joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d8b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x6c9294]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x48d8d7
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x48d8de
mov al, 1
jmp 0x48d9c9
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x44], edx
call fcn.0049e6f0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
call fcn.0049e6f0
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.0049e720
add esp, 8
movzx eax, al
test eax, eax
je 0x48d924
xor al, al
jmp 0x48d9c9
mov dword [ebp - 0x54], 0x20
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x50], edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x30]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x50]
call fcn.004a2060
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x48d966
cmp dword [ebp - 0x34], 1
je 0x48d96d
cmp dword [ebp - 0x34], 3
je 0x48d9bc
jmp 0x48d9c7
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x48d99c
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.004d97d1
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x48d99c
xor al, al
jmp 0x48d9c9
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x48d9b0
mov dword [ebp - 0x3c], 1
jmp 0x48d9b7
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x48d9c9
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov al, 1
jmp 0x48d9c9
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b4fea
mov esp, ebp
pop ebp
ret
Function at 0x497ce0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff5bb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x6c9294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x22c], str.tshed
call fcn.0049f660
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x114]
call fcn.00485a60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x114]
call fcn.00479e70
mov ecx, 1
imul edx, ecx, 0
mov cl, byte [ebp - 0x228]
mov byte [eax + edx], cl
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x224], 0
jmp 0x497d73
mov edx, dword [ebp - 0x220]
add edx, 1
mov dword [ebp - 0x220], edx
cmp dword [ebp - 0x220], 0xc
jge 0x497df0
mov eax, dword [ebp - 0x220]
and eax, 1
je 0x497dae
call fcn.0049f660
mov byte [ebp - 0x219], al
lea ecx, [ebp - 0x114]
call fcn.00479e70
mov ecx, dword [ebp - 0x220]
mov dl, byte [ebp - 0x219]
mov byte [eax + ecx], dl
jmp 0x497deb
mov eax, dword [ebp - 0x22c]
add eax, dword [ebp - 0x224]
mov cl, byte [eax]
mov byte [ebp - 0x21a], cl
lea ecx, [ebp - 0x114]
call fcn.00479e70
mov edx, dword [ebp - 0x220]
mov cl, byte [ebp - 0x21a]
mov byte [eax + edx], cl
mov edx, dword [ebp - 0x224]
add edx, 1
mov dword [ebp - 0x224], edx
jmp 0x497d64
call fcn.0049f660
mov byte [ebp - 0x21b], al
lea ecx, [ebp - 0x114]
call fcn.00479e70
mov ecx, 1
imul edx, ecx, 0xc
mov cl, byte [ebp - 0x21b]
mov byte [eax + edx], cl
lea ecx, [ebp - 0x218]
call fcn.00485a60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114]
call fcn.00479e70
mov dword [ebp - 0x230], eax
call fcn.0049ed80
mov dword [ebp - 0x234], eax
lea ecx, [ebp - 0x218]
call fcn.00479e70
mov dword [ebp - 0x238], eax
mov edx, dword [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
push 0x51b6f8
mov ecx, dword [ebp - 0x238]
push ecx
call fcn.00485000
add esp, 0x10
push 0
lea ecx, [ebp - 0x218]
call fcn.00479e70
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x218]
call fcn.00486bd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.00486bd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b4fea
mov esp, ebp
pop ebp
ret
Function at 0x49f120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x6c9294]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x38], ecx
call fcn.0049e6f0
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.0049e720
add esp, 8
movzx edx, al
test edx, edx
je 0x49f164
lea eax, [ebp + 8]
push eax
call fcn.0049efd0
add esp, 4
jmp 0x49f2f5
mov ecx, dword [ebp - 0x38]
call fcn.0049f620
test eax, eax
je 0x49f1aa
mov ecx, dword [ebp - 0x38]
call fcn.0049f620
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.0049e700
cmp esi, eax
jae 0x49f1aa
lea ecx, [ebp + 8]
push ecx
call fcn.004a1ca0
add esp, 4
mov byte [ebp - 0x39], al
mov ecx, dword [ebp - 0x38]
call fcn.0048e370
mov dl, byte [ebp - 0x39]
mov byte [eax], dl
mov eax, dword [ebp + 8]
jmp 0x49f2f5
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x4c], 0
jne 0x49f1bd
call fcn.0049e6f0
jmp 0x49f2f5
mov ecx, dword [ebp - 0x38]
call fcn.0048e3c0
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x38], 0
jne 0x49f216
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x54], eax
lea ecx, [ebp + 8]
push ecx
call fcn.004a1ca0
add esp, 4
mov byte [ebp - 0x3a], al
mov edx, dword [ebp - 0x54]
push edx
movzx eax, byte [ebp - 0x3a]
push eax
call fcn.00483f40
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x49f206
mov edx, dword [ebp + 8]
mov dword [ebp - 0x48], edx
jmp 0x49f20e
call fcn.0049e6f0
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x49f2f5
mov dword [ebp - 0x5c], 0x20
lea eax, [ebp + 8]
push eax
call fcn.004a1ca0
add esp, 4
mov byte [ebp - 0x2a], al
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x58], edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x29]
push ecx
lea edx, [ebp - 0x2a]
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x58]
call fcn.0049f0e0
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x49f273
cmp dword [ebp - 0x40], 1
je 0x49f273
cmp dword [ebp - 0x40], 3
je 0x49f2c0
jmp 0x49f2f0
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x44], ecx
je 0x49f2a5
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x44]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.004d97d1
add esp, 0x10
cmp dword [ebp - 0x44], eax
je 0x49f2a5
call fcn.0049e6f0
jmp 0x49f2f5
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2a]
cmp dword [ebp - 0x34], edx
je 0x49f2b9
mov eax, dword [ebp + 8]
jmp 0x49f2f5
call fcn.0049e6f0
jmp 0x49f2f5
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2a]
push edx
call fcn.00483f40
add esp, 8
movzx eax, al
test eax, eax
je 0x49f2e3
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x4c], ecx
jmp 0x49f2eb
call fcn.0049e6f0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
jmp 0x49f2f5
call fcn.0049e6f0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b4fea
mov esp, ebp
pop ebp
ret 4
Function at 0x4a19f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x6c9294]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov byte [ebp - 5], al
push 0
push 0
push 0
lea ecx, [ebp - 5]
call fcn.004898a0
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b4fea
mov esp, ebp
pop ebp
ret

Function at 0x4a2150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x6c9294]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x4a217a
jl 0x4a2171
cmp dword [ebp + 0xc], 0
ja 0x4a217a
xor eax, eax
xor edx, edx
jmp 0x4a22bb
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x4a219c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004a22d0
jmp 0x4a22bb
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.0048dcd0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4a220b
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.00403390
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0049ee20
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00403360
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.0049ed40
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x4a22ac
mov ecx, dword [ebp - 0x10]
call fcn.0048e3c0
mov dword [ebp - 0x2c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x4a227b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.004d8aee
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x4a2279
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x4a22bb
jmp 0x4a2227
cmp dword [ebp - 8], 0
jbe 0x4a22ac
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.004d8aee
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b4fea
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a2690
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004e36ff
add esp, 4
call fcn.00496b40
push 0x104
push 0x6cd7a8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 8], 0x6cd7a8
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
add dword [ebp - 8], 1
cmp byte [ebp - 1], 0
jne 0x4a26cc
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [0x6cd7a4], ecx
mov edx, dword [0x6cd7a4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax + 0x6cd7a8]
cmp ecx, 0x5c
jne 0x4a272a
mov edx, dword [0x6cd7a4]
sub edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x6cd7a9
push eax
push 0x6cd7a8
call fcn.004ce670
add esp, 0xc
jmp 0x4a2735
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x4a26f9
mov dword [ebp - 0x14], 0
jmp 0x4a2747
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x6cd7a8
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx]
mov byte [ebp - 2], dl
add dword [ebp - 0x10], 1
cmp byte [ebp - 2], 0
jne 0x4a2757
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x24]
jae 0x4a2798
mov edx, dword [ebp - 0x14]
movsx eax, byte [edx + 0x6cd7a8]
push eax
call fcn.004e1819
add esp, 4
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 0x6cd7a8], al
jmp 0x4a273e
push 0
push 0
push 0
push 0x4a1a30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp + 8]
push edx
call fcn.0048b950
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4a6700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
je 0x4a6727
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004d8aee
add esp, 0x10
jmp 0x4a674d
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004ce670
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
add ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], ecx
pop ebp
ret
Function at 0x4ada10
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6c9294]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x14]
call fcn.0047a060
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0047a000
lea ecx, [ebp - 0x10]
call fcn.0047a0f0
movzx edx, al
test edx, edx
je 0x4ada92
lea ecx, [ebp - 0x10]
call fcn.0047cad0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x1c], 0
je 0x4ada92
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x10]
call fcn.0047ca40
push eax
call fcn.00479d20
add esp, 4
cmp eax, 0xfaba0065
jne 0x4ada90
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.0047b3b0
jmp 0x4adaa3
jmp 0x4ada51
lea ecx, [ebp - 0x14]
call fcn.0047ca70
movzx ecx, al
test ecx, ecx
jne 0x4ada28
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b4fea
mov esp, ebp
pop ebp
ret

Function at 0x4adc20
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6c9294]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x14]
call fcn.0047a060
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0047a000
lea ecx, [ebp - 0x10]
call fcn.0047a0f0
movzx edx, al
test edx, edx
je 0x4adca2
lea ecx, [ebp - 0x10]
call fcn.0047cad0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x1c], 0
je 0x4adca2
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x10]
call fcn.0047ca40
push eax
call fcn.00479d20
add esp, 4
cmp eax, 0xf8f45725
jne 0x4adca0
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.0047b3b0
jmp 0x4adcb3
jmp 0x4adc61
lea ecx, [ebp - 0x14]
call fcn.0047ca70
movzx ecx, al
test ecx, ecx
jne 0x4adc38
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b4fea
mov esp, ebp
pop ebp
ret

Function at 0x4adee0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6c9294]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x14]
call fcn.0047a060
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0047a000
lea ecx, [ebp - 0x10]
call fcn.0047a0f0
movzx edx, al
test edx, edx
je 0x4adf62
lea ecx, [ebp - 0x10]
call fcn.0047cad0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x1c], 0
je 0x4adf62
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x10]
call fcn.0047ca40
push eax
call fcn.00479d20
add esp, 4
cmp eax, 0xbdcac9ce
jne 0x4adf60
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.0047b3b0
jmp 0x4adf73
jmp 0x4adf21
lea ecx, [ebp - 0x14]
call fcn.0047ca70
movzx ecx, al
test ecx, ecx
jne 0x4adef8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b4fea
mov esp, ebp
pop ebp
ret
Function at 0x4ae670
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x4ae68e
mov ecx, dword [ebp - 8]
call fcn.004aedb0
jmp 0x4ae6a1
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x4ae6a1
mov ecx, dword [ebp - 8]
call fcn.004aec30
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0xb
mov edx, dword [ebp - 8]
and ecx, dword [edx + 0x1384]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4aea30
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0
pop ebp
ret
Function at 0x4aec30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x4aec4b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe3
jae 0x4aecb7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x4aec8f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x4aec96
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x4aec42
jmp 0x4aecc2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x26f
jae 0x4aed2e
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 1
je 0x4aed06
mov dword [ebp - 0x18], 0x9908b0df
jmp 0x4aed0d
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
shr eax, 1
xor eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x4aecb9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ecx + 4]
and ecx, 0x7fffffff
or edx, ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x4aed6c
mov dword [ebp - 0x20], 0x9908b0df
jmp 0x4aed73
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
shr eax, 1
xor eax, dword [ebp - 0x20]
mov ecx, 4
imul edx, ecx, 0x18c
mov ecx, dword [ebp - 8]
xor eax, dword [ecx + edx + 4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 4], eax
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
Function at 0x4aedb0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x4aedcb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jae 0x4aee37
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x4aee0f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x4aee16
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x4aedc2
mov esp, ebp
pop ebp
ret
Function at 0x4ecaa1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ec917

Function at 0xdcbdde
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0xdcbde4
pop ebp
sub ebp, 0x10
sub ebp, 0x9cbdd4
jmp 0xdcbdfa
mov eax, 0x9cbdd4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d2
mov edx, 0x8cc22709
xor byte [eax], dl
inc eax
dec ecx
jne 0xdcbe11
jmp 0xdcbe24
add ah, 0x82
xor byte [0x88090909], 0xc8
int1
or dword [ecx], ecx
or dword [edx], ecx
les esi, [ecx + 0x909090c]
mov bl, 0x21
or dword [ecx], ecx
or esi, edi
jmp 0xdcbe4b
insd dword es:[edi], dx
sub eax, 0x2d0d80f5
test byte [ebp + 0x2d], ch
cmc
or byte [0x2ccd612d], 0x28
or dword [ecx + 0x19], esp
xchg ecx, eax
jb 0xdcbe6b
or byte [0x3bb0612d], ah
jg 0xdcbe81
loope 0xdcbe78
or al, 9
or dword [ecx], ecx
loopne 0xdcbeaa
or dword [ecx], ecx
or eax, esp
cmp dword [ecx], ecx
or dword [ecx], ecx
pop esp
test byte [ebp + 0x2d], ah
or dword [ecx], ecx
or dword [esp + eax*4 + 0x65], ebx
sub eax, 0x18c8209
or dword [ecx], ecx
or dword [edx + 0x909018c], eax
or dword [edx + 0x909059c], eax
or dword [edx + 0x9091984], eax
add eax, 0x82090909
test byte [ecx], bl
or dword [ecx], ecx
or eax, ecx
loopne 0xdcbe99
cmp byte [ebx], cl
mov cl, bl
or eax, 0xfd8c0640
div dh
test byte [edx + 0x6d842d25], 0x2d
or eax, 0x820905cb
test dword [0x909090d], ebp
popal
int 0x2c
sub byte [ecx], cl
popal
sbb dword [ecx + 0x25080972], edx
sub eax, 0xf52d6d84
or dword [ecx - 0x33], esp
sub al, 0x28
or dword [ecx + 0x19], esp
xchg ecx, eax
jb 0xdcbebe
or byte [0x2d6d842d], ah
cmc
add byte [0x90ce12d], 9
sub eax, 0x9090ce1
or eax, esp
inc edx
or ecx, dword [ecx]
or dword [ebp + ebp*2 + 0x2580f52d], eax
sub eax, 0x7cf6e582
add eax, 0xe1017cf6
jno 0xdcbee4
or dword [ecx], ecx
xor byte [ecx + eax - 0x77f6f6f7], 0xf8
clc
scasb al, byte es:[edi]
push es
nop
push esi
mov al, bh
clc
scasb al, byte es:[edi]
push es
nop
push esi
cmp al, al
cmp bl, bl
mov ah, cl
or al, 0x41
push es
lea eax, [edi + 9]
or dword [ecx], ecx
push es
add dword [ecx + 9], 0x826f0909
adc eax, 0xe1f28930
push es
lea edx, [ebx]
or dword [ecx], ecx
or dword [ecx - 0x72f91f0e], ecx
sbb byte [ecx], cl
or dword [ecx], ecx
outsd dx, dword [esi]
mov dl, dh
imul byte [esi + eax]
lea ebx, [ecx + ecx]
or dword [ecx], ecx
dec eax
loopne 0xdcbeec
div dh
mul byte [eax]
inc ebp
xor byte [eax], cl
mov cl, al
or al, 0x8a
loope 0xdcbf41
loopne 0xdcbeea
div dh
mul byte [eax]
pop ebp
xor byte [ebx], cl
mov cl, al
jp 0xe266cd28
jecxz 0xdcbf50
mov ah, cl
or al, 0xe0
mov byte [0x82f6f6f6], al
and eax, 0x2d6d842d
or eax, 0x5c0905cb
sub eax, 0x905cb0d
pop esp
and ch, 0x5f
pop esi
pop esp
cmp byte [ebp + eax - 0x7e], 0x74
add ebp, esi
mov ebx, 0x880f8389
iretd