joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498b50
Capabilities:
Check mutex on windows

Disassembly:
push ecx
cmp dword [0x502b74], 0
push esi
push edi
jne 0x498bd8
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x498b72
pop edi
pop esi
pop ecx
ret
mov edi, esi
mov ecx, 0x502b70
xchg dword [ecx], edi
test edi, edi
je 0x498ba3
mov eax, edi
xchg dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x502b74]
pop edi
pop esi
pop ecx
ret
push 0x5861e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push pe_nt_image_headers32
push 0
push 0x553820
call fcn.004b67a0
add esp, 0xc
call fcn.004991b0
push esi
mov dword [0x502b74], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x4992a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 4], ebx
mov ecx, dword [esi + 0x108ec]
lea eax, [ecx - 1]
mov dword [esi + 0x108ec], eax
test ecx, ecx
jle 0x4992d5
mov eax, dword [esi + 0x108e8]
movzx ecx, byte [eax]
inc eax
mov dword [esi + 0x108e8], eax
jmp 0x4992de
mov ecx, esi
call fcn.0048bff0
mov ecx, eax
inc ecx
xor edi, edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edi
jmp 0x4992f0
mov eax, dword [esi + 0x108ec]
lea ecx, [eax - 1]
mov dword [esi + 0x108ec], ecx
test eax, eax
jle 0x499311
mov eax, dword [esi + 0x108e8]
movzx ecx, byte [eax]
jmp 0x49946d
cmp dword [esi + 0x109b0], 0
je 0x499322
or ecx, 0xffffffff
jmp 0x499474
mov eax, dword [esi + 0x90]
test eax, eax
jg 0x499345
dec eax
mov dword [esi + 0x108ec], 0
mov dword [esi + 0x90], eax
or ecx, 0xffffffff
jmp 0x499474
test ecx, ecx
jg 0x49939d
push 0x2000
push dword [esi + 0x108e4]
push dword [esi + 0x10908]
call fcn.004b1dd1
add esp, 0xc
mov dword [esi + 0x108ec], eax
test eax, eax
jne 0x49937a
mov dword [esi + 0x108ec], eax
or ecx, 0xffffffff
jmp 0x499474
js 0x4994c3
mov eax, dword [esi + 0x108e4]
mov ecx, esi
add dword [esi + 0x10910], 0x2000
mov dword [esi + 0x108e8], eax
call fcn.0048beb0
mov eax, dword [esi + 0x8d8]
test byte [eax + 0x18], 1
je 0x49945c
mov eax, dword [esi + 0x108ec]
mov ebx, dword [esi + 0x108e8]
test eax, eax
je 0x499459
mov edi, eax
jmp 0x4993d0
mov ecx, dword [esi + 0x10b04]
lea ebx, [ebx + 1]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
shr eax, 8
xor byte [ebx - 1], al
movzx ecx, byte [ebx - 1]
mov edx, dword [esi + 0x10afc]
xor ecx, edx
mov eax, dword [esi + 0x108dc]
and ecx, 0xff
shr edx, 8
mov eax, dword [eax + ecx*4]
mov ecx, dword [esi + 0x10b04]
xor eax, edx
mov dword [esi + 0x10afc], eax
movzx eax, al
add eax, dword [esi + 0x10b00]
imul edx, eax, 0x8088405
inc edx
mov dword [esi + 0x10b00], edx
mov eax, dword [esi + 0x108dc]
shr edx, 0x18
xor edx, ecx
shr ecx, 8
and edx, 0xff
xor ecx, dword [eax + edx*4]
mov dword [esi + 0x10b04], ecx
dec edi
jne 0x4993d0
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
mov eax, dword [esi + 0x108e8]
dec dword [esi + 0x108ec]
mov cl, byte [eax]
movzx ecx, cl
inc eax
mov dword [esi + 0x108e8], eax
mov edx, ecx
shr ecx, 4
and ecx, 0xf
and edx, 0xf
inc ecx
inc edx
lea eax, [ecx + edi]
cmp eax, dword [ebp + 8]
ja 0x4994b7
lea esp, [esp]
mov dword [ebx + edi*4], edx
inc edi
dec ecx
jne 0x499490
dec dword [ebp - 0xc]
mov dword [ebp - 8], edi
jne 0x4992f0
xor eax, eax
mov ecx, 4
cmp edi, dword [ebp + 8]
pop edi
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10b54]
push 0x401
push 0x1b
push str.error:__zipfile_read_error_n
push esi
call eax
push 1
push 0x586200
call fcn.004b4030
int3
Function at 0x49dd30
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 8], ebx
mov esi, ebx
xor edi, edi
mov dword [0x583bc0], ebx
call fcn.004b3c1b
push eax
push ebx
call fcn.004b3b02
mov ecx, dword [0x583bc0]
add eax, ebx
add esp, 8
mov dword [ebp - 4], eax
movzx ebx, byte [ecx]
test ebx, ebx
je 0x49dec7
lea ecx, [ecx]
cmp ebx, 0x20
je 0x49de8e
cmp ebx, 0x3a
je 0x49de8e
cmp ebx, 0x22
je 0x49de8e
cmp ebx, 0x2a
je 0x49de8e
cmp ebx, 0x2b
je 0x49de8e
cmp ebx, 0x2c
je 0x49de8e
cmp ebx, 0x3b
je 0x49de8e
cmp ebx, 0x3c
je 0x49de8e
cmp ebx, 0x3d
je 0x49de8e
cmp ebx, 0x3e
je 0x49de8e
cmp ebx, 0x3f
je 0x49de8e
cmp ebx, 0x5b
je 0x49de8e
cmp ebx, 0x5d
je 0x49de8e
cmp ebx, 0x7c
je 0x49de8e
cmp ebx, 0x2f
jne 0x49de15
mov dword [0x583bc0], esi
call fcn.004b3c1b
push eax
push esi
call fcn.004b3b02
add esi, eax
add esp, 8
mov eax, dword [0x583bc0]
xor edi, edi
mov byte [eax], bl
jmp 0x49de8e
cmp ebx, 0x2e
jne 0x49de4d
test edi, edi
je 0x49de8e
cmp edi, 9
jge 0x49de46
mov dword [0x583bc0], esi
call fcn.004b3c1b
push eax
push esi
call fcn.004b3b02
add esp, 8
lea edi, [ebx - 0x25]
add esi, eax
mov eax, dword [0x583bc0]
mov byte [eax], bl
jmp 0x49de8e
mov edi, 0xc
jmp 0x49de8e
cmp edi, 0xc
jge 0x49de8e
cmp edi, 8
je 0x49de8e
call fcn.004b3c1b
push eax
push dword [ebp - 4]
call fcn.004b3b02
add edi, eax
mov dword [0x583bc0], esi
call fcn.004b3c1b
push eax
push esi
call fcn.004b3b02
add esp, 0x10
add esi, eax
movzx eax, bl
mov cl, byte [eax + 0x583ac0]
mov eax, dword [0x583bc0]
mov byte [eax], cl
mov ebx, dword [ebp - 4]
mov dword [0x583bc0], ebx
call fcn.004b3c1b
push eax
push ebx
call fcn.004b3b02
add ebx, eax
add esp, 8
mov eax, dword [0x583bc0]
mov dword [ebp - 4], ebx
movzx ebx, byte [eax]
test ebx, ebx
jne 0x49dd70
mov eax, dword [ebp - 8]
pop edi
mov byte [esi], bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
mov byte [esi], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49e8e0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x52430c]
lea edx, [ebp - 0x38]
push esi
push edi
mov edi, dword [0x584034]
mov ecx, edi
call fcn.004a26c0
test eax, eax
jne 0x49e921
cmp word [ebp - 0x30], 1
jg 0x49e93d
push edi
call fcn.004b3fd9
add esp, 4
test eax, eax
jne 0x49e99d
push edi
push ebx
call fcn.004b5328
add esp, 8
test eax, eax
je 0x49e9ea
call fcn.004b3b5b
cmp dword [eax], 0x12
jne 0x49e99d
push 0x4e2060
push ebx
call fcn.004af3f7
mov esi, eax
add esp, 8
mov dword [ebp - 0x40], esi
test esi, esi
jne 0x49e97f
push ebx
push str._replace:_cant_open__s_n
call fcn.004afcf3
add eax, 0x40
push eax
call fcn.004afdcf
add esp, 0xc
lea eax, [esi + 0xa]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
push 0x4ece1c
push edi
call fcn.004af3f7
add esp, 8
mov dword [ebp - 0x3c], eax
test eax, eax
jne 0x49e9b3
push esi
call fcn.004af478
add esp, 4
mov eax, 0xf
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
mov edx, eax
mov ecx, esi
call fcn.0049eb00
add esp, 4
mov esi, eax
push dword [ebp - 0x40]
call fcn.004af478
add esp, 4
push dword [ebp - 0x3c]
call fcn.004af478
add esp, 4
test eax, eax
jne 0x49e9fd
test esi, esi
jne 0x49e9fd
push ebx
call fcn.004b3fd9
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
push edi
call fcn.004b3fd9
add esp, 4
test esi, esi
je 0x49ea28
mov eax, 0xe
cmp esi, 0xa
cmove esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov esi, 0xe
pop edi
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.004aca59
mov esp, ebp
pop ebp
ret
Function at 0x49eb00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0xc], edx
push 0x4000
mov dword [ebp - 8], esi
call fcn.004ae57a
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x49eb2d
lea eax, [edx + 4]
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
cmp ebx, 0xffffffff
je 0x49eb51
cmp edi, ebx
jae 0x49ebde
mov eax, ebx
mov ecx, 0x4000
sub eax, edi
cmp eax, ecx
cmovb ecx, eax
jmp 0x49eb56
mov ecx, 0x4000
push esi
push ecx
push 1
push edx
call fcn.004b55b0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x49ebb5
push dword [ebp - 0xc]
push esi
push 1
push dword [ebp - 4]
call fcn.004b57b5
add esp, 0x10
cmp eax, esi
jne 0x49eb88
mov edx, dword [ebp - 4]
add edi, esi
mov esi, dword [ebp - 8]
jmp 0x49eb34
push dword [ebp - 4]
call fcn.004ae337
add esp, 4
push str._fcopy:_write_error_n
call fcn.004afcf3
add eax, 0x40
push eax
call fcn.004afdcf
add esp, 8
mov eax, 0xa
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
call fcn.004b51f0
add esp, 4
test eax, eax
je 0x49ebdb
push dword [ebp - 4]
call fcn.004ae337
add esp, 4
mov eax, 0xb
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call fcn.004ae337
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a06e0
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
push 0x50
call fcn.004b3669
push edi
push 0x4b
call fcn.004b3669
push edi
push 3
call fcn.004b3669
push edi
push 4
call fcn.004b3669
movsx eax, byte [esi + 2]
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 3]
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0x2c]
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0x2d]
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 6]
add esp, 0x40
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 7]
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 8]
push edi
push eax
call fcn.004b3669
mov eax, dword [esi + 8]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0xa]
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0xb]
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0xc]
push edi
push eax
call fcn.004b3669
mov eax, dword [esi + 0xc]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0xe]
add esp, 0x40
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0xf]
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0x10]
push edi
push eax
call fcn.004b3669
mov eax, dword [esi + 0x10]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0x12]
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0x13]
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0x14]
push edi
push eax
call fcn.004b3669
mov eax, dword [esi + 0x14]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0x16]
add esp, 0x40
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0x17]
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0x18]
push edi
push eax
call fcn.004b3669
mov eax, dword [esi + 0x18]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004b3669
movsx eax, byte [esi + 0x1c]
push edi
push eax
call fcn.004b3669
mov eax, dword [esi + 0x1c]
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004b3669
push edi
push dword [esi + 0x18]
push 1
push dword [esi + 0x48]
call fcn.004b57b5
add esp, 0x40
cmp eax, dword [esi + 0x18]
jne 0x4a0881
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4a087c
push edi
push eax
push 1
push dword [esi + 0x3c]
call fcn.004b57b5
add esp, 0x10
cmp eax, dword [esi + 0x1c]
jne 0x4a0881
pop edi
xor eax, eax
pop esi
ret
pop edi
mov eax, 0xa
pop esi
ret
Function at 0x4a0bf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x502ba4]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, ecx
push edi
mov dword [ebp - 0xc], eax
mov eax, dword [0x583bd0]
push esi
push 0x50
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
call fcn.004b3669
push esi
push 0x4b
call fcn.004b3669
push esi
push 5
call fcn.004b3669
push esi
push 6
call fcn.004b3669
push esi
push 0
call fcn.004b3669
push esi
push 0
call fcn.004b3669
push esi
push 0
call fcn.004b3669
push esi
push 0
call fcn.004b3669
add esp, 0x40
movsx edi, bl
push esi
push edi
call fcn.004b3669
shr ebx, 8
movsx esi, bl
mov ebx, dword [ebp + 0x14]
push ebx
push esi
call fcn.004b3669
push ebx
push edi
call fcn.004b3669
mov edi, ebx
push edi
push esi
call fcn.004b3669
mov ebx, dword [ebp - 4]
movsx eax, bl
push edi
push eax
call fcn.004b3669
mov eax, ebx
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004b3669
mov eax, ebx
shr eax, 0x10
movsx eax, al
push edi
push eax
call fcn.004b3669
shr ebx, 0x18
movsx eax, bl
push edi
push eax
call fcn.004b3669
mov ebx, dword [ebp + 8]
add esp, 0x40
movsx eax, bl
push edi
push eax
call fcn.004b3669
push edi
mov eax, ebx
shr eax, 8
movsx eax, al
push eax
call fcn.004b3669
mov eax, ebx
shr eax, 0x10
movsx eax, al
push edi
push eax
call fcn.004b3669
shr ebx, 0x18
movsx eax, bl
push edi
push eax
call fcn.004b3669
mov ebx, dword [ebp - 8]
movsx eax, bl
push edi
push eax
call fcn.004b3669
mov eax, ebx
shr eax, 8
movsx eax, al
push edi
push eax
call fcn.004b3669
add esp, 0x30
test ebx, ebx
je 0x4a0d33
push edi
push ebx
push 1
push dword [ebp - 0xc]
call fcn.004b57b5
add esp, 0x10
cmp eax, ebx
je 0x4a0d33
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a1d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [0x534748]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov dword [0x5839b0], 2
push esi
mov esi, dword [0x553950]
test ebx, ebx
je 0x4a1f5d
push edi
mov edi, dword [0x534740]
cmp ebx, 3
jb 0x4a1df6
movzx eax, byte [esi + 0x563982]
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
mov dword [0x534740], edi
movzx edx, word [edi*2 + 0x5739a0]
mov dword [ebp - 8], edx
mov word [eax*2 + 0x553960], dx
mov word [edi*2 + 0x5739a0], si
test edx, edx
je 0x4a1e25
mov eax, esi
sub eax, edx
cmp eax, 0x7efa
ja 0x4a1e25
mov eax, dword [0x55394c]
mov ecx, edx
cmp eax, ebx
cmova eax, ebx
mov dword [0x55394c], eax
call fcn.004a1ac0
mov ecx, eax
cmp ecx, ebx
cmova ecx, ebx
mov dword [ebp - 4], ecx
cmp ecx, 3
jb 0x4a1ed4
lea edx, [ecx - 3]
mov ecx, esi
sub ecx, dword [0x5839a8]
call fcn.004a5590
mov ecx, dword [ebp - 4]
mov edx, eax
sub ebx, ecx
mov dword [0x534748], ebx
cmp ecx, dword [0x534744]
ja 0x4a1ea9
cmp ebx, 3
jb 0x4a1ea9
dec ecx
lea esp, [esp]
movzx eax, byte [esi + 0x563983]
inc esi
shl edi, 5
xor edi, eax
mov eax, esi
and edi, 0x7fff
and eax, 0x7fff
movzx ebx, word [edi*2 + 0x5739a0]
mov dword [ebp - 8], ebx
mov word [eax*2 + 0x553960], bx
mov word [edi*2 + 0x5739a0], si
dec ecx
jne 0x4a1e60
mov ebx, dword [0x534748]
mov dword [0x534740], edi
mov dword [ebp - 4], ecx
jmp 0x4a1eeb
movzx edi, byte [esi + ecx + 0x563980]
add esi, ecx
shl edi, 5
mov dword [ebp - 4], 0
movzx eax, byte [esi + 0x563981]
xor edi, eax
and edi, 0x7fff
mov dword [0x534740], edi
jmp 0x4a1eec
movzx edx, byte [esi + 0x563980]
xor ecx, ecx
call fcn.004a5590
dec ebx
mov edx, eax
mov dword [0x534748], ebx
inc esi
mov dword [0x553950], esi
test edx, edx
je 0x4a1f2f
mov eax, dword [0x553954]
test eax, eax
js 0x4a1f07
lea ecx, [eax + 0x563980]
jmp 0x4a1f09
xor ecx, ecx
sub esi, eax
push 0
mov edx, esi
call fcn.004a5380
mov esi, dword [0x553950]
add esp, 4
mov ebx, dword [0x534748]
mov edi, dword [0x534740]
mov dword [0x553954], esi
cmp ebx, 0x106
jae 0x4a1f4e
call fcn.004a1c10
mov ebx, dword [0x534748]
mov edi, dword [0x534740]
mov esi, dword [0x553950]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
test ebx, ebx
jne 0x4a1db7
pop edi
mov eax, dword [0x553954]
test eax, eax
js 0x4a1f80
sub esi, eax
lea ecx, [eax + 0x563980]
push 1
mov edx, esi
call fcn.004a5380
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub esi, eax
xor ecx, ecx
push 1
mov edx, esi
call fcn.004a5380
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a2260
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
lea eax, [ebp - 4]
push 3
push esi
push eax
call fcn.004ae040
movzx eax, byte [ebp - 4]
push eax
call fcn.004aeaeb
add esp, 0x10
test eax, eax
je 0x4a22a0
cmp byte [ebp - 3], 0x3a
jne 0x4a22a0
movzx eax, byte [esi]
mov word [ebp - 2], 0x5c
mov al, byte [eax + 0x583ac0]
mov byte [ebp - 4], al
jmp 0x4a22a8
mov al, 0x5c
mov word [ebp - 4], 0x5c
pop esi
cmp byte [0x501a97], al
jne 0x4a22ba
mov eax, dword [0x502bf4]
mov esp, ebp
pop ebp
ret
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4a22f3
push str.zip_diagnostic:_GetVolumeInformation_failed_n
push dword [0x584044]
call fcn.004afdcf
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 4]
mov byte [0x501a97], al
mov eax, 0xc
cmp eax, dword [ebp - 8]
sbb eax, eax
inc eax
mov dword [0x502bf4], eax
mov esp, ebp
pop ebp
ret

Function at 0x4a2310
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
movzx eax, byte [esi]
push eax
call fcn.004aeaeb
add esp, 4
test eax, eax
je 0x4a233c
cmp byte [esi + 1], 0x3a
je 0x4a235c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea esi, [ebp - 0x20c]
push 3
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], esi
push esi
push eax
call fcn.004ae040
add esp, 0xc
mov byte [ebp - 0x20d], 0
lea eax, [ebp - 0x108]
push 0x104
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 3
lea eax, [ebp - 0x108]
push 0x4ec198
push eax
call fcn.004af682
add esp, 4
push eax
call fcn.004ad660
add esp, 0xc
pop esi
test eax, eax
je 0x4a241d
push 4
lea eax, [ebp - 0x108]
push str.VFAT
push eax
call fcn.004ad660
add esp, 0xc
test eax, eax
je 0x4a241d
push 4
lea eax, [ebp - 0x108]
push str.HPFS
push eax
call fcn.004ad660
add esp, 0xc
test eax, eax
je 0x4a241d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
Function at 0x4a4310
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x502bbc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test eax, eax
jne 0x4a434c
push dword [ebp + 0xc]
push esi
push dword [0x534b70]
call fcn.004b1dd1
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x4a4423
test edi, edi
jne 0x4a43fc
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 1
mov eax, dword [ebp + 0xc]
jne 0x4a439b
shr eax, 1
push eax
lea ebx, [esi + eax]
push ebx
push dword [0x534b70]
call fcn.004b1dd1
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x4a4423
test edi, edi
je 0x4a4423
mov edi, edi
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov byte [esi], al
inc esi
cmp al, 0xa
jne 0x4a4394
mov word [esi - 1], 0xa0d
inc esi
inc edi
dec ecx
jne 0x4a4380
sub esi, edi
jmp 0x4a43fc
dec eax
mov ebx, esi
push eax
push esi
push dword [0x534b70]
call fcn.004b1dd1
mov edi, eax
add esp, 0xc
mov ecx, edi
cmp edi, 0xffffffff
je 0x4a4423
test edi, edi
je 0x4a4423
mov byte [edi + esi], 0xa
nop
mov al, byte [ebx]
lea ebx, [ebx + 1]
mov byte [esi], al
inc esi
cmp al, 0xd
jne 0x4a43d3
cmp byte [ebx], 0xa
jne 0x4a43d3
dec esi
dec edi
dec ecx
jne 0x4a43c0
test edi, edi
jne 0x4a43f2
push 1
push esi
push dword [0x534b70]
call fcn.004b1dd1
add esp, 0xc
mov edi, 1
jmp 0x4a43fc
sub esi, edi
cmp byte [edi + esi - 1], 0x1a
jne 0x4a43fc
dec edi
push edi
push esi
push dword [0x534b74]
call fcn.00489ca0
mov dword [0x534b74], eax
add esp, 0xc
mov eax, dword [0x534b78]
add eax, edi
mov dword [0x534b78], eax
cmp eax, edi
jb 0x4a4428
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, str.file_exceeds_Zips_4GB_uncompressed_size_limit
mov ecx, 6
call fcn.0049b4c0
int3

Function at 0x4a5c00
Capabilities:
Check mutex on windows

Disassembly:
push ecx
cmp dword [0x502c08], 0
push esi
push edi
jne 0x4a5c88
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x4a5c22
pop edi
pop esi
pop ecx
ret
mov edi, esi
mov ecx, 0x503584
xchg dword [ecx], edi
test edi, edi
je 0x4a5c53
mov eax, edi
xchg dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x502c08]
pop edi
pop esi
pop ecx
ret
push 0x5861e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x124
push 0
push 0x553820
call fcn.004b67a0
add esp, 0xc
call fcn.004a6140
push esi
mov dword [0x502c08], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x4a6230
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov al, byte [ecx]
mov edx, 0x12345678
mov dword [0x54eb14], edx
push esi
mov esi, 0x34567890
mov dword [0x54eb1c], esi
push edi
mov edi, 0x23456789
mov dword [0x54eb18], edi
test al, al
je 0x4a62aa
push ebx
mov ebx, dword [0x584048]
movsx eax, al
lea ecx, [ecx + 1]
xor eax, edx
shr edx, 8
and eax, 0xff
xor edx, dword [ebx + eax*4]
movzx eax, dl
add eax, edi
imul edi, eax, 0x8088405
inc edi
mov eax, edi
shr eax, 0x18
xor eax, esi
shr esi, 8
and eax, 0xff
xor esi, dword [ebx + eax*4]
mov al, byte [ecx]
test al, al
jne 0x4a6260
mov dword [0x54eb14], edx
mov dword [0x54eb1c], esi
mov dword [0x54eb18], edi
pop ebx
pop edi
pop esi
ret
Function at 0x4a6550
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x502b9c], 0
mov edx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], edx
je 0x4a660c
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x4a660c
push ebx
mov ebx, dword [0x54eb14]
push esi
mov esi, dword [0x54eb1c]
push edi
mov edi, dword [0x54eb18]
mov edi, edi
mov cl, byte [ecx]
mov edx, esi
and edx, 0xfffd
movsx eax, cl
xor eax, ebx
or edx, 2
and eax, 0xff
mov dword [ebp - 0xc], edx
mov edx, dword [0x584048]
shr ebx, 8
xor ebx, dword [edx + eax*4]
movzx eax, bl
add eax, edi
imul edi, eax, 0x8088405
inc edi
mov eax, edi
shr eax, 0x18
xor eax, esi
shr esi, 8
and eax, 0xff
xor esi, dword [edx + eax*4]
mov eax, dword [ebp - 0xc]
xor eax, 1
imul eax, dword [ebp - 0xc]
shr eax, 8
xor al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx], al
inc ecx
dec dword [ebp - 8]
mov dword [ebp - 4], ecx
jne 0x4a6590
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [0x54eb18], edi
pop edi
mov dword [0x54eb1c], esi
pop esi
mov dword [0x54eb14], ebx
pop ebx
push dword [ebp + 0xc]
push eax
push 1
push edx
call fcn.004b57b5
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x4a66a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push dword [0x54eb20]
mov esi, ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi + 4], eax
test eax, eax
jne 0x4a6717
push 0x503cac
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x503bac]
test eax, eax
je 0x4a66ee
mov dword [esi], eax
mov eax, dword [eax + 0x60]
mov dword [0x503bac], eax
mov eax, dword [esi]
push 0x503cac
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
ret
push 0x64
call fcn.004ad3ab
add esp, 4
test eax, eax
je 0x4a6705
mov ecx, eax
call fcn.004a6630
jmp 0x4a6707
xor eax, eax
push 0x503cac
mov dword [esi], eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
ret