecx + 0xc], eax
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
sar eax, 8
xor byte [edi + ebx], al
add edi, 1
cmp edi, dword [esp + 0x18]
jb 0x4b8bb0
pop esi
pop ebp
pop ebx
pop edi
ret 8

Function at 0x4b8c30
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004b8870
push 0
call fcn.004dd499
add esp, 4
mov edi, eax
mov dword [esp + 0x14], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul eax, edi
push eax
call fcn.004dc8ad
add esp, 4
xor ebp, ebp
call fcn.004dc8ba
mov ebx, eax
sar ebx, 6
test bl, bl
jne 0x4b8c72
mov bl, al
mov edi, dword [esi + 4]
mov eax, dword [esi + 0xc]
movzx ecx, bl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5e3798]
shr edi, 8
xor ecx, edi
mov dword [esi + 4], ecx
movzx ecx, cl
add ecx, dword [esi + 8]
mov edx, eax
imul ecx, ecx, 0x8088405
add ecx, 1
mov dword [esi + 8], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x5e3798]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0xc], eax
and edx, 0xfffd
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
sar eax, 8
xor al, bl
mov byte [ecx + ebp], al
add ebp, 1
cmp ebp, 0xa
jl 0x4b8c62
mov ebp, dword [esp + 0x1c]
mov edi, dword [esi + 4]
mov ebx, ebp
sar ebx, 0x10
mov eax, dword [esi + 0xc]
movzx ecx, bl
xor ecx, edi
and ecx, 0xff
shr edi, 8
mov dword [esp + 0x1c], edi
mov edi, dword [ecx*4 + 0x5e3798]
xor edi, dword [esp + 0x1c]
mov edx, eax
mov dword [esp + 0x1c], edi
movzx ecx, byte [esp + 0x1c]
add ecx, dword [esi + 8]
mov dword [esi + 4], edi
imul ecx, ecx, 0x8088405
add ecx, 1
mov dword [esi + 8], ecx
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x5e3798]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0xc], eax
and edx, 0xfffd
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
sar eax, 8
xor al, bl
mov byte [ecx + 0xa], al
mov edi, dword [esi + 4]
mov ebx, ebp
sar ebx, 0x18
mov eax, dword [esi + 0xc]
movzx ecx, bl
xor ecx, edi
and ecx, 0xff
shr edi, 8
mov dword [esp + 0x1c], edi
mov edi, dword [ecx*4 + 0x5e3798]
xor edi, dword [esp + 0x1c]
mov edx, eax
mov dword [esp + 0x1c], edi
movzx ecx, byte [esp + 0x1c]
add ecx, dword [esi + 8]
mov dword [esi + 4], edi
imul ecx, ecx, 0x8088405
add ecx, 1
mov dword [esi + 8], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x5e3798]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0xc], eax
and edx, 0xfffd
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
pop edi
pop esi
sar eax, 8
xor al, bl
pop ebp
mov byte [ecx + 0xb], al
pop ebx
add esp, 8
ret 8
Function at 0x4b8df0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fad4a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00465c50
xor ebx, ebx
lea ecx, [esi + 0x4c]
mov dword [esp + 0x18], ebx
mov dword [esi], vtable.ExeResource.0
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov byte [esi + 0x48], bl
mov byte [esi + 0x49], bl
call fcn.00451c20
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 1
mov dword [esi + 0x68], ebx
mov byte [esi + 0x6c], bl
call fcn.00451c20
lea ecx, [esi + 0xa0]
mov byte [esp + 0x18], 2
mov byte [esi + 0x8c], bl
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x9c], ebx
call fcn.00458b60
lea ecx, [esi + 0xb4]
mov byte [esp + 0x18], 3
call fcn.00458b60
lea ecx, [esi + 0xcc]
mov byte [esp + 0x18], 4
mov word [esi + 0xc8], bx
mov byte [esi + 0xca], bl
call fcn.00451c20
xor eax, eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x1c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x4b90b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
cmp byte [esi + 0x48], 0
push edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x10], esi
je 0x4b91b6
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x20]
push eax
push 0x10
lea ecx, [esi + 0x30]
push ecx
push ebp
mov dword [esp + 0x30], 0
call ebx
mov edx, dword [esp + 0x1c]
push 0x5e72f8
push edx
mov ecx, edi
call fcn.0046fee0
lea ecx, [esi + 0xa0]
call fcn.004c06c0
xor esi, esi
test eax, eax
mov dword [esp + 0x20], eax
jle 0x4b9155
mov ecx, dword [esp + 0x10]
push esi
add ecx, 0xa0
call fcn.004c0780
push 0
lea ecx, [esp + 0x18]
push ecx
push 8
add eax, 0x40
push eax
push ebp
mov dword [esp + 0x28], 0
call ebx
mov edx, dword [esp + 0x14]
push 0x5e72f8
push edx
mov ecx, edi
call fcn.0046fee0
add esi, 1
cmp esi, dword [esp + 0x20]
jl 0x4b9113
mov ecx, dword [esp + 0x10]
add ecx, 0xb4
call fcn.004c06c0
xor esi, esi
test eax, eax
mov dword [esp + 0x20], eax
jle 0x4b91b2
mov edi, edi
mov ecx, dword [esp + 0x10]
push esi
add ecx, 0xb4
call fcn.004c0780
push 0
lea ecx, [esp + 0x18]
push ecx
push 8
add eax, 0x40
push eax
push ebp
mov dword [esp + 0x28], 0
call ebx
mov edx, dword [esp + 0x14]
push 0x5e72f8
push edx
mov ecx, edi
call fcn.0046fee0
add esi, 1
cmp esi, dword [esp + 0x20]
jl 0x4b9170
mov esi, dword [esp + 0x10]
lea ebx, [esi + 0xa0]
mov ecx, ebx
call fcn.004c06c0
xor esi, esi
test eax, eax
mov dword [esp + 0x20], eax
jle 0x4b91f2
lea ecx, [ecx]
push esi
mov ecx, ebx
call fcn.004c0780
mov ecx, dword [esp + 0x24]
add ecx, 4
push ecx
push edi
push ebp
mov ecx, eax
call fcn.004b90b0
add esi, 1
cmp esi, dword [esp + 0x20]
jl 0x4b91d0
mov ebx, dword [esp + 0x10]
add ebx, 0xb4
mov ecx, ebx
call fcn.004c06c0
xor esi, esi
test eax, eax
mov dword [esp + 0x20], eax
jle 0x4b9237
mov eax, dword [esp + 0x24]
add eax, 4
mov dword [esp + 0x24], eax
push esi
mov ecx, ebx
call fcn.004c0780
mov ecx, dword [esp + 0x24]
push ecx
push edi
push ebp
mov ecx, eax
call fcn.004b90b0
add esi, 1
cmp esi, dword [esp + 0x20]
jl 0x4b9218
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 0xc
Function at 0x4b9250
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x48], 0
mov dword [esp + 0x10], edi
jne 0x4b9296
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x20]
push eax
push 0x10
lea ecx, [edi + 0x20]
push ecx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x1c]
push 0x5e72f8
push eax
mov ecx, ebp
call fcn.0046fee0
add edi, 0xa0
mov ecx, edi
call fcn.004c06c0
mov ebx, eax
xor esi, esi
test ebx, ebx
jle 0x4b92d4
jmp 0x4b92b0
push esi
mov ecx, edi
call fcn.004c0780
mov ecx, dword [esp + 0x20]
add ecx, 4
push ecx
mov ecx, dword [esp + 0x1c]
push ebp
push ecx
mov ecx, eax
call fcn.004b9250
add esi, 1
cmp esi, ebx
jl 0x4b92b0
mov edi, dword [esp + 0x10]
add edi, 0xb4
mov ecx, edi
call fcn.004c06c0
mov ebx, eax
xor esi, esi
test ebx, ebx
jle 0x4b9319
mov edx, dword [esp + 0x20]
add edx, 4
mov dword [esp + 0x20], edx
push esi
mov ecx, edi
call fcn.004c0780
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push ecx
push ebp
push edx
mov ecx, eax
call fcn.004b9250
add esi, 1
cmp esi, ebx
jl 0x4b92f8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 0xc

Function at 0x4b9330
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [ecx + 0xca], 0
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
je 0x4b93c6
lea esi, [ecx + 0xcc]
mov ecx, esi
call fcn.00452770
mov ecx, esi
mov ebp, eax
call fcn.004c49f0
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x20]
push ecx
push 2
lea edx, [esp + 0x24]
movzx eax, ax
push edx
push ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0
call esi
mov eax, dword [esp + 0x1c]
push 0x5e72f8
push eax
mov ecx, edi
call fcn.0046fee0
movzx edx, word [esp + 0x18]
push 0
lea ecx, [esp + 0x20]
push ecx
add edx, edx
push edx
push ebp
push ebx
call esi
mov eax, dword [esp + 0x1c]
push 0x5e72f8
push eax
mov ecx, edi
call fcn.0046fee0
push ebp
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [esp + 0x10]
lea ebp, [ecx + 0xa0]
mov ecx, ebp
call fcn.004c06c0
xor esi, esi
test eax, eax
mov dword [esp + 0x1c], eax
jle 0x4b9402
lea ecx, [ecx]
push esi
mov ecx, ebp
call fcn.004c0780
mov ecx, dword [esp + 0x20]
add ecx, 4
push ecx
push edi
push ebx
mov ecx, eax
call fcn.004b9330
add esi, 1
cmp esi, dword [esp + 0x1c]
jl 0x4b93e0
mov ebp, dword [esp + 0x10]
add ebp, 0xb4
mov ecx, ebp
call fcn.004c06c0
xor esi, esi
test eax, eax
mov dword [esp + 0x1c], eax
jle 0x4b9447
mov ecx, dword [esp + 0x20]
add ecx, 4
mov dword [esp + 0x20], ecx
push esi
mov ecx, ebp
call fcn.004c0780
mov edx, dword [esp + 0x20]
push edx
push edi
push ebx
mov ecx, eax
call fcn.004b9330
add esi, 1
cmp esi, dword [esp + 0x1c]
jl 0x4b9428
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 0xc
Function at 0x4b9460
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4fadeb
mov eax, dword fs:[0]
push eax
mov eax, 0x106c
call fcn.004de8a0
mov eax, dword [0x5e4ce0]
xor eax, esp
mov dword [esp + 0x1068], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x1080]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1094]
mov ebp, dword [esp + 0x1090]
mov esi, ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], eax
call fcn.004537d0
xor ebx, ebx
lea ecx, [esi + 0x70]
mov dword [esp + 0x1088], ebx
call fcn.004c06c0
push eax
lea ecx, [esp + 0x24]
call fcn.00453a60
lea ecx, [esp + 0x20]
push ebx
push ecx
call fcn.00456880
mov edi, eax
or esi, 0xffffffff
add esp, 8
cmp edi, esi
je 0x4b9508
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
je 0x4b9508
cmp eax, esi
jne 0x4b951f
push ebx
push edi
call fcn.004661e0
add esp, 8
lea ecx, [esp + 0x20]
mov dword [esp + 0x1088], esi
call fcn.00453880
xor eax, eax
jmp 0x4b959f
mov esi, eax
push 0
lea edx, [esp + 0x18]
push edx
push 0x1000
lea eax, [esp + 0x88]
push eax
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b957e
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x20]
push ecx
push edx
lea eax, [esp + 0x88]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0x5e72f8
push eax
add ebx, eax
call fcn.0046fee0
sub esi, dword [esp + 0x14]
jne 0x4b9521
push 0
push edi
call fcn.004661e0
add esp, 8
lea ecx, [esp + 0x20]
mov dword [esp + 0x1088], 0xffffffff
call fcn.00453880
mov eax, ebx
mov ecx, dword [esp + 0x1080]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1068]
xor ecx, esp
call fcn.004d99c4
add esp, 0x1078
ret 8
Function at 0x4b95d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, ecx
cmp byte [ebx + 0x48], 0
push esi
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], ebx
jne 0x4b9679
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
cmp byte [ebx + 0x6c], dl
mov dword [esp + 0x2c], edx
je 0x4b960d
push edi
push ebp
call fcn.004b9460
mov dword [esp + 0x2c], eax
jmp 0x4b963d
mov ecx, dword [ebx + 0x90]
cmp ecx, edx
je 0x4b963f
mov eax, dword [ebx + 0x94]
cmp eax, edx
je 0x4b963f
push edx
lea edx, [esp + 0x30]
push edx
push eax
push ecx
push ebp
call esi
mov eax, dword [esp + 0x2c]
push 0x5e72f8
push eax
mov ecx, edi
call fcn.0046fee0
xor edx, edx
mov eax, dword [ebx + 0x98]
cmp eax, edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
je 0x4b9679
push edx
lea ecx, [esp + 0x30]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
push ebp
call esi
mov eax, dword [esp + 0x2c]
push 0x5e72f8
push eax
mov ecx, edi
call fcn.0046fee0
add ebx, 0xa0
mov ecx, ebx
call fcn.004c06c0
xor esi, esi
test eax, eax
mov dword [esp + 0x2c], eax
jle 0x4b96b2
push esi
mov ecx, ebx
call fcn.004c0780
mov ecx, dword [esp + 0x30]
add ecx, 4
push ecx
push edi
push ebp
mov ecx, eax
call fcn.004b95d0
add esi, 1
cmp esi, dword [esp + 0x2c]
jl 0x4b9690
mov ebx, dword [esp + 0x10]
add ebx, 0xb4
mov ecx, ebx
call fcn.004c06c0
xor esi, esi
test eax, eax
mov dword [esp + 0x2c], eax
jle 0x4b96f7
mov ecx, dword [esp + 0x30]
add ecx, 4
mov dword [esp + 0x30], ecx
push esi
mov ecx, ebx
call fcn.004c0780
mov edx, dword [esp + 0x30]
push edx
push edi
push ebp
mov ecx, eax
call fcn.004b95d0
add esi, 1
cmp esi, dword [esp + 0x2c]
jl 0x4b96d8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret 0xc
Function at 0x4bacd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4faf76
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x30]
mov dword [esi + 8], ebx
mov byte [esi + 0x48], 1
mov ecx, dword [eax]
mov dword [esi + 0x30], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x34], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x38], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x3c], edx
movzx ecx, word [eax + 0xc]
test ecx, ecx
movzx ebp, word [eax + 0xe]
mov dword [esp + 0x28], ebp
lea edi, [eax + 0x10]
jle 0x4bad8f
mov dword [esp + 0x30], ecx
push 0xe8
call fcn.004cabe6
add esp, 4
mov dword [esp + 0x14], eax
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x20], ebp
je 0x4bad58
mov ecx, eax
call fcn.004b8df0
mov ebp, eax
push ebp
lea ecx, [esi + 0xa0]
mov dword [esp + 0x24], 0xffffffff
call fcn.00458d20
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
push eax
push ebx
push 1
push ecx
push edi
mov ecx, ebp
call fcn.004baa10
add edi, 8
sub dword [esp + 0x30], 1
jne 0x4bad34
mov ebp, dword [esp + 0x28]
test ebp, ebp
jle 0x4badf9
add esi, 0xb4
mov dword [esp + 0x30], esi
lea ecx, [ecx]
push 0xe8
call fcn.004cabe6
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x20], 1
je 0x4badc8
mov ecx, eax
call fcn.004b8df0
mov esi, eax
jmp 0x4badca
xor esi, esi
mov ecx, dword [esp + 0x30]
push esi
mov dword [esp + 0x24], 0xffffffff
call fcn.00458d20
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
push edx
push ebx
push 1
push eax
push edi
mov ecx, esi
call fcn.004baa10
add edi, 8
sub ebp, 1
jne 0x4bada0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10

Function at 0x4bae30
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov dword [0x5e72fc], eax
mov dword [esp + 0x1c], 0
call fcn.004b9710
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.004b97d0
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004b9860
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004b9900
mov ecx, esi
call fcn.004b8fd0
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
push 0
push edi
push ebx
mov ecx, esi
call fcn.004b90b0
push 0
push edi
push ebx
mov ecx, esi
call fcn.004b9250
push 0
push edi
push ebx
mov ecx, esi
call fcn.004b9330
push 0
push edi
push ebx
mov ecx, esi
call fcn.004b95d0
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
xor edx, edx
div esi
test edx, edx
je 0x4baf0b
sub esi, edx
push ebp
push esi
call fcn.004cabe6
push esi
mov ebp, eax
push 0x58
push ebp
call fcn.004db150
add esp, 0x10
push 0
lea edx, [esp + 0x24]
push edx
push esi
push ebp
push ebx
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x20]
push 0x5e72f8
push eax
mov ecx, edi
call fcn.0046fee0
push ebp
call fcn.004cac16
add esp, 4
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
ret 0x10
Function at 0x4c3bc0
Capabilities:
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x4fb773
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x44]
call fcn.004547e0
add esi, 8
xor edi, edi
mov ecx, esi
mov dword [esp + 0x60], edi
mov word [esp + 0x2c], di
mov word [esp + 0x2e], 1
mov dword [esp + 0x14], esi
call fcn.004c06c0
test eax, eax
je 0x4c3c29
mov ecx, esi
call fcn.004c4070
cmp eax, edi
jne 0x4c3c25
xor eax, eax
jmp 0x4c3c29
movzx eax, word [eax + 4]
mov word [esp + 0x30], ax
push 6
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x4c]
call fcn.00454fa0
movzx ebp, word [esp + 0x30]
cmp ebp, edi
mov dword [esp + 0x18], ebp
jle 0x4c3d0f
mov ebp, dword [esp + 0x68]
mov bl, byte [esp + 0x68]
xor esi, esi
lea esp, [esp]
mov ecx, dword [esp + 0x14]
call fcn.004c06c0
test eax, eax
je 0x4c3caf
mov ecx, dword [esp + 0x14]
call fcn.004c4070
test eax, eax
je 0x4c3caf
movzx ecx, word [eax + 4]
cmp edi, ecx
jge 0x4c3caf
movzx edx, byte [esi + eax + 7]
movzx ecx, byte [esi + eax + 8]
movzx ebx, byte [esi + eax + 6]
movzx ebp, word [esi + eax + 0xc]
mov dword [esp + 0x20], edx
mov edx, dword [esi + eax + 0xe]
movzx eax, word [esi + eax + 0xa]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov cl, byte [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov dl, byte [esp + 0x20]
mov byte [esp + 0x36], cl
mov cx, word [esp + 0x28]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x35], dl
push 0xe
lea eax, [esp + 0x38]
mov word [esp + 0x3c], cx
lea edx, [edi + 1]
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3f], 0
mov word [esp + 0x42], bp
mov word [esp + 0x48], dx
call fcn.00454fa0
add edi, 1
add esi, 0x10
cmp edi, dword [esp + 0x18]
jl 0x4c3c60
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x6c]
call fcn.004c3eb0
xor ebx, ebx
cmp ebp, ebx
jle 0x4c3dc4
mov dword [esp + 0x68], ebx
push 0x20
call fcn.004cabe6
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov byte [esp + 0x60], 1
je 0x4c3d4d
mov ecx, eax
call fcn.004c3fb0
mov edi, eax
jmp 0x4c3d4f
xor edi, edi
mov ecx, esi
mov byte [esp + 0x60], 0
lea ebp, [edi + 0xc]
call fcn.004c06c0
test eax, eax
je 0x4c3da5
mov ecx, esi
call fcn.004c4070
mov esi, eax
test esi, esi
je 0x4c3da1
movzx edx, word [esi + 4]
cmp ebx, edx
jge 0x4c3da1
mov ecx, ebp
call fcn.00454750
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + esi + 0x12]
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00454770
mov edx, dword [esp + 0x68]
mov ecx, dword [edx + esi + 0xe]
push ecx
push eax
mov ecx, ebp
call fcn.00454fa0
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x6c]
push edi
mov dword [edi + 8], ebx
call fcn.00458d20
add dword [esp + 0x68], 0x10
add ebx, 1
cmp ebx, dword [esp + 0x18]
jl 0x4c3d2b
lea ecx, [esp + 0x44]
mov dword [esp + 0x60], 0xffffffff
call fcn.00454dd0
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 8
Function at 0x4c4540
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x4c455e
pop edi
mov eax, 1
pop esi
ret 0xc
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x4c466c
push ebp
lea esp, [esp]
cmp ebx, 0x15b0
mov eax, ebx
jb 0x4c457f
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x4c462b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x4c45a0
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x4c45a0
test eax, eax
je 0x4c463f
nop
movzx edx, byte [esi]
add ecx, edx
add esi, 1
add edi, ecx
sub eax, 1
jne 0x4c4630
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x4c4570
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret 0xc