joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fb50
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x4495f0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x45f5e0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x34], 0
call fcn.00401620
push eax
mov byte [esp + 0x38], 1
call fcn.00401680
call fcn.0041472e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40fbac
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x34], 2
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x18]
push 0x4538b4
push edx
call fcn.00403290
mov dword [esp + 0x28], 0
add esp, 8
mov byte [esp + 0x38], 3
mov edi, dword [esp + 0x18]
mov ebx, esp
mov dword [esp + 0x1c], esp
push edi
call fcn.00401160
lea eax, [esp + 0x24]
push eax
call fcn.004017d0
mov esi, dword [eax]
test esi, esi
je 0x40fcb9
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
mov dword [esp + 0x20], esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x50]
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], 0
call edx
test eax, eax
jge 0x40fc3a
push 0x451230
push esi
push eax
call fcn.00446c50
mov byte [esp + 0x34], 2
cmp word [esp + 0x18], 0
push esi
je 0x40fcc3
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call ecx
lea eax, [edi - 0x10]
mov byte [esp + 0x34], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40fc70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
call fcn.00401650
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fca1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
push 0x80004003
call fcn.00446c30
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
call edx
lea eax, [edi - 0x10]
mov byte [esp + 0x34], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fceb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
call fcn.00401650
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fd1c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x412650
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [eax]
movzx ecx, word [eax + 0x14]
push ebp
xor edx, edx
xor ebp, ebp
lea ecx, [ecx + eax + 0x18]
cmp dx, word [eax + 6]
jae 0x4126e6
push esi
push edi
lea esi, [ecx + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x4126a5
mov eax, dword [esp + 0x18]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x4126d2
mov ecx, dword [esi - 4]
push 4
push 0x1000
push edi
add ecx, ebx
push ecx
call dword [0x463c6c]
push edi
push 0
push eax
mov dword [esi - 8], eax
call fcn.00432d60
jmp 0x4126cf
mov edx, dword [esi - 4]
push 4
push 0x1000
push eax
add edx, ebx
push edx
call dword [0x463c6c]
mov ecx, dword [esi + 4]
add ecx, dword [esp + 0x14]
mov edi, eax
mov eax, dword [esi]
push eax
push ecx
push edi
call fcn.00436890
mov dword [esi - 8], edi
add esp, 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
inc ebp
add esi, 0x28
cmp ebp, ecx
jl 0x412672
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4126f0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [eax]
movzx ecx, word [ebx + 0x14]
push ebp
xor edx, edx
xor ebp, ebp
lea eax, [ecx + ebx + 0x18]
cmp dx, word [ebx + 6]
jae 0x4127a7
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x412747
mov eax, dword [edi - 0x14]
mov ecx, dword [edi - 0x1c]
push 0x4000
push eax
push ecx
call dword [0x463c70]
jmp 0x41278f
lea edx, [edx + ecx*2]
lea ecx, [esi + edx*2]
mov esi, dword [ecx*4 + 0x460df4]
test eax, 0x4000000
je 0x412761
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x41277c
test al, 0x40
je 0x412773
mov ecx, dword [ebx + 0x20]
jmp 0x41277a
test al, al
jns 0x41278f
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x41278f
mov ecx, dword [edi - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [0x463c74]
mov edx, dword [esp + 0x18]
mov ebx, dword [edx]
movzx eax, word [ebx + 6]
inc ebp
add edi, 0x28
cmp ebp, eax
jl 0x412714
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x412990
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov eax, 0x5a4d
cmp word [ebp], ax
je 0x4129a4
xor eax, eax
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x3c]
add ebx, ebp
cmp dword [ebx], 0x4550
je 0x4129b7
pop ebx
xor eax, eax
pop ebp
ret
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x34]
push edi
push 4
push 0x2000
push ecx
push edx
call dword [0x463c6c]
mov edi, eax
test edi, edi
jne 0x4129ef
mov eax, dword [ebx + 0x50]
push 4
push 0x2000
push eax
push edi
call dword [0x463c6c]
mov edi, eax
test edi, edi
jne 0x4129ef
pop edi
pop ebx
pop ebp
ret
push esi
push 0x14
push 0
call dword [0x463c64]
push eax
call dword [0x463c5c]
mov esi, eax
xor eax, eax
push 4
mov dword [esi + 4], edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov ecx, dword [ebx + 0x50]
push 0x1000
push ecx
push edi
call dword [0x463c6c]
mov edx, dword [ebx + 0x54]
push 4
push 0x1000
push edx
push edi
call dword [0x463c6c]
mov ecx, dword [ebx + 0x54]
add ecx, dword [ebp + 0x3c]
mov dword [esp + 0x14], eax
push ecx
push ebp
push eax
call fcn.00436890
mov edx, dword [ebp + 0x3c]
mov eax, dword [esp + 0x20]
push esi
add eax, edx
push ebx
mov dword [esi], eax
push ebp
mov dword [eax + 0x34], edi
call fcn.00412650
mov eax, edi
add esp, 0x18
sub eax, dword [ebx + 0x34]
je 0x412a72
push eax
mov eax, esi
call fcn.00412910
add esp, 4
push esi
call fcn.004127b0
add esp, 4
test eax, eax
je 0x412aa0
push esi
call fcn.004126f0
mov ecx, dword [esi]
mov eax, dword [ecx + 0x28]
add esp, 4
test eax, eax
je 0x412ab3
add eax, edi
je 0x412aa0
push 0
push 1
push edi
call eax
test eax, eax
jne 0x412aac
call fcn.00412b60
pop esi
pop edi
pop ebx
xor eax, eax
pop ebp
ret
mov dword [esi + 0x10], 1
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x412be0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
mov esi, eax
movzx eax, byte [esp + 8]
push edi
cdq
mov edi, 0x5ab
idiv edi
add dl, 0x3d
test esi, esi
jbe 0x412c06
mov al, byte [ecx]
xor al, dl
add al, dl
mov byte [ecx], al
inc ecx
sub esi, 1
jne 0x412bf8
pop edi
pop esi
ret
Function at 0x41be67
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41beae
call fcn.0041e35f
mov esi, dword [eax + 0xc]
push reloc.shlwapi.dll_PathAddBackslashA
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41beae
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41beca
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041b9e1
mov esi, eax
test edi, edi
je 0x41bec8
test ebx, ebx
je 0x41bec8
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41c623
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x44789e
call fcn.004331c0
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x41c648
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41c68e
lea ecx, [ebp - 0x10]
call fcn.00401130
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00414b84
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004010f0
mov eax, esi
call fcn.00433298
ret 8

Function at 0x4314cc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45f5e0]
jne 0x4314d6
repz ret
jmp fcn.0043677f
Function at 0x44017f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043a471
and dword [ebp - 4], 0
cmp dword [0x463b24], 0
mov ebx, eax
jne 0x440230
push 0x4500d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4402e1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4500c8
push edi
call esi
test eax, eax
je 0x4402e1
push eax
call fcn.0043a3ff
mov dword [esp], 0x4500b8
push edi
mov dword [0x463b24], eax
call esi
push eax
call fcn.0043a3ff
mov dword [esp], 0x4500a4
push edi
mov dword [0x463b28], eax
call esi
push eax
call fcn.0043a3ff
mov dword [esp], 0x450088
push edi
mov dword [0x463b2c], eax
call esi
push eax
call fcn.0043a3ff
pop ecx
mov dword [0x463b34], eax
test eax, eax
je 0x440230
push 0x450070
push edi
call esi
push eax
call fcn.0043a3ff
pop ecx
mov dword [0x463b30], eax
mov eax, dword [0x463b30]
cmp eax, ebx
je 0x440288
cmp dword [0x463b34], ebx
je 0x440288
push eax
call fcn.0043a47a
push dword [0x463b34]
mov esi, eax
call fcn.0043a47a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x440288
test edi, edi
je 0x440288
call esi
test eax, eax
je 0x44027f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44027f
test byte [ebp - 0xc], 1
jne 0x440288
or dword [ebp + 0x10], 0x200000
jmp 0x4402c1
mov eax, dword [0x463b28]
cmp eax, ebx
je 0x4402c1
push eax
call fcn.0043a47a
pop ecx
test eax, eax
je 0x4402c1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4402c1
mov eax, dword [0x463b2c]
cmp eax, ebx
je 0x4402c1
push eax
call fcn.0043a47a
pop ecx
test eax, eax
je 0x4402c1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x463b24]
call fcn.0043a47a
pop ecx
test eax, eax
je 0x4402e1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4402e3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x414a9f
pop dword [ebp - 0xc]
mov eax, 0x23526786
add eax, 0xdceee319
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x3f64f
push 0
mov eax, 0x6f1b6067
sub eax, 0x6ed98e53
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x7f9a0600
sub ecx, 0x7f99b5ec
xor esi, esi
add esi, eax
mov edx, 0x436000
add edx, dword [ebp - 0xc]
mov ebx, 0xb2a98ecc
add dword [ebp - 4], 0x8d96daa2
mov edi, dword [edx]
xor dword [ebp - 4], ebx
xor edi, ebx
xor dword [ebp - 8], 0x9c42bf79
mov dword [esi], edi
sub dword [ebp - 8], 0x5dba0b3a
add esi, 0x8b368ea6
sub esi, 0x8b368ea2
add edx, 4
loop 0x414af4
add eax, 0x1548524a
sub eax, 0x15471f27
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8c521c2c
add ecx, 0x73ede3d4
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x406243
pop dword [ebp - 0x38]
mov eax, 0x9dfcb0f9
add eax, 0x6243b14a
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x1a09954a
sub dword [ebp - 0x48], 0xcbb74fff
mov dword [ebp - 0x44], 0x78342a43
add dword [ebp - 0x44], 0xb9ff2202
mov dword [ebp - 0x40], 0x76586c4f
sub dword [ebp - 0x40], 0x2a0c2821
mov dword [ebp - 0x3c], 0xfa58f235
sub dword [ebp - 0x3c], 0xfa58f235
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x8216028
add dword [ebp - 0x48], 0x6c51092e
mov dword [ebp - 0x44], 0xe5211856
add dword [ebp - 0x44], 0x5c4b491f
mov dword [ebp - 0x40], 0x5d9e0ff9
add dword [ebp - 0x40], 0x5d15c73
mov dword [ebp - 0x3c], 0xf469a593
add dword [ebp - 0x3c], 0xb965a6d
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x5f810851
add eax, 0xa0bf78af
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x365e7
push 0
call eax
mov ecx, 0x7d5313e3
add ecx, 0x82ad317f
mov edi, eax
mov ebx, 0xaae2eb44
sub ebx, 0xaa9c0744
add ebx, dword [ebp - 0x38]
mov esi, 0x75dd0b2e
sub esi, 0xb8a6c9c6
mov dword [ebp - 0x24], 0x789dfe6e
mov edx, dword [ebx]
add dword [ebp - 0xc], esi
xor edx, esi
mov dword [ebp - 0x2c], 0xf07102e6
mov dword [edi], edx
sub dword [ebp - 0x10], 0x997ec239
add edi, 0x88d19c0f
sub edi, 0x88d19c0b
add ebx, 0xd5120bbf
sub ebx, 0xd5120bbb
loop 0x406360
add eax, 0x8af9f672
sub eax, 0x8af8ee17
mov ebx, eax
add eax, 0x5248567d
sub eax, 0x52485678
mov ecx, 0xcfee0158
add ecx, 0x3051fea8
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x4a1b2e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401edd
mov eax, dword [0x520768]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00406582
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4a1b70
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4a1ccc
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004066fe
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x5245d0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00403567
mov ecx, dword [esi*4 + 0x5245d0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4a1cc5
cmp eax, dword [edi + ecx + 0x24]
jne 0x4a1cc5
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a1cc5
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00403567
add esp, 0x14
test edx, edx
jl 0x4a1cc5
jg 0x4a1c3b
test eax, eax
jb 0x4a1cc5
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4a1cc5
jl 0x4a1c55
cmp dword [ebp - 0x1008], eax
ja 0x4a1cc5
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4a1c73
test ebx, ebx
je 0x4a1cac
cmp ecx, edi
jae 0x4a1cac
mov al, byte [ecx]
cmp al, 0xd
jne 0x4a1c8d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4a1c99
cmp byte [ecx + 1], 0xa
jne 0x4a1c99
inc ecx
jmp 0x4a1c99
movzx eax, al
movsx eax, byte [eax + 0x520a90]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4a1c73
cmp edx, ebx
jne 0x4a1c73
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4a1cca
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403323
leave
ret
Function at 0x4a240b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x5245d0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a244b
cmp byte [ebx], 0xa
jne 0x4a244b
or byte [eax + edi + 0x28], 4
jmp 0x4a2450
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4a254e
mov al, byte [edx]
cmp al, 0x1a
je 0x4a2530
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4a247f
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4a24a4
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4a24ae
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4a2461
jmp 0x4a254e
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a252b
cmp dword [ebp - 0xc], 0
je 0x4a252b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x5245d0]
test byte [eax + edi + 0x28], 0x48
je 0x4a2505
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4a24f0
mov byte [esi], dl
jmp 0x4a2501
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x5245d0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4a254e
cmp byte [ebp - 1], 0xa
jne 0x4a2514
cmp esi, ebx
jne 0x4a2514
mov byte [esi], 0xa
jmp 0x4a254d
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401a0a
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4a254e
mov byte [esi], 0xd
jmp 0x4a254d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x5245d0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a254a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a254e
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a25aa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x5245d0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a25ed
cmp word [esi], dx
jne 0x4a25ed
or byte [edi + eax + 0x28], 4
jmp 0x4a25f2
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4a2745
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4a2725
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4a2634
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4a266a
cmp eax, edx
jae 0x4a2676
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4a260c
jmp 0x4a2745
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a2721
cmp dword [ebp - 0x14], 0
je 0x4a2721
mov eax, dword [ebx*4 + 0x5245d0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4a26f9
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4a26c2
mov word [esi], cx
jmp 0x4a26f5
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x5245d0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x5245d0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x5245d0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4a2745
pop ebx
cmp word [ebp - 4], bx
jne 0x4a270a
cmp esi, dword [ebp + 0xc]
jne 0x4a270a
mov word [esi], bx
jmp 0x4a2742
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00401a0a
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4a2745
push 0xd
jmp 0x4a273e
mov ecx, dword [ebx*4 + 0x5245d0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a273c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a2745
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a9511
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x520768]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4a955c
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004a99d3
test al, al
jne 0x4a9556
sub edx, 2
cmp edx, edi
jne 0x4a953c
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4a957e
lea eax, [edi + 2]
cmp edx, eax
je 0x4a957e
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004a910a
add esp, 0x10
jmp 0x4a9678
push esi
lea ecx, [ebp - 0x255]
call fcn.004a99d3
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a95c1
push dword [ebp - 0x25c]
jmp 0x4a956e
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4a95fe
cmp word [ebp - 0x226], 0
je 0x4a961f
cmp word [ebp - 0x226], ax
jne 0x4a95fe
cmp word [ebp - 0x224], 0
je 0x4a961f
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004a910a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4a966b
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4a95d8
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4a9653
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4a9678
push 0x4a8af2
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00405b6e
add esp, 0x10
jmp 0x4a9648
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403323
leave
ret
Function at 0x4047c4
Capabilities:
Encode data using xor

Disassembly:
call fcn.004046bf
mov ecx, 0x200
call 0x4047c4
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x4047c7
invalid
in al, dx
invalid