joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4660d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push edi
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x466159
nop
cmp dword [esi + 0x108ec], 0
jg 0x466126
mov eax, dword [esi + 0x108e4]
mov ecx, dword [esi + 0x10908]
push 0x2000
push eax
push ecx
call fcn.004aeb0a
add esp, 0xc
mov dword [esi + 0x108ec], eax
test eax, eax
je 0x466162
js 0x46616d
mov edx, dword [esi + 0x108e4]
add dword [esi + 0x10910], 0x2000
mov dword [esi + 0x108e8], edx
mov edi, dword [esi + 0x108ec]
cmp ebx, edi
jae 0x466132
mov edi, ebx
mov eax, dword [esi + 0x108e8]
mov ecx, dword [ebp + 8]
push edi
push eax
push ecx
call fcn.004b29a0
add dword [ebp + 8], edi
add dword [esi + 0x108e8], edi
sub dword [esi + 0x108ec], edi
add esp, 0xc
sub ebx, edi
jne 0x4660e0
mov eax, dword [ebp - 4]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
pop edi
sub eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x10b54]
push 0x401
push 0x1b
push str.error:__zipfile_read_error_n
push esi
call edx
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x466190
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Read file on windows

Disassembly:
push edi
xor edi, edi
cmp dword [esi + 0x109b0], edi
jne 0x4661b2
mov eax, dword [esi + 0x90]
cmp eax, edi
jg 0x4661b7
dec eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x108ec], edi
or eax, 0xffffffff
pop edi
ret
cmp dword [esi + 0x108ec], edi
jg 0x466224
mov eax, dword [esi + 0x108e4]
mov ecx, dword [esi + 0x10908]
push 0x2000
push eax
push ecx
call fcn.004aeb0a
add esp, 0xc
mov dword [esi + 0x108ec], eax
cmp eax, edi
je 0x4661ac
jge 0x466207
mov edx, dword [esi + 0x10b54]
push 0x401
push 0x1b
push str.error:__zipfile_read_error_n
push esi
call edx
push 1
push 0x57c0e0
call fcn.004b0c40
mov eax, dword [esi + 0x108e4]
add dword [esi + 0x10910], 0x2000
mov dword [esi + 0x108e8], eax
mov eax, esi
call fcn.00466060
mov ecx, dword [esi + 0x8d8]
test byte [ecx + 0x18], 1
je 0x4662c7
mov edx, dword [esi + 0x108e8]
push ebx
mov ebx, dword [esi + 0x108ec]
cmp ebx, edi
je 0x4662c6
lea esp, [esp]
mov eax, dword [esi + 0x10b04]
and eax, 0xfffd
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor byte [edx], cl
movzx ecx, byte [edx]
mov eax, dword [esi + 0x10afc]
mov edi, dword [esi + 0x108dc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [edi + ecx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 0x10b00]
mov dword [esi + 0x10afc], ecx
mov ecx, dword [esi + 0x10b04]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x10b00], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [edi + eax*4]
inc edx
dec ebx
mov dword [esi + 0x10b04], ecx
jne 0x466250
pop ebx
mov eax, dword [esi + 0x108e8]
dec dword [esi + 0x108ec]
mov cl, byte [eax]
inc eax
mov dword [esi + 0x108e8], eax
movzx eax, cl
pop edi
ret
Function at 0x4662f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x10914]
add eax, dword [ebp + 8]
push edi
mov edi, eax
and edi, 0x80001fff
jns 0x46630f
dec edi
or edi, 0xffffe000
inc edi
mov ecx, eax
sub ecx, edi
test eax, eax
jns 0x46634c
mov eax, dword [esi + 0x10904]
push 1
push str.___please_check_that_you_have_transferred_or_created_the_zipfile_in_the_n__appropriate_BINARY_mode_and_that_you_have_compiled_UnZip_properly__n
push eax
lea edi, [esi + 0x8dc]
push str.error___s_:__attempt_to_seek_before_beginning_of_zipfile_n_s
push edi
call fcn.004a931b
mov ecx, dword [esi + 0x10b54]
add esp, 0x10
push eax
push edi
push esi
call ecx
mov eax, 3
pop edi
pop ebp
ret
cmp ecx, dword [esi + 0x10910]
je 0x4663b1
mov edx, dword [esi + 0x10908]
push 0
push ecx
push edx
call fcn.004af41e
mov ecx, dword [esi + 0x10908]
mov dword [esi + 0x10910], eax
mov eax, dword [esi + 0x108e4]
push 0x2000
push eax
push ecx
call fcn.004aeb0a
add esp, 0x18
mov dword [esi + 0x108ec], eax
test eax, eax
jg 0x466396
mov eax, 0x33
pop edi
pop ebp
ret
mov edx, dword [esi + 0x108e4]
sub eax, edi
add edx, edi
mov dword [esi + 0x108ec], eax
mov dword [esi + 0x108e8], edx
xor eax, eax
pop edi
pop ebp
ret
mov eax, dword [esi + 0x108e4]
mov ecx, dword [esi + 0x108e8]
sub ecx, eax
sub ecx, edi
add dword [esi + 0x108ec], ecx
add eax, edi
mov dword [esi + 0x108e8], eax
xor eax, eax
pop edi
pop ebp
ret

Function at 0x467610
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
xor eax, eax
push edi
mov edi, ecx
mov dword [ebp - 4], eax
cmp ebx, 4
jb 0x4676c1
mov eax, dword [0x4eb5cc]
push esi
mov edi, edi
movzx ecx, byte [edi + 3]
movzx edx, byte [edi + 2]
shl cx, 8
movzx esi, cx
or esi, edx
lea ecx, [ebx - 4]
cmp esi, ecx
ja 0x4676bd
movzx edx, byte [edi + 1]
movzx ecx, byte [edi]
shl dx, 8
or dx, cx
mov ecx, 0x4453
cmp dx, cx
jne 0x4676a7
cmp eax, 0xffffffff
jne 0x467687
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x46767e
mov eax, 1
mov dword [0x4eb5cc], eax
jmp 0x46768b
xor eax, eax
mov dword [0x4eb5cc], eax
jmp 0x4676a7
test eax, eax
je 0x4676a7
cmp esi, 5
jb 0x4676a7
cmp byte [edi + 8], 0
ja 0x4676a7
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov dword [ecx], esi
mov dword [ebp - 4], 1
mov edx, 0xfffffffc
sub edx, esi
add ebx, edx
lea edi, [edi + esi + 4]
cmp ebx, 4
jae 0x467630
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4681d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 2
mov esi, ecx
push 0x4d657c
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x46820e
push 2
push 0x4dff08
push esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
jne 0x46822e
mov al, byte [esi + 2]
test al, al
je 0x46822e
cmp al, 0x2f
je 0x46822e
cmp al, 0x5c
je 0x46822e
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
movzx eax, byte [esi]
push eax
call fcn.004aa54b
add esp, 4
test eax, eax
je 0x468244
cmp byte [esi + 1], 0x3a
je 0x468268
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x20c]
push edx
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x46821d
lea esi, [ebp - 0x20c]
push edi
push 2
lea edi, [ebx + 0x10b90]
push esi
push edi
mov dword [ebp - 0x210], esi
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x468368
mov eax, dword [ebp - 0x210]
push 2
push eax
push edi
call fcn.004a9c60
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
push edi
mov word [ebx + 0x10b92], 0x2f
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4682ee
mov byte [edi], al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
mov eax, 0xc
cmp eax, dword [ebp - 0x214]
push 4
sbb ecx, ecx
lea edx, [ebp - 0x108]
inc ecx
push str.VFAT
push edx
mov dword [ebx + 0x10b94], ecx
call fcn.004ab103
add esp, 4
push eax
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x46835d
push 4
lea eax, [ebp - 0x108]
push str.HPFS
push eax
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x46835d
push 3
lea ecx, [ebp - 0x108]
push 0x4dff1c
push ecx
call fcn.004a93c0
add esp, 0xc
test eax, eax
je 0x46835d
xor eax, eax
jmp 0x468362
mov eax, 1
mov dword [ebx + 0x10b98], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
Function at 0x472af0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 0x10afc], 0x12345678
mov dword [ecx + 0x10b00], 0x23456789
mov dword [ecx + 0x10b04], 0x34567890
mov dl, byte [eax]
test dl, dl
je 0x472b86
mov eax, dword [ecx + 0x10afc]
push ebx
mov ebx, dword [ecx + 0x108dc]
push esi
mov esi, dword [ecx + 0x10b00]
push edi
mov edi, 0x34567890
movsx edx, dl
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [ebx + edx*4]
movzx edx, al
add esi, edx
imul esi, esi, 0x8088405
inc esi
mov edx, esi
shr edx, 0x18
xor edx, edi
and edx, 0xff
shr edi, 8
mov dword [ecx + 0x10afc], eax
mov dword [ecx + 0x10b00], esi
xor edi, dword [ebx + edx*4]
mov edx, dword [ebp + 8]
inc edx
mov dword [ecx + 0x10b04], edi
mov dword [ebp + 8], edx
mov dl, byte [edx]
test dl, dl
jne 0x472b34
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4731b0
Capabilities:
Check mutex on windows

Disassembly:
cmp dword [0x5447c8], 0
push ebx
push esi
push edi
jne 0x473247
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
jne 0x4731d6
pop edi
pop esi
pop ebx
ret
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push edi
push 0x5447cc
call ebx
mov esi, eax
test esi, esi
je 0x473212
push esi
push 0x5447cc
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x5447c8]
pop edi
pop esi
pop ebx
ret
push 0x57c0c0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x120
push 0
push 0x5496e0
call fcn.004b2d10
add esp, 0xc
call fcn.00473810
push edi
mov dword [0x5447c8], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x473900
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x108ec]
xor ebx, ebx
lea ecx, [eax - 1]
push edi
mov dword [esi + 0x108ec], ecx
cmp eax, ebx
jle 0x473932
mov ecx, dword [esi + 0x108e8]
movzx eax, byte [ecx]
inc ecx
mov dword [esi + 0x108e8], ecx
jmp 0x473937
call fcn.00466190
inc eax
xor edi, edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x108ec]
lea ecx, [eax - 1]
mov dword [esi + 0x108ec], ecx
cmp eax, ebx
jle 0x473968
mov ecx, dword [esi + 0x108e8]
movzx eax, byte [ecx]
inc ecx
mov dword [esi + 0x108e8], ecx
jmp 0x473aa2
cmp dword [esi + 0x109b0], ebx
je 0x473978
or eax, 0xffffffff
jmp 0x473aa2
mov eax, dword [esi + 0x90]
cmp eax, ebx
jg 0x473997
dec eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x108ec], ebx
or eax, 0xffffffff
jmp 0x473aa2
cmp ecx, ebx
jg 0x4739f1
mov edx, dword [esi + 0x108e4]
mov eax, dword [esi + 0x10908]
push 0x2000
push edx
push eax
call fcn.004aeb0a
add esp, 0xc
mov dword [esi + 0x108ec], eax
cmp eax, ebx
jne 0x4739ce
mov dword [esi + 0x108ec], ebx
or eax, 0xffffffff
jmp 0x473aa2
jl 0x473ad9
mov ecx, dword [esi + 0x108e4]
add dword [esi + 0x10910], 0x2000
mov eax, esi
mov dword [esi + 0x108e8], ecx
call fcn.00466060
mov edx, dword [esi + 0x8d8]
test byte [edx + 0x18], 1
je 0x473a8a
mov ebx, dword [esi + 0x108ec]
mov edx, dword [esi + 0x108e8]
test ebx, ebx
je 0x473a8a
mov eax, dword [esi + 0x10b04]
and eax, 0xfffd
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor byte [edx], cl
movzx ecx, byte [edx]
mov eax, dword [esi + 0x10afc]
mov edi, dword [esi + 0x108dc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [edi + ecx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 0x10b00]
mov dword [esi + 0x10afc], ecx
mov ecx, dword [esi + 0x10b04]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x10b00], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [edi + eax*4]
inc edx
dec ebx
mov dword [esi + 0x10b04], ecx
jne 0x473a11
mov edi, dword [ebp - 4]
mov eax, dword [esi + 0x108e8]
dec dword [esi + 0x108ec]
mov cl, byte [eax]
inc eax
mov dword [esi + 0x108e8], eax
movzx eax, cl
mov edx, dword [ebp + 0xc]
mov ecx, eax
shr eax, 4
and eax, 0xf
inc eax
and ecx, 0xf
lea ebx, [eax + edi]
inc ecx
cmp ebx, edx
ja 0x473afa
lea esp, [esp]
mov ebx, dword [ebp + 8]
mov dword [ebx + edi*4], ecx
inc edi
dec eax
jne 0x473ac0
dec dword [ebp - 8]
mov dword [ebp - 4], edi
je 0x473b06
xor ebx, ebx
jmp 0x473940
mov edx, dword [esi + 0x10b54]
push 0x401
push 0x1b
push str.error:__zipfile_read_error_n
push esi
call edx
push 1
push 0x57c0e0
call fcn.004b0c40
pop edi
pop esi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
sub eax, edx
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4780b0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [0x579980], edi
call fcn.004b0bae
push eax
push edi
call fcn.004b06f0
add eax, edi
mov dword [ebp - 4], eax
mov eax, dword [0x579980]
movzx esi, byte [eax]
add esp, 8
test esi, esi
je 0x47824d
cmp esi, 0x20
je 0x478210
cmp esi, 0x3a
je 0x478210
cmp esi, 0x22
je 0x478210
cmp esi, 0x2a
je 0x478210
cmp esi, 0x2b
je 0x478210
cmp esi, 0x2c
je 0x478210
cmp esi, 0x3b
je 0x478210
cmp esi, 0x3c
je 0x478210
cmp esi, 0x3d
je 0x478210
cmp esi, 0x3e
je 0x478210
cmp esi, 0x3f
je 0x478210
cmp esi, 0x5b
je 0x478210
cmp esi, 0x5d
je 0x478210
cmp esi, 0x7c
je 0x478210
cmp esi, 0x2f
jne 0x478190
mov dword [0x579980], edi
call fcn.004b0bae
push eax
push edi
call fcn.004b06f0
mov ecx, dword [0x579980]
add esp, 8
add edi, eax
mov byte [ecx], 0x2f
xor ebx, ebx
jmp 0x478210
cmp esi, 0x2e
jne 0x4781ca
test ebx, ebx
je 0x478210
cmp ebx, 9
jge 0x4781c3
mov dword [0x579980], edi
call fcn.004b0bae
push eax
push edi
call fcn.004b06f0
mov edx, dword [0x579980]
add esp, 8
add edi, eax
mov byte [edx], 0x2e
lea ebx, [esi - 0x25]
jmp 0x478210
mov ebx, 0xc
jmp 0x478210
cmp ebx, 0xc
jge 0x478210
cmp ebx, 8
je 0x478210
call fcn.004b0bae
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004b06f0
add ebx, eax
mov dword [0x579980], edi
call fcn.004b0bae
push eax
push edi
call fcn.004b06f0
mov edx, dword [0x579980]
add esp, 0x10
add edi, eax
and esi, 0xff
mov cl, byte [esi + 0x5799a0]
mov byte [edx], cl
mov eax, dword [ebp - 4]
mov dword [0x579980], eax
call fcn.004b0bae
mov esi, dword [ebp - 4]
push eax
push esi
call fcn.004b06f0
mov ecx, dword [0x579980]
add esi, eax
mov dword [ebp - 4], esi
movzx esi, byte [ecx]
add esp, 8
test esi, esi
jne 0x4780e6
mov eax, dword [ebp + 8]
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi], bl
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x478e80
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x4000
call fcn.004aa188
mov edi, eax
add esp, 4
test edi, edi
jne 0x478e9d
lea eax, [edi + 4]
pop edi
pop ebp
ret
push ebx
xor ebx, ebx
push esi
mov eax, dword [ebp + 0x10]
cmp eax, 0xffffffff
je 0x478eb6
cmp ebx, eax
jae 0x478f0c
sub eax, ebx
cmp eax, 0x4000
jb 0x478ebb
mov eax, 0x4000
mov ecx, dword [ebp + 8]
push ecx
push eax
push 1
push edi
call fcn.004b20b5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x478ee9
mov edx, dword [ebp + 0xc]
push edx
push esi
push 1
push edi
call fcn.004b2229
add esp, 0x10
cmp eax, esi
jne 0x478f1c
add ebx, esi
jmp 0x478ea1
mov eax, dword [ebp + 8]
push eax
call fcn.004b1d0a
add esp, 4
test eax, eax
je 0x478f0c
push edi
call fcn.004aa14e
add esp, 4
pop esi
pop ebx
mov eax, 0xb
pop edi
pop ebp
ret
push edi
call fcn.004aa14e
add esp, 4
pop esi
pop ebx
xor eax, eax
pop edi
pop ebp
ret
push edi
call fcn.004aa14e
add esp, 4
push str._fcopy:_write_error_n
call fcn.004abb88
add eax, 0x40
push eax
call fcn.004abd3d
add esp, 8
pop esi
pop ebx
mov eax, 0xa
pop edi
pop ebp
ret
Function at 0x47a9e0
Capabilities:
Write file on windows

Disassembly:
push edi
push 0x50
call fcn.004afb55
push edi
push 0x4b
call fcn.004afb55
push edi
push 3
call fcn.004afb55
push edi
push 4
call fcn.004afb55
movsx eax, byte [esi + 2]
push edi
push eax
call fcn.004afb55
movsx ecx, byte [esi + 3]
push edi
push ecx
call fcn.004afb55
movsx edx, byte [esi + 0x2c]
push edi
push edx
call fcn.004afb55
movsx eax, byte [esi + 0x2d]
push edi
push eax
call fcn.004afb55
movsx ecx, byte [esi + 6]
add esp, 0x40
push edi
push ecx
call fcn.004afb55
movsx edx, byte [esi + 7]
push edi
push edx
call fcn.004afb55
movsx eax, byte [esi + 8]
push edi
push eax
call fcn.004afb55
movsx ecx, byte [esi + 9]
push edi
push ecx
call fcn.004afb55
movsx edx, byte [esi + 0xa]
push edi
push edx
call fcn.004afb55
movsx eax, byte [esi + 0xb]
push edi
push eax
call fcn.004afb55
movsx ecx, byte [esi + 0xc]
push edi
push ecx
call fcn.004afb55
movsx edx, byte [esi + 0xd]
push edi
push edx
call fcn.004afb55
movsx eax, byte [esi + 0xe]
add esp, 0x40
push edi
push eax
call fcn.004afb55
movsx ecx, byte [esi + 0xf]
push edi
push ecx
call fcn.004afb55
movsx edx, byte [esi + 0x10]
push edi
push edx
call fcn.004afb55
movsx eax, byte [esi + 0x11]
push edi
push eax
call fcn.004afb55
movsx ecx, byte [esi + 0x12]
push edi
push ecx
call fcn.004afb55
movsx edx, byte [esi + 0x13]
push edi
push edx
call fcn.004afb55
movsx eax, byte [esi + 0x14]
push edi
push eax
call fcn.004afb55
movsx ecx, byte [esi + 0x15]
push edi
push ecx
call fcn.004afb55
movsx edx, byte [esi + 0x16]
add esp, 0x40
push edi
push edx
call fcn.004afb55
movsx eax, byte [esi + 0x17]
push edi
push eax
call fcn.004afb55
movsx ecx, byte [esi + 0x18]
push edi
push ecx
call fcn.004afb55
mov edx, dword [esi + 0x18]
shr edx, 8
movsx eax, dl
push edi
push eax
call fcn.004afb55
movsx ecx, byte [esi + 0x1c]
push edi
push ecx
call fcn.004afb55
mov edx, dword [esi + 0x1c]
shr edx, 8
movsx eax, dl
push edi
push eax
call fcn.004afb55
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x48]
push edi
push ecx
push 1
push edx
call fcn.004b2229
add esp, 0x40
cmp eax, dword [esi + 0x18]
jne 0x47ab68
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x47ab65
push edi
push eax
mov eax, dword [esi + 0x3c]
push 1
push eax
call fcn.004b2229
add esp, 0x10
cmp eax, dword [esi + 0x1c]
jne 0x47ab68
xor eax, eax
ret
mov eax, 0xa
ret
Function at 0x47ae90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [0x579f18]
push ebx
push edi
mov ebx, eax
mov eax, dword [0x544838]
push esi
push 0x50
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
call fcn.004afb55
push esi
push 0x4b
call fcn.004afb55
push esi
push 5
call fcn.004afb55
push esi
push 6
call fcn.004afb55
push esi
push 0
call fcn.004afb55
push esi
push 0
call fcn.004afb55
push esi
push 0
call fcn.004afb55
push esi
push 0
call fcn.004afb55
movsx edi, byte [ebp + 8]
add esp, 0x40
push esi
push edi
call fcn.004afb55
mov eax, dword [ebp + 8]
shr eax, 8
movsx eax, al
push esi
push eax
mov dword [ebp + 8], eax
call fcn.004afb55
push esi
push edi
call fcn.004afb55
mov edx, dword [ebp + 8]
push esi
push edx
call fcn.004afb55
movsx eax, byte [ebp + 0xc]
push esi
push eax
call fcn.004afb55
mov ecx, dword [ebp + 0xc]
shr ecx, 8
movsx edx, cl
push esi
push edx
call fcn.004afb55
mov eax, dword [ebp + 0xc]
shr eax, 0x10
movsx ecx, al
push esi
push ecx
call fcn.004afb55
mov eax, dword [ebp + 0xc]
shr eax, 0x18
movsx edx, al
push esi
push edx
call fcn.004afb55
add esp, 0x40
movsx eax, bl
push esi
push eax
call fcn.004afb55
mov ecx, ebx
shr ecx, 8
push esi
movsx edx, cl
push edx
call fcn.004afb55
mov eax, ebx
shr eax, 0x10
movsx ecx, al
push esi
push ecx
call fcn.004afb55
shr ebx, 0x18
movsx edx, bl
push esi
push edx
call fcn.004afb55
mov ebx, dword [ebp - 4]
movsx eax, bl
push esi
push eax
call fcn.004afb55
mov ecx, ebx
shr ecx, 8
movsx edx, cl
push esi
push edx
call fcn.004afb55
add esp, 0x30
test ebx, ebx
je 0x47afd2
mov eax, dword [ebp - 8]
push esi
push ebx
push 1
push eax
call fcn.004b2229
add esp, 0x10
cmp eax, ebx
je 0x47afd2
pop edi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47c010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x51929c]
push ebx
xor eax, eax
xor ebx, ebx
push esi
mov esi, dword [0x579864]
mov dword [ebp - 4], eax
mov dword [0x549810], 2
test ecx, ecx
je 0x47c1d5
push edi
mov edi, dword [0x5192a4]
jmp 0x47c04d
mov eax, dword [ebp - 4]
mov ecx, dword [0x51929c]
cmp ecx, 3
jb 0x47c08d
movzx eax, byte [esi + 0x559842]
shl edi, 5
xor edi, eax
and edi, 0x7fff
movzx eax, word [edi*2 + 0x549820]
mov edx, esi
and edx, 0x7fff
mov dword [0x5192a4], edi
mov dword [ebp - 4], eax
mov word [edx*2 + 0x569860], ax
mov word [edi*2 + 0x549820], si
test eax, eax
je 0x47c0bd
mov edx, esi
sub edx, eax
cmp edx, 0x7efa
ja 0x47c0bd
cmp dword [0x579868], ecx
jbe 0x47c0ab
mov dword [0x579868], ecx
call fcn.0047bd50
mov ebx, eax
mov eax, dword [0x51929c]
cmp ebx, eax
jbe 0x47c0bd
mov ebx, eax
cmp ebx, 3
jb 0x47c158
mov eax, esi
sub eax, dword [0x549818]
lea ecx, [ebx - 3]
call fcn.0047f6d0
sub dword [0x51929c], ebx
cmp ebx, dword [0x5192a0]
ja 0x47c131
cmp dword [0x51929c], 3
jb 0x47c131
dec ebx
mov edi, edi
movzx ecx, byte [esi + 0x559843]
inc esi
shl edi, 5
xor edi, ecx
and edi, 0x7fff
movzx ecx, word [edi*2 + 0x549820]
mov edx, esi
and edx, 0x7fff
dec ebx
mov dword [ebp - 4], ecx
mov word [edx*2 + 0x569860], cx
mov word [edi*2 + 0x549820], si
jne 0x47c0f0
mov dword [0x5192a4], edi
jmp 0x47c16c
movzx edi, byte [esi + ebx + 0x559840]
movzx ecx, byte [esi + ebx + 0x559841]
add esi, ebx
shl edi, 5
xor edi, ecx
xor ebx, ebx
and edi, 0x7fff
mov dword [0x5192a4], edi
jmp 0x47c16d
movzx ecx, byte [esi + 0x559840]
xor eax, eax
call fcn.0047f6d0
dec dword [0x51929c]
inc esi
mov dword [0x579864], esi
test eax, eax
je 0x47c1aa
mov ecx, dword [0x579860]
test ecx, ecx
js 0x47c189
lea eax, [ecx + 0x559840]
jmp 0x47c18b
xor eax, eax
push 0
sub esi, ecx
push eax
call fcn.0047f4c0
mov esi, dword [0x579864]
mov edi, dword [0x5192a4]
add esp, 8
mov dword [0x579860], esi
cmp dword [0x51929c], 0x106
jae 0x47c1c7
call fcn.0047beb0
mov edi, dword [0x5192a4]
mov esi, dword [0x579864]
cmp dword [0x51929c], 0
jne 0x47c044
pop edi
mov ecx, dword [0x579860]
test ecx, ecx
js 0x47c1f8
lea eax, [ecx + 0x559840]
push 1
sub esi, ecx
push eax
call fcn.0047f4c0
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
push 1
sub esi, ecx
push eax
call fcn.0047f4c0
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret